Fortinet FCP_FGT_AD-7.6 Online Practice Questions and Exam Preparation

Fortinet FCP_FGT_AD-7.6 Online Questions & Answers

• Question 21:

  Refer to the exhibits.

  

  You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.

  You cannot access any of the Google applications, but you are able to access www.fortinet.com.

  What would you do to resolve this issue?

  A. Change the Inspection mode to Proxy-based.
  B. Set SSL inspection to deep-content-inspection.
  C. Move up Google in the Application and Filter Overrides section to set its priority to 1.
  D. Add *Google*.com to the URL category in the security profile.
  C. Move up Google in the Application and Filter Overrides section to set its priority to 1.

  ---

  Explanation

  In the Application and Filter Overrides, the Excessive-Bandwidth filter (set to Block) is priority 1, and Google (set to Monitor) is priority 2. Since overrides are evaluated by priority, Google traffic is being blocked by the higher-priority rule.

  Moving Google to the top (priority 1) ensures it is matched first, allowing access while still monitoring it.

• Question 22:

  A network administrator is reviewing firewall policies in both Interface Pair View and By Sequence View.

  The policies appear in a different order in each view.

  Why is the policy order different in these two views?

  A. Policies in Interface Pair View are prioritized by security levels, while By Sequence View strictly follows the administrator's manual ordering.
  B. By Sequence View groups policies based on rule priority, while Interface Pair View always follows the order of traffic logs.
  C. The firewall dynamically reorders policies in Interface Pair View based on recent traffic patterns, but By Sequence View remains static.
  D. Interface Pair View sorts policies based on matching interfaces, while By Sequence View shows the actual processing order of rules.
  D. Interface Pair View sorts policies based on matching interfaces, while By Sequence View shows the actual processing order of rules.

  ---

  Explanation

  Interface Pair View organizes policies grouped by source and destination interfaces, whereas By Sequence View displays policies in the exact order they are processed by the firewall.

• Question 23:

  An administrator has configured a dialup IPsec VPN on FortiGate with add-route enabled. However, the static route is not showing in the routing table.

  Which two statements about this scenario are correct? (Choose two.)

  A. The administrator must enable a dynamic routing protocol on the dialup interface.
  B. The administrator must use a policy route instead of a static route for add-route to work properly.
  C. The administrator must ensure phase 2 is successfully established.
  D. The administrator must define the remote network correctly in the phase 2 selectors.
  C. The administrator must ensure phase 2 is successfully established.
  D. The administrator must define the remote network correctly in the phase 2 selectors.

  ---

  Explanation

  The administrator must ensure phase 2 is successfully established.

  The static route for the dialup VPN is only added after Phase 2 negotiation completes successfully.

  The administrator must define the remote network correctly in the phase 2 selectors.

  The add-route feature installs a route based on the Phase 2 selectors; if they are incorrect, no route will appear in the routing table.

• Question 24:

  Refer to the exhibits.

  

  

  The SSL VPN connection fails when a user attempts to connect to it.

  What should the user do to successfully connect to the SSL VPN?

  A. Change the SSL VPN port on the client.
  B. Change the SSL VPN portal to the tunnel.
  C. Change the server IP address.
  D. Change the idle-timeout.
  A. Change the SSL VPN port on the client.

• Question 25:

  You are analyzing connectivity problems caused by intermediate devices blocking traffic in SSL VPN environment.

  In which two ways can you effectively resolve the problem? (Choose two.)

  A. You can turn off IKE fragmentation to fix large certificate negotiation problems.
  B. You should use IPsec to solve issues with fragment drops and large certificate exchanges.
  C. You can use SSL VPN tunnel mode to prevent problems with blocked ESP and UDP ports (500 or 4500).
  D. You can configure a hub-and-spoke topology with SSL VPN tunnels to bypass blocked UDP ports.
  C. You can use SSL VPN tunnel mode to prevent problems with blocked ESP and UDP ports (500 or 4500).
  D. You can configure a hub-and-spoke topology with SSL VPN tunnels to bypass blocked UDP ports.

• Question 26:

  An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings.

  What is true about the DNS connection to a FortiGuard server?

  A. It uses DNS over TLS.
  B. It uses DNS over HTTPS.
  C. It uses UDP 8888.
  D. It uses UDP 53.
  A. It uses DNS over TLS.

• Question 27:

  Refer to the exhibit.

  

  An administrator has configured an Application Overrides for the ABC.Com application signature and set the Action to Allow. This application control profile is then applied to a firewall policy that is scanning all outbound traffic. Logging is enabled in the firewall policy. To test the configuration, the administrator accessed the ABC.Com web site several times.

  Why are there no logs generated under security logs for ABC.Com?

  A. The ABC.Com Type is set as Application instead of Filter.
  B. The ABC.Com is configured under application profile, which must be configured as a web filter profile.
  C. The ABC.Com Action is set to Allow.
  D. The ABC.Com is hitting the category Excessive-Bandwidth.
  C. The ABC.Com Action is set to Allow.

  ---

  Explanation

  When the action is set to Allow in an application override, traffic matching this override is allowed without generating security logs because it bypasses deeper inspection and blocking.

• Question 28:

  Refer to the exhibit.

  

  Which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules?

  A. Traffic is sent to the link with the lowest latency.
  B. All traffic from a source IP is sent to the same interface.
  C. All traffic from a source IP to a destination IP is sent to the same interface.
  D. Traffic is distributed based on the number of sessions through each interface.
  C. All traffic from a source IP to a destination IP is sent to the same interface.

• Question 29:

  Which two features of IPsec IKEv1 authentication are supported by FortiGate? (Choose two.)

  A. Extended authentication (XAuth) for faster authentication because fewer packets are exchanged
  B. Pre-shared key and certificate signature as authentication methods
  C. No certificate is required on the remote peer when you set the certificate signature as the authentication method
  D. Extended authentication (XAuth) to request the remote peer to provide a username and password
  B. Pre-shared key and certificate signature as authentication methods
  D. Extended authentication (XAuth) to request the remote peer to provide a username and password

• Question 30:

  An administrator configures SD-WAN with two WAN links. A performance SLA is configured to measure latency and packet loss. The SD-WAN rule is set to "best quality."

  How does FortiGate select the WAN link?

  A. The link with the lowest latency is always selected
  B. The link with the lowest packet loss is always selected
  C. The link that best satisfies the SLA by considering all metrics
  D. SD-WAN alternates links for every new session
  C. The link that best satisfies the SLA by considering all metrics

  ---

  Explanation

  Best-quality strategy evaluates all active SLA metrics (latency, jitter, packet loss) and selects the link with the best overall score.