Fortinet FCP_FGT_AD-7.6 Online Practice Questions and Exam Preparation

Fortinet FCP_FGT_AD-7.6 Online Questions & Answers

• Question 11:

  A remote IPsec VPN tunnel shows phase 1 is up, but phase 2 cannot establish. Which configuration mismatch most commonly causes this?

  A. Mismatched IKE version
  B. Mismatched phase 1 lifetime
  C. Incorrect phase 2 selectors
  D. Incorrect NAT-Traversal settings
  C. Incorrect phase 2 selectors

  ---

  Explanation

  Phase 2 selectors must match exactly between both peers. Any mismatch in local/remote subnets prevents phase 2 negotiation.

• Question 12:

  An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels.

  The requirement is that FortiGate sends DPD probes only when there is no inbound traffic.

  Which DPD mode on FortiGate meets this requirement?

  A. Enabled
  B. On Idle
  C. Disabled
  D. On Demand
  D. On Demand

  ---

  Explanation

  The "On Idle" DPD mode configures FortiGate to send DPD probes only when no inbound traffic is detected, meeting the requirement to send probes only when the tunnel is idle.

• Question 13:

  Refer to the exhibit, which shows an SD-WAN zone configuration on the FortiGate GUI.

  

  Based on the exhibit, which statement is true?

  A. The Underlay zone is the zone by default.
  B. The Underlay zone contains no member.
  C. port2 and port3 are not assigned to a zone.
  D. The virtual-wan-link and overlay zones can be deleted.
  B. The Underlay zone contains no member.

• Question 14:

  The HTTP inspection process in web filtering follows a specific order when multiple features are enabled in the web filter profile.

  Which order must FortiGate use when the web filter profile has features such as safe search enabled?

  A. DNS-based web filter and proxy-based web filter
  B. Static URL filter, FortiGuard category filter, and advanced filters
  C. FortiGuard category filter and rating filter
  D. Static domain filter, SSL inspection filter, and external connectors filters
  B. Static URL filter, FortiGuard category filter, and advanced filters

• Question 15:

  Refer to the exhibit.

  

  The predefined deep-inspection and custom-deep-inspection profiles exclude some web categories from SSL inspection, as shown in the exhibit.

  For which two reasons are these web categories exempted? (Choose two.)

  A. The FortiGate temporary certificate denies the browser's access to websites that use HTTP Strict Transport Security.
  B. These websites are in an allowlist of reputable domain names maintained by FortiGuard.
  C. The resources utilization is optimized because these websites are in the trusted domain list on FortiGate.
  D. The legal regulation aims to prioritize user privacy and protect sensitive information for these websites.
  A. The FortiGate temporary certificate denies the browser's access to websites that use HTTP Strict Transport Security.
  D. The legal regulation aims to prioritize user privacy and protect sensitive information for these websites.

  ---

  Explanation

  FortiGate's temporary SSL certificate may cause access denial to sites using HTTP Strict Transport Security (HSTS), so such sites are exempted from deep SSL inspection.

  Legal regulations require exemption of certain categories to protect user privacy and sensitive information, so these web categories are excluded from SSL inspection.

• Question 16:

  Refer to the exhibit, which shows a routing table.

  

  An administrator wants to create a new static route so the traffic to the subnet 172.20.1.0/24 is routed through port2 only.

  What are the two criteria that the administrator can use to achieve this objective? (Choose two.)

  A. The new static route must have the distance set to 9.
  B. The existing static route through port3 must have the distance set to 11.
  C. The new static route must have the priority set to 3.
  D. The new static route must have the metric set to 1.
  A. The new static route must have the distance set to 9.
  B. The existing static route through port3 must have the distance set to 11.

• Question 17:

  An administrator manages a FortiGate model that supports NTurbo.

  How does NTurbo acceleration enhance antivirus performance?

  A. For proxy-based inspection, NTurbo offloads traffic to the content processor.
  B. For flow-based inspection, NTurbo establishes a dedicated data path to redirect traffic between the IPS engine and FortiGate ingress and egress interfaces.
  C. For proxy-based inspection, NTurbo buffers the whole file and then sends it to the antivirus engine.
  D. For flow-based inspection, NTurbo creates two inspection sessions on the FortiGate device.
  B. For flow-based inspection, NTurbo establishes a dedicated data path to redirect traffic between the IPS engine and FortiGate ingress and egress interfaces.

  ---

  Explanation

  With flow-based inspection, NTurbo improves antivirus performance by establishing a dedicated fast data path that redirects traffic between the IPS engine and the FortiGate ingress/egress interfaces. This reduces CPU overhead, allowing antivirus scanning to happen at higher throughput without requiring full proxy-based buffering.

• Question 18:

  FortiGate is operating in NAT mode and has two physical interfaces connected to the LAN and DMZ networks respectively.

  Which two statements about the requirements of connected physical interfaces on FortiGate are true? (Choose two.)

  A. Both interfaces must have the interface role assigned.
  B. Both interfaces must have directly connected routes on the routing table.
  C. Both interfaces must have DHCP enabled and interfaces set to LAN and DMZ roles assigned.
  D. Both interfaces must have IP addresses assigned.
  B. Both interfaces must have directly connected routes on the routing table.
  D. Both interfaces must have IP addresses assigned.

  ---

  Explanation

  Interfaces must have directly connected routes in the routing table to forward traffic correctly.

  Interfaces must have IP addresses assigned to communicate within their respective networks.

• Question 19:

  A network administrator configures a static route with distance 10 and a second static route for the same destination with distance 20.

  What happens if the primary next hop becomes unreachable?

  A. FortiGate immediately removes the first route from the routing table
  B. FortiGate waits for the timeout in the route-hold timer before switching
  C. FortiGate automatically installs the second static route as the active route
  D. Both routes remain in the routing table and ECMP is used
  C. FortiGate automatically installs the second static route as the active route

  ---

  Explanation

  Lower-distance static routes have higher priority. When the next hop of the primary route becomes unreachable, FortiGate installs the backup static route with distance 20.

• Question 20:

  An administrator has configured the following settings:

  

  What are the two results of this configuration? (Choose two.)

  A. Denied users are blocked for 30 minutes.
  B. A session for denied traffic is created.
  C. Session helpers are disabled for denied traffic.
  D. The number of logs generated by denied traffic is reduced.
  B. A session for denied traffic is created.
  D. The number of logs generated by denied traffic is reduced.

  ---

  Explanation

  set ses-denied-traffic enable ensures FortiGate creates a session entry even for denied traffic.

  set block-session-timer 30 sets the duration (30 seconds) that denied sessions remain in the session table.

  This prevents repeated logging for every packet in the same denied flow, thereby reducing the number of logs generated.