cert
cert-1
cert-2

Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
FCP_FGT_AD-7.6 Exam - Verified By Experts
FCP_FGT_AD-7.6 Premium File

FCP_FGT_AD-7.6 Premium File

$69.99
$76.99
  • Premium File 128 Questions & Answers. Last Update: Nov 04, 2026

Whats Included:

  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
 
$76.99
$69.99
accept 55 downloads in the last 7 days
block-screenshots
Fortinet FCP_FGT_AD-7.6 Practice Test 83

Question 820

A new finance application rule names the correct destination subnet but the wrong incoming VLAN interface, leading debug flow to show no matching allow policy. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Maintain precise address objects, FQDN objects, service definitions and supported interface zones so FortiGate rules express intended business segments rather than accidental broad matches.
  2. Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary.
  3. Internal clients resolve and reach the intended server consistently without bypassing stateful inspection or exposing additional services.
  4. Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages.
  5. Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state.

Explanation

Correct Answers

B:

Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. This directly addresses the FortiOS configuration or response required by the case. FortiGate policy order and first matching rule are crucial; creating a restrictive rule below an unrestricted matching policy does not constrain existing allowed sessions. Verify with: Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages. This is the implementation portion of the required complementary pair. Scenario: A new finance application rule names the correct destination subnet but the wrong incoming VLAN interface, leading debug flow to show no matching allow policy.

D:

Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages. This distinguishes the relevant FortiGate device, session or controller evidence. FortiGate policy order and first matching rule are crucial; creating a restrictive rule below an unrestricted matching policy does not constrain existing allowed sessions. The corresponding action is: Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. This is the verification portion of the required complementary pair. Scenario: A new finance application rule names the correct destination subnet but the wrong incoming VLAN interface, leading debug flow to show no matching allow policy.

Incorrect Answers

A:

Maintain precise address objects, FQDN objects, service definitions and supported interface zones so FortiGate rules express intended business segments rather than accidental broad matches. This choice relates to Address and service objects, interface zones, and policy scoping, not the complementary implementation-and-evidence pair for the case. Implement: Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. Check: Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages. Scenario: A new finance application rule names the correct destination subnet but the wrong incoming VLAN interface, leading debug flow to show no matching allow policy.

C:

Internal clients resolve and reach the intended server consistently without bypassing stateful inspection or exposing additional services. This choice relates to NAT hairpin and internal use of public VIP names, not the complementary implementation-and-evidence pair for the case. Implement: Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. Check: Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages. Scenario: A new finance application rule names the correct destination subnet but the wrong incoming VLAN interface, leading debug flow to show no matching allow policy.

E:

Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state. This choice relates to FSSO collector agent and domain-controller event acquisition, not the complementary implementation-and-evidence pair for the case. Implement: Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. Check: Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages. Scenario: A new finance application rule names the correct destination subnet but the wrong incoming VLAN interface, leading debug flow to show no matching allow policy.

Question 821

Central SNAT was enabled after a migration, yet an administrator still expects a policy NAT toggle to control the same egress session source address. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. The specific public port reaches the intended internal listener and unauthorized external service or source combinations remain blocked.
  2. Access succeeds only for the intended group during its authorized time period, while expired sessions and newly unauthorized flows behave predictably.
  3. Tests confirm approved users reach only intended destinations and services without unintended wildcard access after object or zone changes.
  4. A test flow shows symmetric forward and return tuples, correct NAT mappings and stable application transactions through the intended policy.

Explanation

Correct Answer

D:

A test flow shows symmetric forward and return tuples, correct NAT mappings and stable application transactions through the intended policy. This is the operational validation outcome rather than merely an enabled setting. Firewall session state, NAT mapping and routing are coupled; an asymmetric return path or conflicting central NAT rule can cause failure despite correct outbound translation. Scenario: Central SNAT was enabled after a migration, yet an administrator still expects a policy NAT toggle to control the same egress session source address.

Incorrect Answers

A:

The specific public port reaches the intended internal listener and unauthorized external service or source combinations remain blocked. This result would test VIP destination NAT and published server policies but does not demonstrate the desired FortiGate outcome here. Verify instead: A test flow shows symmetric forward and return tuples, correct NAT mappings and stable application transactions through the intended policy. Scenario: Central SNAT was enabled after a migration, yet an administrator still expects a policy NAT toggle to control the same egress session source address.

B:

Access succeeds only for the intended group during its authorized time period, while expired sessions and newly unauthorized flows behave predictably. This result would test Schedule, authenticated groups and policy-specific change control but does not demonstrate the desired FortiGate outcome here. Verify instead: A test flow shows symmetric forward and return tuples, correct NAT mappings and stable application transactions through the intended policy. Scenario: Central SNAT was enabled after a migration, yet an administrator still expects a policy NAT toggle to control the same egress session source address.

C:

Tests confirm approved users reach only intended destinations and services without unintended wildcard access after object or zone changes. This result would test Address and service objects, interface zones, and policy scoping but does not demonstrate the desired FortiGate outcome here. Verify instead: A test flow shows symmetric forward and return tuples, correct NAT mappings and stable application transactions through the intended policy. Scenario: Central SNAT was enabled after a migration, yet an administrator still expects a policy NAT toggle to control the same egress session source address.

Question 822

A protected branch shows successful routing but antivirus updates fail after DNS settings change, leaving detection efficacy below expectations. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Users experience the configured category or URL behavior with explainable logs and without disabling unrelated accepted traffic.
  2. Set supported protocol and file-size inspection thresholds according to policy, explicitly handling oversized, compressed or unsupported transfers without silently failing open.
  3. Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs.
  4. Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database.
  5. Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log.

Explanation

Correct Answers

C:

Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. This distinguishes the relevant FortiGate device, session or controller evidence. Antivirus effectiveness depends on inspection visibility and current definitions, and an allow action on a profile can still report detections without blocking them. The corresponding action is: Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database. This is the verification portion of the required complementary pair. Scenario: A protected branch shows successful routing but antivirus updates fail after DNS settings change, leaving detection efficacy below expectations.

D:

Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database. This directly addresses the FortiOS configuration or response required by the case. Antivirus effectiveness depends on inspection visibility and current definitions, and an allow action on a profile can still report detections without blocking them. Verify with: Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. This is the implementation portion of the required complementary pair. Scenario: A protected branch shows successful routing but antivirus updates fail after DNS settings change, leaving detection efficacy below expectations.

Incorrect Answers

A:

Users experience the configured category or URL behavior with explainable logs and without disabling unrelated accepted traffic. This choice relates to Flow-based versus proxy-based web filter enforcement, not the complementary implementation-and-evidence pair for the case. Implement: Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database. Check: Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. Scenario: A protected branch shows successful routing but antivirus updates fail after DNS settings change, leaving detection efficacy below expectations.

B:

Set supported protocol and file-size inspection thresholds according to policy, explicitly handling oversized, compressed or unsupported transfers without silently failing open. This choice relates to Oversized transfer handling and antivirus inspection limits, not the complementary implementation-and-evidence pair for the case. Implement: Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database. Check: Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. Scenario: A protected branch shows successful routing but antivirus updates fail after DNS settings change, leaving detection efficacy below expectations.

E:

Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. This choice relates to Antivirus profile scanning modes and supported protocol boundaries, not the complementary implementation-and-evidence pair for the case. Implement: Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database. Check: Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. Scenario: A protected branch shows successful routing but antivirus updates fail after DNS settings change, leaving detection efficacy below expectations.

Question 823

An engineer scales FortiGate-VM to an additional NIC but forgets the cloud platform's subnet association and effective route table requirements. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments.
  2. Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope.
  3. Review cloud vNIC and subnet placement, effective cloud routes, source/destination checks where applicable, FortiOS interface addresses, security groups and return-path symmetry.
  4. Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs.

Explanation

Correct Answer

C:

Review cloud vNIC and subnet placement, effective cloud routes, source/destination checks where applicable, FortiOS interface addresses, security groups and return-path symmetry. This distinguishes the relevant FortiGate device, session or controller evidence. FortiGate VM policies cannot inspect packets that cloud-native route tables never send to it, and cloud security groups remain separate enforcement layers. The corresponding action is: Deploy supported FortiGate-VM interfaces, cloud route tables and security controls so inspected application traffic actually traverses the intended firewall path. Scenario: An engineer scales FortiGate-VM to an additional NIC but forgets the cloud platform's subnet association and effective route table requirements.

Incorrect Answers

A:

Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments. This diagnostic is related to FortiGate local log storage and reliable export rather than the controlling evidence for this scenario. Examine instead: Review cloud vNIC and subnet placement, effective cloud routes, source/destination checks where applicable, FortiOS interface addresses, security groups and return-path symmetry. Scenario: An engineer scales FortiGate-VM to an additional NIC but forgets the cloud platform's subnet association and effective route table requirements.

B:

Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope. This diagnostic is related to FortiGate cloud-native firewall CNF service responsibility rather than the controlling evidence for this scenario. Examine instead: Review cloud vNIC and subnet placement, effective cloud routes, source/destination checks where applicable, FortiOS interface addresses, security groups and return-path symmetry. Scenario: An engineer scales FortiGate-VM to an additional NIC but forgets the cloud platform's subnet association and effective route table requirements.

D:

Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs. This diagnostic is related to FortiSASE PoP policy steering and remote diagnostics rather than the controlling evidence for this scenario. Examine instead: Review cloud vNIC and subnet placement, effective cloud routes, source/destination checks where applicable, FortiOS interface addresses, security groups and return-path symmetry. Scenario: An engineer scales FortiGate-VM to an additional NIC but forgets the cloud platform's subnet association and effective route table requirements.

Question 824

An internal API requires a client certificate for mutual TLS, but deep inspection substitutes an intermediate identity and application authentication fails after the TCP connection succeeds. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Inspect configured simple/wildcard/regex pattern type, URL filter order, exempt/action behavior, relevant hostname/path visibility and web-filter logs.
  2. Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs.
  3. Permitted test downloads receive the intended malware verdict, while excluded sensitive services keep documented and limited inspection behavior.
  4. Apply narrowly scoped, auditable SSL-inspection exclusions for supported certificate-pinned or regulated applications without disabling inspection for every other destination.
  5. Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting.

Explanation

Correct Answers

B:

Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs. This distinguishes the relevant FortiGate device, session or controller evidence. A passed TCP handshake does not prove a successful TLS handshake, and deep inspection can alter observed certificate chains or interfere with application client certificates. The corresponding action is: Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. This is the verification portion of the required complementary pair. Scenario: An internal API requires a client certificate for mutual TLS, but deep inspection substitutes an intermediate identity and application authentication fails after the TCP connection succeeds.

E:

Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. This directly addresses the FortiOS configuration or response required by the case. A passed TCP handshake does not prove a successful TLS handshake, and deep inspection can alter observed certificate chains or interfere with application client certificates. Verify with: Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs. This is the implementation portion of the required complementary pair. Scenario: An internal API requires a client certificate for mutual TLS, but deep inspection substitutes an intermediate identity and application authentication fails after the TCP connection succeeds.

Incorrect Answers

A:

Inspect configured simple/wildcard/regex pattern type, URL filter order, exempt/action behavior, relevant hostname/path visibility and web-filter logs. This choice relates to Static URL filter ordering and wildcard match behavior, not the complementary implementation-and-evidence pair for the case. Implement: Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. Check: Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs. Scenario: An internal API requires a client certificate for mutual TLS, but deep inspection substitutes an intermediate identity and application authentication fails after the TCP connection succeeds.

C:

Permitted test downloads receive the intended malware verdict, while excluded sensitive services keep documented and limited inspection behavior. This choice relates to HTTPS malware scanning with controlled exception validation, not the complementary implementation-and-evidence pair for the case. Implement: Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. Check: Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs. Scenario: An internal API requires a client certificate for mutual TLS, but deep inspection substitutes an intermediate identity and application authentication fails after the TCP connection succeeds.

D:

Apply narrowly scoped, auditable SSL-inspection exclusions for supported certificate-pinned or regulated applications without disabling inspection for every other destination. This choice relates to Targeted SSL inspection exclusions and privacy controls, not the complementary implementation-and-evidence pair for the case. Implement: Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. Check: Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs. Scenario: An internal API requires a client certificate for mutual TLS, but deep inspection substitutes an intermediate identity and application authentication fails after the TCP connection succeeds.

Question 825

A FortiGate-VM replacement boots successfully but its virtual license is unassigned, leaving expected security subscriptions unavailable to production policies. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Choose supported FortiGate Cloud-Native Firewall integration when centralized cloud firewall policies and service-managed dataplane fit the project, rather than assuming CNF is a self-managed FortiGate VM.
  2. Remote clients use the intended FortiSASE security edge and authorized private resources consistently, with failed policy or connector conditions visible to operations.
  3. Validate supported FortiGate-VM entitlement, public-cloud capacity requirements and cloud security policies before cutover, distinguishing vendor appliance configuration from cloud platform permissions.
  4. Inspect HA group name and password, heartbeat link status, cluster member health, firmware/build compatibility, priority settings and synchronization checksums.
  5. Inspect VM license status, instance capacity, cloud IAM roles, cloud interface attachment, health, FortiOS versions and native cloud traffic policy.

Explanation

Correct Answers

C:

Validate supported FortiGate-VM entitlement, public-cloud capacity requirements and cloud security policies before cutover, distinguishing vendor appliance configuration from cloud platform permissions. This directly addresses the FortiOS configuration or response required by the case. An active FortiOS license does not confer AWS or Azure rights, and an allowed firewall rule cannot override a cloud-native deny or missing route. Verify with: Inspect VM license status, instance capacity, cloud IAM roles, cloud interface attachment, health, FortiOS versions and native cloud traffic policy. This is the implementation portion of the required complementary pair. Scenario: A FortiGate-VM replacement boots successfully but its virtual license is unassigned, leaving expected security subscriptions unavailable to production policies.

E:

Inspect VM license status, instance capacity, cloud IAM roles, cloud interface attachment, health, FortiOS versions and native cloud traffic policy. This distinguishes the relevant FortiGate device, session or controller evidence. An active FortiOS license does not confer AWS or Azure rights, and an allowed firewall rule cannot override a cloud-native deny or missing route. The corresponding action is: Validate supported FortiGate-VM entitlement, public-cloud capacity requirements and cloud security policies before cutover, distinguishing vendor appliance configuration from cloud platform permissions. This is the verification portion of the required complementary pair. Scenario: A FortiGate-VM replacement boots successfully but its virtual license is unassigned, leaving expected security subscriptions unavailable to production policies.

Incorrect Answers

A:

Choose supported FortiGate Cloud-Native Firewall integration when centralized cloud firewall policies and service-managed dataplane fit the project, rather than assuming CNF is a self-managed FortiGate VM. This choice relates to FortiGate cloud-native firewall CNF service responsibility, not the complementary implementation-and-evidence pair for the case. Implement: Validate supported FortiGate-VM entitlement, public-cloud capacity requirements and cloud security policies before cutover, distinguishing vendor appliance configuration from cloud platform permissions. Check: Inspect VM license status, instance capacity, cloud IAM roles, cloud interface attachment, health, FortiOS versions and native cloud traffic policy. Scenario: A FortiGate-VM replacement boots successfully but its virtual license is unassigned, leaving expected security subscriptions unavailable to production policies.

B:

Remote clients use the intended FortiSASE security edge and authorized private resources consistently, with failed policy or connector conditions visible to operations. This choice relates to FortiSASE PoP policy steering and remote diagnostics, not the complementary implementation-and-evidence pair for the case. Implement: Validate supported FortiGate-VM entitlement, public-cloud capacity requirements and cloud security policies before cutover, distinguishing vendor appliance configuration from cloud platform permissions. Check: Inspect VM license status, instance capacity, cloud IAM roles, cloud interface attachment, health, FortiOS versions and native cloud traffic policy. Scenario: A FortiGate-VM replacement boots successfully but its virtual license is unassigned, leaving expected security subscriptions unavailable to production policies.

D:

Inspect HA group name and password, heartbeat link status, cluster member health, firmware/build compatibility, priority settings and synchronization checksums. This choice relates to FGCP cluster heartbeat, synchronization and election settings, not the complementary implementation-and-evidence pair for the case. Implement: Validate supported FortiGate-VM entitlement, public-cloud capacity requirements and cloud security policies before cutover, distinguishing vendor appliance configuration from cloud platform permissions. Check: Inspect VM license status, instance capacity, cloud IAM roles, cloud interface attachment, health, FortiOS versions and native cloud traffic policy. Scenario: A FortiGate-VM replacement boots successfully but its virtual license is unassigned, leaving expected security subscriptions unavailable to production policies.

Question 826

A FortiGate deployment handles ordinary TLS traffic but slows significantly after a high-volume SSL deep-inspection rule is enabled for every user. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Choose certificate-only or supported deep SSL/SSH inspection according to required visibility and data-handling policy, assigning the correct profile to matching firewall policies.
  2. Evaluate supported TLS interception and QUIC/HTTP3 handling against FortiOS model capacity, application requirements and policy visibility instead of assuming every encrypted protocol follows the same inspection path.
  3. Verify that security policies for TLS downloads use appropriate deep inspection, antivirus scanning and certificate handling, restricting bypasses to narrowly documented incompatible services.
  4. Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting.

Explanation

Correct Answer

B:

Evaluate supported TLS interception and QUIC/HTTP3 handling against FortiOS model capacity, application requirements and policy visibility instead of assuming every encrypted protocol follows the same inspection path. This directly addresses the FortiOS configuration or response required by the case. HTTP/3 uses QUIC over UDP and may not follow controls designed only for intercepted HTTPS over TCP; deep inspection consumes resources and capability varies by FortiOS build. Verify with: Compare inspection sessions, CPU/memory usage, negotiated TLS or QUIC transport, certificate inspection logs, policy profile and any explicit protocol-control rule. Scenario: A FortiGate deployment handles ordinary TLS traffic but slows significantly after a high-volume SSL deep-inspection rule is enabled for every user.

Incorrect Answers

A:

Choose certificate-only or supported deep SSL/SSH inspection according to required visibility and data-handling policy, assigning the correct profile to matching firewall policies. This addresses FortiGate certificate inspection versus full SSL/SSH inspection, but not the principal task of the described flow. Certificate-only inspection cannot read encrypted HTTP payloads; full SSL inspection introduces endpoint trust, protocol compatibility and privacy considerations. The better fit is: Evaluate supported TLS interception and QUIC/HTTP3 handling against FortiOS model capacity, application requirements and policy visibility instead of assuming every encrypted protocol follows the same inspection path. Scenario: A FortiGate deployment handles ordinary TLS traffic but slows significantly after a high-volume SSL deep-inspection rule is enabled for every user.

C:

Verify that security policies for TLS downloads use appropriate deep inspection, antivirus scanning and certificate handling, restricting bypasses to narrowly documented incompatible services. This addresses HTTPS malware scanning with controlled exception validation, but not the principal task of the described flow. FortiGate cannot content-scan encrypted HTTP payload merely because a web category or trusted certificate is visible; indiscriminate TLS decryption may break pinned clients. The better fit is: Evaluate supported TLS interception and QUIC/HTTP3 handling against FortiOS model capacity, application requirements and policy visibility instead of assuming every encrypted protocol follows the same inspection path. Scenario: A FortiGate deployment handles ordinary TLS traffic but slows significantly after a high-volume SSL deep-inspection rule is enabled for every user.

D:

Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. This addresses TLS and mutual-certificate handshake fault isolation, but not the principal task of the described flow. A passed TCP handshake does not prove a successful TLS handshake, and deep inspection can alter observed certificate chains or interfere with application client certificates. The better fit is: Evaluate supported TLS interception and QUIC/HTTP3 handling against FortiOS model capacity, application requirements and policy visibility instead of assuming every encrypted protocol follows the same inspection path. Scenario: A FortiGate deployment handles ordinary TLS traffic but slows significantly after a high-volume SSL deep-inspection rule is enabled for every user.

Question 827

An administrator clears all SD-WAN health monitors to force a failover, losing the diagnostic evidence needed to identify whether one member or the probe destination actually failed. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect SD-WAN rules in evaluation order, default service strategy, member health, route table, session interface selection and event history.
  2. Inspect the active route table, equal-prefix candidates, distance values, priorities, ECMP status, next-hop reachability and matching interface state.
  3. Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress.
  4. Inspect SD-WAN service status, health-check latency/loss, member availability, session selected interface, forward route, transport packet trace and logs.

Explanation

Correct Answer

D:

Inspect SD-WAN service status, health-check latency/loss, member availability, session selected interface, forward route, transport packet trace and logs. This distinguishes the relevant FortiGate device, session or controller evidence. One successful ping to a monitoring host cannot establish all application paths are healthy, and unnecessary route changes can mask the original packet-loss cause. The corresponding action is: Investigate FortiOS SD-WAN anomalies through rule match, health-check statistics, session tables and routing diagnostics before changing priorities or disabling monitoring. Scenario: An administrator clears all SD-WAN health monitors to force a failover, losing the diagnostic evidence needed to identify whether one member or the probe destination actually failed.

Incorrect Answers

A:

Inspect SD-WAN rules in evaluation order, default service strategy, member health, route table, session interface selection and event history. This diagnostic is related to SD-WAN implicit rules, failover decisions and session persistence rather than the controlling evidence for this scenario. Examine instead: Inspect SD-WAN service status, health-check latency/loss, member availability, session selected interface, forward route, transport packet trace and logs. Scenario: An administrator clears all SD-WAN health monitors to force a failover, losing the diagnostic evidence needed to identify whether one member or the probe destination actually failed.

B:

Inspect the active route table, equal-prefix candidates, distance values, priorities, ECMP status, next-hop reachability and matching interface state. This diagnostic is related to Static route priority, administrative distance and ECMP design rather than the controlling evidence for this scenario. Examine instead: Inspect SD-WAN service status, health-check latency/loss, member availability, session selected interface, forward route, transport packet trace and logs. Scenario: An administrator clears all SD-WAN health monitors to force a failover, losing the diagnostic evidence needed to identify whether one member or the probe destination actually failed.

C:

Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress. This diagnostic is related to SD-WAN interactions with firewall policies and source-specific routes rather than the controlling evidence for this scenario. Examine instead: Inspect SD-WAN service status, health-check latency/loss, member availability, session selected interface, forward route, transport packet trace and logs. Scenario: An administrator clears all SD-WAN health monitors to force a failover, losing the diagnostic evidence needed to identify whether one member or the probe destination actually failed.

Question 828

A company configures certificate inspection for outbound web and expects antivirus to scan files inside TLS sessions despite never decrypting their payloads. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect configured simple/wildcard/regex pattern type, URL filter order, exempt/action behavior, relevant hostname/path visibility and web-filter logs.
  2. Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs.
  3. Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors.
  4. Inspect SSL inspection mode, matched policy, negotiated TLS version, inspected application certificate, session log and target protocol support.

Explanation

Correct Answer

D:

Inspect SSL inspection mode, matched policy, negotiated TLS version, inspected application certificate, session log and target protocol support. This distinguishes the relevant FortiGate device, session or controller evidence. Certificate-only inspection cannot read encrypted HTTP payloads; full SSL inspection introduces endpoint trust, protocol compatibility and privacy considerations. The corresponding action is: Choose certificate-only or supported deep SSL/SSH inspection according to required visibility and data-handling policy, assigning the correct profile to matching firewall policies. Scenario: A company configures certificate inspection for outbound web and expects antivirus to scan files inside TLS sessions despite never decrypting their payloads.

Incorrect Answers

A:

Inspect configured simple/wildcard/regex pattern type, URL filter order, exempt/action behavior, relevant hostname/path visibility and web-filter logs. This diagnostic is related to Static URL filter ordering and wildcard match behavior rather than the controlling evidence for this scenario. Examine instead: Inspect SSL inspection mode, matched policy, negotiated TLS version, inspected application certificate, session log and target protocol support. Scenario: A company configures certificate inspection for outbound web and expects antivirus to scan files inside TLS sessions despite never decrypting their payloads.

B:

Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs. This diagnostic is related to FortiGate deep-inspection CA trust and certificate deployment rather than the controlling evidence for this scenario. Examine instead: Inspect SSL inspection mode, matched policy, negotiated TLS version, inspected application certificate, session log and target protocol support. Scenario: A company configures certificate inspection for outbound web and expects antivirus to scan files inside TLS sessions despite never decrypting their payloads.

C:

Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors. This diagnostic is related to HTTPS malware scanning with controlled exception validation rather than the controlling evidence for this scenario. Examine instead: Inspect SSL inspection mode, matched policy, negotiated TLS version, inspected application certificate, session log and target protocol support. Scenario: A company configures certificate inspection for outbound web and expects antivirus to scan files inside TLS sessions despite never decrypting their payloads.

Question 829

After migration to a new management VLAN, authorized engineers lose the FortiGate GUI but ordinary web browsing through the firewall still works, suggesting a management access rather than transit policy issue. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. Approved administrators reach only the designated management address and untrusted source hosts cannot open the management service.
  2. Both eligible peers join the intended cluster, remain synchronized and elect the expected primary during controlled failover testing.
  3. Licensed security services update normally and test clients obtain unique LAN leases with the intended gateway and resolver values.
  4. Supported established sessions survive or reconnect within documented expectations after a primary failure, with no uncontrolled security policy bypass.

Explanation

Correct Answer

A:

Approved administrators reach only the designated management address and untrusted source hosts cannot open the management service. This is the operational validation outcome rather than merely an enabled setting. A firewall policy permitting transit packets is not equivalent to management-plane access; local-in controls and interface administration settings have separate effects. Scenario: After migration to a new management VLAN, authorized engineers lose the FortiGate GUI but ordinary web browsing through the firewall still works, suggesting a management access rather than transit policy issue.

Incorrect Answers

B:

Both eligible peers join the intended cluster, remain synchronized and elect the expected primary during controlled failover testing. This result would test FGCP cluster heartbeat, synchronization and election settings but does not demonstrate the desired FortiGate outcome here. Verify instead: Approved administrators reach only the designated management address and untrusted source hosts cannot open the management service. Scenario: After migration to a new management VLAN, authorized engineers lose the FortiGate GUI but ordinary web browsing through the firewall still works, suggesting a management access rather than transit policy issue.

C:

Licensed security services update normally and test clients obtain unique LAN leases with the intended gateway and resolver values. This result would test FortiGuard connectivity, registration and internal DHCP provisioning but does not demonstrate the desired FortiGate outcome here. Verify instead: Approved administrators reach only the designated management address and untrusted source hosts cannot open the management service. Scenario: After migration to a new management VLAN, authorized engineers lose the FortiGate GUI but ordinary web browsing through the firewall still works, suggesting a management access rather than transit policy issue.

D:

Supported established sessions survive or reconnect within documented expectations after a primary failure, with no uncontrolled security policy bypass. This result would test HA session-pickup and failover continuity but does not demonstrate the desired FortiGate outcome here. Verify instead: Approved administrators reach only the designated management address and untrusted source hosts cannot open the management service. Scenario: After migration to a new management VLAN, authorized engineers lose the FortiGate GUI but ordinary web browsing through the firewall still works, suggesting a management access rather than transit policy issue.

Question 830

A datacenter firewall forwards system events yet investigations lack accepted session records because logging is disabled on the rule permitting the application. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps.
  2. Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events.
  3. Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination.
  4. Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses.

Explanation

Correct Answer

A:

Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps. This distinguishes the relevant FortiGate device, session or controller evidence. A healthy route to FortiAnalyzer does not mean the device has been authorized, that the right log categories are enabled, or that records are arriving. The corresponding action is: Register FortiGate with the intended FortiAnalyzer instance, permit trusted management connectivity and enable logs on relevant policies and event categories before relying on central investigations. Scenario: A datacenter firewall forwards system events yet investigations lack accepted session records because logging is disabled on the rule permitting the application.

Incorrect Answers

B:

Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events. This diagnostic is related to Reserved HA management, monitoring and firmware upgrades rather than the controlling evidence for this scenario. Examine instead: Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps. Scenario: A datacenter firewall forwards system events yet investigations lack accepted session records because logging is disabled on the rule permitting the application.

C:

Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination. This diagnostic is related to Policy traffic log interpretation and diagnostic event filtering rather than the controlling evidence for this scenario. Examine instead: Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps. Scenario: A datacenter firewall forwards system events yet investigations lack accepted session records because logging is disabled on the rule permitting the application.

D:

Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses. This diagnostic is related to FortiGuard connectivity, registration and internal DHCP provisioning rather than the controlling evidence for this scenario. Examine instead: Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps. Scenario: A datacenter firewall forwards system events yet investigations lack accepted session records because logging is disabled on the rule permitting the application.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests