McAfee Secure

Exam Code: FCP_FGT_AD-7.6

Exam Name: FCP - FortiGate 7.6 Administrator

Certification Provider: Fortinet

Corresponding Certification: NSE4

Questions & Answers

Fortinet FCP_FGT_AD-7.6 Questions & Answers

Study with Up-To-Date REAL Exam Questions and Answers from the ACTUAL Test

Questions & Answers

128 Questions & Answers with Testing Engine

"FCP - FortiGate 7.6 Administrator Exam", also known as FCP_FGT_AD-7.6 exam, is a Fortinet certification exam.

Pass your tests with the always up-to-date FCP_FGT_AD-7.6 Exam Engine. Your FCP_FGT_AD-7.6 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Fortinet FCP_FGT_AD-7.6 Practice Test 105

Question 1040

At Merriton Aviation, the FortiGate 7.6 security administration team encounters the following authorized operational case: one WAN link reaches sustained near-maximum bandwidth but the monitoring plan tracks only loss and latency. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which recurring review is most relevant to the same root risk?

  1. Forecast traffic growth and link contract limits
  2. Assign expiry and change ownership to temporary routing blocks
  3. Tune SLA thresholds against measured voice quality
  4. Verify markings and rule order across the path

Explanation

Correct Answer

A:

Forecast traffic growth and link contract limits. This recurring practice addresses sd-wan carrier capacity headroom because a link can approach congestion before existing SLA probes show a definitive outage. It reinforces the supported change to include throughput and utilization capacity monitoring when tuning SD-WAN steering rather than relying on an unrelated periodic audit.

Incorrect Answers

B:

Assign expiry and change ownership to temporary routing blocks reduces recurrence of static route blackhole diagnosis, rather than the observed sd-wan carrier capacity headroom issue. The relevant preventive control for Merriton Aviation is: Forecast traffic growth and link contract limits. This distinction matters because a link can approach congestion before existing SLA probes show a definitive outage.

C:

Tune SLA thresholds against measured voice quality reduces recurrence of sla packet loss threshold, rather than the observed sd-wan carrier capacity headroom issue. The relevant preventive control for Merriton Aviation is: Forecast traffic growth and link contract limits. This distinction matters because a link can approach congestion before existing SLA probes show a definitive outage.

D:

Verify markings and rule order across the path reduces recurrence of sd-wan dscp handling, rather than the observed sd-wan carrier capacity headroom issue. The relevant preventive control for Merriton Aviation is: Forecast traffic growth and link contract limits. This distinction matters because a link can approach congestion before existing SLA probes show a definitive outage.

Question 1041

At Northbridge Financial Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: an operator disables a WAN member for planned maintenance but the documentation says the service is pinned to that member with no fallback. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which FortiOS 7.6 administration action best addresses this incident?

  1. Review supported ECMP settings and choose a deliberate load-balancing or preferred-path design
  2. Set a supported maintenance-safe alternate member or route before draining the primary
  3. Add a relevant latency SLA target and suitable service rule for the affected traffic
  4. Tune supported health-check failure and recovery thresholds for stable link selection

Explanation

Correct Answer

B:

Set a supported maintenance-safe alternate member or route before draining the primary. This targets sd-wan preferred route during maintenance: explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable. After applying the change, verify that an authorized maintenance test continues service on the approved alternate path. The Northbridge Financial Services case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Review supported ECMP settings and choose a deliberate load-balancing or preferred-path design is a relevant remedy for a DIFFERENT problem—ecmp equal-cost forwarding—when two equivalent WAN routes are installed but traffic is spread across them unexpectedly. In this Northbridge Financial Services case that is not the failing component. Here the correct intervention is to set a supported maintenance-safe alternate member or route before draining the primary because explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable.

C:

Add a relevant latency SLA target and suitable service rule for the affected traffic is a relevant remedy for a DIFFERENT problem—sla latency limit—when remote desktop sessions suffer delay when the lowest-cost WAN meets connectivity but exceeds the allowed round-trip latency. In this Northbridge Financial Services case that is not the failing component. Here the correct intervention is to set a supported maintenance-safe alternate member or route before draining the primary because explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable.

D:

Tune supported health-check failure and recovery thresholds for stable link selection is a relevant remedy for a DIFFERENT problem—sd-wan failover recovery hysteresis—when a flapping WAN repeatedly regains preferred status and disrupts interactive connections. In this Northbridge Financial Services case that is not the failing component. Here the correct intervention is to set a supported maintenance-safe alternate member or route before draining the primary because explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable.

Question 1042

At Northbridge Financial Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: an operator disables a WAN member for planned maintenance but the documentation says the service is pinned to that member with no fallback. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the primary mechanism responsible for the reported result?

  1. Equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes
  2. Basic link status alone cannot distinguish a high-latency but reachable WAN
  3. Explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable
  4. Overly sensitive probes can alternate link eligibility during transient packet loss

Explanation

Correct Answer

C:

Explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable. The mechanism is relevant because the stated sd-wan preferred route during maintenance incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to set a supported maintenance-safe alternate member or route before draining the primary; verify it through this observed condition: an authorized maintenance test continues service on the approved alternate path.

Incorrect Answers

A:

Equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes explains a different situation, ecmp equal-cost forwarding, where two equivalent WAN routes are installed but traffic is spread across them unexpectedly. It does not account for the specific observed sd-wan preferred route during maintenance condition at Northbridge Financial Services. The decisive mechanism here is: Explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable.

B:

Basic link status alone cannot distinguish a high-latency but reachable WAN explains a different situation, sla latency limit, where remote desktop sessions suffer delay when the lowest-cost WAN meets connectivity but exceeds the allowed round-trip latency. It does not account for the specific observed sd-wan preferred route during maintenance condition at Northbridge Financial Services. The decisive mechanism here is: Explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable.

D:

Overly sensitive probes can alternate link eligibility during transient packet loss explains a different situation, sd-wan failover recovery hysteresis, where a flapping WAN repeatedly regains preferred status and disrupts interactive connections. It does not account for the specific observed sd-wan preferred route during maintenance condition at Northbridge Financial Services. The decisive mechanism here is: Explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable.

Question 1043

At Northbridge Financial Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: an operator disables a WAN member for planned maintenance but the documentation says the service is pinned to that member with no fallback. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which validation result would demonstrate that the specified incident has been resolved?

  1. An authorized maintenance test continues service on the approved alternate path
  2. A series of controlled sessions uses the documented link-selection behavior
  3. A supervised delay condition causes the intended low-latency path selection
  4. A simulated intermittent outage produces the intended stable hold-down and recovery

Explanation

Correct Answer

A:

An authorized maintenance test continues service on the approved alternate path. This directly tests the corrective decision to set a supported maintenance-safe alternate member or route before draining the primary. It is a meaningful acceptance check because explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

B:

A series of controlled sessions uses the documented link-selection behavior would validate the separate control ecmp equal-cost forwarding, not the fault reported for Northbridge Financial Services. To confirm this correction, the team instead needs: An authorized maintenance test continues service on the approved alternate path. That is the observable check related to sd-wan preferred route during maintenance.

C:

A supervised delay condition causes the intended low-latency path selection would validate the separate control sla latency limit, not the fault reported for Northbridge Financial Services. To confirm this correction, the team instead needs: An authorized maintenance test continues service on the approved alternate path. That is the observable check related to sd-wan preferred route during maintenance.

D:

A simulated intermittent outage produces the intended stable hold-down and recovery would validate the separate control sd-wan failover recovery hysteresis, not the fault reported for Northbridge Financial Services. To confirm this correction, the team instead needs: An authorized maintenance test continues service on the approved alternate path. That is the observable check related to sd-wan preferred route during maintenance.

Question 1044

At Northbridge Financial Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: an operator disables a WAN member for planned maintenance but the documentation says the service is pinned to that member with no fallback. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which operational practice would most effectively prevent this specific fault?

  1. Create WAN maintenance runbooks with rollback and SLA verification
  2. Record ECMP expectations when adding same-distance routes
  3. Track SLA latency distributions across provider changes
  4. Monitor link flaps and adjust SLA stability thresholds

Explanation

Correct Answer

A:

Create WAN maintenance runbooks with rollback and SLA verification. This recurring practice addresses sd-wan preferred route during maintenance because explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable. It reinforces the supported change to set a supported maintenance-safe alternate member or route before draining the primary rather than relying on an unrelated periodic audit.

Incorrect Answers

B:

Record ECMP expectations when adding same-distance routes reduces recurrence of ecmp equal-cost forwarding, rather than the observed sd-wan preferred route during maintenance issue. The relevant preventive control for Northbridge Financial Services is: Create WAN maintenance runbooks with rollback and SLA verification. This distinction matters because explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable.

C:

Track SLA latency distributions across provider changes reduces recurrence of sla latency limit, rather than the observed sd-wan preferred route during maintenance issue. The relevant preventive control for Northbridge Financial Services is: Create WAN maintenance runbooks with rollback and SLA verification. This distinction matters because explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable.

D:

Monitor link flaps and adjust SLA stability thresholds reduces recurrence of sd-wan failover recovery hysteresis, rather than the observed sd-wan preferred route during maintenance issue. The relevant preventive control for Northbridge Financial Services is: Create WAN maintenance runbooks with rollback and SLA verification. This distinction matters because explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable.

Question 1045

At Northbridge Healthcare, the FortiGate 7.6 security administration team encounters the following authorized operational case: a new site-to-site IPsec tunnel never establishes after one peer changes its IKE encryption and hash proposal. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the most appropriate first configuration correction for this case?

  1. Align a secure supported phase-one IKE proposal on both peers using the FortiOS 7.6 configuration
  2. Add appropriate route-based interface policies for the required local-to-VPN and return directions
  3. Set the intended local IKE identifier and matching remote peer verification on both sides
  4. Create the appropriately limited reverse-direction tunnel firewall policy where business authorization permits

Explanation

Correct Answer

A:

Align a secure supported phase-one IKE proposal on both peers using the FortiOS 7.6 configuration. This targets ipsec ike proposal mismatch: iKE peers cannot negotiate an SA when there is no compatible cryptographic proposal. After applying the change, verify that iKE diagnostics show an established phase-one SA and an approved tunnel flow passes. The Northbridge Healthcare case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

B:

Add appropriate route-based interface policies for the required local-to-VPN and return directions is a relevant remedy for a DIFFERENT problem—route-based tunnel interface policy—when a route-based IPsec tunnel is up but users cannot reach the remote LAN because no firewall policy permits the tunnel interface pair. In this Northbridge Healthcare case that is not the failing component. Here the correct intervention is to align a secure supported phase-one IKE proposal on both peers using the FortiOS 7.6 configuration because iKE peers cannot negotiate an SA when there is no compatible cryptographic proposal.

C:

Set the intended local IKE identifier and matching remote peer verification on both sides is a relevant remedy for a DIFFERENT problem—ike local identifier mismatch—when an upstream NAT hides the initiating FortiGate's public address and the responder expects an IKE identity different from the presented local ID. In this Northbridge Healthcare case that is not the failing component. Here the correct intervention is to align a secure supported phase-one IKE proposal on both peers using the FortiOS 7.6 configuration because iKE peers cannot negotiate an SA when there is no compatible cryptographic proposal.

D:

Create the appropriately limited reverse-direction tunnel firewall policy where business authorization permits is a relevant remedy for a DIFFERENT problem—ipsec tunnel policy return direction—when the head office reaches a remote file server but the remote office cannot initiate sessions toward the head-office database. In this Northbridge Healthcare case that is not the failing component. Here the correct intervention is to align a secure supported phase-one IKE proposal on both peers using the FortiOS 7.6 configuration because iKE peers cannot negotiate an SA when there is no compatible cryptographic proposal.

Question 1046

At Northbridge Healthcare, the FortiGate 7.6 security administration team encounters the following authorized operational case: a new site-to-site IPsec tunnel never establishes after one peer changes its IKE encryption and hash proposal. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which diagnosis best distinguishes this case from other FortiOS problems?

  1. An established IPsec tunnel does not override FortiGate forward-policy enforcement
  2. IKE peers cannot negotiate an SA when there is no compatible cryptographic proposal
  3. IKE identity checks can fail even when packets reach the correct remote public endpoint
  4. An accepting outbound policy does not necessarily create permission for independently initiated inbound flows

Explanation

Correct Answer

B:

IKE peers cannot negotiate an SA when there is no compatible cryptographic proposal. The mechanism is relevant because the stated ipsec ike proposal mismatch incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to align a secure supported phase-one IKE proposal on both peers using the FortiOS 7.6 configuration; verify it through this observed condition: iKE diagnostics show an established phase-one SA and an approved tunnel flow passes.

Incorrect Answers

A:

An established IPsec tunnel does not override FortiGate forward-policy enforcement explains a different situation, route-based tunnel interface policy, where a route-based IPsec tunnel is up but users cannot reach the remote LAN because no firewall policy permits the tunnel interface pair. It does not account for the specific observed ipsec ike proposal mismatch condition at Northbridge Healthcare. The decisive mechanism here is: IKE peers cannot negotiate an SA when there is no compatible cryptographic proposal.

C:

IKE identity checks can fail even when packets reach the correct remote public endpoint explains a different situation, ike local identifier mismatch, where an upstream NAT hides the initiating FortiGate's public address and the responder expects an IKE identity different from the presented local ID. It does not account for the specific observed ipsec ike proposal mismatch condition at Northbridge Healthcare. The decisive mechanism here is: IKE peers cannot negotiate an SA when there is no compatible cryptographic proposal.

D:

An accepting outbound policy does not necessarily create permission for independently initiated inbound flows explains a different situation, ipsec tunnel policy return direction, where the head office reaches a remote file server but the remote office cannot initiate sessions toward the head-office database. It does not account for the specific observed ipsec ike proposal mismatch condition at Northbridge Healthcare. The decisive mechanism here is: IKE peers cannot negotiate an SA when there is no compatible cryptographic proposal.

Question 1047

At Northbridge Healthcare, the FortiGate 7.6 security administration team encounters the following authorized operational case: a new site-to-site IPsec tunnel never establishes after one peer changes its IKE encryption and hash proposal. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which controlled test outcome best proves that the required feature now works?

  1. Authorized LAN-to-LAN traffic matches the intended IPsec interface policy in both directions
  2. IKE diagnostics show an established phase-one SA and an approved tunnel flow passes
  3. IKE logs show accepted peer identity and a stable authenticated SA
  4. Approved remote-initiated sessions match their own permit rule while other ports remain denied

Explanation

Correct Answer

B:

IKE diagnostics show an established phase-one SA and an approved tunnel flow passes. This directly tests the corrective decision to align a secure supported phase-one IKE proposal on both peers using the FortiOS 7.6 configuration. It is a meaningful acceptance check because iKE peers cannot negotiate an SA when there is no compatible cryptographic proposal. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

Authorized LAN-to-LAN traffic matches the intended IPsec interface policy in both directions would validate the separate control route-based tunnel interface policy, not the fault reported for Northbridge Healthcare. To confirm this correction, the team instead needs: IKE diagnostics show an established phase-one SA and an approved tunnel flow passes. That is the observable check related to ipsec ike proposal mismatch.

C:

IKE logs show accepted peer identity and a stable authenticated SA would validate the separate control ike local identifier mismatch, not the fault reported for Northbridge Healthcare. To confirm this correction, the team instead needs: IKE diagnostics show an established phase-one SA and an approved tunnel flow passes. That is the observable check related to ipsec ike proposal mismatch.

D:

Approved remote-initiated sessions match their own permit rule while other ports remain denied would validate the separate control ipsec tunnel policy return direction, not the fault reported for Northbridge Healthcare. To confirm this correction, the team instead needs: IKE diagnostics show an established phase-one SA and an approved tunnel flow passes. That is the observable check related to ipsec ike proposal mismatch.

Question 1048

At Northbridge Healthcare, the FortiGate 7.6 security administration team encounters the following authorized operational case: a new site-to-site IPsec tunnel never establishes after one peer changes its IKE encryption and hash proposal. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What continuing control matches this firewall administration scenario?

  1. Review crypto compatibility before peer firmware upgrades
  2. Test firewall policy scope after creating new tunnel interfaces
  3. Document local and remote IDs alongside tunnel credentials
  4. Document allowed initiation directions in VPN access contracts

Explanation

Correct Answer

A:

Review crypto compatibility before peer firmware upgrades. This recurring practice addresses ipsec ike proposal mismatch because iKE peers cannot negotiate an SA when there is no compatible cryptographic proposal. It reinforces the supported change to align a secure supported phase-one IKE proposal on both peers using the FortiOS 7.6 configuration rather than relying on an unrelated periodic audit.

Incorrect Answers

B:

Test firewall policy scope after creating new tunnel interfaces reduces recurrence of route-based tunnel interface policy, rather than the observed ipsec ike proposal mismatch issue. The relevant preventive control for Northbridge Healthcare is: Review crypto compatibility before peer firmware upgrades. This distinction matters because iKE peers cannot negotiate an SA when there is no compatible cryptographic proposal.

C:

Document local and remote IDs alongside tunnel credentials reduces recurrence of ike local identifier mismatch, rather than the observed ipsec ike proposal mismatch issue. The relevant preventive control for Northbridge Healthcare is: Review crypto compatibility before peer firmware upgrades. This distinction matters because iKE peers cannot negotiate an SA when there is no compatible cryptographic proposal.

D:

Document allowed initiation directions in VPN access contracts reduces recurrence of ipsec tunnel policy return direction, rather than the observed ipsec ike proposal mismatch issue. The relevant preventive control for Northbridge Healthcare is: Review crypto compatibility before peer firmware upgrades. This distinction matters because iKE peers cannot negotiate an SA when there is no compatible cryptographic proposal.

Question 1049

At Northbridge University, the FortiGate 7.6 security administration team encounters the following authorized operational case: two branch FortiGates exchange IKE messages but report authentication failure after a secret rotation. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which supported FortiGate response most directly resolves the stated requirement?

  1. Add or correct the intended destination route through the virtual IPsec interface
  2. Synchronize the approved preshared key through a protected change process at both peers
  3. Install a valid permitted IKE identity certificate and trusted chain with protected private key
  4. Set a mutually supported IKE version and compatible authentication proposals

Explanation

Correct Answer

B:

Synchronize the approved preshared key through a protected change process at both peers. This targets ipsec preshared key mismatch: iKE peer authentication fails when the preshared secrets do not match. After applying the change, verify that a test negotiation authenticates both peers and reaches the expected IKE established state. The Northbridge University case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Add or correct the intended destination route through the virtual IPsec interface is a relevant remedy for a DIFFERENT problem—ipsec tunnel static route—when phase-one and phase-two SAs are established but branch traffic exits the plain internet WAN instead of the IPsec tunnel. In this Northbridge University case that is not the failing component. Here the correct intervention is to synchronize the approved preshared key through a protected change process at both peers because iKE peer authentication fails when the preshared secrets do not match.

C:

Install a valid permitted IKE identity certificate and trusted chain with protected private key is a relevant remedy for a DIFFERENT problem—certificate-authenticated ipsec—when a partner requires certificate-based IKE authentication but the branch FortiGate presents an expired client identity certificate. In this Northbridge University case that is not the failing component. Here the correct intervention is to synchronize the approved preshared key through a protected change process at both peers because iKE peer authentication fails when the preshared secrets do not match.

D:

Set a mutually supported IKE version and compatible authentication proposals is a relevant remedy for a DIFFERENT problem—ike version compatibility—when an IPsec tunnel fails after one vendor peer requires IKEv2 but the FortiGate configuration is pinned to an incompatible IKE version. In this Northbridge University case that is not the failing component. Here the correct intervention is to synchronize the approved preshared key through a protected change process at both peers because iKE peer authentication fails when the preshared secrets do not match.

Question 1050

At Northbridge University, the FortiGate 7.6 security administration team encounters the following authorized operational case: two branch FortiGates exchange IKE messages but report authentication failure after a secret rotation. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What root condition most directly explains the described FortiGate symptom?

  1. IKE peer authentication fails when the preshared secrets do not match
  2. An established VPN cannot carry private prefixes without routing their packets to it
  3. Certificate-based VPN peer authentication depends on issuer trust, validity and identity matching
  4. IKEv1 and IKEv2 have distinct negotiation flows and cannot always interoperate as configured

Explanation

Correct Answer

A:

IKE peer authentication fails when the preshared secrets do not match. The mechanism is relevant because the stated ipsec preshared key mismatch incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to synchronize the approved preshared key through a protected change process at both peers; verify it through this observed condition: a test negotiation authenticates both peers and reaches the expected IKE established state.

Incorrect Answers

B:

An established VPN cannot carry private prefixes without routing their packets to it explains a different situation, ipsec tunnel static route, where phase-one and phase-two SAs are established but branch traffic exits the plain internet WAN instead of the IPsec tunnel. It does not account for the specific observed ipsec preshared key mismatch condition at Northbridge University. The decisive mechanism here is: IKE peer authentication fails when the preshared secrets do not match.

C:

Certificate-based VPN peer authentication depends on issuer trust, validity and identity matching explains a different situation, certificate-authenticated ipsec, where a partner requires certificate-based IKE authentication but the branch FortiGate presents an expired client identity certificate. It does not account for the specific observed ipsec preshared key mismatch condition at Northbridge University. The decisive mechanism here is: IKE peer authentication fails when the preshared secrets do not match.

D:

IKEv1 and IKEv2 have distinct negotiation flows and cannot always interoperate as configured explains a different situation, ike version compatibility, where an IPsec tunnel fails after one vendor peer requires IKEv2 but the FortiGate configuration is pinned to an incompatible IKE version. It does not account for the specific observed ipsec preshared key mismatch condition at Northbridge University. The decisive mechanism here is: IKE peer authentication fails when the preshared secrets do not match.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests