McAfee Secure

Exam Code: FCP_FGT_AD-7.6

Exam Name: FCP - FortiGate 7.6 Administrator

Certification Provider: Fortinet

Corresponding Certification: NSE4

Questions & Answers

Fortinet FCP_FGT_AD-7.6 Questions & Answers

Study with Up-To-Date REAL Exam Questions and Answers from the ACTUAL Test

Questions & Answers

128 Questions & Answers with Testing Engine

"FCP - FortiGate 7.6 Administrator Exam", also known as FCP_FGT_AD-7.6 exam, is a Fortinet certification exam.

Pass your tests with the always up-to-date FCP_FGT_AD-7.6 Exam Engine. Your FCP_FGT_AD-7.6 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Fortinet FCP_FGT_AD-7.6 Practice Test 103

Question 1020

At Merriton Biotechnology, the FortiGate 7.6 security administration team encounters the following authorized operational case: a guest internet link appears as eligible for private branch traffic because dissimilar links were placed in one broad SD-WAN selection pool. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which recurring review is most relevant to the same root risk?

  1. Audit priority after copying route objects
  2. Audit member zone assignments as new transports are added
  3. Monitor route withdrawal during interface maintenance
  4. Practice controlled failover for business-critical services

Explanation

Correct Answer

B:

Audit member zone assignments as new transports are added. This recurring practice addresses sd-wan per-zone segmentation because sD-WAN zones and service-member scope help separate connectivity roles. It reinforces the supported change to organize WAN members into suitable zones and restrict service rules by intended path rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Audit priority after copying route objects reduces recurrence of static route priority tie-breaker, rather than the observed sd-wan per-zone segmentation issue. The relevant preventive control for Merriton Biotechnology is: Audit member zone assignments as new transports are added. This distinction matters because sD-WAN zones and service-member scope help separate connectivity roles.

C:

Monitor route withdrawal during interface maintenance reduces recurrence of route table after interface failure, rather than the observed sd-wan per-zone segmentation issue. The relevant preventive control for Merriton Biotechnology is: Audit member zone assignments as new transports are added. This distinction matters because sD-WAN zones and service-member scope help separate connectivity roles.

D:

Practice controlled failover for business-critical services reduces recurrence of sd-wan preferred-member failover, rather than the observed sd-wan per-zone segmentation issue. The relevant preventive control for Merriton Biotechnology is: Audit member zone assignments as new transports are added. This distinction matters because sD-WAN zones and service-member scope help separate connectivity roles.

Question 1021

At Merriton Distribution, the FortiGate 7.6 security administration team encounters the following authorized operational case: interface monitoring marks the active broadband link up while its carrier loses DNS and application reachability upstream. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which FortiOS 7.6 administration action best addresses this incident?

  1. Use path-level SD-WAN performance SLA probes for the required destination category
  2. Add an appropriate more-specific blackhole route when no safe backup path exists
  3. Correct one device's upstream route and apply protected summaries or blackhole entries where appropriate
  4. Use supported SD-WAN spillover or load-based behavior consistent with the utilization objective

Explanation

Correct Answer

A:

Use path-level SD-WAN performance SLA probes for the required destination category. This targets sd-wan local-link versus full-path health: physical carrier does not establish usable application reachability beyond the provider edge. After applying the change, verify that an approved upstream outage marks the link ineligible for affected services. The Merriton Distribution case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

B:

Add an appropriate more-specific blackhole route when no safe backup path exists is a relevant remedy for a DIFFERENT problem—static blackhole route defense—when a summarized partner route disappears and packets for an internal private network unexpectedly follow the internet default route. In this Merriton Distribution case that is not the failing component. Here the correct intervention is to use path-level SD-WAN performance SLA probes for the required destination category because physical carrier does not establish usable application reachability beyond the provider edge.

C:

Correct one device's upstream route and apply protected summaries or blackhole entries where appropriate is a relevant remedy for a DIFFERENT problem—routing loop caused by opposing defaults—when a FortiGate and upstream router point their fallback default routes at each other and unknown destinations loop. In this Merriton Distribution case that is not the failing component. Here the correct intervention is to use path-level SD-WAN performance SLA probes for the required destination category because physical carrier does not establish usable application reachability beyond the provider edge.

D:

Use supported SD-WAN spillover or load-based behavior consistent with the utilization objective is a relevant remedy for a DIFFERENT problem—spillover on link utilization—when bulk backups saturate the primary ISP while the second healthy circuit remains idle. In this Merriton Distribution case that is not the failing component. Here the correct intervention is to use path-level SD-WAN performance SLA probes for the required destination category because physical carrier does not establish usable application reachability beyond the provider edge.

Question 1022

At Merriton Distribution, the FortiGate 7.6 security administration team encounters the following authorized operational case: interface monitoring marks the active broadband link up while its carrier loses DNS and application reachability upstream. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the primary mechanism responsible for the reported result?

  1. A protective blackhole route prevents a private prefix from falling through to a less-specific default route
  2. Mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss
  3. Physical carrier does not establish usable application reachability beyond the provider edge
  4. A priority-only rule may keep sending new sessions to one member regardless of load

Explanation

Correct Answer

C:

Physical carrier does not establish usable application reachability beyond the provider edge. The mechanism is relevant because the stated sd-wan local-link versus full-path health incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to use path-level SD-WAN performance SLA probes for the required destination category; verify it through this observed condition: an approved upstream outage marks the link ineligible for affected services.

Incorrect Answers

A:

A protective blackhole route prevents a private prefix from falling through to a less-specific default route explains a different situation, static blackhole route defense, where a summarized partner route disappears and packets for an internal private network unexpectedly follow the internet default route. It does not account for the specific observed sd-wan local-link versus full-path health condition at Merriton Distribution. The decisive mechanism here is: Physical carrier does not establish usable application reachability beyond the provider edge.

B:

Mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss explains a different situation, routing loop caused by opposing defaults, where a FortiGate and upstream router point their fallback default routes at each other and unknown destinations loop. It does not account for the specific observed sd-wan local-link versus full-path health condition at Merriton Distribution. The decisive mechanism here is: Physical carrier does not establish usable application reachability beyond the provider edge.

D:

A priority-only rule may keep sending new sessions to one member regardless of load explains a different situation, spillover on link utilization, where bulk backups saturate the primary ISP while the second healthy circuit remains idle. It does not account for the specific observed sd-wan local-link versus full-path health condition at Merriton Distribution. The decisive mechanism here is: Physical carrier does not establish usable application reachability beyond the provider edge.

Question 1023

At Merriton Distribution, the FortiGate 7.6 security administration team encounters the following authorized operational case: interface monitoring marks the active broadband link up while its carrier loses DNS and application reachability upstream. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which validation result would demonstrate that the specified incident has been resolved?

  1. An approved upstream outage marks the link ineligible for affected services
  2. A test toward the disconnected private prefix is dropped rather than sent to WAN
  3. A controlled unreachable-prefix trace stops safely rather than circulating between devices
  4. New bulk test flows use the alternate member after the documented threshold

Explanation

Correct Answer

A:

An approved upstream outage marks the link ineligible for affected services. This directly tests the corrective decision to use path-level SD-WAN performance SLA probes for the required destination category. It is a meaningful acceptance check because physical carrier does not establish usable application reachability beyond the provider edge. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

B:

A test toward the disconnected private prefix is dropped rather than sent to WAN would validate the separate control static blackhole route defense, not the fault reported for Merriton Distribution. To confirm this correction, the team instead needs: An approved upstream outage marks the link ineligible for affected services. That is the observable check related to sd-wan local-link versus full-path health.

C:

A controlled unreachable-prefix trace stops safely rather than circulating between devices would validate the separate control routing loop caused by opposing defaults, not the fault reported for Merriton Distribution. To confirm this correction, the team instead needs: An approved upstream outage marks the link ineligible for affected services. That is the observable check related to sd-wan local-link versus full-path health.

D:

New bulk test flows use the alternate member after the documented threshold would validate the separate control spillover on link utilization, not the fault reported for Merriton Distribution. To confirm this correction, the team instead needs: An approved upstream outage marks the link ineligible for affected services. That is the observable check related to sd-wan local-link versus full-path health.

Question 1024

At Merriton Distribution, the FortiGate 7.6 security administration team encounters the following authorized operational case: interface monitoring marks the active broadband link up while its carrier loses DNS and application reachability upstream. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which operational practice would most effectively prevent this specific fault?

  1. Review summary and blackhole coverage during site withdrawal
  2. Include end-to-end service probes in WAN availability metrics
  3. Review default route responsibilities at each network boundary
  4. Measure member utilization and tune spillover thresholds

Explanation

Correct Answer

B:

Include end-to-end service probes in WAN availability metrics. This recurring practice addresses sd-wan local-link versus full-path health because physical carrier does not establish usable application reachability beyond the provider edge. It reinforces the supported change to use path-level SD-WAN performance SLA probes for the required destination category rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Review summary and blackhole coverage during site withdrawal reduces recurrence of static blackhole route defense, rather than the observed sd-wan local-link versus full-path health issue. The relevant preventive control for Merriton Distribution is: Include end-to-end service probes in WAN availability metrics. This distinction matters because physical carrier does not establish usable application reachability beyond the provider edge.

C:

Review default route responsibilities at each network boundary reduces recurrence of routing loop caused by opposing defaults, rather than the observed sd-wan local-link versus full-path health issue. The relevant preventive control for Merriton Distribution is: Include end-to-end service probes in WAN availability metrics. This distinction matters because physical carrier does not establish usable application reachability beyond the provider edge.

D:

Measure member utilization and tune spillover thresholds reduces recurrence of spillover on link utilization, rather than the observed sd-wan local-link versus full-path health issue. The relevant preventive control for Merriton Distribution is: Include end-to-end service probes in WAN availability metrics. This distinction matters because physical carrier does not establish usable application reachability beyond the provider edge.

Question 1025

At Merriton Public Schools, the FortiGate 7.6 security administration team encounters the following authorized operational case: a newly added broadband member is marked unavailable because its SD-WAN gateway IP points to a former router. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the most appropriate first configuration correction for this case?

  1. Update interface addressing and dependent routes and confirm active connected prefixes
  2. Configure routes in the correct virtual domain and use explicit inter-VDOM links if needed
  3. Select suitable supported bandwidth-aware SD-WAN load-balancing weights
  4. Correct the member's interface gateway and verify underlay neighbor reachability

Explanation

Correct Answer

D:

Correct the member's interface gateway and verify underlay neighbor reachability. This targets sd-wan member gateway mismatch: a wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member. After applying the change, verify that the member becomes healthy and forwards a supervised flow to the intended upstream. The Merriton Public Schools case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Update interface addressing and dependent routes and confirm active connected prefixes is a relevant remedy for a DIFFERENT problem—connected route and interface state—when a FortiGate interface changes subnet but administrators expect the old connected network to remain routed. In this Merriton Public Schools case that is not the failing component. Here the correct intervention is to correct the member's interface gateway and verify underlay neighbor reachability because a wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member.

B:

Configure routes in the correct virtual domain and use explicit inter-VDOM links if needed is a relevant remedy for a DIFFERENT problem—route monitoring across vdoms—when a route is added within one VDOM while the application interfaces belong to a different VDOM routing table. In this Merriton Public Schools case that is not the failing component. Here the correct intervention is to correct the member's interface gateway and verify underlay neighbor reachability because a wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member.

C:

Select suitable supported bandwidth-aware SD-WAN load-balancing weights is a relevant remedy for a DIFFERENT problem—bandwidth-based load distribution—when two ISP links have very different capacities but an equal distribution policy sends too much traffic to the smaller link. In this Merriton Public Schools case that is not the failing component. Here the correct intervention is to correct the member's interface gateway and verify underlay neighbor reachability because a wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member.

Question 1026

At Merriton Public Schools, the FortiGate 7.6 security administration team encounters the following authorized operational case: a newly added broadband member is marked unavailable because its SD-WAN gateway IP points to a former router. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which diagnosis best distinguishes this case from other FortiOS problems?

  1. Connected routes derive from operational interface addressing and state, not static labels
  2. A wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member
  3. VDOMs maintain independent route contexts and do not automatically share forwarding entries
  4. Equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets

Explanation

Correct Answer

B:

A wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member. The mechanism is relevant because the stated sd-wan member gateway mismatch incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to correct the member's interface gateway and verify underlay neighbor reachability; verify it through this observed condition: the member becomes healthy and forwards a supervised flow to the intended upstream.

Incorrect Answers

A:

Connected routes derive from operational interface addressing and state, not static labels explains a different situation, connected route and interface state, where a FortiGate interface changes subnet but administrators expect the old connected network to remain routed. It does not account for the specific observed sd-wan member gateway mismatch condition at Merriton Public Schools. The decisive mechanism here is: A wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member.

C:

VDOMs maintain independent route contexts and do not automatically share forwarding entries explains a different situation, route monitoring across vdoms, where a route is added within one VDOM while the application interfaces belong to a different VDOM routing table. It does not account for the specific observed sd-wan member gateway mismatch condition at Merriton Public Schools. The decisive mechanism here is: A wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member.

D:

Equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets explains a different situation, bandwidth-based load distribution, where two ISP links have very different capacities but an equal distribution policy sends too much traffic to the smaller link. It does not account for the specific observed sd-wan member gateway mismatch condition at Merriton Public Schools. The decisive mechanism here is: A wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member.

Question 1027

At Merriton Public Schools, the FortiGate 7.6 security administration team encounters the following authorized operational case: a newly added broadband member is marked unavailable because its SD-WAN gateway IP points to a former router. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which controlled test outcome best proves that the required feature now works?

  1. The routing table contains only the intended connected subnets after change
  2. The expected route is visible in the correct VDOM and traffic follows its permitted path
  3. The larger link carries a proportionate amount of supervised load without saturating the smaller
  4. The member becomes healthy and forwards a supervised flow to the intended upstream

Explanation

Correct Answer

D:

The member becomes healthy and forwards a supervised flow to the intended upstream. This directly tests the corrective decision to correct the member's interface gateway and verify underlay neighbor reachability. It is a meaningful acceptance check because a wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

The routing table contains only the intended connected subnets after change would validate the separate control connected route and interface state, not the fault reported for Merriton Public Schools. To confirm this correction, the team instead needs: The member becomes healthy and forwards a supervised flow to the intended upstream. That is the observable check related to sd-wan member gateway mismatch.

B:

The expected route is visible in the correct VDOM and traffic follows its permitted path would validate the separate control route monitoring across vdoms, not the fault reported for Merriton Public Schools. To confirm this correction, the team instead needs: The member becomes healthy and forwards a supervised flow to the intended upstream. That is the observable check related to sd-wan member gateway mismatch.

C:

The larger link carries a proportionate amount of supervised load without saturating the smaller would validate the separate control bandwidth-based load distribution, not the fault reported for Merriton Public Schools. To confirm this correction, the team instead needs: The member becomes healthy and forwards a supervised flow to the intended upstream. That is the observable check related to sd-wan member gateway mismatch.

Question 1028

At Merriton Public Schools, the FortiGate 7.6 security administration team encounters the following authorized operational case: a newly added broadband member is marked unavailable because its SD-WAN gateway IP points to a former router. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What continuing control matches this firewall administration scenario?

  1. Revalidate gateways after ISP equipment replacement
  2. Review route impact when renumbering FortiGate VLAN interfaces
  3. Label VDOM context in all routing work instructions
  4. Recalibrate link weights after bandwidth contract changes

Explanation

Correct Answer

A:

Revalidate gateways after ISP equipment replacement. This recurring practice addresses sd-wan member gateway mismatch because a wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member. It reinforces the supported change to correct the member's interface gateway and verify underlay neighbor reachability rather than relying on an unrelated periodic audit.

Incorrect Answers

B:

Review route impact when renumbering FortiGate VLAN interfaces reduces recurrence of connected route and interface state, rather than the observed sd-wan member gateway mismatch issue. The relevant preventive control for Merriton Public Schools is: Revalidate gateways after ISP equipment replacement. This distinction matters because a wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member.

C:

Label VDOM context in all routing work instructions reduces recurrence of route monitoring across vdoms, rather than the observed sd-wan member gateway mismatch issue. The relevant preventive control for Merriton Public Schools is: Revalidate gateways after ISP equipment replacement. This distinction matters because a wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member.

D:

Recalibrate link weights after bandwidth contract changes reduces recurrence of bandwidth-based load distribution, rather than the observed sd-wan member gateway mismatch issue. The relevant preventive control for Merriton Public Schools is: Revalidate gateways after ISP equipment replacement. This distinction matters because a wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member.

Question 1029

At Merriton Insurance, the FortiGate 7.6 security administration team encounters the following authorized operational case: users report intermittent slow internet but operations inspects only the current green member state. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which supported FortiGate response most directly resolves the stated requirement?

  1. Correct next-hop address or interface membership and validate ARP resolution
  2. Review historical SD-WAN SLA latency, jitter and loss events for the affected period
  3. Add the supported WAN interface to the intended SD-WAN zone and verify its gateway settings
  4. Narrow the SD-WAN service rule source to the intended corporate networks

Explanation

Correct Answer

B:

Review historical SD-WAN SLA latency, jitter and loss events for the affected period. This targets sd-wan diagnostic sla history: a present healthy status does not exclude earlier performance deterioration. After applying the change, verify that the archived SLA evidence correlates with a reproduced quality incident. The Merriton Insurance case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Correct next-hop address or interface membership and validate ARP resolution is a relevant remedy for a DIFFERENT problem—next-hop arp resolution—when a valid static route remains installed but traffic fails because the upstream next-hop IP is not on the reachable VLAN. In this Merriton Insurance case that is not the failing component. Here the correct intervention is to review historical SD-WAN SLA latency, jitter and loss events for the affected period because a present healthy status does not exclude earlier performance deterioration.

C:

Add the supported WAN interface to the intended SD-WAN zone and verify its gateway settings is a relevant remedy for a DIFFERENT problem—sd-wan member underlay onboarding—when a new secondary ISP circuit comes online but FortiGate SD-WAN never sends traffic through it because the physical interface is not configured as a member. In this Merriton Insurance case that is not the failing component. Here the correct intervention is to review historical SD-WAN SLA latency, jitter and loss events for the affected period because a present healthy status does not exclude earlier performance deterioration.

D:

Narrow the SD-WAN service rule source to the intended corporate networks is a relevant remedy for a DIFFERENT problem—sd-wan source network matching—when a guest VLAN follows the corporate MPLS WAN rule because its SD-WAN source condition was configured too broadly. In this Merriton Insurance case that is not the failing component. Here the correct intervention is to review historical SD-WAN SLA latency, jitter and loss events for the affected period because a present healthy status does not exclude earlier performance deterioration.

Question 1030

At Merriton Insurance, the FortiGate 7.6 security administration team encounters the following authorized operational case: users report intermittent slow internet but operations inspects only the current green member state. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What root condition most directly explains the described FortiGate symptom?

  1. A route entry does not guarantee layer-two adjacency to its gateway
  2. A present healthy status does not exclude earlier performance deterioration
  3. An up physical interface is not automatically eligible for SD-WAN service selection
  4. Service selection can match more than one subnet when broad source objects are used

Explanation

Correct Answer

B:

A present healthy status does not exclude earlier performance deterioration. The mechanism is relevant because the stated sd-wan diagnostic sla history incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to review historical SD-WAN SLA latency, jitter and loss events for the affected period; verify it through this observed condition: the archived SLA evidence correlates with a reproduced quality incident.

Incorrect Answers

A:

A route entry does not guarantee layer-two adjacency to its gateway explains a different situation, next-hop arp resolution, where a valid static route remains installed but traffic fails because the upstream next-hop IP is not on the reachable VLAN. It does not account for the specific observed sd-wan diagnostic sla history condition at Merriton Insurance. The decisive mechanism here is: A present healthy status does not exclude earlier performance deterioration.

C:

An up physical interface is not automatically eligible for SD-WAN service selection explains a different situation, sd-wan member underlay onboarding, where a new secondary ISP circuit comes online but FortiGate SD-WAN never sends traffic through it because the physical interface is not configured as a member. It does not account for the specific observed sd-wan diagnostic sla history condition at Merriton Insurance. The decisive mechanism here is: A present healthy status does not exclude earlier performance deterioration.

D:

Service selection can match more than one subnet when broad source objects are used explains a different situation, sd-wan source network matching, where a guest VLAN follows the corporate MPLS WAN rule because its SD-WAN source condition was configured too broadly. It does not account for the specific observed sd-wan diagnostic sla history condition at Merriton Insurance. The decisive mechanism here is: A present healthy status does not exclude earlier performance deterioration.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests