Real FCP_FGT_AD-7.6 dumps - Real Fortinet dumps PDF in here [Mar-2026]
Realistic ExamPrepAway FCP_FGT_AD-7.6 Dumps PDF - 100% Passing Guarantee
Fortinet FCP_FGT_AD-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 17
Refer to the exhibits.
An administrator has observed the performance status outputs on an HA cluster for 55 seconds.
Which FortiGate is the primary?
- A. HQ-NGFW-2 with the parameter memory-failover-threshold setting
- B. HQ-NGFW-1 with the parameter memory-failover-flip-timeout setting
- C. HQ-NGFW-2 with the parameter priority setting
- D. HQ-NGFW-1 with the parameter override setting
Answer: D
Explanation:
The HA configuration shows that override is disabled (set override disable), but despite this, HQ-NGFW-1 has the higher priority (200) and is acting as the primary, as indicated by its higher resource usage and uptime. Override allows the device with higher priority to take over as primary, so HQ-NGFW-1 is the primary device.
NEW QUESTION # 18
Refer to the exhibits.
The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration.
An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2.
The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver.
Which additional configuration can the administrator add to a deny firewall policy, beyond the default behavior, to block Remote-User2 from accessing the Webserver?
- A. Set the Destination address as Deny_IP in the Allow_access policy.
- B. Disable match-vip in the Allow_access policy
- C. Configure a One-to-One IP Pool object in a new policy.
- D. Set the Destination address as Webserver in the Deny policy.
Answer: D
Explanation:
To block Remote-User2's access to the Webserver, the deny policy must explicitly specify the Webserver as the destination address; otherwise, it denies traffic to all destinations, which is not the desired behavior.
NEW QUESTION # 19
Refer to the exhibit, which contains a RADIUS server configuration.
An administrator added a configuration for a new RADIUS server. While configuring, the administrator enabled Include in every user group.
What is the impact of enabling Include in every user group in a RADIUS configuration?
- A. This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.
- B. This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.
- C. This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.
- D. This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.
Answer: C
Explanation:
Enabling Include in every user group in the RADIUS configuration means the RADIUS server is automatically added to all FortiGate user groups. As a result, any user who can authenticate successfully against that RADIUS server becomes a member of every FortiGate user group, without needing to be manually assigned. This can inadvertently grant excessive access if not carefully controlled.
NEW QUESTION # 20
Refer to the exhibits. An administrator has observed the performance status outputs on an HA cluster for 55 seconds.
Which FortiGate is the primary?
- A. HQ-NGFW-2 with the parameter memory-failover-threshold setting
- B. HQ-NGFW-1 with the parameter memory-failover-flip-timeout setting
- C. HQ-NGFW-2 with the parameter priority setting
- D. HQ-NGFW-1 with the parameter override setting
Answer: D
Explanation:
The HA configuration shows that override is disabled (set override disable), but despite this, HQ- NGFW-1 has the higher priority (200) and is acting as the primary, as indicated by its higher resource usage and uptime. Override allows the device with higher priority to take over as primary, so HQ- NGFW-1 is the primary device.
NEW QUESTION # 21
Refer to the exhibits.
The exhibits show the system performance output and default configuration of high memory usage thresholds on a FortiGate device.
Based on the system performance output, what are the two possible outcomes? (Choose two.)
- A. Administrators can change the configuration.
- B. FortiGate drops new sessions.
- C. FortiGate has entered conserve mode.
- D. Administrators can access FortiGate only through the console port.
Answer: A,B
Explanation:
Since memory usage is at 90%, exceeding the red threshold (88%), FortiGate enters a state where configuration changes are still allowed.
In this state, FortiGate drops new sessions to preserve resources and maintain stability.
NEW QUESTION # 22
Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)
- A. The server name indication (SNI) extension in the client hello message.
- B. The host field in the HTTP header.
- C. The subject field in the server certificate.
- D. The subject alternative name (SAN) field in the server certificate.
- E. The serial number in the server certificate.
Answer: A,C,D
Explanation:
When using SSL certificate inspection, FortiGate is not decrypting the traffic. During the exchange of hello messages at the beginning of an SSL handshake, FortiGate parses the server name indication (SNI) from client Hello, which is an extension of the TLS protocol. The SNI tells FortiGate the hostname of the SSL server, which is validated against the DNS name before receipt of the server certificate. If there is no SNI exchanged, then FortiGate identifies the server by the value in the server by the value in the Subject field or SAN (Subject Alternative Name) field in the server certificate.
NEW QUESTION # 23
An administrator manages a FortiGate model that supports NTurbo.
How does NTurbo enhance performance for flow-based inspection?
- A. NTurbo creates two inspection sessions on the FortiGate device.
- B. NTurbo offloads traffic to the content processor.
- C. NTurbo creates a special data path to redirect traffic between the IPS engine its ingress and egress interfaces.
- D. NTurbo buffers the whole file and then sends it to the antivirus engine.
Answer: C
Explanation:
NTurbo enhances flow-based inspection performance by creating a fast data path between the IPS engine and the ingress/egress interfaces. This allows traffic to be inspected efficiently without needing to pass through the slower, traditional packet path, thus reducing CPU load and improving throughput during flow-based security inspections.
NEW QUESTION # 24
Which method allows management access to the FortiGate CLI without network connectivity?
- A. CLI console widget
- B. SSH console
- C. Serial console
- D. Telnet console
Answer: C
Explanation:
The serial console provides direct physical access to the FortiGate CLI without requiring any network connectivity. It connects via the FortiGate's console port using a serial cable, allowing administrators to perform initial configuration, recovery, or troubleshooting even if the network interfaces are down or misconfigured.
NEW QUESTION # 25
When configuring firewall policies which of the following is true regarding the policy ID?
- A. You can create a policy in CLI with policy ID 0.
- B. A firewall policy ID identifies the order of policy execution in firewall policies.
- C. It is mandatory to provide a policy ID while creating a firewall policy regardless of GUI or CLI.
- D. A policy ID cannot be edited once a policy is created.
Answer: D
Explanation:
Once a firewall policy is created, its policy ID is fixed and cannot be changed; this ID uniquely identifies the policy within the FortiGate configuration.
NEW QUESTION # 26
Which three statements about SD-WAN performance SLAs are true? (Choose three.)
- A. They monitor the state of the FortiGate device.
- B. They rely on session loss and jitter.
- C. They are applied in a SD-WAN rule lowest cost strategy.
- D. They can be measured actively or passively.
- E. All the SLAtargets can be configured.
Answer: B,D,E
Explanation:
SD-WAN SLAs monitor metrics like packet loss and jitter to evaluate link performance. SLA measurements can be performed using active probing or passive monitoring. Administrators can configure all SLA target parameters to define performance criteria.
NEW QUESTION # 27
You have configured an application control profile, set peer-to-peer traffic to Block under the Categories tab, and applied it to the firewall policy. However, your peer-to-peer traffic on known ports is passing through the FortiGate without being blocked.
What FortiGate settings should you check to resolve this issue?
- A. Application and Filter Overrides
- B. Network Protocol Enforcement
- C. Replacement Messages for UDP-based Applications
- D. FortiGuard category ratings
Answer: B
Explanation:
Network Protocol Enforcement settings control how FortiGate inspects and enforces protocols on traffic, including peer-to-peer applications on known ports. If not properly enabled, peer-to-peer traffic may bypass blocking despite the application control profile.
NEW QUESTION # 28
Which three statements explain a flow-based antivirus profile? (Choose three.)
- A. Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.
- B. FortiGate buffers the whole file but transmits to the client at the same time.
- C. Flow-based inspection optimizes performance compared to proxy-based inspection.
- D. The IPS engine handles the process as a standalone.
- E. If a virus is detected, the last packet is delivered to the client.
Answer: A,B,C
Explanation:
Flow-based antivirus buffers the entire file while simultaneously transmitting data to the client to minimize latency.
Flow-based inspection combines multiple scanning techniques from proxy-based modes for efficient detection.
Flow-based inspection provides better performance by processing traffic on the fly without full proxy overhead.
NEW QUESTION # 29
Refer to the exhibits.
An administrator configured both members of an HA cluster at the same time. After one week of monitoring, the administrator wants to verify the HA failover performance.
How can the administrator force a failover?
- A. The administrator must set the monitored port to down on HQ-NGFW-1.
- B. The administrator must reset the HA uptime on HQ-NGFW-1.
- C. The administrator must increase the HA priority on HQ-NGFW-2.
- D. The administrator must set the parameter override to enable on HQ-NGFW-2.
Answer: B
NEW QUESTION # 30
What is the primary FortiGate election process when the HA override setting is enabled?
- A. Connected monitored ports > Priority > System uptime > FortiGate serial number
- B. Connected monitored ports > System uptime > Priority > FortiGate serial number
- C. Connected monitored ports > HA uptime > Priority > FortiGate serial number
- D. Connected monitored ports > Priority > HA uptime > FortiGate serial number
Answer: D
Explanation:
If Override DISABLED then: ports > HA Uptime > Priority > SN.
If Overrrid ENABLED then: ports > Priority > HA Uptime > SN.
NEW QUESTION # 31
Refer to the exhibit. The predefined deep-inspection and custom-deep-inspection profiles exclude some web categories from SSL inspection, as shown in the exhibit.
For which two reasons are these web categories exempted? (Choose two.)
- A. The legal regulation aims to prioritize user privacy and protect sensitive information for these websites.
- B. The resources utilization is optimized because these websites are in the trusted domain list on FortiGate.
- C. The FortiGate temporary certificate denies the browser's access to websites that use HTTP Strict Transport Security.
- D. These websites are in an allowlist of reputable domain names maintained by FortiGuard.
Answer: A,C
Explanation:
FortiGate's temporary SSL certificate may cause access denial to sites using HTTP Strict Transport Security (HSTS), so such sites are exempted from deep SSL inspection. Legal regulations require exemption of certain categories to protect user privacy and sensitive information, so these web categories are excluded from SSL inspection.
NEW QUESTION # 32
Which two settings are required for SSL VPN to function between two FortiGate devices?
(Choose two.)
- A. The client FortiGate requires a manually added route to remote subnets.
- B. The client FortiGate requires a client certificate signed by the CA on the server FortiGate.
- C. The server FortiGate requires a CA certificate to verify the client FortiGate certificate.
- D. The client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN.
Answer: B,C
Explanation:
The server FortiGate requires a CA certificate to verify the client FortiGate certificate.
When configuring an SSL VPN tunnel between two FortiGates, the server FortiGate must verify the authenticity of the connecting client's certificate. This is done using a CA certificate installed on the server to ensure the client certificate is trusted.
The client FortiGate requires a client certificate signed by the CA on the server FortiGate.
The client FortiGate uses this client certificate to authenticate itself to the server during SSL VPN negotiation. The certificate must be signed by the same CA trusted by the server to establish a secure, validated SSL VPN connection.
NEW QUESTION # 33
Refer to the exhibits.
The exhibits show a diagram of a FortiGate device connected to the network, as well as the firewall policy and IP pool configuration on the FortiGate device Two PCs PC1 and PC2, are connected behind FortiGate and can access the internet successfully However, when the administrator adds a third PC to the network (PC3), the PC cannot connect to the internet Based on the information shown in the exhibit, which two configuration options can the administrator use to fa the connectivity issue for PC3? (Choose two.)
- A. ln the IP pool configuration, set endip to 100.65.0.112.
- B. In the IP pool configuration, set type to overload.
- C. In the firewall policy, set match-vip to enable using CLI.
- D. In the system settings sot Multiple Interface Policies to enable
Answer: A,B
NEW QUESTION # 34
Refer to the exhibit, which shows an SD-WAN zone configuration on the FortiGate GUI.
Based on the exhibit, which statement is true?
- A. The d-wan zone cannot be deleted.
- B. The virtual-wan-link zone contains no member.
- C. The d-wan zone contains no member.
- D. The underlay zone contains port1 and port2.
Answer: C
Explanation:
The "d-wan" zone in FortiGate SD-WAN configuration is the default SD-WAN zone created when SD- WAN is enabled. This zone contains all the interfaces assigned to SD-WAN and is essential for the functionality of the SD-WAN feature. The "d-wan" zone cannot be deleted because it is required for SD-WAN operations. Option A is incorrect because the underlay zone does not contain port1.
NEW QUESTION # 35
What are two features of FortiGate FSSO agentless polling mode? (Choose two.)
- A. FortiGate uses the SMB protocol to read the event viewer logs from the DCs.
- B. FortiGate uses the AD server as the collector agent.
- C. FortiGate directs the collector agent to use a remote LDAP server.
- D. FortiGate does not support workstation check.
Answer: A,B
Explanation:
FortiGate uses the SMB protocol to read the event viewer logs from the DCs → In agentless polling mode, FortiGate connects directly to the AD domain controllers using SMB to collect logon events.
FortiGate uses the AD server as the collector agent → There is no external FSSO collector; instead, the FortiGate itself polls the AD servers, effectively treating them as the source of logon information.
NEW QUESTION # 36
You have configured the FortiGate device for FSSO. A user is successful in log-in to windows, but their access to the internet is denied.
What should the administrator check first?
- A. Whether the user is assigned to the correct AD group.
- B. The FortiGate firewall policy settings for SSL decryption.
- C. The windows event viewer for failed login attempts.
- D. The FortiGate FSSO active users list for user's IP address.
Answer: D
Explanation:
Checking the active users list verifies if FortiGate correctly associates the user with their IP address, ensuring proper policy enforcement for internet access.
NEW QUESTION # 37
An administrator notices that some users are unable to establish SSL VPN connections, while others can connect without any issues.
What should the administrator check first?
- A. Ensure that forced tunneling is enabled to reroute all traffic through the SSL VPN
- B. Ensure that the HTTPS service is enabled on SSL VPN tunnel interface
- C. Ensure that user traffic is hitting the firewall policy.
- D. Ensure that the affected users are using the correct port number.
Answer: D
Explanation:
The key part of the question is some users can connect and some cannot, which strongly suggests a client-side connection issue rather than a firewall-policy issue (policy only applies after the tunnel is established).
For SSL-VPN, the first thing to check when users fail to connect is whether they are using the correct connection settings (especially the port).
NEW QUESTION # 38
Refer to the exhibit. Based on the routing table shown in the exhibit, which two statements are true? (Choose two.)
- A. A packet with the source IP address 10.10.10.10arriving on port2 is allowed if strict RPF is enabled.
- B. A packet with the source IP address 10.100.110.10arriving on port3 is allowed if strict RPF is disabled.
- C. A packet with the source IP address 10.0.13.10arriving on port2 is allowed if strict RPF is disabled.
- D. A packet with the source IP address 10.100.110.10arriving on port2 is allowed if strict RPF is enabled.
Answer: B,C
Explanation:
With strict RPF disabled, asymmetric routing is allowed. So, a packet sourced from
10.100.110.10 (not present in the routing table) and arriving on port3 will be accepted as long as a return route exists (default route via port2).
With strict RPF disabled, a packet from 10.0.13.10 arriving on port2 is also allowed, even though the routing table expects it to come via port6, since the system does not enforce the interface check without strict RPF.
NEW QUESTION # 39
Refer to the exhibits.
The exhibits show a diagram of a FortiGate device connected to the network, VIP configuration, firewall policy, and the sniffer CLI output on the FortiGate device.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
The webserver host (10.0.1.10) must use its VIP external IP address as the source NAT (SNAT) when it pings remote server (10.200.3.1).
Which two statements are valid to achieve this goal? (Choose two.)
- A. Enable NAT on the Allow_access firewall policy.
- B. Disable NAT on the Internet_Access firewall policy.
- C. Create a new firewall policy before Internet_Access for the webserver and apply the IP pool.
- D. Disable port forwarding on the VIP object.
Answer: C,D
Explanation:
The current VIP is configured with port forwarding, so it only applies to TCP/80 traffic. To use the VIP's external address (10.200.1.200) as the source for any outbound sessions (such as ICMP ping), the VIP must be a full static 1-to-1 NAT, which requires disabling port forwarding.
You then need a dedicated firewall policy for the webserver that is placed before the generic Internet_Access policy and that uses an IP pool with 10.200.1.200. Traffic from 10.0.1.10 will match this policy first and be SNATed to 10.200.1.200, so the remote server 10.200.3.1 sees the VIP external IP as the source.
NEW QUESTION # 40
Refer to the exhibits.
The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
Which IP address will be used to source NAT (SNAT) the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?
- A. 10.200.1.149
- B. 10.200.1.99
- C. 10.200.1.49
- D. 10.200.1.1
Answer: B
Explanation:
All_TCP doesn't include ICMP. So you would match rule ID 2, in which uses IP Poop remote 1.
NEW QUESTION # 41
......
Verified FCP_FGT_AD-7.6 dumps Q&As Latest FCP_FGT_AD-7.6 Download: https://www.examprepaway.com/Fortinet/braindumps.FCP_FGT_AD-7.6.ete.file.html
Free Fortinet FCP_FGT_AD-7.6 Exam Questions and Answer: https://drive.google.com/open?id=1_bkDvPFXJqm4Wvypd8WiDQddSZPH1-QM