McAfee Secure

Exam Code: FCP_FGT_AD-7.6

Exam Name: FCP - FortiGate 7.6 Administrator

Certification Provider: Fortinet

Corresponding Certification: NSE4

Questions & Answers

Fortinet FCP_FGT_AD-7.6 Questions & Answers

Study with Up-To-Date REAL Exam Questions and Answers from the ACTUAL Test

Questions & Answers

128 Questions & Answers with Testing Engine

"FCP - FortiGate 7.6 Administrator Exam", also known as FCP_FGT_AD-7.6 exam, is a Fortinet certification exam.

Pass your tests with the always up-to-date FCP_FGT_AD-7.6 Exam Engine. Your FCP_FGT_AD-7.6 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Fortinet FCP_FGT_AD-7.6 Practice Test 120

Question 1190

At Oakmont Insurance, the FortiGate 7.6 security administration team encounters the following authorized operational case: two acquired offices use the same protected subnet and the hub FortiGate cannot distinguish return destinations across their VPNs. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What root condition most directly explains the described FortiGate symptom?

  1. An established IPsec tunnel does not override FortiGate forward-policy enforcement
  2. An accepting outbound policy does not necessarily create permission for independently initiated inbound flows
  3. A wizard's initial example selectors and permit addresses may not match every required protected network
  4. Identical remote prefixes cannot be unambiguously routed to separate IPsec site destinations

Explanation

Correct Answer

D:

Identical remote prefixes cannot be unambiguously routed to separate IPsec site destinations. The mechanism is relevant because the stated ipsec overlapping address conflict incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to readdress one protected network or design compatible selective translation with nonoverlapping tunnel selectors; verify it through this observed condition: a test reaches both offices through distinct documented translated destinations.

Incorrect Answers

A:

An established IPsec tunnel does not override FortiGate forward-policy enforcement explains a different situation, route-based tunnel interface policy, where a route-based IPsec tunnel is up but users cannot reach the remote LAN because no firewall policy permits the tunnel interface pair. It does not account for the specific observed ipsec overlapping address conflict condition at Oakmont Insurance. The decisive mechanism here is: Identical remote prefixes cannot be unambiguously routed to separate IPsec site destinations.

B:

An accepting outbound policy does not necessarily create permission for independently initiated inbound flows explains a different situation, ipsec tunnel policy return direction, where the head office reaches a remote file server but the remote office cannot initiate sessions toward the head-office database. It does not account for the specific observed ipsec overlapping address conflict condition at Oakmont Insurance. The decisive mechanism here is: Identical remote prefixes cannot be unambiguously routed to separate IPsec site destinations.

C:

A wizard's initial example selectors and permit addresses may not match every required protected network explains a different situation, vpn wizard group policy permissions, where a newly created wizard tunnel is reachable from one internal subnet but the wizard-generated policy does not include the second authorized subnet. It does not account for the specific observed ipsec overlapping address conflict condition at Oakmont Insurance. The decisive mechanism here is: Identical remote prefixes cannot be unambiguously routed to separate IPsec site destinations.

Question 1191

At Oakmont Insurance, the FortiGate 7.6 security administration team encounters the following authorized operational case: two acquired offices use the same protected subnet and the hub FortiGate cannot distinguish return destinations across their VPNs. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which observable result should the administrator require before closing this change?

  1. Authorized LAN-to-LAN traffic matches the intended IPsec interface policy in both directions
  2. Approved remote-initiated sessions match their own permit rule while other ports remain denied
  3. A test reaches both offices through distinct documented translated destinations
  4. Both intended subnets connect over the tunnel and a forbidden source is denied

Explanation

Correct Answer

C:

A test reaches both offices through distinct documented translated destinations. This directly tests the corrective decision to readdress one protected network or design compatible selective translation with nonoverlapping tunnel selectors. It is a meaningful acceptance check because identical remote prefixes cannot be unambiguously routed to separate IPsec site destinations. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

Authorized LAN-to-LAN traffic matches the intended IPsec interface policy in both directions would validate the separate control route-based tunnel interface policy, not the fault reported for Oakmont Insurance. To confirm this correction, the team instead needs: A test reaches both offices through distinct documented translated destinations. That is the observable check related to ipsec overlapping address conflict.

B:

Approved remote-initiated sessions match their own permit rule while other ports remain denied would validate the separate control ipsec tunnel policy return direction, not the fault reported for Oakmont Insurance. To confirm this correction, the team instead needs: A test reaches both offices through distinct documented translated destinations. That is the observable check related to ipsec overlapping address conflict.

D:

Both intended subnets connect over the tunnel and a forbidden source is denied would validate the separate control vpn wizard group policy permissions, not the fault reported for Oakmont Insurance. To confirm this correction, the team instead needs: A test reaches both offices through distinct documented translated destinations. That is the observable check related to ipsec overlapping address conflict.

Question 1192

At Oakmont Insurance, the FortiGate 7.6 security administration team encounters the following authorized operational case: two acquired offices use the same protected subnet and the hub FortiGate cannot distinguish return destinations across their VPNs. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which ongoing safeguard best reduces recurrence of this problem?

  1. Test firewall policy scope after creating new tunnel interfaces
  2. Maintain IP allocation governance across acquisitions
  3. Document allowed initiation directions in VPN access contracts
  4. Review generated wizard objects against the site access matrix

Explanation

Correct Answer

B:

Maintain IP allocation governance across acquisitions. This recurring practice addresses ipsec overlapping address conflict because identical remote prefixes cannot be unambiguously routed to separate IPsec site destinations. It reinforces the supported change to readdress one protected network or design compatible selective translation with nonoverlapping tunnel selectors rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Test firewall policy scope after creating new tunnel interfaces reduces recurrence of route-based tunnel interface policy, rather than the observed ipsec overlapping address conflict issue. The relevant preventive control for Oakmont Insurance is: Maintain IP allocation governance across acquisitions. This distinction matters because identical remote prefixes cannot be unambiguously routed to separate IPsec site destinations.

C:

Document allowed initiation directions in VPN access contracts reduces recurrence of ipsec tunnel policy return direction, rather than the observed ipsec overlapping address conflict issue. The relevant preventive control for Oakmont Insurance is: Maintain IP allocation governance across acquisitions. This distinction matters because identical remote prefixes cannot be unambiguously routed to separate IPsec site destinations.

D:

Review generated wizard objects against the site access matrix reduces recurrence of vpn wizard group policy permissions, rather than the observed ipsec overlapping address conflict issue. The relevant preventive control for Oakmont Insurance is: Maintain IP allocation governance across acquisitions. This distinction matters because identical remote prefixes cannot be unambiguously routed to separate IPsec site destinations.

Question 1193

At Oakmont Government Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: a certificate-authenticated IPsec peer suddenly fails because the required certificate status responder is unreachable. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What action should the network security administrator take for this specific fault?

  1. Add or correct the intended destination route through the virtual IPsec interface
  2. Set a mutually supported IKE version and compatible authentication proposals
  3. Restrict IKE peer authentication to the approved certificates or authenticated peer identifiers
  4. Restore authorized certificate status service reachability and review compatible peer trust settings

Explanation

Correct Answer

D:

Restore authorized certificate status service reachability and review compatible peer trust settings. This targets vpn certificate revocation outage: certificate chain validation may depend on approved revocation information before IKE identity is trusted. After applying the change, verify that the valid peer authenticates and a known revoked certificate remains rejected. The Oakmont Government Services case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Add or correct the intended destination route through the virtual IPsec interface is a relevant remedy for a DIFFERENT problem—ipsec tunnel static route—when phase-one and phase-two SAs are established but branch traffic exits the plain internet WAN instead of the IPsec tunnel. In this Oakmont Government Services case that is not the failing component. Here the correct intervention is to restore authorized certificate status service reachability and review compatible peer trust settings because certificate chain validation may depend on approved revocation information before IKE identity is trusted.

B:

Set a mutually supported IKE version and compatible authentication proposals is a relevant remedy for a DIFFERENT problem—ike version compatibility—when an IPsec tunnel fails after one vendor peer requires IKEv2 but the FortiGate configuration is pinned to an incompatible IKE version. In this Oakmont Government Services case that is not the failing component. Here the correct intervention is to restore authorized certificate status service reachability and review compatible peer trust settings because certificate chain validation may depend on approved revocation information before IKE identity is trusted.

C:

Restrict IKE peer authentication to the approved certificates or authenticated peer identifiers is a relevant remedy for a DIFFERENT problem—ipsec remote peer authentication scope—when a dialup responder accepts an unrecognized remote gateway identity because its authentication condition is too broad. In this Oakmont Government Services case that is not the failing component. Here the correct intervention is to restore authorized certificate status service reachability and review compatible peer trust settings because certificate chain validation may depend on approved revocation information before IKE identity is trusted.

Question 1194

At Oakmont Government Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: a certificate-authenticated IPsec peer suddenly fails because the required certificate status responder is unreachable. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which interpretation of the observed failure is technically supported?

  1. Certificate chain validation may depend on approved revocation information before IKE identity is trusted
  2. An established VPN cannot carry private prefixes without routing their packets to it
  3. IKEv1 and IKEv2 have distinct negotiation flows and cannot always interoperate as configured
  4. Dialup gateways need strong peer identity validation independent of variable public source addresses

Explanation

Correct Answer

A:

Certificate chain validation may depend on approved revocation information before IKE identity is trusted. The mechanism is relevant because the stated vpn certificate revocation outage incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to restore authorized certificate status service reachability and review compatible peer trust settings; verify it through this observed condition: the valid peer authenticates and a known revoked certificate remains rejected.

Incorrect Answers

B:

An established VPN cannot carry private prefixes without routing their packets to it explains a different situation, ipsec tunnel static route, where phase-one and phase-two SAs are established but branch traffic exits the plain internet WAN instead of the IPsec tunnel. It does not account for the specific observed vpn certificate revocation outage condition at Oakmont Government Services. The decisive mechanism here is: Certificate chain validation may depend on approved revocation information before IKE identity is trusted.

C:

IKEv1 and IKEv2 have distinct negotiation flows and cannot always interoperate as configured explains a different situation, ike version compatibility, where an IPsec tunnel fails after one vendor peer requires IKEv2 but the FortiGate configuration is pinned to an incompatible IKE version. It does not account for the specific observed vpn certificate revocation outage condition at Oakmont Government Services. The decisive mechanism here is: Certificate chain validation may depend on approved revocation information before IKE identity is trusted.

D:

Dialup gateways need strong peer identity validation independent of variable public source addresses explains a different situation, ipsec remote peer authentication scope, where a dialup responder accepts an unrecognized remote gateway identity because its authentication condition is too broad. It does not account for the specific observed vpn certificate revocation outage condition at Oakmont Government Services. The decisive mechanism here is: Certificate chain validation may depend on approved revocation information before IKE identity is trusted.

Question 1195

At Oakmont Government Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: a certificate-authenticated IPsec peer suddenly fails because the required certificate status responder is unreachable. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which supervised observation would best verify the intended correction?

  1. A route lookup selects the tunnel and a private test packet is encrypted
  2. The two devices negotiate the intended IKE version and establish the required child SA
  3. The authorized peer connects and a supervised unknown identity cannot establish an SA
  4. The valid peer authenticates and a known revoked certificate remains rejected

Explanation

Correct Answer

D:

The valid peer authenticates and a known revoked certificate remains rejected. This directly tests the corrective decision to restore authorized certificate status service reachability and review compatible peer trust settings. It is a meaningful acceptance check because certificate chain validation may depend on approved revocation information before IKE identity is trusted. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

A route lookup selects the tunnel and a private test packet is encrypted would validate the separate control ipsec tunnel static route, not the fault reported for Oakmont Government Services. To confirm this correction, the team instead needs: The valid peer authenticates and a known revoked certificate remains rejected. That is the observable check related to vpn certificate revocation outage.

B:

The two devices negotiate the intended IKE version and establish the required child SA would validate the separate control ike version compatibility, not the fault reported for Oakmont Government Services. To confirm this correction, the team instead needs: The valid peer authenticates and a known revoked certificate remains rejected. That is the observable check related to vpn certificate revocation outage.

C:

The authorized peer connects and a supervised unknown identity cannot establish an SA would validate the separate control ipsec remote peer authentication scope, not the fault reported for Oakmont Government Services. To confirm this correction, the team instead needs: The valid peer authenticates and a known revoked certificate remains rejected. That is the observable check related to vpn certificate revocation outage.

Question 1196

At Oakmont Government Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: a certificate-authenticated IPsec peer suddenly fails because the required certificate status responder is unreachable. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What preventive control should the FortiGate operations team maintain?

  1. Monitor VPN PKI status endpoints and expiry windows
  2. Review tunnel routes when branch CIDRs change
  3. Verify IKE version during tunnel vendor onboarding
  4. Audit remote gateway identities when partners rotate credentials

Explanation

Correct Answer

A:

Monitor VPN PKI status endpoints and expiry windows. This recurring practice addresses vpn certificate revocation outage because certificate chain validation may depend on approved revocation information before IKE identity is trusted. It reinforces the supported change to restore authorized certificate status service reachability and review compatible peer trust settings rather than relying on an unrelated periodic audit.

Incorrect Answers

B:

Review tunnel routes when branch CIDRs change reduces recurrence of ipsec tunnel static route, rather than the observed vpn certificate revocation outage issue. The relevant preventive control for Oakmont Government Services is: Monitor VPN PKI status endpoints and expiry windows. This distinction matters because certificate chain validation may depend on approved revocation information before IKE identity is trusted.

C:

Verify IKE version during tunnel vendor onboarding reduces recurrence of ike version compatibility, rather than the observed vpn certificate revocation outage issue. The relevant preventive control for Oakmont Government Services is: Monitor VPN PKI status endpoints and expiry windows. This distinction matters because certificate chain validation may depend on approved revocation information before IKE identity is trusted.

D:

Audit remote gateway identities when partners rotate credentials reduces recurrence of ipsec remote peer authentication scope, rather than the observed vpn certificate revocation outage issue. The relevant preventive control for Oakmont Government Services is: Monitor VPN PKI status endpoints and expiry windows. This distinction matters because certificate chain validation may depend on approved revocation information before IKE identity is trusted.

Question 1197

At Oakmont Aviation, the FortiGate 7.6 security administration team encounters the following authorized operational case: active-passive FortiGate failover causes all site-to-site tunnels to renegotiate while operations assumes every IKE state is preserved. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which technically justified operational change fits the observed symptoms?

  1. Build and test a supported secondary IPsec tunnel with suitable route preferences or SD-WAN steering
  2. Validate the supported FortiGate HA and IPsec session synchronization or rekey behavior for the release
  3. Update approved phase-two selectors and corresponding policy and route objects on both ends
  4. Inspect phase-two lifetime, rekey logs and matching proposal settings for both peers

Explanation

Correct Answer

B:

Validate the supported FortiGate HA and IPsec session synchronization or rekey behavior for the release. This targets ipsec ha cluster rekey continuity: firewall HA configuration synchronization does not necessarily imply seamless preservation of every IPsec SA state. After applying the change, verify that a controlled HA switch reconnects the protected tunnels within the approved recovery objective. The Oakmont Aviation case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Build and test a supported secondary IPsec tunnel with suitable route preferences or SD-WAN steering is a relevant remedy for a DIFFERENT problem—ipsec redundant secondary tunnel—when a branch VPN uses one tunnel with no alternate path and every carrier outage disconnects the remote office. In this Oakmont Aviation case that is not the failing component. Here the correct intervention is to validate the supported FortiGate HA and IPsec session synchronization or rekey behavior for the release because firewall HA configuration synchronization does not necessarily imply seamless preservation of every IPsec SA state.

C:

Update approved phase-two selectors and corresponding policy and route objects on both ends is a relevant remedy for a DIFFERENT problem—ipsec traffic selector after subnet growth—when a branch adds an application VLAN but the tunnel only encrypts the original LAN subnet. In this Oakmont Aviation case that is not the failing component. Here the correct intervention is to validate the supported FortiGate HA and IPsec session synchronization or rekey behavior for the release because firewall HA configuration synchronization does not necessarily imply seamless preservation of every IPsec SA state.

D:

Inspect phase-two lifetime, rekey logs and matching proposal settings for both peers is a relevant remedy for a DIFFERENT problem—vpn phase2 lifetime rekey evidence—when a site-to-site connection drops periodically at child-SA renewal even though ordinary short tests succeed. In this Oakmont Aviation case that is not the failing component. Here the correct intervention is to validate the supported FortiGate HA and IPsec session synchronization or rekey behavior for the release because firewall HA configuration synchronization does not necessarily imply seamless preservation of every IPsec SA state.

Question 1198

At Oakmont Aviation, the FortiGate 7.6 security administration team encounters the following authorized operational case: active-passive FortiGate failover causes all site-to-site tunnels to renegotiate while operations assumes every IKE state is preserved. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which technical explanation best identifies the underlying FortiGate behavior?

  1. One tunnel on one underlay remains a single point of failure without a separate operational path
  2. Firewall HA configuration synchronization does not necessarily imply seamless preservation of every IPsec SA state
  3. A negotiated child SA handles only the protected prefixes permitted by its selectors
  4. An SA that negotiates initially may still fail at later child-SA rekey events

Explanation

Correct Answer

B:

Firewall HA configuration synchronization does not necessarily imply seamless preservation of every IPsec SA state. The mechanism is relevant because the stated ipsec ha cluster rekey continuity incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to validate the supported FortiGate HA and IPsec session synchronization or rekey behavior for the release; verify it through this observed condition: a controlled HA switch reconnects the protected tunnels within the approved recovery objective.

Incorrect Answers

A:

One tunnel on one underlay remains a single point of failure without a separate operational path explains a different situation, ipsec redundant secondary tunnel, where a branch VPN uses one tunnel with no alternate path and every carrier outage disconnects the remote office. It does not account for the specific observed ipsec ha cluster rekey continuity condition at Oakmont Aviation. The decisive mechanism here is: Firewall HA configuration synchronization does not necessarily imply seamless preservation of every IPsec SA state.

C:

A negotiated child SA handles only the protected prefixes permitted by its selectors explains a different situation, ipsec traffic selector after subnet growth, where a branch adds an application VLAN but the tunnel only encrypts the original LAN subnet. It does not account for the specific observed ipsec ha cluster rekey continuity condition at Oakmont Aviation. The decisive mechanism here is: Firewall HA configuration synchronization does not necessarily imply seamless preservation of every IPsec SA state.

D:

An SA that negotiates initially may still fail at later child-SA rekey events explains a different situation, vpn phase2 lifetime rekey evidence, where a site-to-site connection drops periodically at child-SA renewal even though ordinary short tests succeed. It does not account for the specific observed ipsec ha cluster rekey continuity condition at Oakmont Aviation. The decisive mechanism here is: Firewall HA configuration synchronization does not necessarily imply seamless preservation of every IPsec SA state.

Question 1199

At Oakmont Aviation, the FortiGate 7.6 security administration team encounters the following authorized operational case: active-passive FortiGate failover causes all site-to-site tunnels to renegotiate while operations assumes every IKE state is preserved. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What acceptance evidence most directly confirms the expected policy or network behavior?

  1. A controlled HA switch reconnects the protected tunnels within the approved recovery objective
  2. A primary tunnel failure preserves approved site connectivity through secondary
  3. A test from the newly approved subnet is encrypted and reaches the remote application
  4. A controlled long-lived VPN session survives multiple scheduled child-SA renewals

Explanation

Correct Answer

A:

A controlled HA switch reconnects the protected tunnels within the approved recovery objective. This directly tests the corrective decision to validate the supported FortiGate HA and IPsec session synchronization or rekey behavior for the release. It is a meaningful acceptance check because firewall HA configuration synchronization does not necessarily imply seamless preservation of every IPsec SA state. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

B:

A primary tunnel failure preserves approved site connectivity through secondary would validate the separate control ipsec redundant secondary tunnel, not the fault reported for Oakmont Aviation. To confirm this correction, the team instead needs: A controlled HA switch reconnects the protected tunnels within the approved recovery objective. That is the observable check related to ipsec ha cluster rekey continuity.

C:

A test from the newly approved subnet is encrypted and reaches the remote application would validate the separate control ipsec traffic selector after subnet growth, not the fault reported for Oakmont Aviation. To confirm this correction, the team instead needs: A controlled HA switch reconnects the protected tunnels within the approved recovery objective. That is the observable check related to ipsec ha cluster rekey continuity.

D:

A controlled long-lived VPN session survives multiple scheduled child-SA renewals would validate the separate control vpn phase2 lifetime rekey evidence, not the fault reported for Oakmont Aviation. To confirm this correction, the team instead needs: A controlled HA switch reconnects the protected tunnels within the approved recovery objective. That is the observable check related to ipsec ha cluster rekey continuity.

Question 1200

At Oakmont Aviation, the FortiGate 7.6 security administration team encounters the following authorized operational case: active-passive FortiGate failover causes all site-to-site tunnels to renegotiate while operations assumes every IKE state is preserved. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which recurring review is most relevant to the same root risk?

  1. Verify redundant transport and keys quarterly
  2. Reconcile site address inventories with VPN selectors after subnet additions
  3. Test VPN recovery during HA firmware and member maintenance
  4. Include multi-cycle rekey tests in IPsec acceptance procedures

Explanation

Correct Answer

C:

Test VPN recovery during HA firmware and member maintenance. This recurring practice addresses ipsec ha cluster rekey continuity because firewall HA configuration synchronization does not necessarily imply seamless preservation of every IPsec SA state. It reinforces the supported change to validate the supported FortiGate HA and IPsec session synchronization or rekey behavior for the release rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Verify redundant transport and keys quarterly reduces recurrence of ipsec redundant secondary tunnel, rather than the observed ipsec ha cluster rekey continuity issue. The relevant preventive control for Oakmont Aviation is: Test VPN recovery during HA firmware and member maintenance. This distinction matters because firewall HA configuration synchronization does not necessarily imply seamless preservation of every IPsec SA state.

B:

Reconcile site address inventories with VPN selectors after subnet additions reduces recurrence of ipsec traffic selector after subnet growth, rather than the observed ipsec ha cluster rekey continuity issue. The relevant preventive control for Oakmont Aviation is: Test VPN recovery during HA firmware and member maintenance. This distinction matters because firewall HA configuration synchronization does not necessarily imply seamless preservation of every IPsec SA state.

D:

Include multi-cycle rekey tests in IPsec acceptance procedures reduces recurrence of vpn phase2 lifetime rekey evidence, rather than the observed ipsec ha cluster rekey continuity issue. The relevant preventive control for Oakmont Aviation is: Test VPN recovery during HA firmware and member maintenance. This distinction matters because firewall HA configuration synchronization does not necessarily imply seamless preservation of every IPsec SA state.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests