Fortinet FCP_FGT_AD-7.6 Questions & Answers

Automation requires a scoped credential and does not justify broad interactive administrator rights explains a different situation, automation api account scope, where an inventory script uses a full super-admin account and stores its credential in a shared configuration repository. It does not account for the specific observed identity sso onboarding condition at Dunwell Regional Hospital. The decisive mechanism here is: Identity federation requires consistent application trust and authorization across the identity provider and service.

Filtering before delivery can suppress useful warnings even when logging and transport are healthy explains a different situation, event log severity filtering, where a FortiGate has extensive local events but central monitoring never receives interface-down warnings because of overly restrictive severity filtering. It does not account for the specific observed identity sso onboarding condition at Dunwell Regional Hospital. The decisive mechanism here is: Identity federation requires consistent application trust and authorization across the identity provider and service.

A single common heartbeat transport increases split-brain risk under infrastructure failure explains a different situation, ha split-brain prevention, where a dual-member FortiGate cluster shares one heartbeat switch that maintenance can disconnect simultaneously. It does not account for the specific observed identity sso onboarding condition at Dunwell Regional Hospital. The decisive mechanism here is: Identity federation requires consistent application trust and authorization across the identity provider and service.

The script reads intended inventory while a prohibited policy change is rejected would validate the separate control automation api account scope, not the fault reported for Dunwell Regional Hospital. To confirm this correction, the team instead needs: An approved test identity authenticates and receives only its expected secure access policy. That is the observable check related to identity sso onboarding.

A controlled interface-state event appears in the central search would validate the separate control event log severity filtering, not the fault reported for Dunwell Regional Hospital. To confirm this correction, the team instead needs: An approved test identity authenticates and receives only its expected secure access policy. That is the observable check related to identity sso onboarding.

An approved failure test preserves clear cluster role ownership across a heartbeat-link fault would validate the separate control ha split-brain prevention, not the fault reported for Dunwell Regional Hospital. To confirm this correction, the team instead needs: An approved test identity authenticates and receives only its expected secure access policy. That is the observable check related to identity sso onboarding.

Rotate and revoke automation credentials and audit API access reduces recurrence of automation api account scope, rather than the observed identity sso onboarding issue. The relevant preventive control for Dunwell Regional Hospital is: Review SSO certificates and access assignments before rotation. This distinction matters because identity federation requires consistent application trust and authorization across the identity provider and service.

Review severity thresholds alongside incident detection requirements reduces recurrence of event log severity filtering, rather than the observed identity sso onboarding issue. The relevant preventive control for Dunwell Regional Hospital is: Review SSO certificates and access assignments before rotation. This distinction matters because identity federation requires consistent application trust and authorization across the identity provider and service.

Include heartbeat failure domains in infrastructure designs reduces recurrence of ha split-brain prevention, rather than the observed identity sso onboarding issue. The relevant preventive control for Dunwell Regional Hospital is: Review SSO certificates and access assignments before rotation. This distinction matters because identity federation requires consistent application trust and authorization across the identity provider and service.

Configure reliable permitted DNS resolvers and authenticated or trusted NTP sources is a relevant remedy for a DIFFERENT problem—dns and ntp bootstrap—when a new FortiGate cannot resolve FortiGuard service names and its event times drift from the incident-response timeline. In this Dunwell Retail Group case that is not the failing component. Here the correct intervention is to evaluate the supported FortiSASE steering and split-tunnel policy for approved traffic categories because full-tunnel or split-tunnel selection determines which flows traverse remote security enforcement and performance paths.

Set an authorized FortiAnalyzer or SIEM retention and storage quota policy matching the required period is a relevant remedy for a DIFFERENT problem—remote logging retention quota—when a compliance reviewer cannot retrieve last month's firewall traffic because the remote logging plan retains only two days. In this Dunwell Retail Group case that is not the failing component. Here the correct intervention is to evaluate the supported FortiSASE steering and split-tunnel policy for approved traffic categories because full-tunnel or split-tunnel selection determines which flows traverse remote security enforcement and performance paths.

Verify supported HA virtual MAC behavior and neighbor refresh on attached switches and routers is a relevant remedy for a DIFFERENT problem—ha virtual mac address transition—when hosts keep stale neighbor information after a cluster role swap and some traffic follows an old interface identity. In this Dunwell Retail Group case that is not the failing component. Here the correct intervention is to evaluate the supported FortiSASE steering and split-tunnel policy for approved traffic categories because full-tunnel or split-tunnel selection determines which flows traverse remote security enforcement and performance paths.

Service resolution and accurate clock synchronization are prerequisites for dependable updates and correlated logs explains a different situation, dns and ntp bootstrap, where a new FortiGate cannot resolve FortiGuard service names and its event times drift from the incident-response timeline. It does not account for the specific observed remote split tunnel policy condition at Dunwell Retail Group. The decisive mechanism here is: Full-tunnel or split-tunnel selection determines which flows traverse remote security enforcement and performance paths.

Historical log availability depends on collector storage and retention rules, not only firewall emission explains a different situation, remote logging retention quota, where a compliance reviewer cannot retrieve last month's firewall traffic because the remote logging plan retains only two days. It does not account for the specific observed remote split tunnel policy condition at Dunwell Retail Group. The decisive mechanism here is: Full-tunnel or split-tunnel selection determines which flows traverse remote security enforcement and performance paths.

Failover can require layer-two neighbors to learn the active unit's forwarding identity explains a different situation, ha virtual mac address transition, where hosts keep stale neighbor information after a cluster role swap and some traffic follows an old interface identity. It does not account for the specific observed remote split tunnel policy condition at Dunwell Retail Group. The decisive mechanism here is: Full-tunnel or split-tunnel selection determines which flows traverse remote security enforcement and performance paths.

Name resolution succeeds and FortiGate event timestamps align with the reference clock would validate the separate control dns and ntp bootstrap, not the fault reported for Dunwell Retail Group. To confirm this correction, the team instead needs: A controlled flow trace confirms protected corporate traffic is inspected and eligible traffic takes its approved route. That is the observable check related to remote split tunnel policy.

A sample event persists for the prescribed time and is searchable by policy and source would validate the separate control remote logging retention quota, not the fault reported for Dunwell Retail Group. To confirm this correction, the team instead needs: A controlled flow trace confirms protected corporate traffic is inspected and eligible traffic takes its approved route. That is the observable check related to remote split tunnel policy.

Neighbor tables converge to the active cluster and protected flows resume would validate the separate control ha virtual mac address transition, not the fault reported for Dunwell Retail Group. To confirm this correction, the team instead needs: A controlled flow trace confirms protected corporate traffic is inspected and eligible traffic takes its approved route. That is the observable check related to remote split tunnel policy.

Alert on resolver failures and clock drift reduces recurrence of dns and ntp bootstrap, rather than the observed remote split tunnel policy issue. The relevant preventive control for Dunwell Retail Group is: Document split-tunnel exceptions and audit them after service changes. This distinction matters because full-tunnel or split-tunnel selection determines which flows traverse remote security enforcement and performance paths.

Forecast log volume and alert before quota exhaustion reduces recurrence of remote logging retention quota, rather than the observed remote split tunnel policy issue. The relevant preventive control for Dunwell Retail Group is: Document split-tunnel exceptions and audit them after service changes. This distinction matters because full-tunnel or split-tunnel selection determines which flows traverse remote security enforcement and performance paths.

Validate ARP and switch forwarding after topology adjustments reduces recurrence of ha virtual mac address transition, rather than the observed remote split tunnel policy issue. The relevant preventive control for Dunwell Retail Group is: Document split-tunnel exceptions and audit them after service changes. This distinction matters because full-tunnel or split-tunnel selection determines which flows traverse remote security enforcement and performance paths.

Create the approved VIP mapping from the external service address to the internal server and associate the policy is a relevant remedy for a DIFFERENT problem—vip destination nat publishing—when an outside application cannot reach an internal HTTPS service because only an allow firewall policy exists and no destination translation is configured. In this Dunwell Transport Authority case that is not the failing component. Here the correct intervention is to reorder or narrow the overlapping policies so the intended specific allow rule matches first because fortiGate policy evaluation follows ordered matching rules and can stop at an earlier broad matching action.

Correct the server default or specific return routes for stateful symmetric translation is a relevant remedy for a DIFFERENT problem—nat return path selection—when a server's inbound DNAT service works for SYN packets but response traffic escapes a different gateway outside the FortiGate session path. In this Dunwell Transport Authority case that is not the failing component. Here the correct intervention is to reorder or narrow the overlapping policies so the intended specific allow rule matches first because fortiGate policy evaluation follows ordered matching rules and can stop at an earlier broad matching action.

Import and trust the approved directory CA chain and check LDAP TLS hostname settings is a relevant remedy for a DIFFERENT problem—encrypted ldap ca trust—when fortiGate fails LDAPS handshakes after the directory server's certificate rotates to a new internal issuing CA. In this Dunwell Transport Authority case that is not the failing component. Here the correct intervention is to reorder or narrow the overlapping policies so the intended specific allow rule matches first because fortiGate policy evaluation follows ordered matching rules and can stop at an earlier broad matching action.

A policy that permits traffic does not automatically translate a public destination to an RFC1918 host explains a different situation, vip destination nat publishing, where an outside application cannot reach an internal HTTPS service because only an allow firewall policy exists and no destination translation is configured. It does not account for the specific observed top-down firewall policy matching condition at Dunwell Transport Authority. The decisive mechanism here is: FortiGate policy evaluation follows ordered matching rules and can stop at an earlier broad matching action.

Stateful DNAT sessions depend on return packets reaching the translating firewall context explains a different situation, nat return path selection, where a server's inbound DNAT service works for SYN packets but response traffic escapes a different gateway outside the FortiGate session path. It does not account for the specific observed top-down firewall policy matching condition at Dunwell Transport Authority. The decisive mechanism here is: FortiGate policy evaluation follows ordered matching rules and can stop at an earlier broad matching action.

Encrypted LDAP authentication can fail before user lookup when certificate trust is invalid explains a different situation, encrypted ldap ca trust, where fortiGate fails LDAPS handshakes after the directory server's certificate rotates to a new internal issuing CA. It does not account for the specific observed top-down firewall policy matching condition at Dunwell Transport Authority. The decisive mechanism here is: FortiGate policy evaluation follows ordered matching rules and can stop at an earlier broad matching action.

A controlled external HTTPS request is translated to the intended internal server would validate the separate control vip destination nat publishing, not the fault reported for Dunwell Transport Authority. To confirm this correction, the team instead needs: A controlled application flow logs the expected specific policy ID while prohibited sources still fail. That is the observable check related to top-down firewall policy matching.

A packet capture shows forward and reverse tuples correctly translated in the same session would validate the separate control nat return path selection, not the fault reported for Dunwell Transport Authority. To confirm this correction, the team instead needs: A controlled application flow logs the expected specific policy ID while prohibited sources still fail. That is the observable check related to top-down firewall policy matching.

A verified LDAPS connection succeeds with the expected directory server identity would validate the separate control encrypted ldap ca trust, not the fault reported for Dunwell Transport Authority. To confirm this correction, the team instead needs: A controlled application flow logs the expected specific policy ID while prohibited sources still fail. That is the observable check related to top-down firewall policy matching.

Review VIP and permit rules together when publishing services reduces recurrence of vip destination nat publishing, rather than the observed top-down firewall policy matching issue. The relevant preventive control for Dunwell Transport Authority is: Review shadowed rules after every policy insertion. This distinction matters because fortiGate policy evaluation follows ordered matching rules and can stop at an earlier broad matching action.

Include return-route verification in every VIP publication reduces recurrence of nat return path selection, rather than the observed top-down firewall policy matching issue. The relevant preventive control for Dunwell Transport Authority is: Review shadowed rules after every policy insertion. This distinction matters because fortiGate policy evaluation follows ordered matching rules and can stop at an earlier broad matching action.

Track issuing CA and directory certificate expiration reduces recurrence of encrypted ldap ca trust, rather than the observed top-down firewall policy matching issue. The relevant preventive control for Dunwell Transport Authority is: Review shadowed rules after every policy insertion. This distinction matters because fortiGate policy evaluation follows ordered matching rules and can stop at an earlier broad matching action.