Fortinet FCP_FGT_AD-7.6 Dumps - The Sure Way To Pass Exam
FCP_FGT_AD-7.6 Exam Questions (Updated 2026) 100% Real Question Answers
Fortinet FCP_FGT_AD-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 77
Refer to the exhibits.
The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.
The WAN (port2) interface has the IP address 100.65.0.101/24.
The LAN (port4) interface has the IP address 10.0.11.254/24.
Which IP address will be used to source NAT (SNAT) the traffic, if the user on HQ-PC-1 (10.0.11.50) pings the IP address of BR-FGT (100.65.1.111)
- A. 100.65.0.49
- B. 100.65.0.101
- C. 100.65.0.99
- D. 100.65.0.149
Answer: C
Explanation:
The ping traffic policy uses the IP pool named SNAT-Remote1, which has the external IP range 100.65.0.99. Therefore, traffic matching this policy (ping from HQ-PC-1 to BR1-FGT) will use 100.65.0.99 for source NAT.
NEW QUESTION # 78
Refer to the exhibit. Which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules?
- A. Traffic is sent to the link with the lowest latency.
- B. All traffic from a source IP is sent to the same interface
- C. Traffic is distributed based on the number of sessions through each interface.
- D. All traffic from a source IP to a destination IP is sent to the same interface.
Answer: D
Explanation:
For traffic that does not match any of the defined SD-WAN rules, the default implicit SD-WAN rule is applied. By default, the FortiGate uses a "source-destination IP-based" algorithm, which means all traffic from a specific source IP to a specific destination IP is sent through the same interface.
This ensures that a consistent path is used for traffic between the same source and destination IP addresses.
NEW QUESTION # 79
The HTTP inspection process in web filtering follows a specific order when multiple features are enabled in the web filter profile.
Which order must FortiGate use when the web filter profile has features such as safe search enabled?
- A. Static domain filter, SSL inspection filter, and external connectors filters
- B. FortiGuard category filter and rating filter
- C. Static URL filter, FortiGuard category filter, and advanced filters
- D. DNS-based web filter and proxy-based web filter
Answer: C
Explanation:
When multiple web filtering features are enabled, FortiGate processes HTTP inspection in the following order:
1. Static URL filter - checks requests against manually configured URLs or patterns.
2. FortiGuard category filter - classifies the website based on FortiGuard's web reputation and category database.
3. Advanced filters - applies additional options such as safe search enforcement, YouTube restriction, and keyword filtering.
NEW QUESTION # 80
Refer to the exhibit.
The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile.
An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category.
What are two solutions for satisfying the requirement? (Choose two.)
- A. Configure a web override rating for download.com and select Malicious Websites as the subcategory.
- B. Configure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.
- C. Configure a separate firewall policy with action Deny and an FQDN address object for*.download.com as destination address.
- D. Set the Freeware and Software Downloads category Action to Warning.
Answer: B,C
Explanation:
Creating a static URL filter to block download.com specifically allows blocking that site without affecting the entire category.
Using a separate firewall policy with a Deny action for an FQDN address object matching download.com can also block the site while allowing others in the same category.
NEW QUESTION # 81
An administrator has configured the following settings:
What are the two results of this configuration? (Choose two.)
- A. A session for denied traffic is created.
- B. Session helpers are disabled for denied traffic.
- C. Denied users are blocked for 30 minutes.
- D. The number of logs generated by denied traffic is reduced.
Answer: A,D
Explanation:
set ses-denied-traffic enable → ensures FortiGate creates a session entry even for denied traffic.
set block-session-timer 30 → sets the duration (30 seconds) that denied sessions remain in the session table. This prevents repeated logging for every packet in the same denied flow, thereby reducing the number of logs generated.
NEW QUESTION # 82
Refer to the exhibits. An administrator creates a new address object on the root FortiGate (HQ- NGFW-1) in the Security Fabric. After synchronization, this object is not available on the downstream FortiGate (HQ-ISFW).
What must the administrator do to synchronize the address object?
- A. Change the csfsetting on both devices to set downstream-access enable.
- B. Change the csfsetting on HQ-NGFW-1 (root) to set fabric-object-unification default.
- C. Change the csfsetting on HQ-ISFW (downstream) to set saml-configuration-sync default.
- D. Change the csfsetting on HQ-ISFW (downstream) to set configuration-sync local.
Answer: B
Explanation:
On HQ-NGFW-1 (the root FortiGate), the setting set fabric-object-unification local prevents address objects created on the root from synchronizing downstream. To propagate objects across the Security Fabric, this must be set to default. Changing the root's csf configuration to set fabric-object-unification default ensures that new address objects are synchronized to HQ-ISFW and other downstream devices.
NEW QUESTION # 83
Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true?
(Choose two.)
- A. If SD-WAN is disabled, you can configure the parameter v4-ecmp-mode to volume-based.
- B. If SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP.
- C. If SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance- mode.
- D. If SD-WAN is disabled, you configure the load balancing algorithm in config system settings.
Answer: A,C
Explanation:
When SD-WAN is disabled, FortiGate supports volume-based ECMP mode via the v4-ecmp- mode parameter.
When SD-WAN is enabled, the load balancing algorithm is controlled by the load-balance-mode parameter within the SD-WAN configuration.
NEW QUESTION # 84
An administrator needs to analyze and resolve port conflicts between SSL VPN and HTTPS administrative access on the same interface.
In which two ways can this be done? (Choose two.)
- A. Run SSL VPN on one interface using port 443 and enable HTTPS administrative access on a different interface, also using port 443.
- B. Keep port 443 for both SSL VPN and HTTPS administrative access on the same interface without any problems.
- C. Change the port number for either the SSL VPN service or the HTTPS administrative service if both are on the same interface.
- D. Disable SSL VPN if HTTPS administrative access is using port 443 on any interface.
Answer: A,C
Explanation:
You can keep port 443 for SSL VPN on one interface and also use port 443 for HTTPS admin access on a different interface. Since the services are bound to different interfaces, no conflict occurs.
If both SSL VPN and HTTPS admin access are required on the same interface, you must change the port number for one of the services to avoid a port conflict.
NEW QUESTION # 85
Refer to the exhibits.
The exhibits show a diagram of a FortiGate device connected to the network, VIP configuration, firewall policy, and the sniffer CLI output on the FortiGate device.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
The webserver host (10.0.1.10) must use its VIP external IP address as the source NAT (SNAT) when it pings remote server (10.200.3.1).
Which two statements are valid to achieve this goal? (Choose two.)
- A. Enable NAT on the Allow_access firewall policy.
- B. Disable port forwarding on the VIP object.
- C. Create a new firewall policy before Internet_Access for the webserver and apply the IP pool.
- D. Disable NAT on the Internet_Access firewall policy.
Answer: B,C
Explanation:
The current VIP is configured with port forwarding, so it only applies to TCP/80 traffic. To use the VIP's external address (10.200.1.200) as the source for any outbound sessions (such as ICMP ping), the VIP must be a full static 1-to-1 NAT, which requires disabling port forwarding.
You then need a dedicated firewall policy for the webserver that is placed before the generic Internet_Access policy and that uses an IP pool with 10.200.1.200. Traffic from 10.0.1.10 will match this policy first and be SNATed to 10.200.1.200, so the remote server 10.200.3.1 sees the VIP external IP as the source.
NEW QUESTION # 86
Refer to the exhibit, which shows an SD-WAN zone configuration on the FortiGate GUI.
Based on the exhibit, which statement is true?
- A. port2 and port3 are not assigned to a zone.
- B. The Underlay zone contains no member.
- C. The virtual-wan-link and overlay zones can be deleted.
- D. The Underlay zone is the zone by default.
Answer: D
Explanation:
The Underlay zone is the default SD-WAN zone, typically representing the physical interfaces in the SD- WAN configuration before overlay or virtual links are added.
NEW QUESTION # 87
Refer to the exhibits. The exhibits show a diagram of a FortiGate device connected to the network, and the firewall policies, VIP, and IP pool configurations on the FortiGate device.
The WAN (port2) interface has the IP address 100.65.0.101/24.
The LAN (port4) interface has the IP address 10.0.11.254/24.
The first firewall policy has NAT enabled using the IP pool. The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT (SNAT) the internet traffic coming from a workstation with the IP address 10.0.11.50?
- A. 100.65.0.102
- B. 100.65.0.101
- C. 10.0.11.254
- D. 100.65.0.200
Answer: A
Explanation:
Traffic from the workstation 10.0.11.50 going to the internet matches the Internet(1) policy (LAN
→ WAN) which has NAT enabled and is configured to use the IP Pool. The IP pool specifies the external address 100.65.0.102.
FortiGate will perform source NAT (SNAT) on the outbound traffic, translating the source IP of the workstation to 100.65.0.102.
NEW QUESTION # 88
Refer to the exhibit.
The predefined deep-inspection and custom-deep-inspection profiles exclude some web categories from SSL inspection, as shown in the exhibit.
For which two reasons are these web categories exempted? (Choose two.)
- A. The resources utilization is optimized because these websites are in the trusted domain list on FortiGate.
- B. The FortiGate temporary certificate denies the browser's access to websites that use HTTP Strict Transport Security.
- C. These websites are in an allowlist of reputable domain names maintained by FortiGuard.
- D. The legal regulation aims to prioritize user privacy and protect sensitive information for these websites.
Answer: B,D
Explanation:
FortiGate's temporary SSL certificate may cause access denial to sites using HTTP Strict Transport Security (HSTS), so such sites are exempted from deep SSL inspection.
Legal regulations require exemption of certain categories to protect user privacy and sensitive information, so these web categories are excluded from SSL inspection.
NEW QUESTION # 89
A network administrator enabled antivirus and selected an SSL inspection profile on a firewall policy.
When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and does not block the file, allowing it to be downloaded.
The administrator confirms that the traffic matches the configured firewall policy.
What are two reasons for the failed virus detection by FortiGate? (Choose two.)
- A. The website is exempted from SSL inspection.
- B. The browser does not trust the FortiGate self-signed CA certificate.
- C. The selected SSL inspection profile has certificate inspection enabled.
- D. The El CAR test file exceeds the protocol options oversize limit.
Answer: A,B
NEW QUESTION # 90
Refer to the exhibits.
An administrator has observed the performance status outputs on an HA cluster for 55 seconds.
Which FortiGate is the primary?
- A. HQ-NGFW-1 with the parameter memory-failover-flip-timeout setting
- B. HQ-NGFW-1 with the parameter override setting
- C. HQ-NGFW-2 with the parameter priority setting
- D. HQ-NGFW-2 with the parameter memory-failover-threshold setting
Answer: B
Explanation:
The HA configuration shows that override is disabled (set override disable), but despite this, HQ-NGFW-1 has the higher priority (200) and is acting as the primary, as indicated by its higher resource usage and uptime.
Override allows the device with higher priority to take over as primary, so HQ-NGFW-1 is the primary device.
NEW QUESTION # 91
A network administrator is reviewing firewall policies in both Interface Pair View and By Sequence View.
The policies appear in a different order in each view.
Why is the policy order different in these two views?
- A. Interface Pair View sorts policies based on matching interfaces, while By Sequence View shows the actual processing order of rules.
- B. Policies in Interface Pair View are prioritized by security levels, while By Sequence View strictly follows the administrator's manual ordering.
- C. The firewall dynamically reorders policies in Interface Pair View based on recent traffic patterns, but By Sequence View remains static.
- D. By Sequence View groups policies based on rule priority, while Interface Pair View always follows the order of traffic logs.
Answer: A
Explanation:
Interface Pair View organizes policies grouped by source and destination interfaces, whereas By Sequence View displays policies in the exact order they are processed by the firewall.
NEW QUESTION # 92
Refer to the exhibit.
The NOC team connects to the FortiGate GUI with the NOC_Access admin profile. They request that their GUI sessions do not disconnect too early during inactivity.
What must the administrator configure to answer this specific request from the NOC team?
- A. Increase the admintimeout value under config system accprofile NOC_Access.
- B. Ensure that all NOC_Access users are assigned the super_admin role to guarantee access
- C. Move NOC_Access to the top of the list to ensure all profile settings take effect.
- D. Increase the offline value of the Override Idle Timeout parameter in the NOC_Access admin profile.
Answer: A
Explanation:
The admintimeout setting in the admin access profile controls the inactivity timeout for GUI sessions. Increasing this value will extend the session duration before automatic disconnection.
NEW QUESTION # 93 
Refer to the exhibits.
You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
Which two factors can you observe from these configurations? (Choose two.)
- A. YouTube access is blocked based on Excessive-Bandwidth Application and Filter override settings.
- B. Facebook access is blocked based on the category filter settings.
- C. Facebook access is allowed but you cannot play Facebook videos based on Video/Audio category filter settings.
- D. YouTube search is allowed based on the Google Application and Filter override settings.
Answer: A,B
NEW QUESTION # 94
A network administrator is reviewing firewall policies in both Interface Pair View and By Sequence View. The policies appear in a different order in each view.
Why is the policy order different in these two views?
- A. Interface Pair View sorts policies based on matching interfaces, while By Sequence View shows the actual processing order of rules.
- B. Policies in Interface Pair View are prioritized by security levels, while By Sequence View strictly follows the administrator's manual ordering.
- C. The firewall dynamically reorders policies in Interface Pair View based on recent traffic patterns, but By Sequence View remains static.
- D. By Sequence View groups policies based on rule priority, while Interface Pair View always follows the order of traffic logs.
Answer: A
Explanation:
Interface Pair View organizes policies grouped by source and destination interfaces, whereas By Sequence View displays policies in the exact order they are processed by the firewall.
NEW QUESTION # 95
......
Pass Fortinet FCP_FGT_AD-7.6 Exam Quickly With Exam4Docs: https://www.exam4docs.com/FCP_FGT_AD-7.6-study-questions.html
Prepare FCP_FGT_AD-7.6 Question Answers - FCP_FGT_AD-7.6 Exam Dumps: https://drive.google.com/open?id=1qO6AA03lZbQA9PcshJ78tkLlQwEOVrZ2
