[Q18-Q42] The Most Efficient FCP_FGT_AD-7.6 Pdf Dumps For Assured Success [2026]

4.5/5 - (2 votes)

The Most Efficient FCP_FGT_AD-7.6 Pdf Dumps For Assured Success [2026]

We offers you the latest free online FCP_FGT_AD-7.6 dumps to practice

QUESTION 18
Refer to the exhibits.

An administrator configured both members of an HA cluster at the same time. After one week of monitoring, the administrator wants to verify the HA failover performance.
How can the administrator force a failover?

The administrator must reset the HA uptime on HQ-NGFW-1.

The administrator must set the parameter override to enable on HQ-NGFW-2.

The administrator must increase the HA priority on HQ-NGFW-2.

The administrator must set the monitored port to down on HQ-NGFW-1.

QUESTION 19
A network administrator has configured an SSL/SSH inspection profile defined for full SSL inspection and set with a private CA certificate. The firewall policy that allows the traffic uses this profile for SSL inspection and performs web filtering. When visiting any HTTPS websites, the browser reports certificate warning errors.
What is the reason for the certificate warning errors?

The SSL cipher compliance option is not enabled on the SSL inspection profile. This setting is required when the SSL inspection profile is defined with a private CA certificate.

The certificate used by FortiGate for SSL inspection does not contain the required certificate extensions.

The browser does not recognize the certificate in use as signed by a trusted CA.

With full SSL inspection it is not possible to avoid certificate warning errors at the browser level.

QUESTION 20
Refer to the exhibits. You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
Which two factors can you observe from these configurations? (Choose two.)

YouTube search is allowed based on the Google Application and Filter override settings.

YouTube access is blocked based on Excessive-Bandwidth Application and Filter override settings.

Facebook access is allowed but you cannot play Facebook videos based on Video/Audio category filter settings.

Facebook access is blocked based on the category filter settings.

QUESTION 21
Refer to the exhibit.

The NOC team connects to the FortiGate GUI with the NOC_Access admin profile. They request that their GUI sessions do not disconnect too early during inactivity.
What must the administrator configure to answer this specific request from the NOC team?

Move NOC_Access to the top of the list to ensure all profile settings take effect.

Increase the offline value of the Override Idle Timeout parameter in the NOC_Access admin profile.

Ensure that all NOC_Access users are assigned the super_admin role to guarantee access

Increase the admintimeout value under config system accprofile NOC_Access.

QUESTION 22
What are two features of FortiGate FSSO agentless polling mode? (Choose two.)

FortiGate directs the collector agent to use a remote LDAP server.

FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

FortiGate does not support workstation check.

FortiGate uses the AD server as the collector agent.

QUESTION 23
Which two statements are correct when FortiGate enters conserve mode? (Choose two.)

FortiGate continues to run critical security actions, such as quarantine.

FortiGate refuses to accept configuration changes.

FortiGate halts complete system operation and requires a reboot to regain available resources.

FortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled.

QUESTION 24
You are analyzing connectivity problems caused by intermediate devices blocking traffic in SSL VPN environment.
In which two ways can you effectively resolve the problem? (Choose two.)

You can turn off IKE fragmentation to fix large certificate negotiation problems.

You should use IPsec to solve issues with fragment drops and large certificate exchanges.

You can use SSL VPN tunnel mode to prevent problems with blocked ESP and UDP ports (500 or 4500).

You can configure a hub-and-spoke topology with SSL VPN tunnels to bypass blocked UDP ports.

QUESTION 25
Refer to the exhibit. Why did the FortiGate device drop the packet?

It matched the default implicit firewall policy.

It matched an explicitly configured firewall policy with the action DENY.

It cannot reach the next-hop IP.

It failed the RPF check.

QUESTION 26
Refer to the exhibit. A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up.

Based on the phase 2 configuration shown in the exhibit, which two configuration changes will bring phase 2 up? (Choose two.)

On BR1-FGT, set Seconds to 43200.

On HQ-NGFW, enable Diffie-Hellman Group 2.

On BR1-FGT, set Remote Address to 10.0.11.0/255.255.255.0.

On HQ-NGFW. set Encryption to AES256.

QUESTION 27
Refer to the exhibits.

The exhibits show a diagram of a FortiGate device connected to the network, as well as the firewall policy and IP pool configuration on the FortiGate device.
Two PCs, PC1 and PC2, are connected behind FortiGate and can access the internet successfully. However, when the administrator adds a third PC to the network (PC3), the PC cannot connect to the internet.
Based on the information shown in the exhibit, which two configuration options can the administrator use to fix the connectivity issue for PC3? (Choose two.)

In the IP pool configuration, set typeto overload.

In the firewall policy configuration, add 10.0.1.3as an address object in the source field.

Configure another firewall policy that matches only the address of PC3 as source, and then place the policy on top of the list.

In the IP pool configuration, set endipto 192.2.0.12.

QUESTION 28
Refer to the exhibits.

You are asked to implement an antivirus profile for files downloaded through FTP, HTTP, and HTTPS.
While testing, you are successful with HTTP and FTP protocols, but FortiGate does not block the file download over HTTPS.
What could be the cause?

The feature set in the antivirus profile is not set to Flow-based.

Web filter is not enabled on the firewall policy to complement the antivirus profile.

The action on the firewall policy is not set to deny.

The SSL inspection mode in the firewall policy is not deep content inspection.

QUESTION 29
Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true?
(Choose two.)

If SD-WAN is disabled, you can configure the parameter v4-ecmp-mode to volume-based.

If SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP.

If SD-WAN is disabled, you configure the load balancing algorithm in config system settings.

If SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance- mode.

QUESTION 30
Which two statements about the Security Fabric rating are true? (Choose two.)

A license is required to obtain an executive summary in the Security Rating section.

The root FortiGate provides executive summaries of all the FortiGate devices in the Security Fabric.

The Security Posture category provides PCI compliance results.

Security Rating Insights are available only in the Security Rating page.

QUESTION 31
When FortiGate performs SSL/SSH full inspection, you can decide how it should react when it detects an invalid certificate.
Which three actions are valid actions that FortiGate can perform when it detects an invalid certificate?
(Choose three.)

Allow

Trust & Allow

Allow & Warning

Block

Block & Warning

QUESTION 32
Which two statements are correct when FortiGate enters conserve mode? (Choose two.)

FortiGate continues to run critical security actions, such as quarantine.

FortiGate refuses to accept configuration changes.

FortiGate halts complete system operation and requires a reboot to regain available resources.

FortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled.

QUESTION 33
An administrator notices that some users are unable to establish SSL VPN connections, while others can connect without any issues.
What should the administrator check first?

Ensure that the affected users are using the correct port number.

Ensure that user traffic is hitting the firewall policy.

Ensure that forced tunneling is enabled to reroute all traffic through the SSL VPN

Ensure that the HTTPS service is enabled on SSL VPN tunnel interface

QUESTION 34
Refer to the exhibits. An administrator has observed the performance status outputs on an HA cluster for 55 seconds.

Which FortiGate is the primary?

HQ-NGFW-2 with the parameter memory-failover-threshold setting

HQ-NGFW-2 with the parameter priority setting

HQ-NGFW-1 with the parameter memory-failover-flip-timeout setting

HQ-NGFW-1 with the parameter override setting

QUESTION 35
An administrator must enable a DHCP server on one of the directly connected networks on FortiGate. However, the administrator is unable to complete the process on the GUI to enable the service on the interface.
In this scenario, what prevents the administrator from enabling DHCP service?

The DHCP server setting is available only on the CLI.

Another interface is configured as the only DHCP server on FortiGate.

The FortiGate model does not support the DHCP server.

The role of the interface prevents setting a DHCP server.

QUESTION 36
Refer to the exhibits.

An administrator wants to add HQ-ISFW-2 in the Security Fabric. HQ-ISFW-2 is in the same subnet as HQ-ISFW. After configuring the Security Fabric settings on HQ-ISFW-2, the status stays Pending.
What can be the two possible reasons? (Choose two.)

Upstream FortiGate IP must be set to 10.0.11.254.

SAML Single Sign-On must be set to Manual.

HQ-ISFW-2 must be authorized on HQ-ISFW.

Management IP must be set to 10.0.13.254.

QUESTION 37
Which two statements are true about an HA cluster? (Choose two.)

An HA cluster cannot have both in-band and out-of-band management interfaces at the same time.

Link failover triggers a failover if the administrator sets the interface down on the primary device.

When sniffing the heartbeat interface, the administrator must see the IP address 169.254.0.2.

HA incremental synchronization includes FIB entries and IPsec SAs.

QUESTION 38
A network administrator enabled antivirus and selected an SSL inspection profile on a firewall policy. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and does not block the file, allowing it to be downloaded.
The administrator confirms that the traffic matches the configured firewall policy. What are two reasons for the failed virus detection by FortiGate? (Choose two.)

The selected SSL inspection profile has certificate inspection enabled.

The website is exempted from SSL inspection.

The El CAR test file exceeds the protocol options oversize limit.

The browser does not trust the FortiGate self-signed CA certificate.

QUESTION 39
Refer to the exhibit. Why is the Antivirus scan switch grayed out when you are creating a new antivirus profile for FTP?

None of the inspected protocols are active in this profile.

FortiGate, with less than 2 GB RAM, does not support the Antivirus scan feature.

Antivirus scan is disabled under System -> Feature visibility.

The Feature Set for the profile is Flow-based but it must be Proxy-based.

QUESTION 40
Refer to the exhibits. The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.

The WAN (port2) interface has the IP address 100.65.0.101/24. The LAN (port4) interface has the IP address 10.0.11.254/24. Which IP address will be used to source NAT (SNAT) the traffic, if the user on HQ-PC-1 (10.0.11.50) pings the IP address of BR-FGT (100.65.1.111)

100.65.0.101

100.65.0.49

100.65.0.99

100.65.0.149

QUESTION 41
You have configured an application control profile, set peer-to-peer traffic to Block under the Categories tab, and applied it to the firewall policy. However, your peer-to-peer traffic on known ports is passing through the FortiGate without being blocked. What FortiGate settings should you check to resolve this issue?

FortiGuard category ratings

Application and Filter Overrides

Network Protocol Enforcement

Replacement Messages for UDP-based Applications

QUESTION 42
Refer to the exhibits. An administrator creates a new address object on the root FortiGate (HQ- NGFW-1) in the Security Fabric. After synchronization, this object is not available on the downstream FortiGate (HQ-ISFW).
What must the administrator do to synchronize the address object?