[Aug-2026] FCP_FGT_AD-7.6 Dumps are Available for Instant Access using Prep4sures
FCP_FGT_AD-7.6 Dumps 2026 - New Fortinet FCP_FGT_AD-7.6 Exam Questions
Fortinet FCP_FGT_AD-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 67
Refer to the exhibits. An administrator has observed the performance status outputs on an HA cluster for 55 seconds.
Which FortiGate is the primary?
- A. HQ-NGFW-2 with the parameter priority setting
- B. HQ-NGFW-1 with the parameter memory-failover-flip-timeout setting
- C. HQ-NGFW-1 with the parameter override setting
- D. HQ-NGFW-2 with the parameter memory-failover-threshold setting
Answer: D
Explanation:
The configured memory failover threshold is 70%, and FW-1 is running at 90%. The monitored period is set to 50 seconds, while the question states that the admin observed the output for 55 seconds. This means FW-1 has remained above the 70% threshold for more than the configured monitoring period, while the memory usage on FW-2 is below 70%.
NEW QUESTION # 68
Which three strategies are valid SD-WAN rule strategies for member selection? (Choose three.)
- A. Lowest Quality (SLA) with load balancing
- B. Lowest Cost (SLA) with load balancing
- C. Lowest Cost (SLA) without load balancing
- D. Best Quality with load balancing
- E. Manual with load balancing
Answer: B,C,D
Explanation:
Lowest Cost (SLA) without load balancing → This is a valid strategy, selecting the path with the lowest cost that meets SLA requirements.
Lowest Cost (SLA) with load balancing → Also valid; it distributes sessions across the lowest-cost links that satisfy the SLA.
Best Quality with load balancing → Valid; it chooses the best-performing link based on SLA metrics such as latency, jitter, and packet loss, while also distributing sessions.
NEW QUESTION # 69
What are two features of collector agent advanced mode? (Choose two.)
- A. Advanced mode uses the Windows convention - NetBios: Domain\Username.
- B. In advanced mode, security profiles can be applied only to user groups, not individual users.
- C. Advanced mode supports nested or inherited groups.
- D. In advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.
Answer: C,D
Explanation:
Advanced mode supports nested or inherited groups, allowing FortiGate to recognize users that belong to subgroups within AD.
In advanced mode, FortiGate can be configured as an LDAP client and apply group filters, giving more granular control over user authentication and authorization.
NEW QUESTION # 70
Refer to the exhibits. You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
Which two factors can you observe from these configurations? (Choose two.)
- A. Facebook access is allowed but you cannot play Facebook videos based on Video/Audio category filter settings.
- B. YouTube access is blocked based on Excessive-Bandwidth Application and Filter override settings.
- C. YouTube search is allowed based on the Google Application and Filter override settings.
- D. Facebook access is blocked based on the category filter settings.
Answer: B,D
Explanation:
Facebook belongs to the Social Media application category, which is set to Block in the application sensor. Therefore, any Facebook application traffic is blocked by category.
The Excessive-Bandwidth behavior filter is configured as an override with priority 1 and action Block. YouTube streaming applications are tagged with the Excessive-Bandwidth behavior, so this override takes precedence over the Google (vendor) monitor rule and results in YouTube being blocked.
NEW QUESTION # 71
Refer to the exhibit. The NOC team connects to the FortiGate GUI with the NOC_Access admin profile. They request that their GUI sessions do not disconnect too early during inactivity. What must the administrator configure to answer this specific request from the NOC team?
- A. Ensure that all NOC_Access users are assigned the super_admin role to guarantee access
- B. Increase the offline value of the Override Idle Timeout parameter in the NOC_Access admin profile.
- C. Move NOC_Access to the top of the list to ensure all profile settings take effect.
- D. Increase the admintimeout value under config system accprofile NOC_Access.
Answer: B
Explanation:
You can override the idle timeout setting per administartor profile using the Override Idle Timeout setting.
You can configure an administrator profile to increase inactivity timeout and facilitate use of the GUI for central monitoring. Then Override Idel Timeout setting allows the admintimeout value, under the config system accprofile, to be overridden per access profile..
NEW QUESTION # 72
Which statement correctly describes NetAPI polling mode for the FSSO collector agent?
- A. The collector agent must search Windows application event logs.
- B. The NetSessionEnum function is used to track user logouts.
- C. The collector agent uses a Windows API to query DCs for user logins.
- D. NetAPI polling can increase bandwidth usage in large networks.
Answer: B
Explanation:
NetAPI: polls temporary sessions created on the DC when a user logs in or logs out and calls the NetSessionEnum function on Windows. It's faster than the WinSec and WMI methods; however, it can miss some login events if a DC is under heavy system load. This is because sessions can be quickly created and purged from RAM, before the agent has a chance to poll and notify FortiGate.
NEW QUESTION # 73
An employee needs to connect to the office through a high-latency internet connection.
Which SSL VPN setting should the administrator adjust to prevent SSL VPN negotiation failure?
- A. SSL VPN idle-timeout
- B. SSL VPN dtls-hello-timeout
- C. SSL VPN session-ttl
- D. SSL VPN login-timeout
Answer: D
Explanation:
When connected to SSL VPN over high latency connections, FortiGate can time out the client before the client can finish the negotiation process, such as DNS lookup and time to enter a token. Two new CLI commands under config vpn ssl settings have been added to address this.
The first command allows you to set up the login timeout, replacing the previous hard timeout value. The second command allows you to set up the maximum DTLS hello timeout for SSL VPN connections.
NEW QUESTION # 74
Refer to the exhibits, which show the system performance output and the default configuration of high memory usage thresholds in a FortiGate.
Based on the system performance output, what can be the two possible outcomes? (Choose two.)
- A. FortiGate will start sending all files to FortiSandbox for inspection.
- B. FortiGate has entered conserve mode.
- C. Administrators cannot change the configuration.
- D. Administrators can access FortiGate only through the console port.
Answer: B,C
Explanation:
FortiGate has entered conserve mode.
The system performance output shows memory usage at 90%, which exceeds the red threshold (88%) configured under memory-use-threshold-red. When this happens, FortiGate automatically enters conserve mode to preserve system stability by stopping or limiting memory-intensive processes.
Administrators cannot change the configuration.
In conserve mode, FortiGate restricts configuration changes and disables some non-essential services until memory usage drops below the green threshold (82%), ensuring that available memory is reserved for critical operations.
NEW QUESTION # 75
You have created a web filter profile named restrict_media-profile with a daily category usage quota.
When you are adding the profile to the firewall policy, the restrict_media-profile is not listed in the available web profile drop down.
What could be the reason?
- A. The naming convention used in the web filter profile is restricting it in the firewall policy.
- B. The web filter profile is already referenced in another firewall policy.
- C. The firewall policy is in no-inspection mode instead of deep-inspection.
- D. The inspection mode in the firewall policy is not matching with web filter profile feature set.
Answer: D
Explanation:
Web filter profiles with category usage quotas require the firewall policy to be in proxy-based (deep) inspection mode; if the inspection mode does not match this requirement, the profile will not appear in the drop-down list.
NEW QUESTION # 76
Refer to the exhibit. As an administrator you have created an IPS profile, but it is not performing as expected. While testing you got the output as shown in the exhibit.
What could be the possible reason of the diagnose output shown in the exhibit?
- A. Administrator entered the command diagnose test application ipsmonitor 99.
- B. Administrator entered the command diagnose test application ipsmonitor 5.
- C. There is a no firewall policy configured with an IPS security profile.
- D. FortiGate entered into IPS fail open state.
Answer: C
Explanation:
The output shows the IPS engine count as 0, indicating no active IPS engines are running. This typically means no firewall policy is referencing the IPS security profile, so the IPS profile is not being applied or triggered.
NEW QUESTION # 77
An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is no inbound traffic.
Which DPD mode on FortiGate meets this requirement?
- A. Disabled
- B. Enabled
- C. On Demand
- D. On Idle
Answer: C
Explanation:
Disable: Disable Dead Peer Detection.
On-idle: Trigger Dead Peer Detection when no IPsec traffic is received.
On-demand: Trigger Dead Peer Detection when no IPsec traffic is received AND FortiGate has been sending IPsec traffic. On-demand is the default setting.
NEW QUESTION # 78
Which two statements are correct when FortiGate enters conserve mode? (Choose two.)
- A. FortiGate continues to run critical security actions, such as quarantine.
- B. FortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled.
- C. FortiGate refuses to accept configuration changes.
- D. FortiGate halts complete system operation and requires a reboot to regain available resources.
Answer: B,C
Explanation:
In conserve mode, FortiGate restricts configuration changes to preserve system stability. When IPS fail-open is enabled, FortiGate continues forwarding traffic without IPS inspection during resource constraints (conserve mode).
NEW QUESTION # 79
A network administrator enabled antivirus and selected an SSL inspection profile on a firewall policy. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and does not block the file, allowing it to be downloaded.
The administrator confirms that the traffic matches the configured firewall policy. What are two reasons for the failed virus detection by FortiGate? (Choose two.)
- A. The website is exempted from SSL inspection.
- B. The El CAR test file exceeds the protocol options oversize limit.
- C. The selected SSL inspection profile has certificate inspection enabled.
- D. The browser does not trust the FortiGate self-signed CA certificate.
Answer: A,D
NEW QUESTION # 80
Refer to the exhibit.
The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile.
An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category.
What are two solutions for satisfying the requirement? (Choose two.)
- A. Set the Freeware and Software Downloads category Action to Warning.
- B. Configure a separate firewall policy with action Deny and an FQDN address object for*.download.com as destination address.
- C. Configure a web override rating for download.com and select Malicious Websites as the subcategory.
- D. Configure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.
Answer: B,D
Explanation:
Creating a static URL filter to block download.com specifically allows blocking that site without affecting the entire category.
Using a separate firewall policy with a Deny action for an FQDN address object matching download.com can also block the site while allowing others in the same category.
NEW QUESTION # 81
You are encountering connectivity problems caused by intermediate devices blocking IPsec traffic.
In which two ways can you effectively resolve the problem? (Choose two.)
- A. You should use the protocol IKEv2.
- B. You can use SSL VPN tunnel mode to prevent problems with blocked ESP and UDP ports (500 or 4500).
- C. You can configure a hub-and-spoke topology with SSL VPN tunnels to bypass blocked UDP ports.
- D. You can turn on fragmentation to fix large certificate negotiation problems.
Answer: B,C
Explanation:
The training is basically trying to point out the advantage of FortiGate's SSL VPN over IPSec VPN in situation where issues are caused by an intermediate device.
IPsec uses ESP and UDP 500 and 4500, so where these are blocked, SSL VPN tunnel mode shines because it uses HTTPS (443) and TLS by default (both TCP).
Again where UDP ports are blocked, SSL VPN shines (Tunnel mode Hub and Spoke) because it does not use UDP.
NEW QUESTION # 82
You are analyzing connectivity problems caused by intermediate devices blocking traffic in SSL VPN environment.
In which two ways can you effectively resolve the problem? (Choose two.)
- A. You can use SSL VPN tunnel mode to prevent problems with blocked ESP and UDP ports (500 or 4500).
- B. You can turn off IKE fragmentation to fix large certificate negotiation problems.
- C. You can configure a hub-and-spoke topology with SSL VPN tunnels to bypass blocked UDP ports.
- D. You should use IPsec to solve issues with fragment drops and large certificate exchanges.
Answer: A,B
Explanation:
Disabling IKE fragmentation helps resolve issues caused by intermediate devices blocking large fragmented packets during certificate negotiation.
Using SSL VPN tunnel mode encapsulates traffic over HTTPS, bypassing blocks on ESP and UDP ports commonly used by IPsec.
NEW QUESTION # 83
A FortiGate firewall policy is configured with active authentication, however, the user cannot authenticate when accessing a website.
Which protocol must FortiGate allow even though the user cannot authenticate?
- A. DNS
- B. TACASC+
- C. LDAP
- D. Kerberos
Answer: A
Explanation:
A firewall policy must allow a protocol in order to show the authentication dialog that is used in active authentication (such as HTTP/HTTPS/FTP/Telnet) and DNS.
NEW QUESTION # 84
Refer to the exhibit.
The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile.
An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category.
What are two solutions for satisfying the requirement? (Choose two.)
- A. Set the Freeware and Software Downloads category Action to Warning.
- B. Configure a separate firewall policy with action Deny and an FQDN address object for*.download.com as destination address.
- C. Configure a web override rating for download.com and select Malicious Websites as the subcategory.
- D. Configure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.
Answer: B,D
Explanation:
Creating a static URL filter to block download.com specifically allows blocking that site without affecting the entire category.
Using a separate firewall policy with a Deny action for an FQDN address object matching download.com can also block the site while allowing others in the same category.
NEW QUESTION # 85
An administrator configured a FortiGate device to act as a collector for agentless polling mode.
What must the administrator add to the FortiGate device to retrieve AD user group information?
- A. RADIUS server
- B. Keycloak server
- C. LDAP server
- D. TACACS server
Answer: C
Explanation:
If FortiGate is acting as a collector for agentless polling mode, you must select Poll Active Directory Server and configure the IP addresses and AD administrator credentials for each DC.
FortiGate uses LDAP to query AD to retrieve user group information. For this to happen, you must add the LDAP server to the Poll Active Directory Server configuration.
NEW QUESTION # 86
Refer to the exhibit.
Based on this partial configuration, what are the two possible outcomes when FortiGate enters conserve mode? (Choose two.)
- A. Administrators cannot change the configuration.
- B. FortiGate drops new sessions requiring inspection.
- C. FortiGate skips quarantine actions.
- D. Administrators must restart FortiGate to allow new session.
Answer: B,C
Explanation:
In fail-open mode, FortiGate skips quarantine actions to maintain traffic flow despite IPS or antivirus failures.
FortiGate drops new sessions that require inspection when in conserve mode and fail-open is enabled, to protect the network from potentially harmful traffic.
NEW QUESTION # 87
Refer to the exhibit.
FortiGate has two separate firewall policies for Sales and Engineering to access the same web server with the same security profiles.
Which action must the administrator perform to consolidate the two policies into one?
- A. Select port1 and port2 subnets in a single firewall policy.
- B. Enable Multiple Interface Policies to select port1 and port2 in the same firewall policy.
- C. Create an Interface Group that includes port1 and port2 to create a single firewall policy.
- D. Replace port1 and port2 with the any interface in a single firewall policy.
Answer: C
Explanation:
To consolidate two firewall policies that use different incoming interfaces (port1 and port2) but have the same destination, services, and security profiles, the administrator should create an Interface Group that includes both port1 and port2.
This allows a single firewall policy to apply to traffic from both interfaces, simplifying management while maintaining consistent security enforcement.
NEW QUESTION # 88
Which two statements are correct when FortiGate enters conserve mode? (Choose two.)
- A. FortiGate continues to run critical security actions, such as quarantine.
- B. FortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled.
- C. FortiGate refuses to accept configuration changes.
- D. FortiGate halts complete system operation and requires a reboot to regain available resources.
Answer: B,C
NEW QUESTION # 89
Based on the Exhibits:
A web filter profile configuration and firewall policy configuration are shown.
You are trying to access www.facebook.com, but you are redirected to a FortiGuard web filtering block page.
Based on the exhibits, what is the possible cause of the issue?
- A. The web rating override configuration is incorrect.
- B. For www.facebook.com, the URL filter action is incorrect.
- C. The firewall policy inspection mode is incorrect.
- D. The web filter profile feature set is configured incorrectly.
Answer: A
NEW QUESTION # 90
Refer to the exhibit. What would be the impact of these settings on the Server certificate SNI check configuration on FortiGate?
- A. FortiGate will close the connection if the SNI does not match the CN and SAN fields
- B. FortiGate will accept and use the CN in the server certificate for URL filtering if the SNI does not match the CN or SAN fields.
- C. FortiGate will accept the connection with a warning if the SNI does not match the CN or SAN fields.
- D. FortiGate will close the connection if the SNI does not match the CN or SAN fields.
Answer: A
Explanation:
With the Server certificate SNI check set to Strict, FortiGate enforces that the SNI must match either the Common Name (CN) or Subject Alternative Name (SAN) in the server certificate; otherwise, it closes the connection.
NEW QUESTION # 91
......
Fortinet FCP_FGT_AD-7.6 Exam Practice Test Questions: https://www.prep4sures.top/FCP_FGT_AD-7.6-exam-dumps-torrent.html
Free FCP_FGT_AD-7.6 Braindumps Download Updated: https://drive.google.com/open?id=1HcK-jJY02DBhQzHfMYLP-jL8LivAzT7Y