McAfee Secure

Exam Code: FCP_FGT_AD-7.6

Exam Name: FCP - FortiGate 7.6 Administrator

Certification Provider: Fortinet

Corresponding Certification: NSE4

Questions & Answers

Fortinet FCP_FGT_AD-7.6 Questions & Answers

Study with Up-To-Date REAL Exam Questions and Answers from the ACTUAL Test

Questions & Answers

128 Questions & Answers with Testing Engine

"FCP - FortiGate 7.6 Administrator Exam", also known as FCP_FGT_AD-7.6 exam, is a Fortinet certification exam.

Pass your tests with the always up-to-date FCP_FGT_AD-7.6 Exam Engine. Your FCP_FGT_AD-7.6 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Fortinet FCP_FGT_AD-7.6 Practice Test 116

Question 1150

At Oakmont Regional Hospital, the FortiGate 7.6 security administration team encounters the following authorized operational case: a file transfer fails only for larger payloads across a healthy IPsec tunnel. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What root condition most directly explains the described FortiGate symptom?

  1. Two logical tunnel interfaces sharing one upstream circuit do not protect against that circuit failure
  2. ESP and optional NAT-T add packet overhead that can exceed the underlay path payload size
  3. One tunnel on one underlay remains a single point of failure without a separate operational path
  4. An accepting outbound policy does not necessarily create permission for independently initiated inbound flows

Explanation

Correct Answer

B:

ESP and optional NAT-T add packet overhead that can exceed the underlay path payload size. The mechanism is relevant because the stated ipsec vpn mtu and fragmentation incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to adjust the supported path MTU or TCP MSS behavior after measuring encapsulation overhead and PMTUD; verify it through this observed condition: a supervised large transfer succeeds without recurring fragmentation-related loss.

Incorrect Answers

A:

Two logical tunnel interfaces sharing one upstream circuit do not protect against that circuit failure explains a different situation, redundant vpn split provider design, where two site-to-site IPsec tunnels terminate on the same failing ISP despite being labeled primary and backup. It does not account for the specific observed ipsec vpn mtu and fragmentation condition at Oakmont Regional Hospital. The decisive mechanism here is: ESP and optional NAT-T add packet overhead that can exceed the underlay path payload size.

C:

One tunnel on one underlay remains a single point of failure without a separate operational path explains a different situation, ipsec redundant secondary tunnel, where a branch VPN uses one tunnel with no alternate path and every carrier outage disconnects the remote office. It does not account for the specific observed ipsec vpn mtu and fragmentation condition at Oakmont Regional Hospital. The decisive mechanism here is: ESP and optional NAT-T add packet overhead that can exceed the underlay path payload size.

D:

An accepting outbound policy does not necessarily create permission for independently initiated inbound flows explains a different situation, ipsec tunnel policy return direction, where the head office reaches a remote file server but the remote office cannot initiate sessions toward the head-office database. It does not account for the specific observed ipsec vpn mtu and fragmentation condition at Oakmont Regional Hospital. The decisive mechanism here is: ESP and optional NAT-T add packet overhead that can exceed the underlay path payload size.

Question 1151

At Oakmont Regional Hospital, the FortiGate 7.6 security administration team encounters the following authorized operational case: a file transfer fails only for larger payloads across a healthy IPsec tunnel. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which observable result should the administrator require before closing this change?

  1. A physical carrier outage leaves the independent tunnel serving approved traffic
  2. A supervised large transfer succeeds without recurring fragmentation-related loss
  3. A primary tunnel failure preserves approved site connectivity through secondary
  4. Approved remote-initiated sessions match their own permit rule while other ports remain denied

Explanation

Correct Answer

B:

A supervised large transfer succeeds without recurring fragmentation-related loss. This directly tests the corrective decision to adjust the supported path MTU or TCP MSS behavior after measuring encapsulation overhead and PMTUD. It is a meaningful acceptance check because eSP and optional NAT-T add packet overhead that can exceed the underlay path payload size. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

A physical carrier outage leaves the independent tunnel serving approved traffic would validate the separate control redundant vpn split provider design, not the fault reported for Oakmont Regional Hospital. To confirm this correction, the team instead needs: A supervised large transfer succeeds without recurring fragmentation-related loss. That is the observable check related to ipsec vpn mtu and fragmentation.

C:

A primary tunnel failure preserves approved site connectivity through secondary would validate the separate control ipsec redundant secondary tunnel, not the fault reported for Oakmont Regional Hospital. To confirm this correction, the team instead needs: A supervised large transfer succeeds without recurring fragmentation-related loss. That is the observable check related to ipsec vpn mtu and fragmentation.

D:

Approved remote-initiated sessions match their own permit rule while other ports remain denied would validate the separate control ipsec tunnel policy return direction, not the fault reported for Oakmont Regional Hospital. To confirm this correction, the team instead needs: A supervised large transfer succeeds without recurring fragmentation-related loss. That is the observable check related to ipsec vpn mtu and fragmentation.

Question 1152

At Oakmont Regional Hospital, the FortiGate 7.6 security administration team encounters the following authorized operational case: a file transfer fails only for larger payloads across a healthy IPsec tunnel. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which ongoing safeguard best reduces recurrence of this problem?

  1. Revalidate MTU when adding additional tunnel encapsulation
  2. Track transport diversity and avoid false redundancy assumptions
  3. Verify redundant transport and keys quarterly
  4. Document allowed initiation directions in VPN access contracts

Explanation

Correct Answer

A:

Revalidate MTU when adding additional tunnel encapsulation. This recurring practice addresses ipsec vpn mtu and fragmentation because eSP and optional NAT-T add packet overhead that can exceed the underlay path payload size. It reinforces the supported change to adjust the supported path MTU or TCP MSS behavior after measuring encapsulation overhead and PMTUD rather than relying on an unrelated periodic audit.

Incorrect Answers

B:

Track transport diversity and avoid false redundancy assumptions reduces recurrence of redundant vpn split provider design, rather than the observed ipsec vpn mtu and fragmentation issue. The relevant preventive control for Oakmont Regional Hospital is: Revalidate MTU when adding additional tunnel encapsulation. This distinction matters because eSP and optional NAT-T add packet overhead that can exceed the underlay path payload size.

C:

Verify redundant transport and keys quarterly reduces recurrence of ipsec redundant secondary tunnel, rather than the observed ipsec vpn mtu and fragmentation issue. The relevant preventive control for Oakmont Regional Hospital is: Revalidate MTU when adding additional tunnel encapsulation. This distinction matters because eSP and optional NAT-T add packet overhead that can exceed the underlay path payload size.

D:

Document allowed initiation directions in VPN access contracts reduces recurrence of ipsec tunnel policy return direction, rather than the observed ipsec vpn mtu and fragmentation issue. The relevant preventive control for Oakmont Regional Hospital is: Revalidate MTU when adding additional tunnel encapsulation. This distinction matters because eSP and optional NAT-T add packet overhead that can exceed the underlay path payload size.

Question 1153

At Oakmont Retail Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: return packets from an internal server follow an internet default route instead of the incoming route-based VPN tunnel. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What action should the network security administrator take for this specific fault?

  1. Correct reciprocal static or dynamic routes and preserve the intended stateful path
  2. Correlate IKE negotiation logs, tunnel SA state, route entries and policy traffic logs for the exact test
  3. Design explicit hub transit or a supported partial mesh with the required routes and policies
  4. Set a mutually supported IKE version and compatible authentication proposals

Explanation

Correct Answer

A:

Correct reciprocal static or dynamic routes and preserve the intended stateful path. This targets ipsec asymmetric vpn egress: route-based IPsec depends on consistent forward and return routing through the negotiated security context. After applying the change, verify that a bidirectional test flow returns on the virtual tunnel interface with accepted session state. The Oakmont Retail Group case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

B:

Correlate IKE negotiation logs, tunnel SA state, route entries and policy traffic logs for the exact test is a relevant remedy for a DIFFERENT problem—vpn session log interpretation—when a reported site-to-site outage has only generic firewall deny events and no clear IKE or IPsec event correlation. In this Oakmont Retail Group case that is not the failing component. Here the correct intervention is to correct reciprocal static or dynamic routes and preserve the intended stateful path because route-based IPsec depends on consistent forward and return routing through the negotiated security context.

C:

Design explicit hub transit or a supported partial mesh with the required routes and policies is a relevant remedy for a DIFFERENT problem—meshed vpn topology policy—when three sites A B and C can reach the hub but A cannot reach C even though the administrator assumes hub-and-spoke traffic is fully transitive. In this Oakmont Retail Group case that is not the failing component. Here the correct intervention is to correct reciprocal static or dynamic routes and preserve the intended stateful path because route-based IPsec depends on consistent forward and return routing through the negotiated security context.

D:

Set a mutually supported IKE version and compatible authentication proposals is a relevant remedy for a DIFFERENT problem—ike version compatibility—when an IPsec tunnel fails after one vendor peer requires IKEv2 but the FortiGate configuration is pinned to an incompatible IKE version. In this Oakmont Retail Group case that is not the failing component. Here the correct intervention is to correct reciprocal static or dynamic routes and preserve the intended stateful path because route-based IPsec depends on consistent forward and return routing through the negotiated security context.

Question 1154

At Oakmont Retail Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: return packets from an internal server follow an internet default route instead of the incoming route-based VPN tunnel. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which interpretation of the observed failure is technically supported?

  1. A generic blocked-flow log cannot alone establish whether the tunnel negotiation or firewall rule caused failure
  2. Multiple tunnel existence does not automatically authorize or route site-to-site transit through a hub
  3. Route-based IPsec depends on consistent forward and return routing through the negotiated security context
  4. IKEv1 and IKEv2 have distinct negotiation flows and cannot always interoperate as configured

Explanation

Correct Answer

C:

Route-based IPsec depends on consistent forward and return routing through the negotiated security context. The mechanism is relevant because the stated ipsec asymmetric vpn egress incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to correct reciprocal static or dynamic routes and preserve the intended stateful path; verify it through this observed condition: a bidirectional test flow returns on the virtual tunnel interface with accepted session state.

Incorrect Answers

A:

A generic blocked-flow log cannot alone establish whether the tunnel negotiation or firewall rule caused failure explains a different situation, vpn session log interpretation, where a reported site-to-site outage has only generic firewall deny events and no clear IKE or IPsec event correlation. It does not account for the specific observed ipsec asymmetric vpn egress condition at Oakmont Retail Group. The decisive mechanism here is: Route-based IPsec depends on consistent forward and return routing through the negotiated security context.

B:

Multiple tunnel existence does not automatically authorize or route site-to-site transit through a hub explains a different situation, meshed vpn topology policy, where three sites A B and C can reach the hub but A cannot reach C even though the administrator assumes hub-and-spoke traffic is fully transitive. It does not account for the specific observed ipsec asymmetric vpn egress condition at Oakmont Retail Group. The decisive mechanism here is: Route-based IPsec depends on consistent forward and return routing through the negotiated security context.

D:

IKEv1 and IKEv2 have distinct negotiation flows and cannot always interoperate as configured explains a different situation, ike version compatibility, where an IPsec tunnel fails after one vendor peer requires IKEv2 but the FortiGate configuration is pinned to an incompatible IKE version. It does not account for the specific observed ipsec asymmetric vpn egress condition at Oakmont Retail Group. The decisive mechanism here is: Route-based IPsec depends on consistent forward and return routing through the negotiated security context.

Question 1155

At Oakmont Retail Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: return packets from an internal server follow an internet default route instead of the incoming route-based VPN tunnel. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which supervised observation would best verify the intended correction?

  1. A bidirectional test flow returns on the virtual tunnel interface with accepted session state
  2. A reproduced fault produces a clear matching IKE or policy decision with timestamps
  3. A supervised A-to-C test succeeds only on the deliberately permitted path
  4. The two devices negotiate the intended IKE version and establish the required child SA

Explanation

Correct Answer

A:

A bidirectional test flow returns on the virtual tunnel interface with accepted session state. This directly tests the corrective decision to correct reciprocal static or dynamic routes and preserve the intended stateful path. It is a meaningful acceptance check because route-based IPsec depends on consistent forward and return routing through the negotiated security context. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

B:

A reproduced fault produces a clear matching IKE or policy decision with timestamps would validate the separate control vpn session log interpretation, not the fault reported for Oakmont Retail Group. To confirm this correction, the team instead needs: A bidirectional test flow returns on the virtual tunnel interface with accepted session state. That is the observable check related to ipsec asymmetric vpn egress.

C:

A supervised A-to-C test succeeds only on the deliberately permitted path would validate the separate control meshed vpn topology policy, not the fault reported for Oakmont Retail Group. To confirm this correction, the team instead needs: A bidirectional test flow returns on the virtual tunnel interface with accepted session state. That is the observable check related to ipsec asymmetric vpn egress.

D:

The two devices negotiate the intended IKE version and establish the required child SA would validate the separate control ike version compatibility, not the fault reported for Oakmont Retail Group. To confirm this correction, the team instead needs: A bidirectional test flow returns on the virtual tunnel interface with accepted session state. That is the observable check related to ipsec asymmetric vpn egress.

Question 1156

At Oakmont Retail Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: return packets from an internal server follow an internet default route instead of the incoming route-based VPN tunnel. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What preventive control should the FortiGate operations team maintain?

  1. Use a structured troubleshooting record for all VPN incidents
  2. Maintain an IPsec topology and site-pair access matrix
  3. Review reciprocal route tables after changing branch prefixes
  4. Verify IKE version during tunnel vendor onboarding

Explanation

Correct Answer

C:

Review reciprocal route tables after changing branch prefixes. This recurring practice addresses ipsec asymmetric vpn egress because route-based IPsec depends on consistent forward and return routing through the negotiated security context. It reinforces the supported change to correct reciprocal static or dynamic routes and preserve the intended stateful path rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Use a structured troubleshooting record for all VPN incidents reduces recurrence of vpn session log interpretation, rather than the observed ipsec asymmetric vpn egress issue. The relevant preventive control for Oakmont Retail Group is: Review reciprocal route tables after changing branch prefixes. This distinction matters because route-based IPsec depends on consistent forward and return routing through the negotiated security context.

B:

Maintain an IPsec topology and site-pair access matrix reduces recurrence of meshed vpn topology policy, rather than the observed ipsec asymmetric vpn egress issue. The relevant preventive control for Oakmont Retail Group is: Review reciprocal route tables after changing branch prefixes. This distinction matters because route-based IPsec depends on consistent forward and return routing through the negotiated security context.

D:

Verify IKE version during tunnel vendor onboarding reduces recurrence of ike version compatibility, rather than the observed ipsec asymmetric vpn egress issue. The relevant preventive control for Oakmont Retail Group is: Review reciprocal route tables after changing branch prefixes. This distinction matters because route-based IPsec depends on consistent forward and return routing through the negotiated security context.

Question 1157

At Oakmont Transport Authority, the FortiGate 7.6 security administration team encounters the following authorized operational case: an organization wants multiple changing site networks reachable over an IPsec interface but maintains dozens of fragile static routes. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which technically justified operational change fits the observed symptoms?

  1. Configure supported split-tunnel selectors or client routes limited to approved corporate networks
  2. Review and adapt the generated tunnel settings through supported manual configuration as required
  3. Configure a supported BGP adjacency across the route-based IPsec interface with controlled prefix filtering
  4. Update approved phase-two selectors and corresponding policy and route objects on both ends

Explanation

Correct Answer

C:

Configure a supported BGP adjacency across the route-based IPsec interface with controlled prefix filtering. This targets ipsec bgp over virtual tunnel: dynamic routing can exchange changing protected prefixes while the IPsec tunnel supplies encrypted transport. After applying the change, verify that authorized routes are learned across the tunnel and a supervised prefix update converges. The Oakmont Transport Authority case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Configure supported split-tunnel selectors or client routes limited to approved corporate networks is a relevant remedy for a DIFFERENT problem—split tunnel protection for remote vpn—when a remote IPsec client is routed through headquarters for every internet destination although company policy only requires private application prefixes. In this Oakmont Transport Authority case that is not the failing component. Here the correct intervention is to configure a supported BGP adjacency across the route-based IPsec interface with controlled prefix filtering because dynamic routing can exchange changing protected prefixes while the IPsec tunnel supplies encrypted transport.

B:

Review and adapt the generated tunnel settings through supported manual configuration as required is a relevant remedy for a DIFFERENT problem—ipsec wizard versus manual tunnel control—when a technician expects FortiGate's VPN wizard template to work unchanged with a peer that uses uncommon selectors and authentication settings. In this Oakmont Transport Authority case that is not the failing component. Here the correct intervention is to configure a supported BGP adjacency across the route-based IPsec interface with controlled prefix filtering because dynamic routing can exchange changing protected prefixes while the IPsec tunnel supplies encrypted transport.

D:

Update approved phase-two selectors and corresponding policy and route objects on both ends is a relevant remedy for a DIFFERENT problem—ipsec traffic selector after subnet growth—when a branch adds an application VLAN but the tunnel only encrypts the original LAN subnet. In this Oakmont Transport Authority case that is not the failing component. Here the correct intervention is to configure a supported BGP adjacency across the route-based IPsec interface with controlled prefix filtering because dynamic routing can exchange changing protected prefixes while the IPsec tunnel supplies encrypted transport.

Question 1158

At Oakmont Transport Authority, the FortiGate 7.6 security administration team encounters the following authorized operational case: an organization wants multiple changing site networks reachable over an IPsec interface but maintains dozens of fragile static routes. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which technical explanation best identifies the underlying FortiGate behavior?

  1. Tunnel selector and route scope decide which client packets use the encrypted corporate path
  2. Wizard defaults are starting templates and cannot encode every third-party peer requirement
  3. Dynamic routing can exchange changing protected prefixes while the IPsec tunnel supplies encrypted transport
  4. A negotiated child SA handles only the protected prefixes permitted by its selectors

Explanation

Correct Answer

C:

Dynamic routing can exchange changing protected prefixes while the IPsec tunnel supplies encrypted transport. The mechanism is relevant because the stated ipsec bgp over virtual tunnel incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to configure a supported BGP adjacency across the route-based IPsec interface with controlled prefix filtering; verify it through this observed condition: authorized routes are learned across the tunnel and a supervised prefix update converges.

Incorrect Answers

A:

Tunnel selector and route scope decide which client packets use the encrypted corporate path explains a different situation, split tunnel protection for remote vpn, where a remote IPsec client is routed through headquarters for every internet destination although company policy only requires private application prefixes. It does not account for the specific observed ipsec bgp over virtual tunnel condition at Oakmont Transport Authority. The decisive mechanism here is: Dynamic routing can exchange changing protected prefixes while the IPsec tunnel supplies encrypted transport.

B:

Wizard defaults are starting templates and cannot encode every third-party peer requirement explains a different situation, ipsec wizard versus manual tunnel control, where a technician expects FortiGate's VPN wizard template to work unchanged with a peer that uses uncommon selectors and authentication settings. It does not account for the specific observed ipsec bgp over virtual tunnel condition at Oakmont Transport Authority. The decisive mechanism here is: Dynamic routing can exchange changing protected prefixes while the IPsec tunnel supplies encrypted transport.

D:

A negotiated child SA handles only the protected prefixes permitted by its selectors explains a different situation, ipsec traffic selector after subnet growth, where a branch adds an application VLAN but the tunnel only encrypts the original LAN subnet. It does not account for the specific observed ipsec bgp over virtual tunnel condition at Oakmont Transport Authority. The decisive mechanism here is: Dynamic routing can exchange changing protected prefixes while the IPsec tunnel supplies encrypted transport.

Question 1159

At Oakmont Transport Authority, the FortiGate 7.6 security administration team encounters the following authorized operational case: an organization wants multiple changing site networks reachable over an IPsec interface but maintains dozens of fragile static routes. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What acceptance evidence most directly confirms the expected policy or network behavior?

  1. Private application test traffic is encrypted while approved general internet traffic follows client policy
  2. Authorized routes are learned across the tunnel and a supervised prefix update converges
  3. The finished tunnel matches the peer's approved phase-one and phase-two parameters
  4. A test from the newly approved subnet is encrypted and reaches the remote application

Explanation

Correct Answer

B:

Authorized routes are learned across the tunnel and a supervised prefix update converges. This directly tests the corrective decision to configure a supported BGP adjacency across the route-based IPsec interface with controlled prefix filtering. It is a meaningful acceptance check because dynamic routing can exchange changing protected prefixes while the IPsec tunnel supplies encrypted transport. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

Private application test traffic is encrypted while approved general internet traffic follows client policy would validate the separate control split tunnel protection for remote vpn, not the fault reported for Oakmont Transport Authority. To confirm this correction, the team instead needs: Authorized routes are learned across the tunnel and a supervised prefix update converges. That is the observable check related to ipsec bgp over virtual tunnel.

C:

The finished tunnel matches the peer's approved phase-one and phase-two parameters would validate the separate control ipsec wizard versus manual tunnel control, not the fault reported for Oakmont Transport Authority. To confirm this correction, the team instead needs: Authorized routes are learned across the tunnel and a supervised prefix update converges. That is the observable check related to ipsec bgp over virtual tunnel.

D:

A test from the newly approved subnet is encrypted and reaches the remote application would validate the separate control ipsec traffic selector after subnet growth, not the fault reported for Oakmont Transport Authority. To confirm this correction, the team instead needs: Authorized routes are learned across the tunnel and a supervised prefix update converges. That is the observable check related to ipsec bgp over virtual tunnel.

Question 1160

At Oakmont Transport Authority, the FortiGate 7.6 security administration team encounters the following authorized operational case: an organization wants multiple changing site networks reachable over an IPsec interface but maintains dozens of fragile static routes. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which recurring review is most relevant to the same root risk?

  1. Monitor BGP neighbor health and filter accidental prefix advertisements
  2. Review split tunnel destinations when new corporate apps are added
  3. Archive negotiated settings after wizard-driven deployment
  4. Reconcile site address inventories with VPN selectors after subnet additions

Explanation

Correct Answer

A:

Monitor BGP neighbor health and filter accidental prefix advertisements. This recurring practice addresses ipsec bgp over virtual tunnel because dynamic routing can exchange changing protected prefixes while the IPsec tunnel supplies encrypted transport. It reinforces the supported change to configure a supported BGP adjacency across the route-based IPsec interface with controlled prefix filtering rather than relying on an unrelated periodic audit.

Incorrect Answers

B:

Review split tunnel destinations when new corporate apps are added reduces recurrence of split tunnel protection for remote vpn, rather than the observed ipsec bgp over virtual tunnel issue. The relevant preventive control for Oakmont Transport Authority is: Monitor BGP neighbor health and filter accidental prefix advertisements. This distinction matters because dynamic routing can exchange changing protected prefixes while the IPsec tunnel supplies encrypted transport.

C:

Archive negotiated settings after wizard-driven deployment reduces recurrence of ipsec wizard versus manual tunnel control, rather than the observed ipsec bgp over virtual tunnel issue. The relevant preventive control for Oakmont Transport Authority is: Monitor BGP neighbor health and filter accidental prefix advertisements. This distinction matters because dynamic routing can exchange changing protected prefixes while the IPsec tunnel supplies encrypted transport.

D:

Reconcile site address inventories with VPN selectors after subnet additions reduces recurrence of ipsec traffic selector after subnet growth, rather than the observed ipsec bgp over virtual tunnel issue. The relevant preventive control for Oakmont Transport Authority is: Monitor BGP neighbor health and filter accidental prefix advertisements. This distinction matters because dynamic routing can exchange changing protected prefixes while the IPsec tunnel supplies encrypted transport.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests