McAfee Secure

Exam Code: FCP_FGT_AD-7.6

Exam Name: FCP - FortiGate 7.6 Administrator

Certification Provider: Fortinet

Corresponding Certification: NSE4

Questions & Answers

Fortinet FCP_FGT_AD-7.6 Questions & Answers

Study with Up-To-Date REAL Exam Questions and Answers from the ACTUAL Test

Questions & Answers

128 Questions & Answers with Testing Engine

"FCP - FortiGate 7.6 Administrator Exam", also known as FCP_FGT_AD-7.6 exam, is a Fortinet certification exam.

Pass your tests with the always up-to-date FCP_FGT_AD-7.6 Exam Engine. Your FCP_FGT_AD-7.6 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Fortinet FCP_FGT_AD-7.6 Practice Test 40

Question 390

At Eastvale Insurance, the FortiGate 7.6 security administration team encounters the following authorized operational case: a FortiGate central SNAT configuration translates a restricted server through the general internet pool instead of its assigned pool. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What root condition most directly explains the described FortiGate symptom?

  1. An LDAP connector cannot search users through an invalid service bind even if the user passwords are correct
  2. Central source NAT rules are evaluated by their match criteria and ordering
  3. An ordinary source-address permit rule does not force the end user to complete interactive authentication
  4. A collector cannot infer logons that never reach any configured event or agent source

Explanation

Correct Answer

B:

Central source NAT rules are evaluated by their match criteria and ordering. The mechanism is relevant because the stated central snat rule precedence incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to place or refine the specific central SNAT rule ahead of overlapping broader entries; verify it through this observed condition: a test server egress uses its assigned public address while ordinary clients use the shared pool.

Incorrect Answers

A:

An LDAP connector cannot search users through an invalid service bind even if the user passwords are correct explains a different situation, ldap bind account permissions, where fortiGate LDAP authentication begins failing after the enterprise directory bind account is disabled. It does not account for the specific observed central snat rule precedence condition at Eastvale Insurance. The decisive mechanism here is: Central source NAT rules are evaluated by their match criteria and ordering.

C:

An ordinary source-address permit rule does not force the end user to complete interactive authentication explains a different situation, captive portal active authentication, where guest wireless clients pass the firewall to a restricted website without ever being prompted for required login. It does not account for the specific observed central snat rule precedence condition at Eastvale Insurance. The decisive mechanism here is: Central source NAT rules are evaluated by their match criteria and ordering.

D:

A collector cannot infer logons that never reach any configured event or agent source explains a different situation, fsso domain-controller agent collection, where domain users intermittently lose identity mapping after their logons move to a domain controller that lacks the FSSO agent. It does not account for the specific observed central snat rule precedence condition at Eastvale Insurance. The decisive mechanism here is: Central source NAT rules are evaluated by their match criteria and ordering.

Question 391

At Eastvale Insurance, the FortiGate 7.6 security administration team encounters the following authorized operational case: a FortiGate central SNAT configuration translates a restricted server through the general internet pool instead of its assigned pool. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which observable result should the administrator require before closing this change?

  1. An authorized directory account authenticates and the connector reports successful bind and search
  2. A test guest sees the required portal and accesses the service only after an approved login
  3. A test server egress uses its assigned public address while ordinary clients use the shared pool
  4. A test logon on each monitored domain controller appears in the FSSO user list

Explanation

Correct Answer

C:

A test server egress uses its assigned public address while ordinary clients use the shared pool. This directly tests the corrective decision to place or refine the specific central SNAT rule ahead of overlapping broader entries. It is a meaningful acceptance check because central source NAT rules are evaluated by their match criteria and ordering. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

An authorized directory account authenticates and the connector reports successful bind and search would validate the separate control ldap bind account permissions, not the fault reported for Eastvale Insurance. To confirm this correction, the team instead needs: A test server egress uses its assigned public address while ordinary clients use the shared pool. That is the observable check related to central snat rule precedence.

B:

A test guest sees the required portal and accesses the service only after an approved login would validate the separate control captive portal active authentication, not the fault reported for Eastvale Insurance. To confirm this correction, the team instead needs: A test server egress uses its assigned public address while ordinary clients use the shared pool. That is the observable check related to central snat rule precedence.

D:

A test logon on each monitored domain controller appears in the FSSO user list would validate the separate control fsso domain-controller agent collection, not the fault reported for Eastvale Insurance. To confirm this correction, the team instead needs: A test server egress uses its assigned public address while ordinary clients use the shared pool. That is the observable check related to central snat rule precedence.

Question 392

At Eastvale Insurance, the FortiGate 7.6 security administration team encounters the following authorized operational case: a FortiGate central SNAT configuration translates a restricted server through the general internet pool instead of its assigned pool. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which ongoing safeguard best reduces recurrence of this problem?

  1. Monitor service-account lifecycle and certificate rotation
  2. Test authentication prompts after guest policy changes
  3. Check specific-to-general ordering when adding central NAT mappings
  4. Audit domain-controller additions and agent health

Explanation

Correct Answer

C:

Check specific-to-general ordering when adding central NAT mappings. This recurring practice addresses central snat rule precedence because central source NAT rules are evaluated by their match criteria and ordering. It reinforces the supported change to place or refine the specific central SNAT rule ahead of overlapping broader entries rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Monitor service-account lifecycle and certificate rotation reduces recurrence of ldap bind account permissions, rather than the observed central snat rule precedence issue. The relevant preventive control for Eastvale Insurance is: Check specific-to-general ordering when adding central NAT mappings. This distinction matters because central source NAT rules are evaluated by their match criteria and ordering.

B:

Test authentication prompts after guest policy changes reduces recurrence of captive portal active authentication, rather than the observed central snat rule precedence issue. The relevant preventive control for Eastvale Insurance is: Check specific-to-general ordering when adding central NAT mappings. This distinction matters because central source NAT rules are evaluated by their match criteria and ordering.

D:

Audit domain-controller additions and agent health reduces recurrence of fsso domain-controller agent collection, rather than the observed central snat rule precedence issue. The relevant preventive control for Eastvale Insurance is: Check specific-to-general ordering when adding central NAT mappings. This distinction matters because central source NAT rules are evaluated by their match criteria and ordering.

Question 393

At Eastvale Government Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: an outside application cannot reach an internal HTTPS service because only an allow firewall policy exists and no destination translation is configured. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What action should the network security administrator take for this specific fault?

  1. Create the approved VIP mapping from the external service address to the internal server and associate the policy
  2. Update the LDAP group match to the current directory distinguished name and verify membership
  3. Use a supported passive FSSO identity mapping rather than an interactive portal for eligible domain users
  4. Add the required approved domain group to the FSSO collector and FortiGate group filters

Explanation

Correct Answer

A:

Create the approved VIP mapping from the external service address to the internal server and associate the policy. This targets vip destination nat publishing: a policy that permits traffic does not automatically translate a public destination to an RFC1918 host. After applying the change, verify that a controlled external HTTPS request is translated to the intended internal server. The Eastvale Government Services case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

B:

Update the LDAP group match to the current directory distinguished name and verify membership is a relevant remedy for a DIFFERENT problem—ldap group distinguished name—when an LDAP-backed firewall policy rejects a valid employee because the group DN references a renamed organizational unit. In this Eastvale Government Services case that is not the failing component. Here the correct intervention is to create the approved VIP mapping from the external service address to the internal server and associate the policy because a policy that permits traffic does not automatically translate a public destination to an RFC1918 host.

C:

Use a supported passive FSSO identity mapping rather than an interactive portal for eligible domain users is a relevant remedy for a DIFFERENT problem—passive sso versus captive portal—when a managed domain workstation receives repeated browser authentication prompts despite an available passive identity integration. In this Eastvale Government Services case that is not the failing component. Here the correct intervention is to create the approved VIP mapping from the external service address to the internal server and associate the policy because a policy that permits traffic does not automatically translate a public destination to an RFC1918 host.

D:

Add the required approved domain group to the FSSO collector and FortiGate group filters is a relevant remedy for a DIFFERENT problem—fsso group filter scope—when fortiGate learns user IPs via FSSO but authorized members of a particular AD group are never recognized. In this Eastvale Government Services case that is not the failing component. Here the correct intervention is to create the approved VIP mapping from the external service address to the internal server and associate the policy because a policy that permits traffic does not automatically translate a public destination to an RFC1918 host.

Question 394

At Eastvale Government Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: an outside application cannot reach an internal HTTPS service because only an allow firewall policy exists and no destination translation is configured. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which interpretation of the observed failure is technically supported?

  1. Group-based firewall identity matching depends on directory identifiers rather than the group's friendly label
  2. A policy that permits traffic does not automatically translate a public destination to an RFC1918 host
  3. Passive identity mapping can associate an authenticated workstation user without requiring a repeated captive portal challenge
  4. A populated FSSO user table does not guarantee every AD group is included in identity policy mapping

Explanation

Correct Answer

B:

A policy that permits traffic does not automatically translate a public destination to an RFC1918 host. The mechanism is relevant because the stated vip destination nat publishing incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to create the approved VIP mapping from the external service address to the internal server and associate the policy; verify it through this observed condition: a controlled external HTTPS request is translated to the intended internal server.

Incorrect Answers

A:

Group-based firewall identity matching depends on directory identifiers rather than the group's friendly label explains a different situation, ldap group distinguished name, where an LDAP-backed firewall policy rejects a valid employee because the group DN references a renamed organizational unit. It does not account for the specific observed vip destination nat publishing condition at Eastvale Government Services. The decisive mechanism here is: A policy that permits traffic does not automatically translate a public destination to an RFC1918 host.

C:

Passive identity mapping can associate an authenticated workstation user without requiring a repeated captive portal challenge explains a different situation, passive sso versus captive portal, where a managed domain workstation receives repeated browser authentication prompts despite an available passive identity integration. It does not account for the specific observed vip destination nat publishing condition at Eastvale Government Services. The decisive mechanism here is: A policy that permits traffic does not automatically translate a public destination to an RFC1918 host.

D:

A populated FSSO user table does not guarantee every AD group is included in identity policy mapping explains a different situation, fsso group filter scope, where fortiGate learns user IPs via FSSO but authorized members of a particular AD group are never recognized. It does not account for the specific observed vip destination nat publishing condition at Eastvale Government Services. The decisive mechanism here is: A policy that permits traffic does not automatically translate a public destination to an RFC1918 host.

Question 395

At Eastvale Government Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: an outside application cannot reach an internal HTTPS service because only an allow firewall policy exists and no destination translation is configured. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which supervised observation would best verify the intended correction?

  1. An eligible member matches the FortiGate remote group and an outsider is denied
  2. A signed-in domain user matches the expected user group without a new password prompt
  3. An eligible group member matches the intended identity rule without other groups being granted
  4. A controlled external HTTPS request is translated to the intended internal server

Explanation

Correct Answer

D:

A controlled external HTTPS request is translated to the intended internal server. This directly tests the corrective decision to create the approved VIP mapping from the external service address to the internal server and associate the policy. It is a meaningful acceptance check because a policy that permits traffic does not automatically translate a public destination to an RFC1918 host. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

An eligible member matches the FortiGate remote group and an outsider is denied would validate the separate control ldap group distinguished name, not the fault reported for Eastvale Government Services. To confirm this correction, the team instead needs: A controlled external HTTPS request is translated to the intended internal server. That is the observable check related to vip destination nat publishing.

B:

A signed-in domain user matches the expected user group without a new password prompt would validate the separate control passive sso versus captive portal, not the fault reported for Eastvale Government Services. To confirm this correction, the team instead needs: A controlled external HTTPS request is translated to the intended internal server. That is the observable check related to vip destination nat publishing.

C:

An eligible group member matches the intended identity rule without other groups being granted would validate the separate control fsso group filter scope, not the fault reported for Eastvale Government Services. To confirm this correction, the team instead needs: A controlled external HTTPS request is translated to the intended internal server. That is the observable check related to vip destination nat publishing.

Question 396

At Eastvale Government Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: an outside application cannot reach an internal HTTPS service because only an allow firewall policy exists and no destination translation is configured. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What preventive control should the FortiGate operations team maintain?

  1. Review VIP and permit rules together when publishing services
  2. Review directory group object changes during identity maintenance
  3. Monitor passive identity freshness and fallback methods
  4. Review FSSO filters when application groups change

Explanation

Correct Answer

A:

Review VIP and permit rules together when publishing services. This recurring practice addresses vip destination nat publishing because a policy that permits traffic does not automatically translate a public destination to an RFC1918 host. It reinforces the supported change to create the approved VIP mapping from the external service address to the internal server and associate the policy rather than relying on an unrelated periodic audit.

Incorrect Answers

B:

Review directory group object changes during identity maintenance reduces recurrence of ldap group distinguished name, rather than the observed vip destination nat publishing issue. The relevant preventive control for Eastvale Government Services is: Review VIP and permit rules together when publishing services. This distinction matters because a policy that permits traffic does not automatically translate a public destination to an RFC1918 host.

C:

Monitor passive identity freshness and fallback methods reduces recurrence of passive sso versus captive portal, rather than the observed vip destination nat publishing issue. The relevant preventive control for Eastvale Government Services is: Review VIP and permit rules together when publishing services. This distinction matters because a policy that permits traffic does not automatically translate a public destination to an RFC1918 host.

D:

Review FSSO filters when application groups change reduces recurrence of fsso group filter scope, rather than the observed vip destination nat publishing issue. The relevant preventive control for Eastvale Government Services is: Review VIP and permit rules together when publishing services. This distinction matters because a policy that permits traffic does not automatically translate a public destination to an RFC1918 host.

Question 397

At Eastvale Aviation, the FortiGate 7.6 security administration team encounters the following authorized operational case: a reverse proxy on TCP 8443 is published through a standard external HTTPS endpoint but the FortiGate VIP has no port forwarding mapping. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which technically justified operational change fits the observed symptoms?

  1. Import and trust the approved directory CA chain and check LDAP TLS hostname settings
  2. Configure a supported VIP port-forward from the external TCP 443 to the permitted internal TCP 8443
  3. Configure supported explicit proxy user authentication and group-based policy matching
  4. Update the supported FSSO collector connection credentials consistently on FortiGate and collector

Explanation

Correct Answer

B:

Configure a supported VIP port-forward from the external TCP 443 to the permitted internal TCP 8443. This targets vip destination port translation: destination NAT requires the specified port remap when external and internal listeners differ. After applying the change, verify that the outside client connects on 443 and the inside server receives 8443. The Eastvale Aviation case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Import and trust the approved directory CA chain and check LDAP TLS hostname settings is a relevant remedy for a DIFFERENT problem—encrypted ldap ca trust—when fortiGate fails LDAPS handshakes after the directory server's certificate rotates to a new internal issuing CA. In this Eastvale Aviation case that is not the failing component. Here the correct intervention is to configure a supported VIP port-forward from the external TCP 443 to the permitted internal TCP 8443 because destination NAT requires the specified port remap when external and internal listeners differ.

C:

Configure supported explicit proxy user authentication and group-based policy matching is a relevant remedy for a DIFFERENT problem—explicit proxy authentication settings—when web browser requests use an explicit proxy on FortiGate but security records show anonymous clients when per-user control is required. In this Eastvale Aviation case that is not the failing component. Here the correct intervention is to configure a supported VIP port-forward from the external TCP 443 to the permitted internal TCP 8443 because destination NAT requires the specified port remap when external and internal listeners differ.

D:

Update the supported FSSO collector connection credentials consistently on FortiGate and collector is a relevant remedy for a DIFFERENT problem—fsso collector shared secret—when the FortiGate cannot retrieve login mappings after the FSSO collector password rotates. In this Eastvale Aviation case that is not the failing component. Here the correct intervention is to configure a supported VIP port-forward from the external TCP 443 to the permitted internal TCP 8443 because destination NAT requires the specified port remap when external and internal listeners differ.

Question 398

At Eastvale Aviation, the FortiGate 7.6 security administration team encounters the following authorized operational case: a reverse proxy on TCP 8443 is published through a standard external HTTPS endpoint but the FortiGate VIP has no port forwarding mapping. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which technical explanation best identifies the underlying FortiGate behavior?

  1. Encrypted LDAP authentication can fail before user lookup when certificate trust is invalid
  2. Destination NAT requires the specified port remap when external and internal listeners differ
  3. An unauthenticated proxy connection does not by itself identify the human user for policy decisions
  4. An authenticated agent connection rejects clients with a mismatched shared password

Explanation

Correct Answer

B:

Destination NAT requires the specified port remap when external and internal listeners differ. The mechanism is relevant because the stated vip destination port translation incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to configure a supported VIP port-forward from the external TCP 443 to the permitted internal TCP 8443; verify it through this observed condition: the outside client connects on 443 and the inside server receives 8443.

Incorrect Answers

A:

Encrypted LDAP authentication can fail before user lookup when certificate trust is invalid explains a different situation, encrypted ldap ca trust, where fortiGate fails LDAPS handshakes after the directory server's certificate rotates to a new internal issuing CA. It does not account for the specific observed vip destination port translation condition at Eastvale Aviation. The decisive mechanism here is: Destination NAT requires the specified port remap when external and internal listeners differ.

C:

An unauthenticated proxy connection does not by itself identify the human user for policy decisions explains a different situation, explicit proxy authentication settings, where web browser requests use an explicit proxy on FortiGate but security records show anonymous clients when per-user control is required. It does not account for the specific observed vip destination port translation condition at Eastvale Aviation. The decisive mechanism here is: Destination NAT requires the specified port remap when external and internal listeners differ.

D:

An authenticated agent connection rejects clients with a mismatched shared password explains a different situation, fsso collector shared secret, where the FortiGate cannot retrieve login mappings after the FSSO collector password rotates. It does not account for the specific observed vip destination port translation condition at Eastvale Aviation. The decisive mechanism here is: Destination NAT requires the specified port remap when external and internal listeners differ.

Question 399

At Eastvale Aviation, the FortiGate 7.6 security administration team encounters the following authorized operational case: a reverse proxy on TCP 8443 is published through a standard external HTTPS endpoint but the FortiGate VIP has no port forwarding mapping. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What acceptance evidence most directly confirms the expected policy or network behavior?

  1. A verified LDAPS connection succeeds with the expected directory server identity
  2. The outside client connects on 443 and the inside server receives 8443
  3. The authenticated browser session appears with the expected user and policy action
  4. The FortiGate reconnects to the collector and receives test user sessions

Explanation

Correct Answer

B:

The outside client connects on 443 and the inside server receives 8443. This directly tests the corrective decision to configure a supported VIP port-forward from the external TCP 443 to the permitted internal TCP 8443. It is a meaningful acceptance check because destination NAT requires the specified port remap when external and internal listeners differ. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

A verified LDAPS connection succeeds with the expected directory server identity would validate the separate control encrypted ldap ca trust, not the fault reported for Eastvale Aviation. To confirm this correction, the team instead needs: The outside client connects on 443 and the inside server receives 8443. That is the observable check related to vip destination port translation.

C:

The authenticated browser session appears with the expected user and policy action would validate the separate control explicit proxy authentication settings, not the fault reported for Eastvale Aviation. To confirm this correction, the team instead needs: The outside client connects on 443 and the inside server receives 8443. That is the observable check related to vip destination port translation.

D:

The FortiGate reconnects to the collector and receives test user sessions would validate the separate control fsso collector shared secret, not the fault reported for Eastvale Aviation. To confirm this correction, the team instead needs: The outside client connects on 443 and the inside server receives 8443. That is the observable check related to vip destination port translation.

Question 400

At Eastvale Aviation, the FortiGate 7.6 security administration team encounters the following authorized operational case: a reverse proxy on TCP 8443 is published through a standard external HTTPS endpoint but the FortiGate VIP has no port forwarding mapping. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which recurring review is most relevant to the same root risk?

  1. Track issuing CA and directory certificate expiration
  2. Document port mappings and test them after proxy upgrades
  3. Audit proxy authentication and session timeout behavior
  4. Coordinate collector credential rotation with firewall configuration

Explanation

Correct Answer

B:

Document port mappings and test them after proxy upgrades. This recurring practice addresses vip destination port translation because destination NAT requires the specified port remap when external and internal listeners differ. It reinforces the supported change to configure a supported VIP port-forward from the external TCP 443 to the permitted internal TCP 8443 rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Track issuing CA and directory certificate expiration reduces recurrence of encrypted ldap ca trust, rather than the observed vip destination port translation issue. The relevant preventive control for Eastvale Aviation is: Document port mappings and test them after proxy upgrades. This distinction matters because destination NAT requires the specified port remap when external and internal listeners differ.

C:

Audit proxy authentication and session timeout behavior reduces recurrence of explicit proxy authentication settings, rather than the observed vip destination port translation issue. The relevant preventive control for Eastvale Aviation is: Document port mappings and test them after proxy upgrades. This distinction matters because destination NAT requires the specified port remap when external and internal listeners differ.

D:

Coordinate collector credential rotation with firewall configuration reduces recurrence of fsso collector shared secret, rather than the observed vip destination port translation issue. The relevant preventive control for Eastvale Aviation is: Document port mappings and test them after proxy upgrades. This distinction matters because destination NAT requires the specified port remap when external and internal listeners differ.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests