cert
cert-1
cert-2

Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
FCP_FGT_AD-7.6 Exam - Verified By Experts
FCP_FGT_AD-7.6 Premium File

FCP_FGT_AD-7.6 Premium File

$69.99
$76.99
  • Premium File 128 Questions & Answers. Last Update: Nov 04, 2026

Whats Included:

  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
 
$76.99
$69.99
accept 55 downloads in the last 7 days
block-screenshots
Fortinet FCP_FGT_AD-7.6 Practice Test 77

Question 760

A new application signature begins flagging internal update traffic as anonymization software, and administrators need packet and signature context before adding an exception. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports.
  2. Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting.
  3. Build a FortiGate intrusion prevention sensor using supported signature filters, action overrides and protected-application context, then attach it to the correct policy.
  4. Investigate FortiOS application detection logs and signature revisions before creating narrowly scoped exclusions, ensuring legitimate traffic and policy intent remain visible.

Explanation

Correct Answer

D:

Investigate FortiOS application detection logs and signature revisions before creating narrowly scoped exclusions, ensuring legitimate traffic and policy intent remain visible. This directly addresses the FortiOS configuration or response required by the case. A single application signature hit may be insufficient to prove a user deliberately launched that program; classification and encrypted traffic can be imperfect. Verify with: Review application log signature name, action, profile override, FortiGuard signature version, client flow, SSL inspection and change history. Scenario: A new application signature begins flagging internal update traffic as anonymization software, and administrators need packet and signature context before adding an exception.

Incorrect Answers

A:

Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. This addresses Application control signature matching and required visibility, but not the principal task of the described flow. Application detection is not identical to TCP service-port matching; encrypted or evasive traffic can require additional visibility and signature coverage. The better fit is: Investigate FortiOS application detection logs and signature revisions before creating narrowly scoped exclusions, ensuring legitimate traffic and policy intent remain visible. Scenario: A new application signature begins flagging internal update traffic as anonymization software, and administrators need packet and signature context before adding an exception.

B:

Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. This addresses TLS and mutual-certificate handshake fault isolation, but not the principal task of the described flow. A passed TCP handshake does not prove a successful TLS handshake, and deep inspection can alter observed certificate chains or interfere with application client certificates. The better fit is: Investigate FortiOS application detection logs and signature revisions before creating narrowly scoped exclusions, ensuring legitimate traffic and policy intent remain visible. Scenario: A new application signature begins flagging internal update traffic as anonymization software, and administrators need packet and signature context before adding an exception.

C:

Build a FortiGate intrusion prevention sensor using supported signature filters, action overrides and protected-application context, then attach it to the correct policy. This addresses IPS signature filters, severity and policy actions, but not the principal task of the described flow. Signature severity alone does not guarantee relevance; a disabled or monitor-only IPS rule may log threats without blocking, and encrypted payloads need appropriate inspection. The better fit is: Investigate FortiOS application detection logs and signature revisions before creating narrowly scoped exclusions, ensuring legitimate traffic and policy intent remain visible. Scenario: A new application signature begins flagging internal update traffic as anonymization software, and administrators need packet and signature context before adding an exception.

Question 761

An acquired branch changes its public IP but the FortiGate Phase 1 remote gateway still points to the previous address, leaving the tunnel down. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. Licensed security services update normally and test clients obtain unique LAN leases with the intended gateway and resolver values.
  2. An incorrectly classified approved site receives a narrow documented exception while disallowed categories continue to be blocked for the intended groups.
  3. The expected peer establishes an authenticated IKE security association under approved cryptographic settings without accepting an unintended identity.
  4. When one tunnel or underlay fails, protected applications reconnect through a valid alternative within the documented recovery target.

Explanation

Correct Answer

C:

The expected peer establishes an authenticated IKE security association under approved cryptographic settings without accepting an unintended identity. This is the operational validation outcome rather than merely an enabled setting. A reachable VPN peer does not guarantee matching Phase 1 identity, PSK or proposal; authentication and crypto negotiation fail before user traffic selectors can be installed. Scenario: An acquired branch changes its public IP but the FortiGate Phase 1 remote gateway still points to the previous address, leaving the tunnel down.

Incorrect Answers

A:

Licensed security services update normally and test clients obtain unique LAN leases with the intended gateway and resolver values. This result would test FortiGuard connectivity, registration and internal DHCP provisioning but does not demonstrate the desired FortiGate outcome here. Verify instead: The expected peer establishes an authenticated IKE security association under approved cryptographic settings without accepting an unintended identity. Scenario: An acquired branch changes its public IP but the FortiGate Phase 1 remote gateway still points to the previous address, leaving the tunnel down.

B:

An incorrectly classified approved site receives a narrow documented exception while disallowed categories continue to be blocked for the intended groups. This result would test FortiGuard category ratings and controlled recategorization but does not demonstrate the desired FortiGate outcome here. Verify instead: The expected peer establishes an authenticated IKE security association under approved cryptographic settings without accepting an unintended identity. Scenario: An acquired branch changes its public IP but the FortiGate Phase 1 remote gateway still points to the previous address, leaving the tunnel down.

D:

When one tunnel or underlay fails, protected applications reconnect through a valid alternative within the documented recovery target. This result would test Redundant tunnels, dead peer detection and controlled failover but does not demonstrate the desired FortiGate outcome here. Verify instead: The expected peer establishes an authenticated IKE security association under approved cryptographic settings without accepting an unintended identity. Scenario: An acquired branch changes its public IP but the FortiGate Phase 1 remote gateway still points to the previous address, leaving the tunnel down.

Question 762

During inspection CA rotation, some laptops trust only the retired CA and cannot establish HTTPS connections through the newly configured firewall profile. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Deploy a controlled inspection CA and trusted endpoint certificate chain for full SSL inspection, protecting its private key and ensuring endpoint browsers accept the configured inspection certificate.
  2. Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs.
  3. Evaluate supported TLS interception and QUIC/HTTP3 handling against FortiOS model capacity, application requirements and policy visibility instead of assuming every encrypted protocol follows the same inspection path.
  4. The targeted false positive no longer interrupts an approved service, while exploit attempts retain blocking coverage and traceable alerts.
  5. Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs.

Explanation

Correct Answers

A:

Deploy a controlled inspection CA and trusted endpoint certificate chain for full SSL inspection, protecting its private key and ensuring endpoint browsers accept the configured inspection certificate. This directly addresses the FortiOS configuration or response required by the case. Deep inspection creates a controlled man-in-the-middle TLS endpoint; users should not be trained to ignore certificate warnings, and protected trust material requires lifecycle management. Verify with: Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs. This is the implementation portion of the required complementary pair. Scenario: During inspection CA rotation, some laptops trust only the retired CA and cannot establish HTTPS connections through the newly configured firewall profile.

E:

Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs. This distinguishes the relevant FortiGate device, session or controller evidence. Deep inspection creates a controlled man-in-the-middle TLS endpoint; users should not be trained to ignore certificate warnings, and protected trust material requires lifecycle management. The corresponding action is: Deploy a controlled inspection CA and trusted endpoint certificate chain for full SSL inspection, protecting its private key and ensuring endpoint browsers accept the configured inspection certificate. This is the verification portion of the required complementary pair. Scenario: During inspection CA rotation, some laptops trust only the retired CA and cannot establish HTTPS connections through the newly configured firewall profile.

Incorrect Answers

B:

Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. This choice relates to FortiGuard antivirus signature freshness and incident response, not the complementary implementation-and-evidence pair for the case. Implement: Deploy a controlled inspection CA and trusted endpoint certificate chain for full SSL inspection, protecting its private key and ensuring endpoint browsers accept the configured inspection certificate. Check: Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs. Scenario: During inspection CA rotation, some laptops trust only the retired CA and cannot establish HTTPS connections through the newly configured firewall profile.

C:

Evaluate supported TLS interception and QUIC/HTTP3 handling against FortiOS model capacity, application requirements and policy visibility instead of assuming every encrypted protocol follows the same inspection path. This choice relates to SSL inspection resources and QUIC protocol behavior, not the complementary implementation-and-evidence pair for the case. Implement: Deploy a controlled inspection CA and trusted endpoint certificate chain for full SSL inspection, protecting its private key and ensuring endpoint browsers accept the configured inspection certificate. Check: Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs. Scenario: During inspection CA rotation, some laptops trust only the retired CA and cannot establish HTTPS connections through the newly configured firewall profile.

D:

The targeted false positive no longer interrupts an approved service, while exploit attempts retain blocking coverage and traceable alerts. This choice relates to IPS signatures, logs and focused exception maintenance, not the complementary implementation-and-evidence pair for the case. Implement: Deploy a controlled inspection CA and trusted endpoint certificate chain for full SSL inspection, protecting its private key and ensuring endpoint browsers accept the configured inspection certificate. Check: Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs. Scenario: During inspection CA rotation, some laptops trust only the retired CA and cannot establish HTTPS connections through the newly configured firewall profile.

Question 763

During inspection CA rotation, some laptops trust only the retired CA and cannot establish HTTPS connections through the newly configured firewall profile. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. Only unauthorized application categories are blocked while monitored business tools generate usable visibility without unexpected interruption.
  2. Approved HTTPS content receives the intended inspection depth while unsupported or privacy-sensitive traffic follows explicit reviewed exceptions.
  3. A controlled benign exploit simulation triggers the expected IPS action while legitimate application transactions continue under tested exclusions.
  4. Managed endpoints validate permitted intercepted TLS sessions without certificate errors and reject untrusted or forged inspection identities.

Explanation

Correct Answer

D:

Managed endpoints validate permitted intercepted TLS sessions without certificate errors and reject untrusted or forged inspection identities. This is the operational validation outcome rather than merely an enabled setting. Deep inspection creates a controlled man-in-the-middle TLS endpoint; users should not be trained to ignore certificate warnings, and protected trust material requires lifecycle management. Scenario: During inspection CA rotation, some laptops trust only the retired CA and cannot establish HTTPS connections through the newly configured firewall profile.

Incorrect Answers

A:

Only unauthorized application categories are blocked while monitored business tools generate usable visibility without unexpected interruption. This result would test Application control monitor versus block actions and exceptions but does not demonstrate the desired FortiGate outcome here. Verify instead: Managed endpoints validate permitted intercepted TLS sessions without certificate errors and reject untrusted or forged inspection identities. Scenario: During inspection CA rotation, some laptops trust only the retired CA and cannot establish HTTPS connections through the newly configured firewall profile.

B:

Approved HTTPS content receives the intended inspection depth while unsupported or privacy-sensitive traffic follows explicit reviewed exceptions. This result would test FortiGate certificate inspection versus full SSL/SSH inspection but does not demonstrate the desired FortiGate outcome here. Verify instead: Managed endpoints validate permitted intercepted TLS sessions without certificate errors and reject untrusted or forged inspection identities. Scenario: During inspection CA rotation, some laptops trust only the retired CA and cannot establish HTTPS connections through the newly configured firewall profile.

C:

A controlled benign exploit simulation triggers the expected IPS action while legitimate application transactions continue under tested exclusions. This result would test IPS signature filters, severity and policy actions but does not demonstrate the desired FortiGate outcome here. Verify instead: Managed endpoints validate permitted intercepted TLS sessions without certificate errors and reject untrusted or forged inspection identities. Scenario: During inspection CA rotation, some laptops trust only the retired CA and cannot establish HTTPS connections through the newly configured firewall profile.

Question 764

A security engineer shortens Phase 2 SA lifetime on one peer without coordinating rekey behavior, leading recurring outages at predictable intervals. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Examine Phase 2 source and destination selectors, PFS group, ESP proposal, SA lifetimes, phase negotiation events and counters for protected prefixes.
  2. Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior.
  3. The targeted false positive no longer interrupts an approved service, while exploit attempts retain blocking coverage and traceable alerts.
  4. Build supported route-based FortiGate IPsec tunnel interfaces with destination routes and bidirectional firewall policies so accepted encrypted traffic travels through the correct tunnel.
  5. Review authenticated user monitor, auth method, group sources, user-to-IP mapping, identity timeout, traffic source IP and matching policy ID.

Explanation

Correct Answers

A:

Examine Phase 2 source and destination selectors, PFS group, ESP proposal, SA lifetimes, phase negotiation events and counters for protected prefixes. This distinguishes the relevant FortiGate device, session or controller evidence. A successful IKE Phase 1 SA is not proof that Phase 2 traffic selectors match; mismatched PFS or subnet ranges can prevent payload traffic. The corresponding action is: Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior. This is the verification portion of the required complementary pair. Scenario: A security engineer shortens Phase 2 SA lifetime on one peer without coordinating rekey behavior, leading recurring outages at predictable intervals.

B:

Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior. This directly addresses the FortiOS configuration or response required by the case. A successful IKE Phase 1 SA is not proof that Phase 2 traffic selectors match; mismatched PFS or subnet ranges can prevent payload traffic. Verify with: Examine Phase 2 source and destination selectors, PFS group, ESP proposal, SA lifetimes, phase negotiation events and counters for protected prefixes. This is the implementation portion of the required complementary pair. Scenario: A security engineer shortens Phase 2 SA lifetime on one peer without coordinating rekey behavior, leading recurring outages at predictable intervals.

Incorrect Answers

C:

The targeted false positive no longer interrupts an approved service, while exploit attempts retain blocking coverage and traceable alerts. This choice relates to IPS signatures, logs and focused exception maintenance, not the complementary implementation-and-evidence pair for the case. Implement: Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior. Check: Examine Phase 2 source and destination selectors, PFS group, ESP proposal, SA lifetimes, phase negotiation events and counters for protected prefixes. Scenario: A security engineer shortens Phase 2 SA lifetime on one peer without coordinating rekey behavior, leading recurring outages at predictable intervals.

D:

Build supported route-based FortiGate IPsec tunnel interfaces with destination routes and bidirectional firewall policies so accepted encrypted traffic travels through the correct tunnel. This choice relates to Route-based IPsec tunnel interface and matching security policies, not the complementary implementation-and-evidence pair for the case. Implement: Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior. Check: Examine Phase 2 source and destination selectors, PFS group, ESP proposal, SA lifetimes, phase negotiation events and counters for protected prefixes. Scenario: A security engineer shortens Phase 2 SA lifetime on one peer without coordinating rekey behavior, leading recurring outages at predictable intervals.

E:

Review authenticated user monitor, auth method, group sources, user-to-IP mapping, identity timeout, traffic source IP and matching policy ID. This choice relates to Active versus passive FortiGate authentication evidence, not the complementary implementation-and-evidence pair for the case. Implement: Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior. Check: Examine Phase 2 source and destination selectors, PFS group, ESP proposal, SA lifetimes, phase negotiation events and counters for protected prefixes. Scenario: A security engineer shortens Phase 2 SA lifetime on one peer without coordinating rekey behavior, leading recurring outages at predictable intervals.

Question 765

An Azure cloud deployment grants an overly broad subscription owner role to the FortiGate integration even though the intended service requires only scoped permissions. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege.
  2. Cloud resources are protected by the approved managed firewall service with visible policy hits and provider-cloud routing appropriate to that deployment model.
  3. Authorized workloads cross the inspection interfaces and return through a symmetric allowed path rather than bypassing the FortiGate VM or being blackholed.
  4. Approved administrators reach only the designated management address and untrusted source hosts cannot open the management service.

Explanation

Correct Answer

A:

The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege. This is the operational validation outcome rather than merely an enabled setting. An active FortiOS license does not confer AWS or Azure rights, and an allowed firewall rule cannot override a cloud-native deny or missing route. Scenario: An Azure cloud deployment grants an overly broad subscription owner role to the FortiGate integration even though the intended service requires only scoped permissions.

Incorrect Answers

B:

Cloud resources are protected by the approved managed firewall service with visible policy hits and provider-cloud routing appropriate to that deployment model. This result would test FortiGate cloud-native firewall CNF service responsibility but does not demonstrate the desired FortiGate outcome here. Verify instead: The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege. Scenario: An Azure cloud deployment grants an overly broad subscription owner role to the FortiGate integration even though the intended service requires only scoped permissions.

C:

Authorized workloads cross the inspection interfaces and return through a symmetric allowed path rather than bypassing the FortiGate VM or being blackholed. This result would test FortiGate VM in public-cloud route and interface topology but does not demonstrate the desired FortiGate outcome here. Verify instead: The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege. Scenario: An Azure cloud deployment grants an overly broad subscription owner role to the FortiGate integration even though the intended service requires only scoped permissions.

D:

Approved administrators reach only the designated management address and untrusted source hosts cannot open the management service. This result would test FortiGate administrator access and trusted management surfaces but does not demonstrate the desired FortiGate outcome here. Verify instead: The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege. Scenario: An Azure cloud deployment grants an overly broad subscription owner role to the FortiGate integration even though the intended service requires only scoped permissions.

Question 766

An Azure hub-spoke deployment sends ingress through FortiGate-VM while return packets take the direct peering path, causing stateful inspection sessions to fail. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Review cloud vNIC and subnet placement, effective cloud routes, source/destination checks where applicable, FortiOS interface addresses, security groups and return-path symmetry.
  2. Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope.
  3. Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs.
  4. Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses.

Explanation

Correct Answer

A:

Review cloud vNIC and subnet placement, effective cloud routes, source/destination checks where applicable, FortiOS interface addresses, security groups and return-path symmetry. This distinguishes the relevant FortiGate device, session or controller evidence. FortiGate VM policies cannot inspect packets that cloud-native route tables never send to it, and cloud security groups remain separate enforcement layers. The corresponding action is: Deploy supported FortiGate-VM interfaces, cloud route tables and security controls so inspected application traffic actually traverses the intended firewall path. Scenario: An Azure hub-spoke deployment sends ingress through FortiGate-VM while return packets take the direct peering path, causing stateful inspection sessions to fail.

Incorrect Answers

B:

Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope. This diagnostic is related to FortiGate cloud-native firewall CNF service responsibility rather than the controlling evidence for this scenario. Examine instead: Review cloud vNIC and subnet placement, effective cloud routes, source/destination checks where applicable, FortiOS interface addresses, security groups and return-path symmetry. Scenario: An Azure hub-spoke deployment sends ingress through FortiGate-VM while return packets take the direct peering path, causing stateful inspection sessions to fail.

C:

Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs. This diagnostic is related to FortiSASE PoP policy steering and remote diagnostics rather than the controlling evidence for this scenario. Examine instead: Review cloud vNIC and subnet placement, effective cloud routes, source/destination checks where applicable, FortiOS interface addresses, security groups and return-path symmetry. Scenario: An Azure hub-spoke deployment sends ingress through FortiGate-VM while return packets take the direct peering path, causing stateful inspection sessions to fail.

D:

Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses. This diagnostic is related to FortiGuard connectivity, registration and internal DHCP provisioning rather than the controlling evidence for this scenario. Examine instead: Review cloud vNIC and subnet placement, effective cloud routes, source/destination checks where applicable, FortiOS interface addresses, security groups and return-path symmetry. Scenario: An Azure hub-spoke deployment sends ingress through FortiGate-VM while return packets take the direct peering path, causing stateful inspection sessions to fail.

Question 767

An administrator sets a source group on an allow policy before deploying any supporting authentication method, then assumes user names alone can be matched from packet headers. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. The intended sessions are allowed or blocked according to policy and the required supported threat inspection actually runs on their traffic.
  2. Operators can prove why a given session was accepted or denied and can distinguish missing logging from absent traffic.
  3. Authorized users receive the intended group or MFA result and unauthorized or unavailable-server attempts fail according to explicit policy.
  4. Access succeeds only for the intended group during its authorized time period, while expired sessions and newly unauthorized flows behave predictably.

Explanation

Correct Answer

D:

Access succeeds only for the intended group during its authorized time period, while expired sessions and newly unauthorized flows behave predictably. This is the operational validation outcome rather than merely an enabled setting. A scheduled policy or identity filter does not retroactively terminate every established session, and a group match depends on reliable identification of the user's current IP or session. Scenario: An administrator sets a source group on an allow policy before deploying any supporting authentication method, then assumes user names alone can be matched from packet headers.

Incorrect Answers

A:

The intended sessions are allowed or blocked according to policy and the required supported threat inspection actually runs on their traffic. This result would test Security profiles and flow versus proxy inspection boundaries but does not demonstrate the desired FortiGate outcome here. Verify instead: Access succeeds only for the intended group during its authorized time period, while expired sessions and newly unauthorized flows behave predictably. Scenario: An administrator sets a source group on an allow policy before deploying any supporting authentication method, then assumes user names alone can be matched from packet headers.

B:

Operators can prove why a given session was accepted or denied and can distinguish missing logging from absent traffic. This result would test Implicit denial, policy logging and rule hit interpretation but does not demonstrate the desired FortiGate outcome here. Verify instead: Access succeeds only for the intended group during its authorized time period, while expired sessions and newly unauthorized flows behave predictably. Scenario: An administrator sets a source group on an allow policy before deploying any supporting authentication method, then assumes user names alone can be matched from packet headers.

C:

Authorized users receive the intended group or MFA result and unauthorized or unavailable-server attempts fail according to explicit policy. This result would test RADIUS authentication and policy-bound MFA validation but does not demonstrate the desired FortiGate outcome here. Verify instead: Access succeeds only for the intended group during its authorized time period, while expired sessions and newly unauthorized flows behave predictably. Scenario: An administrator sets a source group on an allow policy before deploying any supporting authentication method, then assumes user names alone can be matched from packet headers.

Question 768

A remediation team permits an entire WAN destination group to bypass IPS for one fragile legacy application, unintentionally expanding the exception to sensitive new services. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Examine IPS process CPU, concurrent sessions, per-policy UTM statistics, inspection mode, hardware offload status, log rate and throughput baseline.
  2. Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors.
  3. Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs.
  4. Review IPS signature ID and revision, source/destination flow, detected action, matched sensor and policy, packet context and exception expiration.

Explanation

Correct Answer

D:

Review IPS signature ID and revision, source/destination flow, detected action, matched sensor and policy, packet context and exception expiration. This distinguishes the relevant FortiGate device, session or controller evidence. An IPS exemption by broad source subnet or application category may remove protection beyond one false positive; signature updates can change what matches. The corresponding action is: Investigate FortiOS IPS detection and blocking evidence with signature context and false-positive testing, maintaining tightly bounded exclusions and tested action overrides. Scenario: A remediation team permits an entire WAN destination group to bypass IPS for one fragile legacy application, unintentionally expanding the exception to sensitive new services.

Incorrect Answers

A:

Examine IPS process CPU, concurrent sessions, per-policy UTM statistics, inspection mode, hardware offload status, log rate and throughput baseline. This diagnostic is related to IPS process CPU demand and inspection capacity rather than the controlling evidence for this scenario. Examine instead: Review IPS signature ID and revision, source/destination flow, detected action, matched sensor and policy, packet context and exception expiration. Scenario: A remediation team permits an entire WAN destination group to bypass IPS for one fragile legacy application, unintentionally expanding the exception to sensitive new services.

B:

Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors. This diagnostic is related to HTTPS malware scanning with controlled exception validation rather than the controlling evidence for this scenario. Examine instead: Review IPS signature ID and revision, source/destination flow, detected action, matched sensor and policy, packet context and exception expiration. Scenario: A remediation team permits an entire WAN destination group to bypass IPS for one fragile legacy application, unintentionally expanding the exception to sensitive new services.

C:

Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs. This diagnostic is related to FortiGate deep-inspection CA trust and certificate deployment rather than the controlling evidence for this scenario. Examine instead: Review IPS signature ID and revision, source/destination flow, detected action, matched sensor and policy, packet context and exception expiration. Scenario: A remediation team permits an entire WAN destination group to bypass IPS for one fragile legacy application, unintentionally expanding the exception to sensitive new services.

Question 769

A team adds a VPN tunnel interface into an SD-WAN zone but forgets that the corresponding LAN-to-VPN firewall policy must reference the intended zone. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Permitted test downloads receive the intended malware verdict, while excluded sensitive services keep documented and limited inspection behavior.
  2. Use appropriate certificate trust, subject identity and revocation or PSK rotation controls for FortiGate site-to-site IPsec, and verify rekey without disabling peer validation.
  3. Integrate FortiGate IPsec tunnel interfaces into a supported SD-WAN steering design, ensuring underlay reachability, overlay routes and matching firewall policies for protected traffic.
  4. Review SD-WAN tunnel member status, underlay interface selection, phase1/phase2 state, performance SLA, overlay destination route and policy logs.
  5. Review application log signature name, action, profile override, FortiGuard signature version, client flow, SSL inspection and change history.

Explanation

Correct Answers

C:

Integrate FortiGate IPsec tunnel interfaces into a supported SD-WAN steering design, ensuring underlay reachability, overlay routes and matching firewall policies for protected traffic. This directly addresses the FortiOS configuration or response required by the case. An SD-WAN member rule may select a physical underlay without providing the encrypted overlay route; policy, tunnel health and overlay steering are distinct dependencies. Verify with: Review SD-WAN tunnel member status, underlay interface selection, phase1/phase2 state, performance SLA, overlay destination route and policy logs. This is the implementation portion of the required complementary pair. Scenario: A team adds a VPN tunnel interface into an SD-WAN zone but forgets that the corresponding LAN-to-VPN firewall policy must reference the intended zone.

D:

Review SD-WAN tunnel member status, underlay interface selection, phase1/phase2 state, performance SLA, overlay destination route and policy logs. This distinguishes the relevant FortiGate device, session or controller evidence. An SD-WAN member rule may select a physical underlay without providing the encrypted overlay route; policy, tunnel health and overlay steering are distinct dependencies. The corresponding action is: Integrate FortiGate IPsec tunnel interfaces into a supported SD-WAN steering design, ensuring underlay reachability, overlay routes and matching firewall policies for protected traffic. This is the verification portion of the required complementary pair. Scenario: A team adds a VPN tunnel interface into an SD-WAN zone but forgets that the corresponding LAN-to-VPN firewall policy must reference the intended zone.

Incorrect Answers

A:

Permitted test downloads receive the intended malware verdict, while excluded sensitive services keep documented and limited inspection behavior. This choice relates to HTTPS malware scanning with controlled exception validation, not the complementary implementation-and-evidence pair for the case. Implement: Integrate FortiGate IPsec tunnel interfaces into a supported SD-WAN steering design, ensuring underlay reachability, overlay routes and matching firewall policies for protected traffic. Check: Review SD-WAN tunnel member status, underlay interface selection, phase1/phase2 state, performance SLA, overlay destination route and policy logs. Scenario: A team adds a VPN tunnel interface into an SD-WAN zone but forgets that the corresponding LAN-to-VPN firewall policy must reference the intended zone.

B:

Use appropriate certificate trust, subject identity and revocation or PSK rotation controls for FortiGate site-to-site IPsec, and verify rekey without disabling peer validation. This choice relates to Certificate-based IPsec authentication and safe tunnel rekey, not the complementary implementation-and-evidence pair for the case. Implement: Integrate FortiGate IPsec tunnel interfaces into a supported SD-WAN steering design, ensuring underlay reachability, overlay routes and matching firewall policies for protected traffic. Check: Review SD-WAN tunnel member status, underlay interface selection, phase1/phase2 state, performance SLA, overlay destination route and policy logs. Scenario: A team adds a VPN tunnel interface into an SD-WAN zone but forgets that the corresponding LAN-to-VPN firewall policy must reference the intended zone.

E:

Review application log signature name, action, profile override, FortiGuard signature version, client flow, SSL inspection and change history. This choice relates to Application control incident logging and false positive investigation, not the complementary implementation-and-evidence pair for the case. Implement: Integrate FortiGate IPsec tunnel interfaces into a supported SD-WAN steering design, ensuring underlay reachability, overlay routes and matching firewall policies for protected traffic. Check: Review SD-WAN tunnel member status, underlay interface selection, phase1/phase2 state, performance SLA, overlay destination route and policy logs. Scenario: A team adds a VPN tunnel interface into an SD-WAN zone but forgets that the corresponding LAN-to-VPN firewall policy must reference the intended zone.

Question 770

Web-filter logs show a category deny for the server host while management interprets the record as proof of which encrypted document the user opened. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites.
  2. Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable.
  3. Investigate FortiOS IPS detection and blocking evidence with signature context and false-positive testing, maintaining tightly bounded exclusions and tested action overrides.
  4. Evaluate supported TLS interception and QUIC/HTTP3 handling against FortiOS model capacity, application requirements and policy visibility instead of assuming every encrypted protocol follows the same inspection path.

Explanation

Correct Answer

B:

Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. This directly addresses the FortiOS configuration or response required by the case. Certificate inspection does not expose all encrypted HTTP headers and paths; some modern encrypted client protocols reduce metadata availability. Verify with: Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. Scenario: Web-filter logs show a category deny for the server host while management interprets the record as proof of which encrypted document the user opened.

Incorrect Answers

A:

Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. This addresses FortiGuard category ratings and controlled recategorization, but not the principal task of the described flow. Category-based filtering is only as accurate as current rating data and profile ordering; an override for one domain can affect all paths hosted there. The better fit is: Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. Scenario: Web-filter logs show a category deny for the server host while management interprets the record as proof of which encrypted document the user opened.

C:

Investigate FortiOS IPS detection and blocking evidence with signature context and false-positive testing, maintaining tightly bounded exclusions and tested action overrides. This addresses IPS signatures, logs and focused exception maintenance, but not the principal task of the described flow. An IPS exemption by broad source subnet or application category may remove protection beyond one false positive; signature updates can change what matches. The better fit is: Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. Scenario: Web-filter logs show a category deny for the server host while management interprets the record as proof of which encrypted document the user opened.

D:

Evaluate supported TLS interception and QUIC/HTTP3 handling against FortiOS model capacity, application requirements and policy visibility instead of assuming every encrypted protocol follows the same inspection path. This addresses SSL inspection resources and QUIC protocol behavior, but not the principal task of the described flow. HTTP/3 uses QUIC over UDP and may not follow controls designed only for intercepted HTTPS over TCP; deep inspection consumes resources and capability varies by FortiOS build. The better fit is: Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. Scenario: Web-filter logs show a category deny for the server host while management interprets the record as proof of which encrypted document the user opened.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests