cert
cert-1
cert-2

Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
FCP_FGT_AD-7.6 Exam - Verified By Experts
FCP_FGT_AD-7.6 Premium File

FCP_FGT_AD-7.6 Premium File

$69.99
$76.99
  • Premium File 128 Questions & Answers. Last Update: Nov 04, 2026

Whats Included:

  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
 
$76.99
$69.99
accept 55 downloads in the last 7 days
block-screenshots
Fortinet FCP_FGT_AD-7.6 Practice Test 84

Question 830

A datacenter firewall forwards system events yet investigations lack accepted session records because logging is disabled on the rule permitting the application. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps.
  2. Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events.
  3. Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination.
  4. Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses.

Explanation

Correct Answer

A:

Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps. This distinguishes the relevant FortiGate device, session or controller evidence. A healthy route to FortiAnalyzer does not mean the device has been authorized, that the right log categories are enabled, or that records are arriving. The corresponding action is: Register FortiGate with the intended FortiAnalyzer instance, permit trusted management connectivity and enable logs on relevant policies and event categories before relying on central investigations. Scenario: A datacenter firewall forwards system events yet investigations lack accepted session records because logging is disabled on the rule permitting the application.

Incorrect Answers

B:

Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events. This diagnostic is related to Reserved HA management, monitoring and firmware upgrades rather than the controlling evidence for this scenario. Examine instead: Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps. Scenario: A datacenter firewall forwards system events yet investigations lack accepted session records because logging is disabled on the rule permitting the application.

C:

Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination. This diagnostic is related to Policy traffic log interpretation and diagnostic event filtering rather than the controlling evidence for this scenario. Examine instead: Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps. Scenario: A datacenter firewall forwards system events yet investigations lack accepted session records because logging is disabled on the rule permitting the application.

D:

Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses. This diagnostic is related to FortiGuard connectivity, registration and internal DHCP provisioning rather than the controlling evidence for this scenario. Examine instead: Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps. Scenario: A datacenter firewall forwards system events yet investigations lack accepted session records because logging is disabled on the rule permitting the application.

Question 831

An IPS sensor was carefully tuned but never attached to the outbound firewall policy, so known exploit requests pass without a matching IPS log. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Inspect the matched firewall policy, inspection mode, selected security profiles, SSL inspection profile, feature availability and UTM log records.
  2. Attach supported antivirus, web filter, IPS and application control profiles to the relevant FortiGate firewall policies using a compatible flow-based or proxy-based inspection mode.
  3. Compare collector monitored groups, AD membership, security identifier/group names, group refresh status, FortiGate group objects and policy group references.
  4. Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary.
  5. A valid user authenticates into the correct FortiGate user group while wrong passwords and unmapped groups are denied without bypass policies.

Explanation

Correct Answers

A:

Inspect the matched firewall policy, inspection mode, selected security profiles, SSL inspection profile, feature availability and UTM log records. This distinguishes the relevant FortiGate device, session or controller evidence. Security profiles take effect only when an appropriate policy matches and inspection requirements are met; a profile existing in the GUI does not make it globally active. The corresponding action is: Attach supported antivirus, web filter, IPS and application control profiles to the relevant FortiGate firewall policies using a compatible flow-based or proxy-based inspection mode. This is the verification portion of the required complementary pair. Scenario: An IPS sensor was carefully tuned but never attached to the outbound firewall policy, so known exploit requests pass without a matching IPS log.

B:

Attach supported antivirus, web filter, IPS and application control profiles to the relevant FortiGate firewall policies using a compatible flow-based or proxy-based inspection mode. This directly addresses the FortiOS configuration or response required by the case. Security profiles take effect only when an appropriate policy matches and inspection requirements are met; a profile existing in the GUI does not make it globally active. Verify with: Inspect the matched firewall policy, inspection mode, selected security profiles, SSL inspection profile, feature availability and UTM log records. This is the implementation portion of the required complementary pair. Scenario: An IPS sensor was carefully tuned but never attached to the outbound firewall policy, so known exploit requests pass without a matching IPS log.

Incorrect Answers

C:

Compare collector monitored groups, AD membership, security identifier/group names, group refresh status, FortiGate group objects and policy group references. This choice relates to FSSO group filters and AD membership reconciliation, not the complementary implementation-and-evidence pair for the case. Implement: Attach supported antivirus, web filter, IPS and application control profiles to the relevant FortiGate firewall policies using a compatible flow-based or proxy-based inspection mode. Check: Inspect the matched firewall policy, inspection mode, selected security profiles, SSL inspection profile, feature availability and UTM log records. Scenario: An IPS sensor was carefully tuned but never attached to the outbound firewall policy, so known exploit requests pass without a matching IPS log.

D:

Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. This choice relates to Firewall policy evaluation order, interfaces and least privilege, not the complementary implementation-and-evidence pair for the case. Implement: Attach supported antivirus, web filter, IPS and application control profiles to the relevant FortiGate firewall policies using a compatible flow-based or proxy-based inspection mode. Check: Inspect the matched firewall policy, inspection mode, selected security profiles, SSL inspection profile, feature availability and UTM log records. Scenario: An IPS sensor was carefully tuned but never attached to the outbound firewall policy, so known exploit requests pass without a matching IPS log.

E:

A valid user authenticates into the correct FortiGate user group while wrong passwords and unmapped groups are denied without bypass policies. This choice relates to LDAP remote user integration over trusted TLS, not the complementary implementation-and-evidence pair for the case. Implement: Attach supported antivirus, web filter, IPS and application control profiles to the relevant FortiGate firewall policies using a compatible flow-based or proxy-based inspection mode. Check: Inspect the matched firewall policy, inspection mode, selected security profiles, SSL inspection profile, feature availability and UTM log records. Scenario: An IPS sensor was carefully tuned but never attached to the outbound firewall policy, so known exploit requests pass without a matching IPS log.

Question 832

A web-filter policy blocks newly registered domains, but one business service uses a short-lived subdomain that requires a documented risk decision rather than a global allow. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Check application signature database freshness, policy ID, inspection profile, session protocol, application detection event and decryption scope.
  2. Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log.
  3. Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log.
  4. Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields.

Explanation

Correct Answer

C:

Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. This distinguishes the relevant FortiGate device, session or controller evidence. Category-based filtering is only as accurate as current rating data and profile ordering; an override for one domain can affect all paths hosted there. The corresponding action is: Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. Scenario: A web-filter policy blocks newly registered domains, but one business service uses a short-lived subdomain that requires a documented risk decision rather than a global allow.

Incorrect Answers

A:

Check application signature database freshness, policy ID, inspection profile, session protocol, application detection event and decryption scope. This diagnostic is related to Application control signature matching and required visibility rather than the controlling evidence for this scenario. Examine instead: Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. Scenario: A web-filter policy blocks newly registered domains, but one business service uses a short-lived subdomain that requires a documented risk decision rather than a global allow.

B:

Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. This diagnostic is related to Antivirus profile scanning modes and supported protocol boundaries rather than the controlling evidence for this scenario. Examine instead: Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. Scenario: A web-filter policy blocks newly registered domains, but one business service uses a short-lived subdomain that requires a documented risk decision rather than a global allow.

D:

Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. This diagnostic is related to HTTPS web filtering hostname limitations and logging rather than the controlling evidence for this scenario. Examine instead: Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. Scenario: A web-filter policy blocks newly registered domains, but one business service uses a short-lived subdomain that requires a documented risk decision rather than a global allow.

Question 833

After restoring the primary ISP, operators expect every established connection to jump instantly back to it, ignoring sticky-session and established-path behavior. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. The intended application follows the approved source-aware path without inadvertently diverting unrelated users or bypassing inspection policy.
  2. Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded.
  3. Traffic exits the intended interface through a reachable next hop and return connectivity works without a broader unapproved default route.
  4. An impaired member is correctly classified and a tested policy change restores traffic without hiding intermittent loss or creating new path asymmetry.

Explanation

Correct Answer

B:

Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded. This is the operational validation outcome rather than merely an enabled setting. A healthy member can still be chosen incorrectly because of service-rule ordering, and existing sessions may not instantly rebalance when a different member becomes optimal. Scenario: After restoring the primary ISP, operators expect every established connection to jump instantly back to it, ignoring sticky-session and established-path behavior.

Incorrect Answers

A:

The intended application follows the approved source-aware path without inadvertently diverting unrelated users or bypassing inspection policy. This result would test Policy routes versus destination routing and session steering but does not demonstrate the desired FortiGate outcome here. Verify instead: Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded. Scenario: After restoring the primary ISP, operators expect every established connection to jump instantly back to it, ignoring sticky-session and established-path behavior.

C:

Traffic exits the intended interface through a reachable next hop and return connectivity works without a broader unapproved default route. This result would test FortiGate static default routes and interface reachability but does not demonstrate the desired FortiGate outcome here. Verify instead: Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded. Scenario: After restoring the primary ISP, operators expect every established connection to jump instantly back to it, ignoring sticky-session and established-path behavior.

D:

An impaired member is correctly classified and a tested policy change restores traffic without hiding intermittent loss or creating new path asymmetry. This result would test SD-WAN diagnostics, route changes and link-quality evidence but does not demonstrate the desired FortiGate outcome here. Verify instead: Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded. Scenario: After restoring the primary ISP, operators expect every established connection to jump instantly back to it, ignoring sticky-session and established-path behavior.

Question 834

A mobile banking app stops connecting when deep inspection is enabled because it pins the origin certificate, and an administrator proposes exempting all HTTPS traffic. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log.
  2. Compare inspection sessions, CPU/memory usage, negotiated TLS or QUIC transport, certificate inspection logs, policy profile and any explicit protocol-control rule.
  3. Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors.
  4. Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception.

Explanation

Correct Answer

D:

Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception. This distinguishes the relevant FortiGate device, session or controller evidence. Broad category-level SSL exemptions can create large visibility gaps; an exception should be limited to the actual affected flow and justified by policy. The corresponding action is: Apply narrowly scoped, auditable SSL-inspection exclusions for supported certificate-pinned or regulated applications without disabling inspection for every other destination. Scenario: A mobile banking app stops connecting when deep inspection is enabled because it pins the origin certificate, and an administrator proposes exempting all HTTPS traffic.

Incorrect Answers

A:

Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. This diagnostic is related to Antivirus profile scanning modes and supported protocol boundaries rather than the controlling evidence for this scenario. Examine instead: Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception. Scenario: A mobile banking app stops connecting when deep inspection is enabled because it pins the origin certificate, and an administrator proposes exempting all HTTPS traffic.

B:

Compare inspection sessions, CPU/memory usage, negotiated TLS or QUIC transport, certificate inspection logs, policy profile and any explicit protocol-control rule. This diagnostic is related to SSL inspection resources and QUIC protocol behavior rather than the controlling evidence for this scenario. Examine instead: Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception. Scenario: A mobile banking app stops connecting when deep inspection is enabled because it pins the origin certificate, and an administrator proposes exempting all HTTPS traffic.

C:

Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors. This diagnostic is related to HTTPS malware scanning with controlled exception validation rather than the controlling evidence for this scenario. Examine instead: Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception. Scenario: A mobile banking app stops connecting when deep inspection is enabled because it pins the origin certificate, and an administrator proposes exempting all HTTPS traffic.

Question 835

An operations team searches only branch firewall logs during a remote user's blocked web request, overlooking the FortiSASE PoP event that actually applied the denial. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments.
  2. Onboard supported remote users and endpoints through FortiSASE identity enrollment and device posture policies, then apply least-privilege internet or private-application access rules.
  3. Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs.
  4. Validate the FortiSASE service edge, policy assignment, client route steering and logging for remote access and internet security scenarios before attributing every failure to FortiGate site firewall rules.
  5. Cloud resources are protected by the approved managed firewall service with visible policy hits and provider-cloud routing appropriate to that deployment model.

Explanation

Correct Answers

C:

Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs. This distinguishes the relevant FortiGate device, session or controller evidence. FortiSASE cloud inspection and a branch FortiGate security policy are distinct enforcement points; successful endpoint authentication alone does not prove traffic steering. The corresponding action is: Validate the FortiSASE service edge, policy assignment, client route steering and logging for remote access and internet security scenarios before attributing every failure to FortiGate site firewall rules. This is the verification portion of the required complementary pair. Scenario: An operations team searches only branch firewall logs during a remote user's blocked web request, overlooking the FortiSASE PoP event that actually applied the denial.

D:

Validate the FortiSASE service edge, policy assignment, client route steering and logging for remote access and internet security scenarios before attributing every failure to FortiGate site firewall rules. This directly addresses the FortiOS configuration or response required by the case. FortiSASE cloud inspection and a branch FortiGate security policy are distinct enforcement points; successful endpoint authentication alone does not prove traffic steering. Verify with: Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs. This is the implementation portion of the required complementary pair. Scenario: An operations team searches only branch firewall logs during a remote user's blocked web request, overlooking the FortiSASE PoP event that actually applied the denial.

Incorrect Answers

A:

Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments. This choice relates to FortiGate local log storage and reliable export, not the complementary implementation-and-evidence pair for the case. Implement: Validate the FortiSASE service edge, policy assignment, client route steering and logging for remote access and internet security scenarios before attributing every failure to FortiGate site firewall rules. Check: Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs. Scenario: An operations team searches only branch firewall logs during a remote user's blocked web request, overlooking the FortiSASE PoP event that actually applied the denial.

B:

Onboard supported remote users and endpoints through FortiSASE identity enrollment and device posture policies, then apply least-privilege internet or private-application access rules. This choice relates to FortiSASE endpoint onboarding and identity-bound access, not the complementary implementation-and-evidence pair for the case. Implement: Validate the FortiSASE service edge, policy assignment, client route steering and logging for remote access and internet security scenarios before attributing every failure to FortiGate site firewall rules. Check: Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs. Scenario: An operations team searches only branch firewall logs during a remote user's blocked web request, overlooking the FortiSASE PoP event that actually applied the denial.

E:

Cloud resources are protected by the approved managed firewall service with visible policy hits and provider-cloud routing appropriate to that deployment model. This choice relates to FortiGate cloud-native firewall CNF service responsibility, not the complementary implementation-and-evidence pair for the case. Implement: Validate the FortiSASE service edge, policy assignment, client route steering and logging for remote access and internet security scenarios before attributing every failure to FortiGate site firewall rules. Check: Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs. Scenario: An operations team searches only branch firewall logs during a remote user's blocked web request, overlooking the FortiSASE PoP event that actually applied the denial.

Question 836

Remote users can browse public web sites through FortiSASE but receive denial on a sensitive internal finance application because the assigned group lacks private access rules. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect user group mapping, SSO state, endpoint registration, FortiClient agent status, posture checks, FortiSASE portal permissions and applied access policy.
  2. Examine diagnose sys top or equivalent supported process views, CPU load by core, session throughput, UTM process consumption, interrupts and incident timestamps.
  3. Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs.
  4. Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps.

Explanation

Correct Answer

A:

Inspect user group mapping, SSO state, endpoint registration, FortiClient agent status, posture checks, FortiSASE portal permissions and applied access policy. This distinguishes the relevant FortiGate device, session or controller evidence. An internet connection from the user is not equivalent to successful FortiSASE enrollment or private-app authorization, and endpoint posture must be evaluated separately from username. The corresponding action is: Onboard supported remote users and endpoints through FortiSASE identity enrollment and device posture policies, then apply least-privilege internet or private-application access rules. Scenario: Remote users can browse public web sites through FortiSASE but receive denial on a sensitive internal finance application because the assigned group lacks private access rules.

Incorrect Answers

B:

Examine diagnose sys top or equivalent supported process views, CPU load by core, session throughput, UTM process consumption, interrupts and incident timestamps. This diagnostic is related to CPU process health and abnormal-load troubleshooting rather than the controlling evidence for this scenario. Examine instead: Inspect user group mapping, SSO state, endpoint registration, FortiClient agent status, posture checks, FortiSASE portal permissions and applied access policy. Scenario: Remote users can browse public web sites through FortiSASE but receive denial on a sensitive internal finance application because the assigned group lacks private access rules.

C:

Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs. This diagnostic is related to FortiSASE PoP policy steering and remote diagnostics rather than the controlling evidence for this scenario. Examine instead: Inspect user group mapping, SSO state, endpoint registration, FortiClient agent status, posture checks, FortiSASE portal permissions and applied access policy. Scenario: Remote users can browse public web sites through FortiSASE but receive denial on a sensitive internal finance application because the assigned group lacks private access rules.

D:

Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps. This diagnostic is related to FortiAnalyzer registration and centralized log forwarding rather than the controlling evidence for this scenario. Examine instead: Inspect user group mapping, SSO state, endpoint registration, FortiClient agent status, posture checks, FortiSASE portal permissions and applied access policy. Scenario: Remote users can browse public web sites through FortiSASE but receive denial on a sensitive internal finance application because the assigned group lacks private access rules.

Question 837

After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Use a supported FortiGate captive portal or identity-aware authentication policy to identify users before applying restricted network access, testing redirection and session lifetime.
  2. Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints.
  3. Attach supported antivirus, web filter, IPS and application control profiles to the relevant FortiGate firewall policies using a compatible flow-based or proxy-based inspection mode.
  4. Connect FortiGate to the intended LDAP directory over a verified encrypted transport, with correct base DN, bind account and group mappings for firewall authentication.

Explanation

Correct Answer

A:

Use a supported FortiGate captive portal or identity-aware authentication policy to identify users before applying restricted network access, testing redirection and session lifetime. This directly addresses the FortiOS configuration or response required by the case. A captive portal requires appropriate traffic interception, browser/TLS behavior and a valid identity mapping; it is not activated merely by naming a user group in a firewall address object. Verify with: Inspect authentication rule order, captive portal URL and certificate, user group, browser redirect behavior, session authentication list and logout/timeout timestamps. Scenario: After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration.

Incorrect Answers

B:

Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. This addresses VIP destination NAT and published server policies, but not the principal task of the described flow. Creating a VIP object alone does not allow traffic; a corresponding firewall policy, correct port mapping and valid server route are required. The better fit is: Use a supported FortiGate captive portal or identity-aware authentication policy to identify users before applying restricted network access, testing redirection and session lifetime. Scenario: After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration.

C:

Attach supported antivirus, web filter, IPS and application control profiles to the relevant FortiGate firewall policies using a compatible flow-based or proxy-based inspection mode. This addresses Security profiles and flow versus proxy inspection boundaries, but not the principal task of the described flow. Security profiles take effect only when an appropriate policy matches and inspection requirements are met; a profile existing in the GUI does not make it globally active. The better fit is: Use a supported FortiGate captive portal or identity-aware authentication policy to identify users before applying restricted network access, testing redirection and session lifetime. Scenario: After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration.

D:

Connect FortiGate to the intended LDAP directory over a verified encrypted transport, with correct base DN, bind account and group mappings for firewall authentication. This addresses LDAP remote user integration over trusted TLS, but not the principal task of the described flow. A successful TCP connection to a directory server does not establish that LDAP bind identity, group lookup or TLS certificate validation is correct. The better fit is: Use a supported FortiGate captive portal or identity-aware authentication policy to identify users before applying restricted network access, testing redirection and session lifetime. Scenario: After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration.

Question 838

A retail kiosk obtains a new public IP every week and its central FortiGate VPN fails because the gateway is configured as a fixed address. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile.
  2. Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs.
  3. Diagnose FortiOS IPsec connectivity by separating interface transport, IKE Phase 1 authentication, Phase 2 negotiation, routed packet selection and firewall policy outcomes.
  4. Review policy flow/proxy mode, web filter profile, SSL inspection depth, web request metadata, FortiGuard rating and matching event logs.
  5. The desired category or hostname restriction is enforced where supported and any path-based policy explicitly requires appropriate decrypting inspection.

Explanation

Correct Answers

A:

Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. This directly addresses the FortiOS configuration or response required by the case. A static remote-gateway configuration is brittle for dynamic branch addressing; accepting arbitrary peer identities weakens site-to-site VPN authentication. Verify with: Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. This is the implementation portion of the required complementary pair. Scenario: A retail kiosk obtains a new public IP every week and its central FortiGate VPN fails because the gateway is configured as a fixed address.

B:

Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. This distinguishes the relevant FortiGate device, session or controller evidence. A static remote-gateway configuration is brittle for dynamic branch addressing; accepting arbitrary peer identities weakens site-to-site VPN authentication. The corresponding action is: Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. This is the verification portion of the required complementary pair. Scenario: A retail kiosk obtains a new public IP every week and its central FortiGate VPN fails because the gateway is configured as a fixed address.

Incorrect Answers

C:

Diagnose FortiOS IPsec connectivity by separating interface transport, IKE Phase 1 authentication, Phase 2 negotiation, routed packet selection and firewall policy outcomes. This choice relates to IKE and IPsec debug evidence for Phase 1 versus child-SA failures, not the complementary implementation-and-evidence pair for the case. Implement: Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. Check: Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. Scenario: A retail kiosk obtains a new public IP every week and its central FortiGate VPN fails because the gateway is configured as a fixed address.

D:

Review policy flow/proxy mode, web filter profile, SSL inspection depth, web request metadata, FortiGuard rating and matching event logs. This choice relates to Flow-based versus proxy-based web filter enforcement, not the complementary implementation-and-evidence pair for the case. Implement: Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. Check: Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. Scenario: A retail kiosk obtains a new public IP every week and its central FortiGate VPN fails because the gateway is configured as a fixed address.

E:

The desired category or hostname restriction is enforced where supported and any path-based policy explicitly requires appropriate decrypting inspection. This choice relates to HTTPS web filtering hostname limitations and logging, not the complementary implementation-and-evidence pair for the case. Implement: Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. Check: Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. Scenario: A retail kiosk obtains a new public IP every week and its central FortiGate VPN fails because the gateway is configured as a fixed address.

Question 839

A branch FortiGate cannot map employees to groups after a domain controller replacement because the FSSO collector still polls the retired controller address. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Map the intended AD security groups through FSSO collector group filters and FortiGate firewall user groups, checking nested membership and current event identity.
  2. Inspect the matched firewall policy, inspection mode, selected security profiles, SSL inspection profile, feature availability and UTM log records.
  3. Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state.
  4. Unauthenticated clients encounter the intended portal or deny behavior and authenticated users reach only their approved resources.
  5. Deploy and validate a supported Fortinet Single Sign-On collector and domain-controller event source, ensuring logon events reach the correct FortiGate connector.

Explanation

Correct Answers

C:

Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state. This distinguishes the relevant FortiGate device, session or controller evidence. FSSO identifies users from login events rather than interrogating the user at every new TCP connection; a broken collector can leave stale or missing identities. The corresponding action is: Deploy and validate a supported Fortinet Single Sign-On collector and domain-controller event source, ensuring logon events reach the correct FortiGate connector. This is the verification portion of the required complementary pair. Scenario: A branch FortiGate cannot map employees to groups after a domain controller replacement because the FSSO collector still polls the retired controller address.

E:

Deploy and validate a supported Fortinet Single Sign-On collector and domain-controller event source, ensuring logon events reach the correct FortiGate connector. This directly addresses the FortiOS configuration or response required by the case. FSSO identifies users from login events rather than interrogating the user at every new TCP connection; a broken collector can leave stale or missing identities. Verify with: Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state. This is the implementation portion of the required complementary pair. Scenario: A branch FortiGate cannot map employees to groups after a domain controller replacement because the FSSO collector still polls the retired controller address.

Incorrect Answers

A:

Map the intended AD security groups through FSSO collector group filters and FortiGate firewall user groups, checking nested membership and current event identity. This choice relates to FSSO group filters and AD membership reconciliation, not the complementary implementation-and-evidence pair for the case. Implement: Deploy and validate a supported Fortinet Single Sign-On collector and domain-controller event source, ensuring logon events reach the correct FortiGate connector. Check: Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state. Scenario: A branch FortiGate cannot map employees to groups after a domain controller replacement because the FSSO collector still polls the retired controller address.

B:

Inspect the matched firewall policy, inspection mode, selected security profiles, SSL inspection profile, feature availability and UTM log records. This choice relates to Security profiles and flow versus proxy inspection boundaries, not the complementary implementation-and-evidence pair for the case. Implement: Deploy and validate a supported Fortinet Single Sign-On collector and domain-controller event source, ensuring logon events reach the correct FortiGate connector. Check: Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state. Scenario: A branch FortiGate cannot map employees to groups after a domain controller replacement because the FSSO collector still polls the retired controller address.

D:

Unauthenticated clients encounter the intended portal or deny behavior and authenticated users reach only their approved resources. This choice relates to Captive portal and explicit firewall user authentication, not the complementary implementation-and-evidence pair for the case. Implement: Deploy and validate a supported Fortinet Single Sign-On collector and domain-controller event source, ensuring logon events reach the correct FortiGate connector. Check: Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state. Scenario: A branch FortiGate cannot map employees to groups after a domain controller replacement because the FSSO collector still polls the retired controller address.

Question 840

An operations team searches only branch firewall logs during a remote user's blocked web request, overlooking the FortiSASE PoP event that actually applied the denial. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. Only appropriately enrolled and authenticated endpoints reach approved applications, with denied or noncompliant clients producing interpretable policy evidence.
  2. Important traffic and security logs persist for the required investigation period and missing or delayed export produces observable alerts.
  3. Remote clients use the intended FortiSASE security edge and authorized private resources consistently, with failed policy or connector conditions visible to operations.
  4. Approved administrators reach only the designated management address and untrusted source hosts cannot open the management service.

Explanation

Correct Answer

C:

Remote clients use the intended FortiSASE security edge and authorized private resources consistently, with failed policy or connector conditions visible to operations. This is the operational validation outcome rather than merely an enabled setting. FortiSASE cloud inspection and a branch FortiGate security policy are distinct enforcement points; successful endpoint authentication alone does not prove traffic steering. Scenario: An operations team searches only branch firewall logs during a remote user's blocked web request, overlooking the FortiSASE PoP event that actually applied the denial.

Incorrect Answers

A:

Only appropriately enrolled and authenticated endpoints reach approved applications, with denied or noncompliant clients producing interpretable policy evidence. This result would test FortiSASE endpoint onboarding and identity-bound access but does not demonstrate the desired FortiGate outcome here. Verify instead: Remote clients use the intended FortiSASE security edge and authorized private resources consistently, with failed policy or connector conditions visible to operations. Scenario: An operations team searches only branch firewall logs during a remote user's blocked web request, overlooking the FortiSASE PoP event that actually applied the denial.

B:

Important traffic and security logs persist for the required investigation period and missing or delayed export produces observable alerts. This result would test FortiGate local log storage and reliable export but does not demonstrate the desired FortiGate outcome here. Verify instead: Remote clients use the intended FortiSASE security edge and authorized private resources consistently, with failed policy or connector conditions visible to operations. Scenario: An operations team searches only branch firewall logs during a remote user's blocked web request, overlooking the FortiSASE PoP event that actually applied the denial.

D:

Approved administrators reach only the designated management address and untrusted source hosts cannot open the management service. This result would test FortiGate administrator access and trusted management surfaces but does not demonstrate the desired FortiGate outcome here. Verify instead: Remote clients use the intended FortiSASE security edge and authorized private resources consistently, with failed policy or connector conditions visible to operations. Scenario: An operations team searches only branch firewall logs during a remote user's blocked web request, overlooking the FortiSASE PoP event that actually applied the denial.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests