McAfee Secure

Exam Code: FCP_FGT_AD-7.6

Exam Name: FCP - FortiGate 7.6 Administrator

Certification Provider: Fortinet

Corresponding Certification: NSE4

Questions & Answers

Fortinet FCP_FGT_AD-7.6 Questions & Answers

Study with Up-To-Date REAL Exam Questions and Answers from the ACTUAL Test

Questions & Answers

128 Questions & Answers with Testing Engine

"FCP - FortiGate 7.6 Administrator Exam", also known as FCP_FGT_AD-7.6 exam, is a Fortinet certification exam.

Pass your tests with the always up-to-date FCP_FGT_AD-7.6 Exam Engine. Your FCP_FGT_AD-7.6 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Fortinet FCP_FGT_AD-7.6 Practice Test 115

Question 1140

At Oakmont Manufacturing, the FortiGate 7.6 security administration team encounters the following authorized operational case: both peers show an established IKE SA yet applications fail because no relevant phase-two or firewall policy state exists. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which recurring review is most relevant to the same root risk?

  1. Audit remote gateway identities when partners rotate credentials
  2. Use stepwise IKE, phase-two, route and policy diagnostics
  3. Maintain IP allocation governance across acquisitions
  4. Rehearse dead-peer and routing failover with realistic outages

Explanation

Correct Answer

B:

Use stepwise IKE, phase-two, route and policy diagnostics. This recurring practice addresses phase-one up but no payload traffic because iKE control-channel establishment is not equivalent to permitted encrypted application forwarding. It reinforces the supported change to review child-SA selectors, tunnel routes and interface firewall policies in the correct sequence rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Audit remote gateway identities when partners rotate credentials reduces recurrence of ipsec remote peer authentication scope, rather than the observed phase-one up but no payload traffic issue. The relevant preventive control for Oakmont Manufacturing is: Use stepwise IKE, phase-two, route and policy diagnostics. This distinction matters because iKE control-channel establishment is not equivalent to permitted encrypted application forwarding.

C:

Maintain IP allocation governance across acquisitions reduces recurrence of ipsec overlapping address conflict, rather than the observed phase-one up but no payload traffic issue. The relevant preventive control for Oakmont Manufacturing is: Use stepwise IKE, phase-two, route and policy diagnostics. This distinction matters because iKE control-channel establishment is not equivalent to permitted encrypted application forwarding.

D:

Rehearse dead-peer and routing failover with realistic outages reduces recurrence of dead peer detection failover, rather than the observed phase-one up but no payload traffic issue. The relevant preventive control for Oakmont Manufacturing is: Use stepwise IKE, phase-two, route and policy diagnostics. This distinction matters because iKE control-channel establishment is not equivalent to permitted encrypted application forwarding.

Question 1141

At Oakmont Media Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: a branch peer changes public IP frequently and the central FortiGate has a static peer address pointing to last week's gateway. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which FortiOS 7.6 administration action best addresses this incident?

  1. Inspect phase-two lifetime, rekey logs and matching proposal settings for both peers
  2. Restore authorized certificate status service reachability and review compatible peer trust settings
  3. Use supported peer FQDN or dialup selection with authenticated identity and current DNS behavior
  4. Add appropriate route-based interface policies for the required local-to-VPN and return directions

Explanation

Correct Answer

C:

Use supported peer FQDN or dialup selection with authenticated identity and current DNS behavior. This targets ipsec endpoint fqdn dynamic dns: fixed gateway addressing becomes stale when remote public connections are dynamically reassigned. After applying the change, verify that after an ISP address change the authorized peer reconnects and passes protected traffic. The Oakmont Media Group case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Inspect phase-two lifetime, rekey logs and matching proposal settings for both peers is a relevant remedy for a DIFFERENT problem—vpn phase2 lifetime rekey evidence—when a site-to-site connection drops periodically at child-SA renewal even though ordinary short tests succeed. In this Oakmont Media Group case that is not the failing component. Here the correct intervention is to use supported peer FQDN or dialup selection with authenticated identity and current DNS behavior because fixed gateway addressing becomes stale when remote public connections are dynamically reassigned.

B:

Restore authorized certificate status service reachability and review compatible peer trust settings is a relevant remedy for a DIFFERENT problem—vpn certificate revocation outage—when a certificate-authenticated IPsec peer suddenly fails because the required certificate status responder is unreachable. In this Oakmont Media Group case that is not the failing component. Here the correct intervention is to use supported peer FQDN or dialup selection with authenticated identity and current DNS behavior because fixed gateway addressing becomes stale when remote public connections are dynamically reassigned.

D:

Add appropriate route-based interface policies for the required local-to-VPN and return directions is a relevant remedy for a DIFFERENT problem—route-based tunnel interface policy—when a route-based IPsec tunnel is up but users cannot reach the remote LAN because no firewall policy permits the tunnel interface pair. In this Oakmont Media Group case that is not the failing component. Here the correct intervention is to use supported peer FQDN or dialup selection with authenticated identity and current DNS behavior because fixed gateway addressing becomes stale when remote public connections are dynamically reassigned.

Question 1142

At Oakmont Media Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: a branch peer changes public IP frequently and the central FortiGate has a static peer address pointing to last week's gateway. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the primary mechanism responsible for the reported result?

  1. An SA that negotiates initially may still fail at later child-SA rekey events
  2. Fixed gateway addressing becomes stale when remote public connections are dynamically reassigned
  3. Certificate chain validation may depend on approved revocation information before IKE identity is trusted
  4. An established IPsec tunnel does not override FortiGate forward-policy enforcement

Explanation

Correct Answer

B:

Fixed gateway addressing becomes stale when remote public connections are dynamically reassigned. The mechanism is relevant because the stated ipsec endpoint fqdn dynamic dns incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to use supported peer FQDN or dialup selection with authenticated identity and current DNS behavior; verify it through this observed condition: after an ISP address change the authorized peer reconnects and passes protected traffic.

Incorrect Answers

A:

An SA that negotiates initially may still fail at later child-SA rekey events explains a different situation, vpn phase2 lifetime rekey evidence, where a site-to-site connection drops periodically at child-SA renewal even though ordinary short tests succeed. It does not account for the specific observed ipsec endpoint fqdn dynamic dns condition at Oakmont Media Group. The decisive mechanism here is: Fixed gateway addressing becomes stale when remote public connections are dynamically reassigned.

C:

Certificate chain validation may depend on approved revocation information before IKE identity is trusted explains a different situation, vpn certificate revocation outage, where a certificate-authenticated IPsec peer suddenly fails because the required certificate status responder is unreachable. It does not account for the specific observed ipsec endpoint fqdn dynamic dns condition at Oakmont Media Group. The decisive mechanism here is: Fixed gateway addressing becomes stale when remote public connections are dynamically reassigned.

D:

An established IPsec tunnel does not override FortiGate forward-policy enforcement explains a different situation, route-based tunnel interface policy, where a route-based IPsec tunnel is up but users cannot reach the remote LAN because no firewall policy permits the tunnel interface pair. It does not account for the specific observed ipsec endpoint fqdn dynamic dns condition at Oakmont Media Group. The decisive mechanism here is: Fixed gateway addressing becomes stale when remote public connections are dynamically reassigned.

Question 1143

At Oakmont Media Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: a branch peer changes public IP frequently and the central FortiGate has a static peer address pointing to last week's gateway. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which validation result would demonstrate that the specified incident has been resolved?

  1. After an ISP address change the authorized peer reconnects and passes protected traffic
  2. A controlled long-lived VPN session survives multiple scheduled child-SA renewals
  3. The valid peer authenticates and a known revoked certificate remains rejected
  4. Authorized LAN-to-LAN traffic matches the intended IPsec interface policy in both directions

Explanation

Correct Answer

A:

After an ISP address change the authorized peer reconnects and passes protected traffic. This directly tests the corrective decision to use supported peer FQDN or dialup selection with authenticated identity and current DNS behavior. It is a meaningful acceptance check because fixed gateway addressing becomes stale when remote public connections are dynamically reassigned. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

B:

A controlled long-lived VPN session survives multiple scheduled child-SA renewals would validate the separate control vpn phase2 lifetime rekey evidence, not the fault reported for Oakmont Media Group. To confirm this correction, the team instead needs: After an ISP address change the authorized peer reconnects and passes protected traffic. That is the observable check related to ipsec endpoint fqdn dynamic dns.

C:

The valid peer authenticates and a known revoked certificate remains rejected would validate the separate control vpn certificate revocation outage, not the fault reported for Oakmont Media Group. To confirm this correction, the team instead needs: After an ISP address change the authorized peer reconnects and passes protected traffic. That is the observable check related to ipsec endpoint fqdn dynamic dns.

D:

Authorized LAN-to-LAN traffic matches the intended IPsec interface policy in both directions would validate the separate control route-based tunnel interface policy, not the fault reported for Oakmont Media Group. To confirm this correction, the team instead needs: After an ISP address change the authorized peer reconnects and passes protected traffic. That is the observable check related to ipsec endpoint fqdn dynamic dns.

Question 1144

At Oakmont Media Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: a branch peer changes public IP frequently and the central FortiGate has a static peer address pointing to last week's gateway. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which operational practice would most effectively prevent this specific fault?

  1. Include multi-cycle rekey tests in IPsec acceptance procedures
  2. Monitor VPN PKI status endpoints and expiry windows
  3. Test firewall policy scope after creating new tunnel interfaces
  4. Monitor peer name resolution and dynamic-DNS update health

Explanation

Correct Answer

D:

Monitor peer name resolution and dynamic-DNS update health. This recurring practice addresses ipsec endpoint fqdn dynamic dns because fixed gateway addressing becomes stale when remote public connections are dynamically reassigned. It reinforces the supported change to use supported peer FQDN or dialup selection with authenticated identity and current DNS behavior rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Include multi-cycle rekey tests in IPsec acceptance procedures reduces recurrence of vpn phase2 lifetime rekey evidence, rather than the observed ipsec endpoint fqdn dynamic dns issue. The relevant preventive control for Oakmont Media Group is: Monitor peer name resolution and dynamic-DNS update health. This distinction matters because fixed gateway addressing becomes stale when remote public connections are dynamically reassigned.

B:

Monitor VPN PKI status endpoints and expiry windows reduces recurrence of vpn certificate revocation outage, rather than the observed ipsec endpoint fqdn dynamic dns issue. The relevant preventive control for Oakmont Media Group is: Monitor peer name resolution and dynamic-DNS update health. This distinction matters because fixed gateway addressing becomes stale when remote public connections are dynamically reassigned.

C:

Test firewall policy scope after creating new tunnel interfaces reduces recurrence of route-based tunnel interface policy, rather than the observed ipsec endpoint fqdn dynamic dns issue. The relevant preventive control for Oakmont Media Group is: Monitor peer name resolution and dynamic-DNS update health. This distinction matters because fixed gateway addressing becomes stale when remote public connections are dynamically reassigned.

Question 1145

At Oakmont Research Institute, the FortiGate 7.6 security administration team encounters the following authorized operational case: the VPN appears idle and operations guesses phase-two failure without checking whether any LAN packets enter the firewall. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the most appropriate first configuration correction for this case?

  1. Migrate the partner to a secure mutually supported proposal and scope any temporary exception narrowly
  2. Validate the supported FortiGate HA and IPsec session synchronization or rekey behavior for the release
  3. Add or correct the intended destination route through the virtual IPsec interface
  4. Correlate scoped packet sniffer, IKE diagnostic and phase-two status for an approved test flow

Explanation

Correct Answer

D:

Correlate scoped packet sniffer, IKE diagnostic and phase-two status for an approved test flow. This targets ipsec logs versus packet sniffer: no application traffic or wrong routing can look like an idle VPN without implying failed cryptographic negotiation. After applying the change, verify that the trace shows the test packet entering the tunnel and an expected encrypted egress. The Oakmont Research Institute case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Migrate the partner to a secure mutually supported proposal and scope any temporary exception narrowly is a relevant remedy for a DIFFERENT problem—vpn crypto policy hardening—when a legacy tunnel only works with an obsolete weak cipher and staff propose enabling that cipher for every site. In this Oakmont Research Institute case that is not the failing component. Here the correct intervention is to correlate scoped packet sniffer, IKE diagnostic and phase-two status for an approved test flow because no application traffic or wrong routing can look like an idle VPN without implying failed cryptographic negotiation.

B:

Validate the supported FortiGate HA and IPsec session synchronization or rekey behavior for the release is a relevant remedy for a DIFFERENT problem—ipsec ha cluster rekey continuity—when active-passive FortiGate failover causes all site-to-site tunnels to renegotiate while operations assumes every IKE state is preserved. In this Oakmont Research Institute case that is not the failing component. Here the correct intervention is to correlate scoped packet sniffer, IKE diagnostic and phase-two status for an approved test flow because no application traffic or wrong routing can look like an idle VPN without implying failed cryptographic negotiation.

C:

Add or correct the intended destination route through the virtual IPsec interface is a relevant remedy for a DIFFERENT problem—ipsec tunnel static route—when phase-one and phase-two SAs are established but branch traffic exits the plain internet WAN instead of the IPsec tunnel. In this Oakmont Research Institute case that is not the failing component. Here the correct intervention is to correlate scoped packet sniffer, IKE diagnostic and phase-two status for an approved test flow because no application traffic or wrong routing can look like an idle VPN without implying failed cryptographic negotiation.

Question 1146

At Oakmont Research Institute, the FortiGate 7.6 security administration team encounters the following authorized operational case: the VPN appears idle and operations guesses phase-two failure without checking whether any LAN packets enter the firewall. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which diagnosis best distinguishes this case from other FortiOS problems?

  1. Cryptographic proposal negotiation must meet both interoperability and current organizational strength requirements
  2. Firewall HA configuration synchronization does not necessarily imply seamless preservation of every IPsec SA state
  3. An established VPN cannot carry private prefixes without routing their packets to it
  4. No application traffic or wrong routing can look like an idle VPN without implying failed cryptographic negotiation

Explanation

Correct Answer

D:

No application traffic or wrong routing can look like an idle VPN without implying failed cryptographic negotiation. The mechanism is relevant because the stated ipsec logs versus packet sniffer incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to correlate scoped packet sniffer, IKE diagnostic and phase-two status for an approved test flow; verify it through this observed condition: the trace shows the test packet entering the tunnel and an expected encrypted egress.

Incorrect Answers

A:

Cryptographic proposal negotiation must meet both interoperability and current organizational strength requirements explains a different situation, vpn crypto policy hardening, where a legacy tunnel only works with an obsolete weak cipher and staff propose enabling that cipher for every site. It does not account for the specific observed ipsec logs versus packet sniffer condition at Oakmont Research Institute. The decisive mechanism here is: No application traffic or wrong routing can look like an idle VPN without implying failed cryptographic negotiation.

B:

Firewall HA configuration synchronization does not necessarily imply seamless preservation of every IPsec SA state explains a different situation, ipsec ha cluster rekey continuity, where active-passive FortiGate failover causes all site-to-site tunnels to renegotiate while operations assumes every IKE state is preserved. It does not account for the specific observed ipsec logs versus packet sniffer condition at Oakmont Research Institute. The decisive mechanism here is: No application traffic or wrong routing can look like an idle VPN without implying failed cryptographic negotiation.

C:

An established VPN cannot carry private prefixes without routing their packets to it explains a different situation, ipsec tunnel static route, where phase-one and phase-two SAs are established but branch traffic exits the plain internet WAN instead of the IPsec tunnel. It does not account for the specific observed ipsec logs versus packet sniffer condition at Oakmont Research Institute. The decisive mechanism here is: No application traffic or wrong routing can look like an idle VPN without implying failed cryptographic negotiation.

Question 1147

At Oakmont Research Institute, the FortiGate 7.6 security administration team encounters the following authorized operational case: the VPN appears idle and operations guesses phase-two failure without checking whether any LAN packets enter the firewall. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which controlled test outcome best proves that the required feature now works?

  1. The new tunnel negotiates approved encryption while unrelated VPNs retain stronger settings
  2. A controlled HA switch reconnects the protected tunnels within the approved recovery objective
  3. A route lookup selects the tunnel and a private test packet is encrypted
  4. The trace shows the test packet entering the tunnel and an expected encrypted egress

Explanation

Correct Answer

D:

The trace shows the test packet entering the tunnel and an expected encrypted egress. This directly tests the corrective decision to correlate scoped packet sniffer, IKE diagnostic and phase-two status for an approved test flow. It is a meaningful acceptance check because no application traffic or wrong routing can look like an idle VPN without implying failed cryptographic negotiation. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

The new tunnel negotiates approved encryption while unrelated VPNs retain stronger settings would validate the separate control vpn crypto policy hardening, not the fault reported for Oakmont Research Institute. To confirm this correction, the team instead needs: The trace shows the test packet entering the tunnel and an expected encrypted egress. That is the observable check related to ipsec logs versus packet sniffer.

B:

A controlled HA switch reconnects the protected tunnels within the approved recovery objective would validate the separate control ipsec ha cluster rekey continuity, not the fault reported for Oakmont Research Institute. To confirm this correction, the team instead needs: The trace shows the test packet entering the tunnel and an expected encrypted egress. That is the observable check related to ipsec logs versus packet sniffer.

C:

A route lookup selects the tunnel and a private test packet is encrypted would validate the separate control ipsec tunnel static route, not the fault reported for Oakmont Research Institute. To confirm this correction, the team instead needs: The trace shows the test packet entering the tunnel and an expected encrypted egress. That is the observable check related to ipsec logs versus packet sniffer.

Question 1148

At Oakmont Research Institute, the FortiGate 7.6 security administration team encounters the following authorized operational case: the VPN appears idle and operations guesses phase-two failure without checking whether any LAN packets enter the firewall. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What continuing control matches this firewall administration scenario?

  1. Maintain safe packet-capture filters and retire debug sessions promptly
  2. Retire legacy crypto exceptions by agreed migration dates
  3. Test VPN recovery during HA firmware and member maintenance
  4. Review tunnel routes when branch CIDRs change

Explanation

Correct Answer

A:

Maintain safe packet-capture filters and retire debug sessions promptly. This recurring practice addresses ipsec logs versus packet sniffer because no application traffic or wrong routing can look like an idle VPN without implying failed cryptographic negotiation. It reinforces the supported change to correlate scoped packet sniffer, IKE diagnostic and phase-two status for an approved test flow rather than relying on an unrelated periodic audit.

Incorrect Answers

B:

Retire legacy crypto exceptions by agreed migration dates reduces recurrence of vpn crypto policy hardening, rather than the observed ipsec logs versus packet sniffer issue. The relevant preventive control for Oakmont Research Institute is: Maintain safe packet-capture filters and retire debug sessions promptly. This distinction matters because no application traffic or wrong routing can look like an idle VPN without implying failed cryptographic negotiation.

C:

Test VPN recovery during HA firmware and member maintenance reduces recurrence of ipsec ha cluster rekey continuity, rather than the observed ipsec logs versus packet sniffer issue. The relevant preventive control for Oakmont Research Institute is: Maintain safe packet-capture filters and retire debug sessions promptly. This distinction matters because no application traffic or wrong routing can look like an idle VPN without implying failed cryptographic negotiation.

D:

Review tunnel routes when branch CIDRs change reduces recurrence of ipsec tunnel static route, rather than the observed ipsec logs versus packet sniffer issue. The relevant preventive control for Oakmont Research Institute is: Maintain safe packet-capture filters and retire debug sessions promptly. This distinction matters because no application traffic or wrong routing can look like an idle VPN without implying failed cryptographic negotiation.

Question 1149

At Oakmont Regional Hospital, the FortiGate 7.6 security administration team encounters the following authorized operational case: a file transfer fails only for larger payloads across a healthy IPsec tunnel. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which supported FortiGate response most directly resolves the stated requirement?

  1. Use independent permitted underlays or peer paths and verify resilience across failure domains
  2. Build and test a supported secondary IPsec tunnel with suitable route preferences or SD-WAN steering
  3. Adjust the supported path MTU or TCP MSS behavior after measuring encapsulation overhead and PMTUD
  4. Create the appropriately limited reverse-direction tunnel firewall policy where business authorization permits

Explanation

Correct Answer

C:

Adjust the supported path MTU or TCP MSS behavior after measuring encapsulation overhead and PMTUD. This targets ipsec vpn mtu and fragmentation: eSP and optional NAT-T add packet overhead that can exceed the underlay path payload size. After applying the change, verify that a supervised large transfer succeeds without recurring fragmentation-related loss. The Oakmont Regional Hospital case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Use independent permitted underlays or peer paths and verify resilience across failure domains is a relevant remedy for a DIFFERENT problem—redundant vpn split provider design—when two site-to-site IPsec tunnels terminate on the same failing ISP despite being labeled primary and backup. In this Oakmont Regional Hospital case that is not the failing component. Here the correct intervention is to adjust the supported path MTU or TCP MSS behavior after measuring encapsulation overhead and PMTUD because eSP and optional NAT-T add packet overhead that can exceed the underlay path payload size.

B:

Build and test a supported secondary IPsec tunnel with suitable route preferences or SD-WAN steering is a relevant remedy for a DIFFERENT problem—ipsec redundant secondary tunnel—when a branch VPN uses one tunnel with no alternate path and every carrier outage disconnects the remote office. In this Oakmont Regional Hospital case that is not the failing component. Here the correct intervention is to adjust the supported path MTU or TCP MSS behavior after measuring encapsulation overhead and PMTUD because eSP and optional NAT-T add packet overhead that can exceed the underlay path payload size.

D:

Create the appropriately limited reverse-direction tunnel firewall policy where business authorization permits is a relevant remedy for a DIFFERENT problem—ipsec tunnel policy return direction—when the head office reaches a remote file server but the remote office cannot initiate sessions toward the head-office database. In this Oakmont Regional Hospital case that is not the failing component. Here the correct intervention is to adjust the supported path MTU or TCP MSS behavior after measuring encapsulation overhead and PMTUD because eSP and optional NAT-T add packet overhead that can exceed the underlay path payload size.

Question 1150

At Oakmont Regional Hospital, the FortiGate 7.6 security administration team encounters the following authorized operational case: a file transfer fails only for larger payloads across a healthy IPsec tunnel. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What root condition most directly explains the described FortiGate symptom?

  1. Two logical tunnel interfaces sharing one upstream circuit do not protect against that circuit failure
  2. ESP and optional NAT-T add packet overhead that can exceed the underlay path payload size
  3. One tunnel on one underlay remains a single point of failure without a separate operational path
  4. An accepting outbound policy does not necessarily create permission for independently initiated inbound flows

Explanation

Correct Answer

B:

ESP and optional NAT-T add packet overhead that can exceed the underlay path payload size. The mechanism is relevant because the stated ipsec vpn mtu and fragmentation incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to adjust the supported path MTU or TCP MSS behavior after measuring encapsulation overhead and PMTUD; verify it through this observed condition: a supervised large transfer succeeds without recurring fragmentation-related loss.

Incorrect Answers

A:

Two logical tunnel interfaces sharing one upstream circuit do not protect against that circuit failure explains a different situation, redundant vpn split provider design, where two site-to-site IPsec tunnels terminate on the same failing ISP despite being labeled primary and backup. It does not account for the specific observed ipsec vpn mtu and fragmentation condition at Oakmont Regional Hospital. The decisive mechanism here is: ESP and optional NAT-T add packet overhead that can exceed the underlay path payload size.

C:

One tunnel on one underlay remains a single point of failure without a separate operational path explains a different situation, ipsec redundant secondary tunnel, where a branch VPN uses one tunnel with no alternate path and every carrier outage disconnects the remote office. It does not account for the specific observed ipsec vpn mtu and fragmentation condition at Oakmont Regional Hospital. The decisive mechanism here is: ESP and optional NAT-T add packet overhead that can exceed the underlay path payload size.

D:

An accepting outbound policy does not necessarily create permission for independently initiated inbound flows explains a different situation, ipsec tunnel policy return direction, where the head office reaches a remote file server but the remote office cannot initiate sessions toward the head-office database. It does not account for the specific observed ipsec vpn mtu and fragmentation condition at Oakmont Regional Hospital. The decisive mechanism here is: ESP and optional NAT-T add packet overhead that can exceed the underlay path payload size.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests