Jul 21, 2026 Updated FCP_FGT_AD-7.6 Dumps Questions For Fortinet Exam
Best Value Available Preparation Guide for FCP_FGT_AD-7.6 Exam
Fortinet FCP_FGT_AD-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 66
An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is no inbound traffic.
Which DPD mode on FortiGate meets this requirement?
- A. On Idle
- B. On Demand
- C. Disabled
- D. Enabled
Answer: B
Explanation:
Disable: Disable Dead Peer Detection.
On-idle: Trigger Dead Peer Detection when no IPsec traffic is received.
On-demand: Trigger Dead Peer Detection when no IPsec traffic is received AND FortiGate has been sending IPsec traffic. On-demand is the default setting.
NEW QUESTION # 67
What are two features of FortiGate FSSO agentless polling mode? (Choose two.)
- A. FortiGate does not support workstation check.
- B. FortiGate uses the SMB protocol to read the event viewer logs from the DCs.
- C. FortiGate directs the collector agent to use a remote LDAP server.
- D. FortiGate uses the AD server as the collector agent.
Answer: A,B
NEW QUESTION # 68
Refer to the exhibits. An administrator has observed the performance status outputs on an HA cluster for 55 seconds.
Which FortiGate is the primary?
- A. HQ-NGFW-2 with the parameter memory-failover-threshold setting
- B. HQ-NGFW-1 with the parameter memory-failover-flip-timeout setting
- C. HQ-NGFW-2 with the parameter priority setting
- D. HQ-NGFW-1 with the parameter override setting
Answer: D
Explanation:
The HA configuration shows that override is disabled (set override disable), but despite this, HQ- NGFW-1 has the higher priority (200) and is acting as the primary, as indicated by its higher resource usage and uptime. Override allows the device with higher priority to take over as primary, so HQ- NGFW-1 is the primary device.
NEW QUESTION # 69
You have configured the below commands on a FortiGate.
What would be the impact of this configuration on FortiGate?
- A. The global configuration will take precedence and FortiGate will enable strict RPF on all interfaces.
- B. Port1 will be enabled with flexible RPF, and all other interfaces will be enabled for strict RPF
- C. FortiGate will enable strict RPF on all its interfaces and port1 will be exempted from RPF checks.
- D. FortiGate will enable strict RPF on ail its interfaces and port1 will be enable for asymmetric routing.
Answer: C
Explanation:
The global setting enables strict source checking (RPF) on all interfaces by default. The per-interface setting disables the source check on port1, exempting it from strict RPF enforcement.
NEW QUESTION # 70
Refer to the exhibit. The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile.
An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category.
What are two solutions for satisfying the requirement? (Choose two.)
- A. Set the Freeware and Software Downloads category Action to Warning.
- B. Configure a web override rating for download.com and select Malicious Websites as the subcategory.
- C. Configure a separate firewall policy with action Deny and an FQDN address object for*.download.com as destination address.
- D. Configure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.
Answer: B,D
Explanation:
You can create a web rating override to change the website category to someone that is blocked in the web filter profile You can enable the URL Filter in the Web Filter Profile and block the website.
NEW QUESTION # 71
Refer to the exhibit. Review the intrusion prevention system (IPS) profile signature settings shown in the exhibit.
What can you conclude about the signature when adding the FTP.Login.Failed signature to the IPS Sensor profile?
- A. The signature setting includes a group of other signatures.
- B. The signature setting uses a custom rating threshold
- C. FortiGate stores a local copy of the packet that matches the signature.
- D. FortiGate allows this low severity signature packet and creates a log.
Answer: D
Explanation:
The IPS signature FTP.Login.Failed is configured with the action Pass and Packet logging = Enable. This means FortiGate will allow traffic that matches this signature but will also log the event, since the severity is low and blocking is not applied.
NEW QUESTION # 72
Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true?
(Choose two.)
- A. If SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance- mode.
- B. If SD-WAN is disabled, you can configure the parameter v4-ecmp-mode to volume-based.
- C. If SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP.
- D. If SD-WAN is disabled, you configure the load balancing algorithm in config system settings.
Answer: A,B
Explanation:
When SD-WAN is disabled, FortiGate supports volume-based ECMP mode via the v4-ecmp- mode parameter.
When SD-WAN is enabled, the load balancing algorithm is controlled by the load-balance-mode parameter within the SD-WAN configuration.
NEW QUESTION # 73
Refer to the exhibits. An administrator configured the Web Filter Profile to block access to all social networking sites except Facebook. However, when users try to access Facebook.com, they are redirected to a FortiGuard web filtering block page.
Based on the exhibits, which configuration change must the administrator make to allow Facebook while blocking all other social networking sites?
- A. Change the type as Simple in the Static URL Filter section.
- B. Set the Action as Exempt for www.facebook.com in the Static URL Filter.
- C. Set the Social Networking action as warning in the FortiGuard Category Based Filter.
- D. Change the Feature set of Web Filter Profile as Proxy-based.
Answer: B
Explanation:
The FortiGuard category filter is blocking Social Networking, which includes Facebook. Although a static URL filter entry for www.facebook.com exists, its action is set to Monitor, so it does not override the category block. To allow Facebook while blocking other social networking sites, the action for www.facebook.com in the Static URL Filter must be set to Exempt. This explicitly bypasses category filtering for that URL.
NEW QUESTION # 74
Which two statements describe how the RPF check is used? (Choose two.)
- A. The RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks.
- B. The RPF check is run on the first sent and reply packet of any new session.
- C. The RPF check is run on the first sent packet of any new session.
- D. The RPF check is run on the first reply packet of any new session.
Answer: A,C
Explanation:
The RPF (Reverse Path Forwarding) check is used to prevent IP spoofing attacks by verifying that the source IP address of a received packet is reachable through the same interface it arrived on. If not, the packet is dropped, ensuring traffic legitimacy.
The RPF check runs on the first sent packet of any new session to validate that the route to the source IP is consistent with the interface it's received on. This helps FortiGate detect spoofed or asymmetric routing scenarios early in the session establishment.
NEW QUESTION # 75
Refer to the exhibit. FortiGate has two separate firewall policies for Sales and Engineering to access the same web server with the same security profiles.
Which action must the administrator perform to consolidate the two policies into one?
- A. Replace port1 and port2 with the any interface in a single firewall policy.
- B. Select port1 and port2 subnets in a single firewall policy.
- C. Enable Multiple Interface Policies to select port1 and port2 in the same firewall policy.
- D. Create an Aggregate interface that includes port1 and port2 to create a single firewall policy.
Answer: C
Explanation:
Enabling Multiple Interface Policies allows you to select multiple interfaces (like port1 and port2) in a single firewall policy, consolidating access rules for both Sales and Engineering to the web server.
NEW QUESTION # 76
Refer to the exhibit. Why did FortiGate drop the packet?
- A. It matched the default implicit firewall policy.
- B. It failed the RPF check.
- C. The next-hop IP address is unreachable.
- D. It matched an explicitly configured firewall policy with the action DENY.
Answer: A
Explanation:
The debug trace output shows that the packet was "Denied by forward policy check (policy 0)." In FortiGate, policy ID 0 corresponds to the default implicit deny policy. This means that if a packet does not match any configured firewall policies, it is denied by the default implicit policy.
NEW QUESTION # 77
A network administrator is configuring an IPsec VPN tunnel for a sales employee travelling abroad.
Which IPsec Wizard template must the administrator apply?
- A. Hub-and-Spoke
- B. Site to Site
- C. Remote Access
- D. Dial up User
Answer: C
Explanation:
The Remote Access IPsec Wizard template is used for individual users connecting from remote locations, such as traveling employees. This template configures FortiGate to act as an IPsec VPN server, allowing remote clients (like FortiClient) to securely connect and access internal network resources while abroad.
NEW QUESTION # 78
Which two features of IPsec IKEv1 authentication are supported by FortiGate? (Choose two.)
- A. Extended authentication (XAuth) for faster authentication because fewer packets are exchanged
- B. Pre-shared key and certificate signature as authentication methods
- C. No certificate is required on the remote peer when you set the certificate signature as the authentication method
- D. Extended authentication (XAuth) to request the remote peer to provide a username and password
Answer: B,D
Explanation:
Authentication-wise, both versions support PSK and certificate signature. Although only IKEv1 supports XAuth, IKEv2 supports EAP, which is equivalent to XAuth.
NEW QUESTION # 79
Refer to the exhibit. In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output shown in the exhibit.
What should the administrator do next, to troubleshoot the problem?
- A. Execute a debug flow.
- B. Capture the traffic using an external sniffer connected to port1.
- C. Run a sniffer on the web server.
- D. Execute another sniffer on FortiGate, this time with the filter "host 10.0.1.10".
Answer: A
Explanation:
The sniffer output shows that packets from the web client are reaching the FortiGate and being forwarded to the web server, but there is no indication that the web server is responding. To troubleshoot this issue, executing a debug flow will help analyze the traffic path and pinpoint where the problem might be occurring, such as a possible issue in firewall policy or route settings that is causing the server not to respond correctly.
NEW QUESTION # 80
An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings.
What is true about the DNS connection to a FortiGuard server?
- A. It uses DNS over HTTPS.
- B. It uses UDP 53.
- C. It uses UDP 8888.
- D. It uses DNS over TLS.
Answer: D
Explanation:
When using FortiGuard servers for DNS, FortiOS uses DNS over TLS (DoT) by default to secure the DNS traffic. New FortiGuard DNS servers have been added as primary and secondary servers.
NEW QUESTION # 81
Refer to the exhibits. You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
Which two factors can you observe from these configurations? (Choose two.)
- A. YouTube search is allowed based on the Google Application and Filter override settings.
- B. Facebook access is blocked based on the category filter settings.
- C. YouTube access is blocked based on Excessive-Bandwidth Application and Filter override settings.
- D. Facebook access is allowed but you cannot play Facebook videos based on Video/Audio category filter settings.
Answer: A,D
Explanation:
Facebook belongs to the Social Media application category, which is set to Block in the application sensor. Therefore, any Facebook application traffic is blocked by category.
YouTube Search may fall under Google services or General Interest depending on how traffic is parsed (especially with SSL deep inspection).
The Google application override is set to Monitor, which means traffic is allowed, just logged.
The Video/Audio category (which includes YouTube video playback) is blocked, but this does not block YouTube Search, which is just browsing and searching on the site, is not blocked by the Video/Audio category unless the actual video stream starts.
NEW QUESTION # 82 
Refer to the exhibits.
An administrator configured the Web Filter Profile to block access to all social networking sites except Facebook. However, when users try to access Facebook.com, they are redirected to a FortiGuard web filtering block page.
Based on the exhibits, which configuration change must the administrator make to allow Facebook while blocking all other social networking sites?
- A. Change the type as Simple in the Static URL Filter section.
- B. Set the Action as Exempt for www.facebook.com in the Static URL Filter.
- C. Set the Social Networking action as warning in the FortiGuard Category Based Filter.
- D. Change the Feature set of Web Filter Profile as Proxy-based.
Answer: B
NEW QUESTION # 83
Which two statements are true about an HA cluster? (Choose two.)
- A. Link failover triggers a failover if the administrator sets the interface down on the primary device.
- B. HA incremental synchronization includes FIB entries and IPsec SAs.
- C. When sniffing the heartbeat interface, the administrator must see the IP address 169.254.0.2.
- D. An HA cluster cannot have both in-band and out-of-band management interfaces at the same time.
Answer: A,B
Explanation:
Incremental synchronization also synchronizes other dynamic configuration information such as the DHCP server address lease database, routing table updates, IPsec SAs, MAC address tables, and so on.
HA propagates more than just configuration details. Some runtime data, such as DHCP leases and FIB entries, are also synchronized.
NEW QUESTION # 84
Refer to the exhibits. The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration.
An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2.
The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver.
Which additional configuration can the administrator add to a deny firewall policy, beyond the default behavior, to block Remote-User2 from accessing the Webserver?
- A. Disable match-vip in the Allow_access policy
- B. Set the Destination address as Webserver in the Deny policy.
- C. Set the Destination address as Deny_IP in the Allow_access policy.
- D. Configure a One-to-One IP Pool object in a new policy.
Answer: B
Explanation:
To block Remote-User2's access to the Webserver, the deny policy must explicitly specify the Webserver as the destination address; otherwise, it denies traffic to all destinations, which is not the desired behavior.
NEW QUESTION # 85
......
Full FCP_FGT_AD-7.6 Practice Test and 132 Unique Questions, Get it Now!: https://www.pass4training.com/FCP_FGT_AD-7.6-pass-exam-training.html
The Best FCP_FGT_AD-7.6 Exam Study Material Premium Files and Preparation Tool: https://drive.google.com/open?id=19L0Qrck4oEQpS2tm0bux9oklLVbygiOK
