cert
cert-1
cert-2

Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
FCP_FGT_AD-7.6 Exam - Verified By Experts
FCP_FGT_AD-7.6 Premium File

FCP_FGT_AD-7.6 Premium File

$69.99
$76.99
  • Premium File 128 Questions & Answers. Last Update: Nov 04, 2026

Whats Included:

  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
 
$76.99
$69.99
accept 55 downloads in the last 7 days
block-screenshots
Fortinet FCP_FGT_AD-7.6 Practice Test 79

Question 780

Operators filter FortiAnalyzer by the wrong device timezone and conclude that no suspicious traffic crossed the firewall during a reported incident. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions.
  2. Inspect VM license status, instance capacity, cloud IAM roles, cloud interface attachment, health, FortiOS versions and native cloud traffic policy.
  3. Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination.
  4. The packet's entry point, policy decision, NAT change and forwarding path are identifiable, and a corrected configuration restores verified bidirectional connectivity.
  5. Register FortiGate with the intended FortiAnalyzer instance, permit trusted management connectivity and enable logs on relevant policies and event categories before relying on central investigations.

Explanation

Correct Answers

A:

Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions. This directly addresses the FortiOS configuration or response required by the case. A UTM blocked-threat record and a firewall implicit-deny event are not interchangeable; absence of a traffic log may mean logging is disabled rather than that no packet arrived. Verify with: Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination. This is the implementation portion of the required complementary pair. Scenario: Operators filter FortiAnalyzer by the wrong device timezone and conclude that no suspicious traffic crossed the firewall during a reported incident.

C:

Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination. This distinguishes the relevant FortiGate device, session or controller evidence. A UTM blocked-threat record and a firewall implicit-deny event are not interchangeable; absence of a traffic log may mean logging is disabled rather than that no packet arrived. The corresponding action is: Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions. This is the verification portion of the required complementary pair. Scenario: Operators filter FortiAnalyzer by the wrong device timezone and conclude that no suspicious traffic crossed the firewall during a reported incident.

Incorrect Answers

B:

Inspect VM license status, instance capacity, cloud IAM roles, cloud interface attachment, health, FortiOS versions and native cloud traffic policy. This choice relates to Cloud FortiGate licensing and infrastructure ownership boundaries, not the complementary implementation-and-evidence pair for the case. Implement: Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions. Check: Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination. Scenario: Operators filter FortiAnalyzer by the wrong device timezone and conclude that no suspicious traffic crossed the firewall during a reported incident.

D:

The packet's entry point, policy decision, NAT change and forwarding path are identifiable, and a corrected configuration restores verified bidirectional connectivity. This choice relates to Packet capture, debug flow and physical-path investigation, not the complementary implementation-and-evidence pair for the case. Implement: Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions. Check: Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination. Scenario: Operators filter FortiAnalyzer by the wrong device timezone and conclude that no suspicious traffic crossed the firewall during a reported incident.

E:

Register FortiGate with the intended FortiAnalyzer instance, permit trusted management connectivity and enable logs on relevant policies and event categories before relying on central investigations. This choice relates to FortiAnalyzer registration and centralized log forwarding, not the complementary implementation-and-evidence pair for the case. Implement: Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions. Check: Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination. Scenario: Operators filter FortiAnalyzer by the wrong device timezone and conclude that no suspicious traffic crossed the firewall during a reported incident.

Question 781

An AV scanning rule blocks all large uploads needed for an approved backup workflow and the team attempts to fix it with a broad any-any policy rather than a scoped exception. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs.
  2. Review DNS policy/profile, DNS transport, query logs, client resolver configuration, DoH/DoT behavior, browser HTTPS requests and matching web-filter outcomes.
  3. Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests.
  4. Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors.

Explanation

Correct Answer

C:

Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests. This distinguishes the relevant FortiGate device, session or controller evidence. An allowed oversize bypass can create a malware scanning gap even though the AV profile is enabled for smaller files; archive depth changes effective inspection capability. The corresponding action is: Set supported protocol and file-size inspection thresholds according to policy, explicitly handling oversized, compressed or unsupported transfers without silently failing open. Scenario: An AV scanning rule blocks all large uploads needed for an approved backup workflow and the team attempts to fix it with a broad any-any policy rather than a scoped exception.

Incorrect Answers

A:

Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. This diagnostic is related to FortiGuard antivirus signature freshness and incident response rather than the controlling evidence for this scenario. Examine instead: Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests. Scenario: An AV scanning rule blocks all large uploads needed for an approved backup workflow and the team attempts to fix it with a broad any-any policy rather than a scoped exception.

B:

Review DNS policy/profile, DNS transport, query logs, client resolver configuration, DoH/DoT behavior, browser HTTPS requests and matching web-filter outcomes. This diagnostic is related to DNS filtering versus web filtering visibility boundaries rather than the controlling evidence for this scenario. Examine instead: Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests. Scenario: An AV scanning rule blocks all large uploads needed for an approved backup workflow and the team attempts to fix it with a broad any-any policy rather than a scoped exception.

D:

Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors. This diagnostic is related to HTTPS malware scanning with controlled exception validation rather than the controlling evidence for this scenario. Examine instead: Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests. Scenario: An AV scanning rule blocks all large uploads needed for an approved backup workflow and the team attempts to fix it with a broad any-any policy rather than a scoped exception.

Question 782

A company enables deep SSL inspection but forgets to distribute the FortiGate inspection CA, producing certificate warnings on every managed workstation. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception.
  2. Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs.
  3. Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields.
  4. Review DNS policy/profile, DNS transport, query logs, client resolver configuration, DoH/DoT behavior, browser HTTPS requests and matching web-filter outcomes.

Explanation

Correct Answer

B:

Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs. This distinguishes the relevant FortiGate device, session or controller evidence. Deep inspection creates a controlled man-in-the-middle TLS endpoint; users should not be trained to ignore certificate warnings, and protected trust material requires lifecycle management. The corresponding action is: Deploy a controlled inspection CA and trusted endpoint certificate chain for full SSL inspection, protecting its private key and ensuring endpoint browsers accept the configured inspection certificate. Scenario: A company enables deep SSL inspection but forgets to distribute the FortiGate inspection CA, producing certificate warnings on every managed workstation.

Incorrect Answers

A:

Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception. This diagnostic is related to Targeted SSL inspection exclusions and privacy controls rather than the controlling evidence for this scenario. Examine instead: Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs. Scenario: A company enables deep SSL inspection but forgets to distribute the FortiGate inspection CA, producing certificate warnings on every managed workstation.

C:

Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. This diagnostic is related to HTTPS web filtering hostname limitations and logging rather than the controlling evidence for this scenario. Examine instead: Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs. Scenario: A company enables deep SSL inspection but forgets to distribute the FortiGate inspection CA, producing certificate warnings on every managed workstation.

D:

Review DNS policy/profile, DNS transport, query logs, client resolver configuration, DoH/DoT behavior, browser HTTPS requests and matching web-filter outcomes. This diagnostic is related to DNS filtering versus web filtering visibility boundaries rather than the controlling evidence for this scenario. Examine instead: Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs. Scenario: A company enables deep SSL inspection but forgets to distribute the FortiGate inspection CA, producing certificate warnings on every managed workstation.

Question 783

An endpoint agent shows Connected after enrollment, but its failed posture check prevents access to a restricted application despite valid SSO credentials. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Onboard supported remote users and endpoints through FortiSASE identity enrollment and device posture policies, then apply least-privilege internet or private-application access rules.
  2. Supported established sessions survive or reconnect within documented expectations after a primary failure, with no uncontrolled security policy bypass.
  3. Review cloud vNIC and subnet placement, effective cloud routes, source/destination checks where applicable, FortiOS interface addresses, security groups and return-path symmetry.
  4. Validate the FortiSASE service edge, policy assignment, client route steering and logging for remote access and internet security scenarios before attributing every failure to FortiGate site firewall rules.
  5. Inspect user group mapping, SSO state, endpoint registration, FortiClient agent status, posture checks, FortiSASE portal permissions and applied access policy.

Explanation

Correct Answers

A:

Onboard supported remote users and endpoints through FortiSASE identity enrollment and device posture policies, then apply least-privilege internet or private-application access rules. This directly addresses the FortiOS configuration or response required by the case. An internet connection from the user is not equivalent to successful FortiSASE enrollment or private-app authorization, and endpoint posture must be evaluated separately from username. Verify with: Inspect user group mapping, SSO state, endpoint registration, FortiClient agent status, posture checks, FortiSASE portal permissions and applied access policy. This is the implementation portion of the required complementary pair. Scenario: An endpoint agent shows Connected after enrollment, but its failed posture check prevents access to a restricted application despite valid SSO credentials.

E:

Inspect user group mapping, SSO state, endpoint registration, FortiClient agent status, posture checks, FortiSASE portal permissions and applied access policy. This distinguishes the relevant FortiGate device, session or controller evidence. An internet connection from the user is not equivalent to successful FortiSASE enrollment or private-app authorization, and endpoint posture must be evaluated separately from username. The corresponding action is: Onboard supported remote users and endpoints through FortiSASE identity enrollment and device posture policies, then apply least-privilege internet or private-application access rules. This is the verification portion of the required complementary pair. Scenario: An endpoint agent shows Connected after enrollment, but its failed posture check prevents access to a restricted application despite valid SSO credentials.

Incorrect Answers

B:

Supported established sessions survive or reconnect within documented expectations after a primary failure, with no uncontrolled security policy bypass. This choice relates to HA session-pickup and failover continuity, not the complementary implementation-and-evidence pair for the case. Implement: Onboard supported remote users and endpoints through FortiSASE identity enrollment and device posture policies, then apply least-privilege internet or private-application access rules. Check: Inspect user group mapping, SSO state, endpoint registration, FortiClient agent status, posture checks, FortiSASE portal permissions and applied access policy. Scenario: An endpoint agent shows Connected after enrollment, but its failed posture check prevents access to a restricted application despite valid SSO credentials.

C:

Review cloud vNIC and subnet placement, effective cloud routes, source/destination checks where applicable, FortiOS interface addresses, security groups and return-path symmetry. This choice relates to FortiGate VM in public-cloud route and interface topology, not the complementary implementation-and-evidence pair for the case. Implement: Onboard supported remote users and endpoints through FortiSASE identity enrollment and device posture policies, then apply least-privilege internet or private-application access rules. Check: Inspect user group mapping, SSO state, endpoint registration, FortiClient agent status, posture checks, FortiSASE portal permissions and applied access policy. Scenario: An endpoint agent shows Connected after enrollment, but its failed posture check prevents access to a restricted application despite valid SSO credentials.

D:

Validate the FortiSASE service edge, policy assignment, client route steering and logging for remote access and internet security scenarios before attributing every failure to FortiGate site firewall rules. This choice relates to FortiSASE PoP policy steering and remote diagnostics, not the complementary implementation-and-evidence pair for the case. Implement: Onboard supported remote users and endpoints through FortiSASE identity enrollment and device posture policies, then apply least-privilege internet or private-application access rules. Check: Inspect user group mapping, SSO state, endpoint registration, FortiClient agent status, posture checks, FortiSASE portal permissions and applied access policy. Scenario: An endpoint agent shows Connected after enrollment, but its failed posture check prevents access to a restricted application despite valid SSO credentials.

Question 784

A branch firewall permits every outbound TCP service before an administrator adds a narrow deny for unapproved remote desktop, so the deny rule never matches. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Enable the intended logging options on relevant FortiGate allow and deny policies, then correlate explicit and implicit deny handling with counters and session evidence.
  2. Configure a supported RADIUS server and shared secrets for user authentication, interpreting Access-Accept, Access-Reject, timeout and group attributes before changing network policy.
  3. Isolate FSSO group-policy failures by tracing directory login events to collector tables and FortiGate identity records before altering the protected firewall policy.
  4. Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary.

Explanation

Correct Answer

D:

Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. This directly addresses the FortiOS configuration or response required by the case. FortiGate policy order and first matching rule are crucial; creating a restrictive rule below an unrestricted matching policy does not constrain existing allowed sessions. Verify with: Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages. Scenario: A branch firewall permits every outbound TCP service before an administrator adds a narrow deny for unapproved remote desktop, so the deny rule never matches.

Incorrect Answers

A:

Enable the intended logging options on relevant FortiGate allow and deny policies, then correlate explicit and implicit deny handling with counters and session evidence. This addresses Implicit denial, policy logging and rule hit interpretation, but not the principal task of the described flow. An implicit firewall deny may have different log visibility than an explicit deny; no traffic log is not reliable evidence that a packet never reached the FortiGate. The better fit is: Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. Scenario: A branch firewall permits every outbound TCP service before an administrator adds a narrow deny for unapproved remote desktop, so the deny rule never matches.

B:

Configure a supported RADIUS server and shared secrets for user authentication, interpreting Access-Accept, Access-Reject, timeout and group attributes before changing network policy. This addresses RADIUS authentication and policy-bound MFA validation, but not the principal task of the described flow. A reachable RADIUS server can still reject every user if the shared secret, client registration, user group mapping or MFA flow is incorrect. The better fit is: Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. Scenario: A branch firewall permits every outbound TCP service before an administrator adds a narrow deny for unapproved remote desktop, so the deny rule never matches.

C:

Isolate FSSO group-policy failures by tracing directory login events to collector tables and FortiGate identity records before altering the protected firewall policy. This addresses FSSO troubleshooting and authentication connector health, but not the principal task of the described flow. A firewall policy allowing any user is an unsafe substitute for repairing a failed identity collector; authentication is a separate dependency from packet route reachability. The better fit is: Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. Scenario: A branch firewall permits every outbound TCP service before an administrator adds a narrow deny for unapproved remote desktop, so the deny rule never matches.

Question 785

During an upgrade, the primary switches unexpectedly and operations cannot identify whether the cause was a monitored interface, heartbeat failure or maintenance election. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Investigate conserve-mode state and memory consumption by processes and sessions before changing thresholds, inspection settings or hardware sizing.
  2. Provide out-of-band access to each HA member through supported reserved management interfaces, and stage firmware upgrades with cluster health and rollback checks.
  3. Configure compatible FortiGate peers as an FGCP high-availability cluster with appropriate heartbeat interfaces, group identity, matching licenses and tracked interfaces.
  4. Validate supported FortiGate-VM entitlement, public-cloud capacity requirements and cloud security policies before cutover, distinguishing vendor appliance configuration from cloud platform permissions.

Explanation

Correct Answer

B:

Provide out-of-band access to each HA member through supported reserved management interfaces, and stage firmware upgrades with cluster health and rollback checks. This directly addresses the FortiOS configuration or response required by the case. Access to the virtual cluster primary is not the same as independent access to each physical peer, and an HA firmware upgrade requires build compatibility and sequence planning. Verify with: Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events. Scenario: During an upgrade, the primary switches unexpectedly and operations cannot identify whether the cause was a monitored interface, heartbeat failure or maintenance election.

Incorrect Answers

A:

Investigate conserve-mode state and memory consumption by processes and sessions before changing thresholds, inspection settings or hardware sizing. This addresses FortiGate memory pressure and conserve-mode diagnosis, but not the principal task of the described flow. Memory conserve mode can restrict session establishment or inspection by policy; simply disabling security services may hide the symptom while creating protection gaps. The better fit is: Provide out-of-band access to each HA member through supported reserved management interfaces, and stage firmware upgrades with cluster health and rollback checks. Scenario: During an upgrade, the primary switches unexpectedly and operations cannot identify whether the cause was a monitored interface, heartbeat failure or maintenance election.

C:

Configure compatible FortiGate peers as an FGCP high-availability cluster with appropriate heartbeat interfaces, group identity, matching licenses and tracked interfaces. This addresses FGCP cluster heartbeat, synchronization and election settings, but not the principal task of the described flow. FGCP heartbeat must operate over suitable dedicated links; two matching hostnames alone cannot build a synchronized HA pair or guarantee traffic survival. The better fit is: Provide out-of-band access to each HA member through supported reserved management interfaces, and stage firmware upgrades with cluster health and rollback checks. Scenario: During an upgrade, the primary switches unexpectedly and operations cannot identify whether the cause was a monitored interface, heartbeat failure or maintenance election.

D:

Validate supported FortiGate-VM entitlement, public-cloud capacity requirements and cloud security policies before cutover, distinguishing vendor appliance configuration from cloud platform permissions. This addresses Cloud FortiGate licensing and infrastructure ownership boundaries, but not the principal task of the described flow. An active FortiOS license does not confer AWS or Azure rights, and an allowed firewall rule cannot override a cloud-native deny or missing route. The better fit is: Provide out-of-band access to each HA member through supported reserved management interfaces, and stage firmware upgrades with cluster health and rollback checks. Scenario: During an upgrade, the primary switches unexpectedly and operations cannot identify whether the cause was a monitored interface, heartbeat failure or maintenance election.

Question 786

An administrator creates only a branch-to-head-office policy and assumes reply traffic will work without considering the reverse direction and matching inbound policy context. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. A valid user authenticates into the correct FortiGate user group while wrong passwords and unmapped groups are denied without bypass policies.
  2. Permitted LAN-to-LAN traffic crosses the established IPsec interface with expected addressing and no unintended source NAT.
  3. Approved VPN peers authenticate and rotate keys or certificates without accepting expired, revoked or unexpected identities and while maintaining tested availability.
  4. Users experience the configured category or URL behavior with explainable logs and without disabling unrelated accepted traffic.

Explanation

Correct Answer

B:

Permitted LAN-to-LAN traffic crosses the established IPsec interface with expected addressing and no unintended source NAT. This is the operational validation outcome rather than merely an enabled setting. An established VPN SA cannot route user packets without valid route and firewall policy; applying source NAT across a private site-to-site tunnel can break peer selectors or application identity. Scenario: An administrator creates only a branch-to-head-office policy and assumes reply traffic will work without considering the reverse direction and matching inbound policy context.

Incorrect Answers

A:

A valid user authenticates into the correct FortiGate user group while wrong passwords and unmapped groups are denied without bypass policies. This result would test LDAP remote user integration over trusted TLS but does not demonstrate the desired FortiGate outcome here. Verify instead: Permitted LAN-to-LAN traffic crosses the established IPsec interface with expected addressing and no unintended source NAT. Scenario: An administrator creates only a branch-to-head-office policy and assumes reply traffic will work without considering the reverse direction and matching inbound policy context.

C:

Approved VPN peers authenticate and rotate keys or certificates without accepting expired, revoked or unexpected identities and while maintaining tested availability. This result would test Certificate-based IPsec authentication and safe tunnel rekey but does not demonstrate the desired FortiGate outcome here. Verify instead: Permitted LAN-to-LAN traffic crosses the established IPsec interface with expected addressing and no unintended source NAT. Scenario: An administrator creates only a branch-to-head-office policy and assumes reply traffic will work without considering the reverse direction and matching inbound policy context.

D:

Users experience the configured category or URL behavior with explainable logs and without disabling unrelated accepted traffic. This result would test Flow-based versus proxy-based web filter enforcement but does not demonstrate the desired FortiGate outcome here. Verify instead: Permitted LAN-to-LAN traffic crosses the established IPsec interface with expected addressing and no unintended source NAT. Scenario: An administrator creates only a branch-to-head-office policy and assumes reply traffic will work without considering the reverse direction and matching inbound policy context.

Question 787

An expired certificate causes periodic VPN tunnel failure at reauthentication, but operators attempt to fix it only by adding broad firewall permit rules. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Review policy flow/proxy mode, web filter profile, SSL inspection depth, web request metadata, FortiGuard rating and matching event logs.
  2. Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception.
  3. Check VPN certificate subject/SAN, CA trust chain, CRL availability, peer ID matching, validity dates, IKE authentication events and SA rekey statistics.
  4. Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs.

Explanation

Correct Answer

C:

Check VPN certificate subject/SAN, CA trust chain, CRL availability, peer ID matching, validity dates, IKE authentication events and SA rekey statistics. This distinguishes the relevant FortiGate device, session or controller evidence. Disabling certificate or peer identity verification may bring a tunnel up but defeats authentication, and scheduled IKE/ESP rekey depends on both ends agreeing on proposals. The corresponding action is: Use appropriate certificate trust, subject identity and revocation or PSK rotation controls for FortiGate site-to-site IPsec, and verify rekey without disabling peer validation. Scenario: An expired certificate causes periodic VPN tunnel failure at reauthentication, but operators attempt to fix it only by adding broad firewall permit rules.

Incorrect Answers

A:

Review policy flow/proxy mode, web filter profile, SSL inspection depth, web request metadata, FortiGuard rating and matching event logs. This diagnostic is related to Flow-based versus proxy-based web filter enforcement rather than the controlling evidence for this scenario. Examine instead: Check VPN certificate subject/SAN, CA trust chain, CRL availability, peer ID matching, validity dates, IKE authentication events and SA rekey statistics. Scenario: An expired certificate causes periodic VPN tunnel failure at reauthentication, but operators attempt to fix it only by adding broad firewall permit rules.

B:

Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception. This diagnostic is related to Targeted SSL inspection exclusions and privacy controls rather than the controlling evidence for this scenario. Examine instead: Check VPN certificate subject/SAN, CA trust chain, CRL availability, peer ID matching, validity dates, IKE authentication events and SA rekey statistics. Scenario: An expired certificate causes periodic VPN tunnel failure at reauthentication, but operators attempt to fix it only by adding broad firewall permit rules.

D:

Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. This diagnostic is related to Dialup IPsec dynamic peer identification and authentication rather than the controlling evidence for this scenario. Examine instead: Check VPN certificate subject/SAN, CA trust chain, CRL availability, peer ID matching, validity dates, IKE authentication events and SA rekey statistics. Scenario: An expired certificate causes periodic VPN tunnel failure at reauthentication, but operators attempt to fix it only by adding broad firewall permit rules.

Question 788

A security team adds an explicit deny rule for outbound SMB but sees no alert because the rule does not log its matching traffic. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Unauthenticated clients encounter the intended portal or deny behavior and authenticated users reach only their approved resources.
  2. Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details.
  3. Attach supported antivirus, web filter, IPS and application control profiles to the relevant FortiGate firewall policies using a compatible flow-based or proxy-based inspection mode.
  4. Enable the intended logging options on relevant FortiGate allow and deny policies, then correlate explicit and implicit deny handling with counters and session evidence.
  5. Examine user authentication state, configured source user groups, policy schedule, session table, policy ID and log timestamps on the test client.

Explanation

Correct Answers

B:

Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details. This distinguishes the relevant FortiGate device, session or controller evidence. An implicit firewall deny may have different log visibility than an explicit deny; no traffic log is not reliable evidence that a packet never reached the FortiGate. The corresponding action is: Enable the intended logging options on relevant FortiGate allow and deny policies, then correlate explicit and implicit deny handling with counters and session evidence. This is the verification portion of the required complementary pair. Scenario: A security team adds an explicit deny rule for outbound SMB but sees no alert because the rule does not log its matching traffic.

D:

Enable the intended logging options on relevant FortiGate allow and deny policies, then correlate explicit and implicit deny handling with counters and session evidence. This directly addresses the FortiOS configuration or response required by the case. An implicit firewall deny may have different log visibility than an explicit deny; no traffic log is not reliable evidence that a packet never reached the FortiGate. Verify with: Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details. This is the implementation portion of the required complementary pair. Scenario: A security team adds an explicit deny rule for outbound SMB but sees no alert because the rule does not log its matching traffic.

Incorrect Answers

A:

Unauthenticated clients encounter the intended portal or deny behavior and authenticated users reach only their approved resources. This choice relates to Captive portal and explicit firewall user authentication, not the complementary implementation-and-evidence pair for the case. Implement: Enable the intended logging options on relevant FortiGate allow and deny policies, then correlate explicit and implicit deny handling with counters and session evidence. Check: Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details. Scenario: A security team adds an explicit deny rule for outbound SMB but sees no alert because the rule does not log its matching traffic.

C:

Attach supported antivirus, web filter, IPS and application control profiles to the relevant FortiGate firewall policies using a compatible flow-based or proxy-based inspection mode. This choice relates to Security profiles and flow versus proxy inspection boundaries, not the complementary implementation-and-evidence pair for the case. Implement: Enable the intended logging options on relevant FortiGate allow and deny policies, then correlate explicit and implicit deny handling with counters and session evidence. Check: Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details. Scenario: A security team adds an explicit deny rule for outbound SMB but sees no alert because the rule does not log its matching traffic.

E:

Examine user authentication state, configured source user groups, policy schedule, session table, policy ID and log timestamps on the test client. This choice relates to Schedule, authenticated groups and policy-specific change control, not the complementary implementation-and-evidence pair for the case. Implement: Enable the intended logging options on relevant FortiGate allow and deny policies, then correlate explicit and implicit deny handling with counters and session evidence. Check: Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details. Scenario: A security team adds an explicit deny rule for outbound SMB but sees no alert because the rule does not log its matching traffic.

Question 789

A tunnel forwards traffic in one direction but the return path is denied by the remote firewall, and the operator concludes the shared pre-shared key must be incorrect. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Use FortiGate route and session diagnostics to isolate asymmetric return paths, overlapping prefixes and wrong interface selection before opening firewall policy to compensate.
  2. Enable the intended logging options on relevant FortiGate allow and deny policies, then correlate explicit and implicit deny handling with counters and session evidence.
  3. Configure redundant FortiGate site-to-site IPsec tunnels with supported peer monitoring, link health and deterministic routing preferences, then exercise failover under controlled tests.
  4. Diagnose FortiOS IPsec connectivity by separating interface transport, IKE Phase 1 authentication, Phase 2 negotiation, routed packet selection and firewall policy outcomes.

Explanation

Correct Answer

D:

Diagnose FortiOS IPsec connectivity by separating interface transport, IKE Phase 1 authentication, Phase 2 negotiation, routed packet selection and firewall policy outcomes. This directly addresses the FortiOS configuration or response required by the case. An IKE SA in established state does not prove any user payload crossed the tunnel, and generic ping failure can arise from routes or firewall rules after both phases succeed. Verify with: Collect scoped IKE debug, vpn tunnel list state, security association counters, phase proposal messages, tunnel route, session table and forward/reverse packet captures. Scenario: A tunnel forwards traffic in one direction but the return path is denied by the remote firewall, and the operator concludes the shared pre-shared key must be incorrect.

Incorrect Answers

A:

Use FortiGate route and session diagnostics to isolate asymmetric return paths, overlapping prefixes and wrong interface selection before opening firewall policy to compensate. This addresses Routing table and reverse-path asymmetric connectivity analysis, but not the principal task of the described flow. A permitted inbound SYN with no symmetric return route can fail even when its matching firewall policy allows it; static route tables are prefix-sensitive. The better fit is: Diagnose FortiOS IPsec connectivity by separating interface transport, IKE Phase 1 authentication, Phase 2 negotiation, routed packet selection and firewall policy outcomes. Scenario: A tunnel forwards traffic in one direction but the return path is denied by the remote firewall, and the operator concludes the shared pre-shared key must be incorrect.

B:

Enable the intended logging options on relevant FortiGate allow and deny policies, then correlate explicit and implicit deny handling with counters and session evidence. This addresses Implicit denial, policy logging and rule hit interpretation, but not the principal task of the described flow. An implicit firewall deny may have different log visibility than an explicit deny; no traffic log is not reliable evidence that a packet never reached the FortiGate. The better fit is: Diagnose FortiOS IPsec connectivity by separating interface transport, IKE Phase 1 authentication, Phase 2 negotiation, routed packet selection and firewall policy outcomes. Scenario: A tunnel forwards traffic in one direction but the return path is denied by the remote firewall, and the operator concludes the shared pre-shared key must be incorrect.

C:

Configure redundant FortiGate site-to-site IPsec tunnels with supported peer monitoring, link health and deterministic routing preferences, then exercise failover under controlled tests. This addresses Redundant tunnels, dead peer detection and controlled failover, but not the principal task of the described flow. Two configured tunnels do not guarantee failover if their routes or peer liveness are incorrect; DPD detects peer unavailability but is not a substitute for end-to-end application validation. The better fit is: Diagnose FortiOS IPsec connectivity by separating interface transport, IKE Phase 1 authentication, Phase 2 negotiation, routed packet selection and firewall policy outcomes. Scenario: A tunnel forwards traffic in one direction but the return path is denied by the remote firewall, and the operator concludes the shared pre-shared key must be incorrect.

Question 790

An engineering group is nested under a broader department group, but the FSSO connector's group retrieval design does not deliver the expected nested mapping for the firewall rule. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Compare collector monitored groups, AD membership, security identifier/group names, group refresh status, FortiGate group objects and policy group references.
  2. Examine user authentication state, configured source user groups, policy schedule, session table, policy ID and log timestamps on the test client.
  3. Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs.
  4. Review authenticated user monitor, auth method, group sources, user-to-IP mapping, identity timeout, traffic source IP and matching policy ID.

Explanation

Correct Answer

A:

Compare collector monitored groups, AD membership, security identifier/group names, group refresh status, FortiGate group objects and policy group references. This distinguishes the relevant FortiGate device, session or controller evidence. An FSSO logon event can be valid while its group mapping is incomplete; FortiGate rules depend on the group data and policy references available at match time. The corresponding action is: Map the intended AD security groups through FSSO collector group filters and FortiGate firewall user groups, checking nested membership and current event identity. Scenario: An engineering group is nested under a broader department group, but the FSSO connector's group retrieval design does not deliver the expected nested mapping for the firewall rule.

Incorrect Answers

B:

Examine user authentication state, configured source user groups, policy schedule, session table, policy ID and log timestamps on the test client. This diagnostic is related to Schedule, authenticated groups and policy-specific change control rather than the controlling evidence for this scenario. Examine instead: Compare collector monitored groups, AD membership, security identifier/group names, group refresh status, FortiGate group objects and policy group references. Scenario: An engineering group is nested under a broader department group, but the FSSO connector's group retrieval design does not deliver the expected nested mapping for the firewall rule.

C:

Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs. This diagnostic is related to FSSO user-to-IP identity across DHCP and shared networks rather than the controlling evidence for this scenario. Examine instead: Compare collector monitored groups, AD membership, security identifier/group names, group refresh status, FortiGate group objects and policy group references. Scenario: An engineering group is nested under a broader department group, but the FSSO connector's group retrieval design does not deliver the expected nested mapping for the firewall rule.

D:

Review authenticated user monitor, auth method, group sources, user-to-IP mapping, identity timeout, traffic source IP and matching policy ID. This diagnostic is related to Active versus passive FortiGate authentication evidence rather than the controlling evidence for this scenario. Examine instead: Compare collector monitored groups, AD membership, security identifier/group names, group refresh status, FortiGate group objects and policy group references. Scenario: An engineering group is nested under a broader department group, but the FSSO connector's group retrieval design does not deliver the expected nested mapping for the firewall rule.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests