100% Free Real Updated FCP_FGT_AD-7.6 Questions & Answers Pass Your Exam Easily [Q48-Q71]

Rate this post

100% Free Real Updated FCP_FGT_AD-7.6 Questions & Answers Pass Your Exam Easily

Easily To Pass New FCP_FGT_AD-7.6 Verified & Correct Answers

Fortinet FCP_FGT_AD-7.6 Exam Syllabus Topics:

Section	Weight	Objectives
Topic 1: Network and Firewall Configuration	20-25%	– Zone-based configuration – SD-WAN configuration – Virtual wire pair and transparent mode – Firewall policies and NAT – Routing (static, dynamic)
Topic 2: Logging and Monitoring	10-15%	– Report generation – Alert and notification settings – FortiAnalyzer integration – Log types and configurations
Topic 3: Deployment and System Configuration	15-20%	– System settings and global parameters – High availability (HA) deployment – Initial setup and configuration – Administrative access and management
Topic 4: User Authentication	10-15%	– FortiToken and two-factor authentication – Local and remote authentication – User groups and policies – Single sign-on (SSO) integration
Topic 5: Security Profiles	25-30%	– Antivirus and sandbox integration – Data loss prevention (DLP) – Web filtering and DNS filtering – Intrusion prevention system (IPS) – Application control

NEW QUESTION 48
You have configured the below commands on a FortiGate.

What would be the impact of this configuration on FortiGate?

FortiGate will enable strict RPF on ail its interfaces and port1 will be enable for asymmetric routing.

FortiGate will enable strict RPF on all its interfaces and port1 will be exempted from RPF checks.

Port1 will be enabled with flexible RPF, and all other interfaces will be enabled for strict RPF

The global configuration will take precedence and FortiGate will enable strict RPF on all interfaces.

NEW QUESTION 49
Refer to the exhibit, which shows a routing table.

An administrator wants to create a new static route so the traffic to the subnet 172.20.1.0/24 is routed through port2 only.
What are the two criteria that the administrator can use to achieve this objective? (Choose two.)

The new static route must have the distance set to 9.

The existing static route through port3 must have the distance set to 11.

The new static route must have the priority set to 3.

The new static route must have the metric set to 1.

NEW QUESTION 50
What are two features of FortiGate FSSO agentless polling mode? (Choose two.)

FortiGate directs the collector agent to use a remote LDAP server.

FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

FortiGate does not support workstation check.

FortiGate uses the AD server as the collector agent.

NEW QUESTION 51
Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

The collector agent uses a Windows API to query DCs for user logins.

NetAPI polling can increase bandwidth usage in large networks.

The NetSessionEnum function is used to track user logouts.

The collector agent must search Windows application event logs.

NEW QUESTION 52
Refer to the exhibit.

Review the intrusion prevention system (IPS) profile signature settings shown in the exhibit.
What do you conclude when adding the FTP.Login.Failed signature to the IPS sensor profile?

Traffic matching the signature will be allowed and logged.

The signature setting uses a custom rating threshold.

The signature setting includes a group of other signatures.

Traffic matching the signature will be silently dropped and logged.

NEW QUESTION 53
A new administrator is configuring FSSO authentication on FortiGate using DC Agent Mode.
Which step is NOT part of the expected process?

The DC agent sends login event data directly to FortiGate.

The user logs into the windows domain.

The collector agent forwards login event data to FortiGate.

FortiGate determines user identity based on the IP address in the FSSO list.

NEW QUESTION 54
Refer to the exhibit, which shows a partial configuration from the remote authentication server.

Why does the FortiGate administrator need this configuration?

To set up a RADIUS server Secret.

To authenticate Any FortiGate user groups.

To authenticate and match the Training OU on the RADIUS server.

To authenticate only the Training user group.

NEW QUESTION 55
A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors.
What is the reason for the certificate warning errors?

The browser does not trust the certificate used by FortiGate for SSL inspection.

The option invalid SSL certificates is set to allow on the SSL/SSH inspection profile

The matching firewall policy is set to proxy inspection mode.

The certificate used by FortiGate for SSL inspection does not contain the required certificate extensions.

NEW QUESTION 56
Refer to the exhibits.

You are asked to implement an antivirus profile for files downloaded through FTP, HTTP, and HTTPS.
While testing, you are successful with HTTP and FTP protocols, but FortiGate does not block the file download over HTTPS.
What could be the cause?

The feature set in the antivirus profile is not set to Flow-based.

Web filter is not enabled on the firewall policy to complement the antivirus profile.

The action on the firewall policy is not set to deny.

The SSL inspection mode in the firewall policy is not deep content inspection.

NEW QUESTION 57
FortiGate is integrated with FortiAnalyzer and FortiManager.
When creating a firewall policy, which attribute must an administrator include to enhance functionality and enable log recording on FortiAnalyzer and FortiManager?

Policy ID

Log ID

Universally Unique Identifier

Sequence ID

NEW QUESTION 58
Which three methods are used by the collector agent for AD polling? (Choose three.)

WinSecLog

NetAPI

FortiGate polling

FSSO REST API

WMI

NEW QUESTION 59
Which two statements about the Security Fabric rating are true? (Choose two.)

A license is required to obtain an executive summary in the Security Rating section.

The root FortiGate provides executive summaries of all the FortiGate devices in the Security Fabric.

The Security Posture category provides PCI compliance results.

Security Rating Insights are available only in the Security Rating page.

NEW QUESTION 60
Refer to the exhibits.

An administrator wants to add HQ-ISFW-2 in the Security Fabric. HQ-ISFW-2 is in the same subnet as HQ- ISFW. After configuring the Security Fabric settings on HQ-ISFW-2, the status stays Pending.
What can be the two possible reasons? (Choose two.)

Upstream FortiGate IP must be set to 10.0.11.254.

SAML Single Sign-On must be set to Manual.

HQ-ISFW-2 must be authorized on HQ-ISFW.

Management IP must be set to 10.0.13.254.

NEW QUESTION 61
A network administrator enabled antivirus and selected an SSL inspection profile on a firewall policy. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and does not block the file, allowing it to be downloaded.
The administrator confirms that the traffic matches the configured firewall policy. What are two reasons for the failed virus detection by FortiGate? (Choose two.)

The selected SSL inspection profile has certificate inspection enabled.

The website is exempted from SSL inspection.

The El CAR test file exceeds the protocol options oversize limit.

The browser does not trust the FortiGate self-signed CA certificate.

NEW QUESTION 62
Refer to the exhibit. The predefined deep-inspection and custom-deep-inspection profiles exclude some web categories from SSL inspection, as shown in the exhibit.
For which two reasons are these web categories exempted? (Choose two.)

The FortiGate temporary certificate denies the browser’s access to websites that use HTTP Strict Transport Security.

These websites are in an allowlist of reputable domain names maintained by FortiGuard.

The resources utilization is optimized because these websites are in the trusted domain list on FortiGate.

The legal regulation aims to prioritize user privacy and protect sensitive information for these websites.

NEW QUESTION 63
Which two statements are correct when FortiGate enters conserve mode? (Choose two.)

FortiGate continues to run critical security actions, such as quarantine.

FortiGate refuses to accept configuration changes.

FortiGate halts complete system operation and requires a reboot to regain available resources.

FortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled.

NEW QUESTION 64
Based on the Exhibits:

A web filter profile configuration and firewall policy configuration are shown.
You are trying to access www.facebook.com, but you are redirected to a FortiGuard web filtering block page.
Based on the exhibits, what is the possible cause of the issue?

The web filter profile feature set is configured incorrectly.

The web rating override configuration is incorrect.

The firewall policy inspection mode is incorrect.

For www.facebook.com, the URL filter action is incorrect.

NEW QUESTION 65
Refer to the exhibit.

The predefined deep-inspection and custom-deep-inspection profiles exclude some web categories from SSL inspection, as shown in the exhibit.
For which two reasons are these web categories exempted? (Choose two.)

The FortiGate temporary certificate denies the browser’s access to websites that use HTTP Strict Transport Security.

These websites are in an allowlist of reputable domain names maintained by FortiGuard.

The resources utilization is optimized because these websites are in the trusted domain list on FortiGate.

The legal regulation aims to prioritize user privacy and protect sensitive information for these websites.

NEW QUESTION 66
An employee needs to connect to the office through a high-latency internet connection.
Which SSL VPN setting should the administrator adjust to prevent SSL VPN negotiation failure?

SSL VPN dtls-hello-timeout

SSL VPN login-timeout

SSL VPN session-ttl

SSL VPN idle-timeout

NEW QUESTION 67
Refer to the exhibit. Which two statements are true about the routing entries in this database table? (Choose two.)

All of the entries in the routing database table are installed in the FortiGate routing table.

The port2 interface is marked as inactive.

Both default routes have different administrative distances.

The default route on port2 is marked as the standby route.

NEW QUESTION 68
You are analyzing connectivity problems caused by intermediate devices blocking traffic in SSL VPN environment.
In which two ways can you effectively resolve the problem? (Choose two.)

You can turn off IKE fragmentation to fix large certificate negotiation problems.

You should use IPsec to solve issues with fragment drops and large certificate exchanges.

You can use SSL VPN tunnel mode to prevent problems with blocked ESP and UDP ports (500 or 4500).

You can configure a hub-and-spoke topology with SSL VPN tunnels to bypass blocked UDP ports.

NEW QUESTION 69
A FortiGate administrator enables SSL deep inspection on a policy but users report certificate warnings in their browsers. What is the most appropriate step to resolve this while keeping deep inspection active?

Install the FortiGate CA certificate on client devices

Disable HTTPS scanning in the policy

Disable all security profiles on the policy

Change the policy action from ACCEPT to DENY

NEW QUESTION 70

Refer to the exhibits.
You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
Which two factors can you observe from these configurations? (Choose two.)

YouTube search is allowed based on the Google Application and Filter override settings.

YouTube access is blocked based on Excessive-Bandwidth Application and Filter override settings.

Facebook access is allowed but you cannot play Facebook videos based on Video/Audio category filter settings.

Facebook access is blocked based on the category filter settings.

NEW QUESTION 71
A new administrator is configuring FSSO authentication on FortiGate using DC Agent Mode.
Which step is NOT part of the expected process?

The DC agent sends login event data directly to FortiGate.

The user logs into the windows domain.

The collector agent forwards login event data to FortiGate.

FortiGate determines user identity based on the IP address in the FSSO list.