McAfee Secure

Exam Code: FCP_FGT_AD-7.6

Exam Name: FCP - FortiGate 7.6 Administrator

Certification Provider: Fortinet

Corresponding Certification: NSE4

Questions & Answers

Fortinet FCP_FGT_AD-7.6 Questions & Answers

Study with Up-To-Date REAL Exam Questions and Answers from the ACTUAL Test

Questions & Answers

128 Questions & Answers with Testing Engine

"FCP - FortiGate 7.6 Administrator Exam", also known as FCP_FGT_AD-7.6 exam, is a Fortinet certification exam.

Pass your tests with the always up-to-date FCP_FGT_AD-7.6 Exam Engine. Your FCP_FGT_AD-7.6 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Fortinet FCP_FGT_AD-7.6 Practice Test 100

Question 990

At Merriton Regional Hospital, the FortiGate 7.6 security administration team encounters the following authorized operational case: a rule forces all finance traffic onto one provider and keeps attempting the unhealthy member during a fault. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What root condition most directly explains the described FortiGate symptom?

  1. A blackhole route intentionally discards matching packets even when an apparently usable default exists
  2. SD-WAN zones and service-member scope help separate connectivity roles
  3. A fixed preferred member without relevant health conditions can remain selected despite degraded service
  4. Explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable

Explanation

Correct Answer

C:

A fixed preferred member without relevant health conditions can remain selected despite degraded service. The mechanism is relevant because the stated sd-wan preferred-member failover incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to configure supported SLA-aware primary and fallback member behavior; verify it through this observed condition: an authorized loss test moves new finance sessions to the approved healthy backup.

Incorrect Answers

A:

A blackhole route intentionally discards matching packets even when an apparently usable default exists explains a different situation, static route blackhole diagnosis, where firewall traffic stops at a static blackhole rule added as a temporary workaround and later forgotten. It does not account for the specific observed sd-wan preferred-member failover condition at Merriton Regional Hospital. The decisive mechanism here is: A fixed preferred member without relevant health conditions can remain selected despite degraded service.

B:

SD-WAN zones and service-member scope help separate connectivity roles explains a different situation, sd-wan per-zone segmentation, where a guest internet link appears as eligible for private branch traffic because dissimilar links were placed in one broad SD-WAN selection pool. It does not account for the specific observed sd-wan preferred-member failover condition at Merriton Regional Hospital. The decisive mechanism here is: A fixed preferred member without relevant health conditions can remain selected despite degraded service.

D:

Explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable explains a different situation, sd-wan preferred route during maintenance, where an operator disables a WAN member for planned maintenance but the documentation says the service is pinned to that member with no fallback. It does not account for the specific observed sd-wan preferred-member failover condition at Merriton Regional Hospital. The decisive mechanism here is: A fixed preferred member without relevant health conditions can remain selected despite degraded service.

Question 991

At Merriton Regional Hospital, the FortiGate 7.6 security administration team encounters the following authorized operational case: a rule forces all finance traffic onto one provider and keeps attempting the unhealthy member during a fault. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which observable result should the administrator require before closing this change?

  1. A corrected route forwards the intended private flow while protected prefixes remain contained
  2. An authorized loss test moves new finance sessions to the approved healthy backup
  3. A protected branch flow cannot select the guest-only internet interface
  4. An authorized maintenance test continues service on the approved alternate path

Explanation

Correct Answer

B:

An authorized loss test moves new finance sessions to the approved healthy backup. This directly tests the corrective decision to configure supported SLA-aware primary and fallback member behavior. It is a meaningful acceptance check because a fixed preferred member without relevant health conditions can remain selected despite degraded service. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

A corrected route forwards the intended private flow while protected prefixes remain contained would validate the separate control static route blackhole diagnosis, not the fault reported for Merriton Regional Hospital. To confirm this correction, the team instead needs: An authorized loss test moves new finance sessions to the approved healthy backup. That is the observable check related to sd-wan preferred-member failover.

C:

A protected branch flow cannot select the guest-only internet interface would validate the separate control sd-wan per-zone segmentation, not the fault reported for Merriton Regional Hospital. To confirm this correction, the team instead needs: An authorized loss test moves new finance sessions to the approved healthy backup. That is the observable check related to sd-wan preferred-member failover.

D:

An authorized maintenance test continues service on the approved alternate path would validate the separate control sd-wan preferred route during maintenance, not the fault reported for Merriton Regional Hospital. To confirm this correction, the team instead needs: An authorized loss test moves new finance sessions to the approved healthy backup. That is the observable check related to sd-wan preferred-member failover.

Question 992

At Merriton Regional Hospital, the FortiGate 7.6 security administration team encounters the following authorized operational case: a rule forces all finance traffic onto one provider and keeps attempting the unhealthy member during a fault. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which ongoing safeguard best reduces recurrence of this problem?

  1. Assign expiry and change ownership to temporary routing blocks
  2. Practice controlled failover for business-critical services
  3. Audit member zone assignments as new transports are added
  4. Create WAN maintenance runbooks with rollback and SLA verification

Explanation

Correct Answer

B:

Practice controlled failover for business-critical services. This recurring practice addresses sd-wan preferred-member failover because a fixed preferred member without relevant health conditions can remain selected despite degraded service. It reinforces the supported change to configure supported SLA-aware primary and fallback member behavior rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Assign expiry and change ownership to temporary routing blocks reduces recurrence of static route blackhole diagnosis, rather than the observed sd-wan preferred-member failover issue. The relevant preventive control for Merriton Regional Hospital is: Practice controlled failover for business-critical services. This distinction matters because a fixed preferred member without relevant health conditions can remain selected despite degraded service.

C:

Audit member zone assignments as new transports are added reduces recurrence of sd-wan per-zone segmentation, rather than the observed sd-wan preferred-member failover issue. The relevant preventive control for Merriton Regional Hospital is: Practice controlled failover for business-critical services. This distinction matters because a fixed preferred member without relevant health conditions can remain selected despite degraded service.

D:

Create WAN maintenance runbooks with rollback and SLA verification reduces recurrence of sd-wan preferred route during maintenance, rather than the observed sd-wan preferred-member failover issue. The relevant preventive control for Merriton Regional Hospital is: Practice controlled failover for business-critical services. This distinction matters because a fixed preferred member without relevant health conditions can remain selected despite degraded service.

Question 993

At Merriton Retail Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: bulk backups saturate the primary ISP while the second healthy circuit remains idle. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What action should the network security administrator take for this specific fault?

  1. Review supported ECMP settings and choose a deliberate load-balancing or preferred-path design
  2. Use supported SD-WAN spillover or load-based behavior consistent with the utilization objective
  3. Use path-level SD-WAN performance SLA probes for the required destination category
  4. Align supported static or dynamic routes with the intended SD-WAN zone and service rules

Explanation

Correct Answer

B:

Use supported SD-WAN spillover or load-based behavior consistent with the utilization objective. This targets spillover on link utilization: a priority-only rule may keep sending new sessions to one member regardless of load. After applying the change, verify that new bulk test flows use the alternate member after the documented threshold. The Merriton Retail Group case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Review supported ECMP settings and choose a deliberate load-balancing or preferred-path design is a relevant remedy for a DIFFERENT problem—ecmp equal-cost forwarding—when two equivalent WAN routes are installed but traffic is spread across them unexpectedly. In this Merriton Retail Group case that is not the failing component. Here the correct intervention is to use supported SD-WAN spillover or load-based behavior consistent with the utilization objective because a priority-only rule may keep sending new sessions to one member regardless of load.

C:

Use path-level SD-WAN performance SLA probes for the required destination category is a relevant remedy for a DIFFERENT problem—sd-wan local-link versus full-path health—when interface monitoring marks the active broadband link up while its carrier loses DNS and application reachability upstream. In this Merriton Retail Group case that is not the failing component. Here the correct intervention is to use supported SD-WAN spillover or load-based behavior consistent with the utilization objective because a priority-only rule may keep sending new sessions to one member regardless of load.

D:

Align supported static or dynamic routes with the intended SD-WAN zone and service rules is a relevant remedy for a DIFFERENT problem—sd-wan routing into zone—when an SD-WAN rule selects a preferred member but the routing table still sends traffic directly through a standalone WAN interface. In this Merriton Retail Group case that is not the failing component. Here the correct intervention is to use supported SD-WAN spillover or load-based behavior consistent with the utilization objective because a priority-only rule may keep sending new sessions to one member regardless of load.

Question 994

At Merriton Retail Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: bulk backups saturate the primary ISP while the second healthy circuit remains idle. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which interpretation of the observed failure is technically supported?

  1. Equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes
  2. Physical carrier does not establish usable application reachability beyond the provider edge
  3. SD-WAN link steering needs a viable route to the SD-WAN context as well as a matching service rule
  4. A priority-only rule may keep sending new sessions to one member regardless of load

Explanation

Correct Answer

D:

A priority-only rule may keep sending new sessions to one member regardless of load. The mechanism is relevant because the stated spillover on link utilization incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to use supported SD-WAN spillover or load-based behavior consistent with the utilization objective; verify it through this observed condition: new bulk test flows use the alternate member after the documented threshold.

Incorrect Answers

A:

Equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes explains a different situation, ecmp equal-cost forwarding, where two equivalent WAN routes are installed but traffic is spread across them unexpectedly. It does not account for the specific observed spillover on link utilization condition at Merriton Retail Group. The decisive mechanism here is: A priority-only rule may keep sending new sessions to one member regardless of load.

B:

Physical carrier does not establish usable application reachability beyond the provider edge explains a different situation, sd-wan local-link versus full-path health, where interface monitoring marks the active broadband link up while its carrier loses DNS and application reachability upstream. It does not account for the specific observed spillover on link utilization condition at Merriton Retail Group. The decisive mechanism here is: A priority-only rule may keep sending new sessions to one member regardless of load.

C:

SD-WAN link steering needs a viable route to the SD-WAN context as well as a matching service rule explains a different situation, sd-wan routing into zone, where an SD-WAN rule selects a preferred member but the routing table still sends traffic directly through a standalone WAN interface. It does not account for the specific observed spillover on link utilization condition at Merriton Retail Group. The decisive mechanism here is: A priority-only rule may keep sending new sessions to one member regardless of load.

Question 995

At Merriton Retail Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: bulk backups saturate the primary ISP while the second healthy circuit remains idle. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which supervised observation would best verify the intended correction?

  1. New bulk test flows use the alternate member after the documented threshold
  2. A series of controlled sessions uses the documented link-selection behavior
  3. An approved upstream outage marks the link ineligible for affected services
  4. A route lookup and test session both select the configured SD-WAN path

Explanation

Correct Answer

A:

New bulk test flows use the alternate member after the documented threshold. This directly tests the corrective decision to use supported SD-WAN spillover or load-based behavior consistent with the utilization objective. It is a meaningful acceptance check because a priority-only rule may keep sending new sessions to one member regardless of load. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

B:

A series of controlled sessions uses the documented link-selection behavior would validate the separate control ecmp equal-cost forwarding, not the fault reported for Merriton Retail Group. To confirm this correction, the team instead needs: New bulk test flows use the alternate member after the documented threshold. That is the observable check related to spillover on link utilization.

C:

An approved upstream outage marks the link ineligible for affected services would validate the separate control sd-wan local-link versus full-path health, not the fault reported for Merriton Retail Group. To confirm this correction, the team instead needs: New bulk test flows use the alternate member after the documented threshold. That is the observable check related to spillover on link utilization.

D:

A route lookup and test session both select the configured SD-WAN path would validate the separate control sd-wan routing into zone, not the fault reported for Merriton Retail Group. To confirm this correction, the team instead needs: New bulk test flows use the alternate member after the documented threshold. That is the observable check related to spillover on link utilization.

Question 996

At Merriton Retail Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: bulk backups saturate the primary ISP while the second healthy circuit remains idle. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What preventive control should the FortiGate operations team maintain?

  1. Record ECMP expectations when adding same-distance routes
  2. Include end-to-end service probes in WAN availability metrics
  3. Measure member utilization and tune spillover thresholds
  4. Test route and SD-WAN rule interaction during WAN migrations

Explanation

Correct Answer

C:

Measure member utilization and tune spillover thresholds. This recurring practice addresses spillover on link utilization because a priority-only rule may keep sending new sessions to one member regardless of load. It reinforces the supported change to use supported SD-WAN spillover or load-based behavior consistent with the utilization objective rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Record ECMP expectations when adding same-distance routes reduces recurrence of ecmp equal-cost forwarding, rather than the observed spillover on link utilization issue. The relevant preventive control for Merriton Retail Group is: Measure member utilization and tune spillover thresholds. This distinction matters because a priority-only rule may keep sending new sessions to one member regardless of load.

B:

Include end-to-end service probes in WAN availability metrics reduces recurrence of sd-wan local-link versus full-path health, rather than the observed spillover on link utilization issue. The relevant preventive control for Merriton Retail Group is: Measure member utilization and tune spillover thresholds. This distinction matters because a priority-only rule may keep sending new sessions to one member regardless of load.

D:

Test route and SD-WAN rule interaction during WAN migrations reduces recurrence of sd-wan routing into zone, rather than the observed spillover on link utilization issue. The relevant preventive control for Merriton Retail Group is: Measure member utilization and tune spillover thresholds. This distinction matters because a priority-only rule may keep sending new sessions to one member regardless of load.

Question 997

At Merriton Transport Authority, the FortiGate 7.6 security administration team encounters the following authorized operational case: two ISP links have very different capacities but an equal distribution policy sends too much traffic to the smaller link. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which technically justified operational change fits the observed symptoms?

  1. Use suitable supported link-monitor and route withdrawal or SD-WAN health checks
  2. Select suitable supported bandwidth-aware SD-WAN load-balancing weights
  3. Correct the member's interface gateway and verify underlay neighbor reachability
  4. Configure suitable performance SLA packet-loss thresholds and a rule that respects service quality

Explanation

Correct Answer

B:

Select suitable supported bandwidth-aware SD-WAN load-balancing weights. This targets bandwidth-based load distribution: equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets. After applying the change, verify that the larger link carries a proportionate amount of supervised load without saturating the smaller. The Merriton Transport Authority case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Use suitable supported link-monitor and route withdrawal or SD-WAN health checks is a relevant remedy for a DIFFERENT problem—static route failover link monitoring—when a primary route stays active when its ISP gateway responds locally but the service beyond the ISP fails. In this Merriton Transport Authority case that is not the failing component. Here the correct intervention is to select suitable supported bandwidth-aware SD-WAN load-balancing weights because equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets.

C:

Correct the member's interface gateway and verify underlay neighbor reachability is a relevant remedy for a DIFFERENT problem—sd-wan member gateway mismatch—when a newly added broadband member is marked unavailable because its SD-WAN gateway IP points to a former router. In this Merriton Transport Authority case that is not the failing component. Here the correct intervention is to select suitable supported bandwidth-aware SD-WAN load-balancing weights because equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets.

D:

Configure suitable performance SLA packet-loss thresholds and a rule that respects service quality is a relevant remedy for a DIFFERENT problem—sla packet loss threshold—when voice traffic remains on a lossy ISP circuit because SD-WAN health checks monitor only link availability. In this Merriton Transport Authority case that is not the failing component. Here the correct intervention is to select suitable supported bandwidth-aware SD-WAN load-balancing weights because equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets.

Question 998

At Merriton Transport Authority, the FortiGate 7.6 security administration team encounters the following authorized operational case: two ISP links have very different capacities but an equal distribution policy sends too much traffic to the smaller link. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which technical explanation best identifies the underlying FortiGate behavior?

  1. An interface's carrier state does not prove upstream end-to-end reachability
  2. Equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets
  3. A wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member
  4. A link can remain up while packet loss makes real-time applications unusable

Explanation

Correct Answer

B:

Equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets. The mechanism is relevant because the stated bandwidth-based load distribution incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to select suitable supported bandwidth-aware SD-WAN load-balancing weights; verify it through this observed condition: the larger link carries a proportionate amount of supervised load without saturating the smaller.

Incorrect Answers

A:

An interface's carrier state does not prove upstream end-to-end reachability explains a different situation, static route failover link monitoring, where a primary route stays active when its ISP gateway responds locally but the service beyond the ISP fails. It does not account for the specific observed bandwidth-based load distribution condition at Merriton Transport Authority. The decisive mechanism here is: Equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets.

C:

A wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member explains a different situation, sd-wan member gateway mismatch, where a newly added broadband member is marked unavailable because its SD-WAN gateway IP points to a former router. It does not account for the specific observed bandwidth-based load distribution condition at Merriton Transport Authority. The decisive mechanism here is: Equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets.

D:

A link can remain up while packet loss makes real-time applications unusable explains a different situation, sla packet loss threshold, where voice traffic remains on a lossy ISP circuit because SD-WAN health checks monitor only link availability. It does not account for the specific observed bandwidth-based load distribution condition at Merriton Transport Authority. The decisive mechanism here is: Equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets.

Question 999

At Merriton Transport Authority, the FortiGate 7.6 security administration team encounters the following authorized operational case: two ISP links have very different capacities but an equal distribution policy sends too much traffic to the smaller link. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What acceptance evidence most directly confirms the expected policy or network behavior?

  1. A controlled remote outage removes or deprioritizes the unusable path and uses the backup
  2. The member becomes healthy and forwards a supervised flow to the intended upstream
  3. A controlled packet-loss test shifts new voice traffic to the healthier eligible link
  4. The larger link carries a proportionate amount of supervised load without saturating the smaller

Explanation

Correct Answer

D:

The larger link carries a proportionate amount of supervised load without saturating the smaller. This directly tests the corrective decision to select suitable supported bandwidth-aware SD-WAN load-balancing weights. It is a meaningful acceptance check because equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

A controlled remote outage removes or deprioritizes the unusable path and uses the backup would validate the separate control static route failover link monitoring, not the fault reported for Merriton Transport Authority. To confirm this correction, the team instead needs: The larger link carries a proportionate amount of supervised load without saturating the smaller. That is the observable check related to bandwidth-based load distribution.

B:

The member becomes healthy and forwards a supervised flow to the intended upstream would validate the separate control sd-wan member gateway mismatch, not the fault reported for Merriton Transport Authority. To confirm this correction, the team instead needs: The larger link carries a proportionate amount of supervised load without saturating the smaller. That is the observable check related to bandwidth-based load distribution.

C:

A controlled packet-loss test shifts new voice traffic to the healthier eligible link would validate the separate control sla packet loss threshold, not the fault reported for Merriton Transport Authority. To confirm this correction, the team instead needs: The larger link carries a proportionate amount of supervised load without saturating the smaller. That is the observable check related to bandwidth-based load distribution.

Question 1000

At Merriton Transport Authority, the FortiGate 7.6 security administration team encounters the following authorized operational case: two ISP links have very different capacities but an equal distribution policy sends too much traffic to the smaller link. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which recurring review is most relevant to the same root risk?

  1. Test remote failures rather than only unplugging local cables
  2. Revalidate gateways after ISP equipment replacement
  3. Recalibrate link weights after bandwidth contract changes
  4. Tune SLA thresholds against measured voice quality

Explanation

Correct Answer

C:

Recalibrate link weights after bandwidth contract changes. This recurring practice addresses bandwidth-based load distribution because equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets. It reinforces the supported change to select suitable supported bandwidth-aware SD-WAN load-balancing weights rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Test remote failures rather than only unplugging local cables reduces recurrence of static route failover link monitoring, rather than the observed bandwidth-based load distribution issue. The relevant preventive control for Merriton Transport Authority is: Recalibrate link weights after bandwidth contract changes. This distinction matters because equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets.

B:

Revalidate gateways after ISP equipment replacement reduces recurrence of sd-wan member gateway mismatch, rather than the observed bandwidth-based load distribution issue. The relevant preventive control for Merriton Transport Authority is: Recalibrate link weights after bandwidth contract changes. This distinction matters because equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets.

D:

Tune SLA thresholds against measured voice quality reduces recurrence of sla packet loss threshold, rather than the observed bandwidth-based load distribution issue. The relevant preventive control for Merriton Transport Authority is: Recalibrate link weights after bandwidth contract changes. This distinction matters because equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests