FCP_FGT_AD-7.6 Braindumps Real Exam Updated on Jun 04, 2026 with 129 Questions
Latest FCP_FGT_AD-7.6 PDF Dumps & Real Tests Free Updated Today
Fortinet FCP_FGT_AD-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 42
Which three statements about SD-WAN performance SLAs are true? (Choose three.)
- A. They rely on session loss and jitter.
- B. They can be measured actively or passively.
- C. They are applied in a SD-WAN rule lowest cost strategy.
- D. All the SLAtargets can be configured.
- E. They monitor the state of the FortiGate device.
Answer: A,B,D
Explanation:
SD-WAN SLAs monitor metrics like packet loss and jitter to evaluate link performance. SLA measurements can be performed using active probing or passive monitoring. Administrators can configure all SLA target parameters to define performance criteria.
NEW QUESTION # 43
Refer to the exhibit. Which two statements about the FortiGuard connection are true? (Choose two.)
- A. FortiGate is using the default port for FortiGuard communication.
- B. FortiGate identified the FortiGuard Server using DNS lookup.
- C. You can configure unreliable protocols to communicate with FortiGuard Server.
- D. The weight increases as the number of failed packets rises.
Answer: B,D
Explanation:
FortiGate identified the FortiGuard Server using DNS lookup → The server is shown with a private IP (10.0.1.241), which indicates FortiGate resolved it via DNS or explicit override rather than using default FortiGuard anycast servers.
The weight value reflects server reliability. It decreases with good performance and increases as packet loss or failures rise, meaning higher weight indicates more failures.
NEW QUESTION # 44
Refer to the exhibits.
An administrator has observed the performance status outputs on an HA cluster for 55 seconds.
Which FortiGate is the primary?
- A. HQ-NGFW-2 with the parameter memory-failover-threshold setting
- B. HQ-NGFW-1 with the parameter override setting
- C. HQ-NGFW-2 with the parameter priority setting
- D. HQ-NGFW-1 with the parameter memory-failover-flip-timeout setting
Answer: B
Explanation:
The HA configuration shows that override is disabled (set override disable), but despite this, HQ-NGFW-1 has the higher priority (200) and is acting as the primary, as indicated by its higher resource usage and uptime.
Override allows the device with higher priority to take over as primary, so HQ-NGFW-1 is the primary device.
NEW QUESTION # 45
An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is no inbound traffic.
Which DPD mode on FortiGate meets this requirement?
- A. On Demand
- B. On Idle
- C. Disabled
- D. Enabled
Answer: D
Explanation:
The "On Idle" DPD mode configures FortiGate to send DPD probes only when no inbound traffic is detected, meeting the requirement to send probes only when the tunnel is idle.
NEW QUESTION # 46
Refer to the exhibits. The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.
The WAN (port2) interface has the IP address 100.65.0.101/24. The LAN (port4) interface has the IP address 10.0.11.254/24. Which IP address will be used to source NAT (SNAT) the traffic, if the user on HQ-PC-1 (10.0.11.50) pings the IP address of BR-FGT (100.65.1.111)
- A. 100.65.0.99
- B. 100.65.0.101
- C. 100.65.0.49
- D. 100.65.0.149
Answer: A
Explanation:
The ping traffic policy uses the IP pool named SNAT-Remote1, which has the external IP range
100.65.0.99. Therefore, traffic matching this policy (ping from HQ-PC-1 to BR1-FGT) will use
100.65.0.99 for source NAT.
NEW QUESTION # 47
Which two statements are true regarding FortiGate HA configuration synchronization? (Choose two.)
- A. Incremental configuration synchronization can occur from changes made on any FortiGate device within the HA cluster.
- B. Checksums of devices are compared against each other to ensure configurations are the same.
- C. Checksums of devices will be different from each other because some configuration items are not synced to other HA members.
- D. Incremental configuration synchronization can occur only from changes made on the primary FortiGate device.
Answer: B,D
Explanation:
In FortiGate HA (High Availability) configuration, checksums of device configurations are compared to ensure they are synchronized and identical across the cluster. Incremental synchronization can only happen from changes made on the primary device to ensure consistency and integrity across the cluster members.
Changes made on non-primary devices do not initiate synchronization.
NEW QUESTION # 48
Which two statements describe how the RPF check is used? (Choose two.)
- A. The RPF check is run on the first sent packet of any new session.
- B. The RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks.
- C. The RPF check is run on the first sent and reply packet of any new session.
- D. The RPF check is run on the first reply packet of any new session.
Answer: A,B
Explanation:
The RPF (Reverse Path Forwarding) check is used to prevent IP spoofing attacks by verifying that the source IP address of a received packet is reachable through the same interface it arrived on. If not, the packet is dropped, ensuring traffic legitimacy.
The RPF check runs on the first sent packet of any new session to validate that the route to the source IP is consistent with the interface it's received on. This helps FortiGate detect spoofed or asymmetric routing scenarios early in the session establishment.
NEW QUESTION # 49
Refer to the exhibits. The exhibits show the system performance output and default configuration of high memory usage thresholds on a FortiGate device.
Based on the system performance output, what are the two possible outcomes? (Choose two.)
- A. Administrators can change the configuration.
- B. FortiGate has entered conserve mode.
- C. Administrators can access FortiGate only through the console port.
- D. FortiGate drops new sessions.
Answer: B,D
NEW QUESTION # 50
Refer to the exhibits.
The exhibits show a diagram of a FortiGate device connected to the network, as well as the firewall policy and IP pool configuration on the FortiGate device.
Two PCs, PC1 and PC2, are connected behind FortiGate and can access the internet successfully. However, when the administrator adds a third PC to the network (PC3), the PC cannot connect to the internet.
Based on the information shown in the exhibit, which two configuration options can the administrator use to fix the connectivity issue for PC3? (Choose two.)
- A. In the IP pool configuration, set endipto 192.2.0.12.
- B. Configure another firewall policy that matches only the address of PC3 as source, and then place the policy on top of the list.
- C. In the firewall policy configuration, add 10.0.1.3as an address object in the source field.
- D. In the IP pool configuration, set typeto overload.
Answer: A,D
Explanation:
With IP pool type set to One-to-One, only as many internal hosts as there are public IPs in the pool (192.2.0.10-192.2.0.11) can use NAT. Changing the type to overload allows all internal hosts (including PC3) to share the available public IPs, so PC3 can reach the internet.
Alternatively, keeping One-to-One but extending the pool to 192.2.0.10-192.2.0.12 adds another public IP, allowing a third internal host (PC3) to be mapped and gain internet access.
NEW QUESTION # 51
What is the primary FortiGate election process when the HA override setting is enabled?
- A. Connected monitored ports > Priority > System uptime > FortiGate serial number
- B. Connected monitored ports > Priority > HA uptime > FortiGate serial number
- C. Connected monitored ports > HA uptime > Priority > FortiGate serial number
- D. Connected monitored ports > System uptime > Priority > FortiGate serial number
Answer: B
Explanation:
If Override DISABLED then: ports > HA Uptime > Priority > SN.
If Overrrid ENABLED then: ports > Priority > HA Uptime > SN.
NEW QUESTION # 52
Refer to the exhibit.
As an administrator you have created an IPS profile, but it is not performing as expected. While testing you got the output as shown in the exhibit.
What could be the possible reason of the diagnose output shown in the exhibit?
- A. Administrator entered the command diagnose test application ipsmonitor 99.
- B. FortiGate entered into IPS fail open state.
- C. Administrator entered the command diagnose test application ipsmonitor 5.
- D. There is a no firewall policy configured with an IPS security profile.
Answer: D
Explanation:
The output shows the IPS engine count as 0, indicating no active IPS engines are running. This typically means no firewall policy is referencing the IPS security profile, so the IPS profile is not being applied or triggered.
NEW QUESTION # 53
Refer to the exhibit.
Which two statements are true about the routing entries in this database table? (Choose two.)
- A. All of the entries in the routing database table are installed in the FortiGate routing table.
- B. The default route on port2 is marked as the standby route.
- C. Both default routes have different administrative distances.
- D. The port2 interface is marked as inactive.
Answer: B,C
Explanation:
The routing table in the exhibit shows two default routes (0.0.0.0/0) with different administrative distances:
* The default route through port2 has an administrative distance of 20.
* The default route through port1 has an administrative distance of 10.
Administrative distance determines the priority of the route; a lower value is preferred. Here, the route through port1 with an administrative distance of 10 is the preferred route. The route through port2 with an administrative distance of 20 acts as a standby or backup route. If the primary route (port1) fails or is unavailable, traffic will then be routed through port2.
Regarding the statement that the port2 interface is marked as inactive, there is no indication in the routing table that port2 is inactive. Similarly, all the routes displayed are not necessarily installed in the FortiGate routing table, as the table could include both active and backup routes.
References:
FortiOS 7.4.1 Administration Guide: Default route configuration
FortiOS 7.4.1 Administration Guide: Routing table explanation
NEW QUESTION # 54
Refer to the exhibit.
Based on this partial configuration, what are the two possible outcomes when FortiGate enters conserve mode? (Choose two.)
- A. Administrators must restart FortiGate to allow new session.
- B. Administrators cannot change the configuration.
- C. FortiGate skips quarantine actions.
- D. FortiGate drops new sessions requiring inspection.
Answer: C,D
Explanation:
In fail-open mode, FortiGate skips quarantine actions to maintain traffic flow despite IPS or antivirus failures.
FortiGate drops new sessions that require inspection when in conserve mode and fail-open is enabled, to protect the network from potentially harmful traffic.
NEW QUESTION # 55
Refer to the exhibit.
An administrator has configured an Application Overrides for the ABC.Com application signature and set the Action to Allow. This application control profile is then applied to a firewall policy that is scanning all outbound traffic. Logging is enabled in the firewall policy. To test the configuration, the administrator accessed the ABC.Com web site several times.
Why are there no logs generated under security logs for ABC.Com?
- A. The ABC.Com is hitting the category Excessive-Bandwidth.
- B. The ABC.Com Action is set to Allow.
- C. The ABC.Com Type is set as Application instead of Filter.
- D. The ABC.Com is configured under application profile, which must be configured as a web filter profile.
Answer: B
Explanation:
When the action is set to Allow in an application override, traffic matching this override is allowed without generating security logs because it bypasses deeper inspection and blocking.
NEW QUESTION # 56
A network administrator is configuring an IPsec VPN tunnel for a sales employee travelling abroad.
Which IPsec Wizard template must the administrator apply?
- A. Site to Site
- B. Hub-and-Spoke
- C. Remote Access
- D. Dial up User
Answer: C
Explanation:
The Remote Access IPsec Wizard template is used for individual users connecting from remote locations, such as traveling employees. This template configures FortiGate to act as an IPsec VPN server, allowing remote clients (like FortiClient) to securely connect and access internal network resources while abroad.
NEW QUESTION # 57
What are two features of collector agent advanced mode? (Choose two.)
- A. Advanced mode uses the Windows convention - NetBios: Domain\Username.
- B. In advanced mode, security profiles can be applied only to user groups, not individual users.
- C. Advanced mode supports nested or inherited groups.
- D. In advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.
Answer: C,D
Explanation:
Advanced mode supports nested or inherited groups, allowing FortiGate to recognize users that belong to subgroups within AD.
In advanced mode, FortiGate can be configured as an LDAP client and apply group filters, giving more granular control over user authentication and authorization.
NEW QUESTION # 58
What are two features of FortiGate FSSO agentless polling mode? (Choose two.)
- A. FortiGate uses the SMB protocol to read the event viewer logs from the DCs.
- B. FortiGate does not support workstation check.
- C. FortiGate uses the AD server as the collector agent.
- D. FortiGate directs the collector agent to use a remote LDAP server.
Answer: A,B
NEW QUESTION # 59
Refer to the exhibit.
What would be the impact of these settings on the Server certificate SNI check configuration on FortiGate?
- A. FortiGate will accept the connection with a warning if the SNI does not match the CN or SAN fields.
- B. FortiGate will close the connection if the SNI does not match the CN or SAN fields.
- C. FortiGate will close the connection if the SNI does not match the CN and SAN fields
- D. FortiGate will accept and use the CN in the server certificate for URL filtering if the SNI does not match the CN or SAN fields.
Answer: C
Explanation:
With the Server certificate SNI check set to Strict, FortiGate enforces that the SNI must match either the Common Name (CN) or Subject Alternative Name (SAN) in the server certificate; otherwise, it closes the connection.
NEW QUESTION # 60
Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)
- A. The serial number in the server certificate.
- B. The server name indication (SNI) extension in the client hello message.
- C. The subject field in the server certificate.
- D. The subject alternative name (SAN) field in the server certificate.
- E. The host field in the HTTP header.
Answer: B,C,D
Explanation:
When SSL certificate inspection is enabled on a FortiGate device, the system uses the following three pieces of information to identify the hostname of the SSL server:
* Server Name Indication (SNI) extension in the client hello message (B): The SNI is an extension in the client hello message of the SSL/TLS protocol. It indicates the hostname the client is attempting to connect to. This allows FortiGate to identify the server's hostname during the SSL handshake.
* Subject Alternative Name (SAN) field in the server certificate (C): The SAN field in the server certificate lists additional hostnames or IP addresses that the certificate is valid for. FortiGate inspects this field to confirm the identity of the server.
* Subject field in the server certificate (D): The Subject field contains the primary hostname or domain name for which the certificate was issued. FortiGate uses this information to match and validate the server's identity during SSL certificate inspection.
The other options are not used in SSL certificate inspection for hostname identification:
* Host field in the HTTP header (A): This is part of the HTTP request, not the SSL handshake, and is not used for SSL certificate inspection.
* Serial number in the server certificate (E): The serial number is used for certificate management and revocation, not for hostname identification.
References
* FortiOS 7.4.1 Administration Guide - SSL/SSH Inspection, page 1802.
* FortiOS 7.4.1 Administration Guide - Configuring SSL/SSH Inspection Profile, page 1799.
NEW QUESTION # 61
......
FCP_FGT_AD-7.6 Dumps With 100% Verified Q&As - Pass Guarantee or Full Refund: https://www.troytecdumps.com/FCP_FGT_AD-7.6-troytec-exam-dumps.html
Pass Fortinet FCP_FGT_AD-7.6 Exam With Practice Test Questions Dumps Bundle: https://drive.google.com/open?id=1V3IPyG37XM8VfU0flUa59xUQQc_k23bQ