McAfee Secure

Exam Code: FCP_FGT_AD-7.6

Exam Name: FCP - FortiGate 7.6 Administrator

Certification Provider: Fortinet

Corresponding Certification: NSE4

Questions & Answers

Fortinet FCP_FGT_AD-7.6 Questions & Answers

Study with Up-To-Date REAL Exam Questions and Answers from the ACTUAL Test

Questions & Answers

128 Questions & Answers with Testing Engine

"FCP - FortiGate 7.6 Administrator Exam", also known as FCP_FGT_AD-7.6 exam, is a Fortinet certification exam.

Pass your tests with the always up-to-date FCP_FGT_AD-7.6 Exam Engine. Your FCP_FGT_AD-7.6 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Fortinet FCP_FGT_AD-7.6 Practice Test 47

Question 460

At Fairmont Biotechnology, the FortiGate 7.6 security administration team encounters the following authorized operational case: valid users fail authentication during a primary RADIUS server outage despite a configured secondary server. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which recurring review is most relevant to the same root risk?

  1. Review FSSO filters when application groups change
  2. Exercise identity-server failover under controlled conditions
  3. Track identity infrastructure DNS and address changes
  4. Verify route and policy direction together during deployment

Explanation

Correct Answer

B:

Exercise identity-server failover under controlled conditions. This recurring practice addresses radius timeout and failover because a backup identity server is ineffective when its address, route or retry behavior is misconfigured. It reinforces the supported change to set suitable supported backup RADIUS server ordering and reachability/timeouts rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Review FSSO filters when application groups change reduces recurrence of fsso group filter scope, rather than the observed radius timeout and failover issue. The relevant preventive control for Fairmont Biotechnology is: Exercise identity-server failover under controlled conditions. This distinction matters because a backup identity server is ineffective when its address, route or retry behavior is misconfigured.

C:

Track identity infrastructure DNS and address changes reduces recurrence of fsso hostname and dns resolution, rather than the observed radius timeout and failover issue. The relevant preventive control for Fairmont Biotechnology is: Exercise identity-server failover under controlled conditions. This distinction matters because a backup identity server is ineffective when its address, route or retry behavior is misconfigured.

D:

Verify route and policy direction together during deployment reduces recurrence of incoming versus outgoing interface selection, rather than the observed radius timeout and failover issue. The relevant preventive control for Fairmont Biotechnology is: Exercise identity-server failover under controlled conditions. This distinction matters because a backup identity server is ineffective when its address, route or retry behavior is misconfigured.

Question 461

At Fairmont Distribution, the FortiGate 7.6 security administration team encounters the following authorized operational case: security operations cannot correlate user logoff events because the FortiGate implementation collects only RADIUS authentication results. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which FortiOS 7.6 administration action best addresses this incident?

  1. Update the supported FSSO collector connection credentials consistently on FortiGate and collector
  2. Evaluate supported RADIUS accounting and session-logging configuration for the required user context
  3. Add or reorder the intended identity-based firewall policy and verify user-group matching
  4. Align the policy schedule to the approved maintenance period instead of opening it permanently

Explanation

Correct Answer

B:

Evaluate supported RADIUS accounting and session-logging configuration for the required user context. This targets radius accounting visibility: authentication success alone does not necessarily provide session start, stop or accounting records. After applying the change, verify that a controlled user session produces appropriate accounting start and stop context. The Fairmont Distribution case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Update the supported FSSO collector connection credentials consistently on FortiGate and collector is a relevant remedy for a DIFFERENT problem—fsso collector shared secret—when the FortiGate cannot retrieve login mappings after the FSSO collector password rotates. In this Fairmont Distribution case that is not the failing component. Here the correct intervention is to evaluate supported RADIUS accounting and session-logging configuration for the required user context because authentication success alone does not necessarily provide session start, stop or accounting records.

C:

Add or reorder the intended identity-based firewall policy and verify user-group matching is a relevant remedy for a DIFFERENT problem—fsso log-to-policy correlation—when identity logs show a valid user mapping but traffic continues to follow a generic source-IP permit rule. In this Fairmont Distribution case that is not the failing component. Here the correct intervention is to evaluate supported RADIUS accounting and session-logging configuration for the required user context because authentication success alone does not necessarily provide session start, stop or accounting records.

D:

Align the policy schedule to the approved maintenance period instead of opening it permanently is a relevant remedy for a DIFFERENT problem—firewall schedule expiration—when an authorized overnight vendor maintenance flow stops working after a policy's time schedule expires. In this Fairmont Distribution case that is not the failing component. Here the correct intervention is to evaluate supported RADIUS accounting and session-logging configuration for the required user context because authentication success alone does not necessarily provide session start, stop or accounting records.

Question 462

At Fairmont Distribution, the FortiGate 7.6 security administration team encounters the following authorized operational case: security operations cannot correlate user logoff events because the FortiGate implementation collects only RADIUS authentication results. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the primary mechanism responsible for the reported result?

  1. Authentication success alone does not necessarily provide session start, stop or accounting records
  2. An authenticated agent connection rejects clients with a mismatched shared password
  3. A learned FSSO identity alone does not cause a flow to match a rule lacking the intended user condition
  4. A scheduled firewall policy does not match outside its configured active time window

Explanation

Correct Answer

A:

Authentication success alone does not necessarily provide session start, stop or accounting records. The mechanism is relevant because the stated radius accounting visibility incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to evaluate supported RADIUS accounting and session-logging configuration for the required user context; verify it through this observed condition: a controlled user session produces appropriate accounting start and stop context.

Incorrect Answers

B:

An authenticated agent connection rejects clients with a mismatched shared password explains a different situation, fsso collector shared secret, where the FortiGate cannot retrieve login mappings after the FSSO collector password rotates. It does not account for the specific observed radius accounting visibility condition at Fairmont Distribution. The decisive mechanism here is: Authentication success alone does not necessarily provide session start, stop or accounting records.

C:

A learned FSSO identity alone does not cause a flow to match a rule lacking the intended user condition explains a different situation, fsso log-to-policy correlation, where identity logs show a valid user mapping but traffic continues to follow a generic source-IP permit rule. It does not account for the specific observed radius accounting visibility condition at Fairmont Distribution. The decisive mechanism here is: Authentication success alone does not necessarily provide session start, stop or accounting records.

D:

A scheduled firewall policy does not match outside its configured active time window explains a different situation, firewall schedule expiration, where an authorized overnight vendor maintenance flow stops working after a policy's time schedule expires. It does not account for the specific observed radius accounting visibility condition at Fairmont Distribution. The decisive mechanism here is: Authentication success alone does not necessarily provide session start, stop or accounting records.

Question 463

At Fairmont Distribution, the FortiGate 7.6 security administration team encounters the following authorized operational case: security operations cannot correlate user logoff events because the FortiGate implementation collects only RADIUS authentication results. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which validation result would demonstrate that the specified incident has been resolved?

  1. The FortiGate reconnects to the collector and receives test user sessions
  2. A controlled test session records the expected user and identity-specific firewall policy
  3. The connection works during the approved test window and is denied outside that period
  4. A controlled user session produces appropriate accounting start and stop context

Explanation

Correct Answer

D:

A controlled user session produces appropriate accounting start and stop context. This directly tests the corrective decision to evaluate supported RADIUS accounting and session-logging configuration for the required user context. It is a meaningful acceptance check because authentication success alone does not necessarily provide session start, stop or accounting records. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

The FortiGate reconnects to the collector and receives test user sessions would validate the separate control fsso collector shared secret, not the fault reported for Fairmont Distribution. To confirm this correction, the team instead needs: A controlled user session produces appropriate accounting start and stop context. That is the observable check related to radius accounting visibility.

B:

A controlled test session records the expected user and identity-specific firewall policy would validate the separate control fsso log-to-policy correlation, not the fault reported for Fairmont Distribution. To confirm this correction, the team instead needs: A controlled user session produces appropriate accounting start and stop context. That is the observable check related to radius accounting visibility.

C:

The connection works during the approved test window and is denied outside that period would validate the separate control firewall schedule expiration, not the fault reported for Fairmont Distribution. To confirm this correction, the team instead needs: A controlled user session produces appropriate accounting start and stop context. That is the observable check related to radius accounting visibility.

Question 464

At Fairmont Distribution, the FortiGate 7.6 security administration team encounters the following authorized operational case: security operations cannot correlate user logoff events because the FortiGate implementation collects only RADIUS authentication results. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which operational practice would most effectively prevent this specific fault?

  1. Coordinate collector credential rotation with firewall configuration
  2. Monitor accounting collector availability and event retention
  3. Audit identity-based policy ordering after source IP rule changes
  4. Reconcile maintenance schedules with access expiration requirements

Explanation

Correct Answer

B:

Monitor accounting collector availability and event retention. This recurring practice addresses radius accounting visibility because authentication success alone does not necessarily provide session start, stop or accounting records. It reinforces the supported change to evaluate supported RADIUS accounting and session-logging configuration for the required user context rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Coordinate collector credential rotation with firewall configuration reduces recurrence of fsso collector shared secret, rather than the observed radius accounting visibility issue. The relevant preventive control for Fairmont Distribution is: Monitor accounting collector availability and event retention. This distinction matters because authentication success alone does not necessarily provide session start, stop or accounting records.

C:

Audit identity-based policy ordering after source IP rule changes reduces recurrence of fsso log-to-policy correlation, rather than the observed radius accounting visibility issue. The relevant preventive control for Fairmont Distribution is: Monitor accounting collector availability and event retention. This distinction matters because authentication success alone does not necessarily provide session start, stop or accounting records.

D:

Reconcile maintenance schedules with access expiration requirements reduces recurrence of firewall schedule expiration, rather than the observed radius accounting visibility issue. The relevant preventive control for Fairmont Distribution is: Monitor accounting collector availability and event retention. This distinction matters because authentication success alone does not necessarily provide session start, stop or accounting records.

Question 465

At Fairmont Public Schools, the FortiGate 7.6 security administration team encounters the following authorized operational case: guest wireless clients pass the firewall to a restricted website without ever being prompted for required login. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the most appropriate first configuration correction for this case?

  1. Configure the supported identity-based firewall or captive portal authentication policy on the guest traffic path
  2. Correct FSSO logoff, logon and workstation IP update behavior with appropriate aging
  3. Select and configure a supported FSSO collection mode with the correct domain permissions and event access
  4. Add the correctly scoped subnet to the approved address group and review any overlapping objects

Explanation

Correct Answer

A:

Configure the supported identity-based firewall or captive portal authentication policy on the guest traffic path. This targets captive portal active authentication: an ordinary source-address permit rule does not force the end user to complete interactive authentication. After applying the change, verify that a test guest sees the required portal and accesses the service only after an approved login. The Fairmont Public Schools case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

B:

Correct FSSO logoff, logon and workstation IP update behavior with appropriate aging is a relevant remedy for a DIFFERENT problem—roaming user stale ip mapping—when an employee moves from Ethernet to Wi-Fi and inherits another user's old FortiGate identity mapping. In this Fairmont Public Schools case that is not the failing component. Here the correct intervention is to configure the supported identity-based firewall or captive portal authentication policy on the guest traffic path because an ordinary source-address permit rule does not force the end user to complete interactive authentication.

C:

Select and configure a supported FSSO collection mode with the correct domain permissions and event access is a relevant remedy for a DIFFERENT problem—fsso polling versus dc agent mode—when a new domain-controller deployment fails to generate timely FSSO mappings because its chosen collection method cannot access the expected logon events. In this Fairmont Public Schools case that is not the failing component. Here the correct intervention is to configure the supported identity-based firewall or captive portal authentication policy on the guest traffic path because an ordinary source-address permit rule does not force the end user to complete interactive authentication.

D:

Add the correctly scoped subnet to the approved address group and review any overlapping objects is a relevant remedy for a DIFFERENT problem—address group membership—when a firewall rule permits the engineering address group but a newly added engineering subnet is missing from that group. In this Fairmont Public Schools case that is not the failing component. Here the correct intervention is to configure the supported identity-based firewall or captive portal authentication policy on the guest traffic path because an ordinary source-address permit rule does not force the end user to complete interactive authentication.

Question 466

At Fairmont Public Schools, the FortiGate 7.6 security administration team encounters the following authorized operational case: guest wireless clients pass the firewall to a restricted website without ever being prompted for required login. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which diagnosis best distinguishes this case from other FortiOS problems?

  1. Passive identity tied to an address can be stale when endpoint addresses are reassigned quickly
  2. Agent-based and polling collection rely on different event acquisition paths and prerequisites
  3. Policy address-group evaluation is limited to its actual member addresses, not their business labels
  4. An ordinary source-address permit rule does not force the end user to complete interactive authentication

Explanation

Correct Answer

D:

An ordinary source-address permit rule does not force the end user to complete interactive authentication. The mechanism is relevant because the stated captive portal active authentication incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to configure the supported identity-based firewall or captive portal authentication policy on the guest traffic path; verify it through this observed condition: a test guest sees the required portal and accesses the service only after an approved login.

Incorrect Answers

A:

Passive identity tied to an address can be stale when endpoint addresses are reassigned quickly explains a different situation, roaming user stale ip mapping, where an employee moves from Ethernet to Wi-Fi and inherits another user's old FortiGate identity mapping. It does not account for the specific observed captive portal active authentication condition at Fairmont Public Schools. The decisive mechanism here is: An ordinary source-address permit rule does not force the end user to complete interactive authentication.

B:

Agent-based and polling collection rely on different event acquisition paths and prerequisites explains a different situation, fsso polling versus dc agent mode, where a new domain-controller deployment fails to generate timely FSSO mappings because its chosen collection method cannot access the expected logon events. It does not account for the specific observed captive portal active authentication condition at Fairmont Public Schools. The decisive mechanism here is: An ordinary source-address permit rule does not force the end user to complete interactive authentication.

C:

Policy address-group evaluation is limited to its actual member addresses, not their business labels explains a different situation, address group membership, where a firewall rule permits the engineering address group but a newly added engineering subnet is missing from that group. It does not account for the specific observed captive portal active authentication condition at Fairmont Public Schools. The decisive mechanism here is: An ordinary source-address permit rule does not force the end user to complete interactive authentication.

Question 467

At Fairmont Public Schools, the FortiGate 7.6 security administration team encounters the following authorized operational case: guest wireless clients pass the firewall to a restricted website without ever being prompted for required login. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which controlled test outcome best proves that the required feature now works?

  1. A test guest sees the required portal and accesses the service only after an approved login
  2. A roaming test user receives the current correct identity and the stale mapping disappears
  3. A fresh domain login reaches the collector within the accepted detection interval
  4. Only clients in the updated group obtain intended access

Explanation

Correct Answer

A:

A test guest sees the required portal and accesses the service only after an approved login. This directly tests the corrective decision to configure the supported identity-based firewall or captive portal authentication policy on the guest traffic path. It is a meaningful acceptance check because an ordinary source-address permit rule does not force the end user to complete interactive authentication. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

B:

A roaming test user receives the current correct identity and the stale mapping disappears would validate the separate control roaming user stale ip mapping, not the fault reported for Fairmont Public Schools. To confirm this correction, the team instead needs: A test guest sees the required portal and accesses the service only after an approved login. That is the observable check related to captive portal active authentication.

C:

A fresh domain login reaches the collector within the accepted detection interval would validate the separate control fsso polling versus dc agent mode, not the fault reported for Fairmont Public Schools. To confirm this correction, the team instead needs: A test guest sees the required portal and accesses the service only after an approved login. That is the observable check related to captive portal active authentication.

D:

Only clients in the updated group obtain intended access would validate the separate control address group membership, not the fault reported for Fairmont Public Schools. To confirm this correction, the team instead needs: A test guest sees the required portal and accesses the service only after an approved login. That is the observable check related to captive portal active authentication.

Question 468

At Fairmont Public Schools, the FortiGate 7.6 security administration team encounters the following authorized operational case: guest wireless clients pass the firewall to a restricted website without ever being prompted for required login. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What continuing control matches this firewall administration scenario?

  1. Monitor identity aging and DHCP reassignment in FSSO deployments
  2. Test authentication prompts after guest policy changes
  3. Document FSSO mode prerequisites when replacing domain controllers
  4. Audit group contents after subnet allocation changes

Explanation

Correct Answer

B:

Test authentication prompts after guest policy changes. This recurring practice addresses captive portal active authentication because an ordinary source-address permit rule does not force the end user to complete interactive authentication. It reinforces the supported change to configure the supported identity-based firewall or captive portal authentication policy on the guest traffic path rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Monitor identity aging and DHCP reassignment in FSSO deployments reduces recurrence of roaming user stale ip mapping, rather than the observed captive portal active authentication issue. The relevant preventive control for Fairmont Public Schools is: Test authentication prompts after guest policy changes. This distinction matters because an ordinary source-address permit rule does not force the end user to complete interactive authentication.

C:

Document FSSO mode prerequisites when replacing domain controllers reduces recurrence of fsso polling versus dc agent mode, rather than the observed captive portal active authentication issue. The relevant preventive control for Fairmont Public Schools is: Test authentication prompts after guest policy changes. This distinction matters because an ordinary source-address permit rule does not force the end user to complete interactive authentication.

D:

Audit group contents after subnet allocation changes reduces recurrence of address group membership, rather than the observed captive portal active authentication issue. The relevant preventive control for Fairmont Public Schools is: Test authentication prompts after guest policy changes. This distinction matters because an ordinary source-address permit rule does not force the end user to complete interactive authentication.

Question 469

At Fairmont Insurance, the FortiGate 7.6 security administration team encounters the following authorized operational case: a managed domain workstation receives repeated browser authentication prompts despite an available passive identity integration. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which supported FortiGate response most directly resolves the stated requirement?

  1. Use a supported terminal-server identity agent or compatible per-user mapping design
  2. Use a supported passive FSSO identity mapping rather than an interactive portal for eligible domain users
  3. Configure a supported redundant collector arrangement and verify FortiGate connection behavior
  4. Use precise approved partner source addresses or justified geographic exceptions

Explanation

Correct Answer

B:

Use a supported passive FSSO identity mapping rather than an interactive portal for eligible domain users. This targets passive sso versus captive portal: passive identity mapping can associate an authenticated workstation user without requiring a repeated captive portal challenge. After applying the change, verify that a signed-in domain user matches the expected user group without a new password prompt. The Fairmont Insurance case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Use a supported terminal-server identity agent or compatible per-user mapping design is a relevant remedy for a DIFFERENT problem—terminal server multi-user fsso—when several remote desktop users share one terminal-server IP and FortiGate incorrectly assigns them the same firewall identity. In this Fairmont Insurance case that is not the failing component. Here the correct intervention is to use a supported passive FSSO identity mapping rather than an interactive portal for eligible domain users because passive identity mapping can associate an authenticated workstation user without requiring a repeated captive portal challenge.

C:

Configure a supported redundant collector arrangement and verify FortiGate connection behavior is a relevant remedy for a DIFFERENT problem—fsso collector redundancy—when firewall identity policies stop matching after the single FSSO collector host becomes unavailable. In this Fairmont Insurance case that is not the failing component. Here the correct intervention is to use a supported passive FSSO identity mapping rather than an interactive portal for eligible domain users because passive identity mapping can associate an authenticated workstation user without requiring a repeated captive portal challenge.

D:

Use precise approved partner source addresses or justified geographic exceptions is a relevant remedy for a DIFFERENT problem—geographic address policy exceptions—when legitimate partner traffic is blocked because a country address object was applied as a broad policy condition without verifying the partner's real egress. In this Fairmont Insurance case that is not the failing component. Here the correct intervention is to use a supported passive FSSO identity mapping rather than an interactive portal for eligible domain users because passive identity mapping can associate an authenticated workstation user without requiring a repeated captive portal challenge.

Question 470

At Fairmont Insurance, the FortiGate 7.6 security administration team encounters the following authorized operational case: a managed domain workstation receives repeated browser authentication prompts despite an available passive identity integration. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What root condition most directly explains the described FortiGate symptom?

  1. One IP address alone cannot distinguish simultaneous user sessions on a shared terminal server
  2. A single identity collector creates a failure domain for otherwise healthy firewall policies
  3. Passive identity mapping can associate an authenticated workstation user without requiring a repeated captive portal challenge
  4. Country-based address matching can differ from a partner's administrative location when egress IPs are elsewhere

Explanation

Correct Answer

C:

Passive identity mapping can associate an authenticated workstation user without requiring a repeated captive portal challenge. The mechanism is relevant because the stated passive sso versus captive portal incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to use a supported passive FSSO identity mapping rather than an interactive portal for eligible domain users; verify it through this observed condition: a signed-in domain user matches the expected user group without a new password prompt.

Incorrect Answers

A:

One IP address alone cannot distinguish simultaneous user sessions on a shared terminal server explains a different situation, terminal server multi-user fsso, where several remote desktop users share one terminal-server IP and FortiGate incorrectly assigns them the same firewall identity. It does not account for the specific observed passive sso versus captive portal condition at Fairmont Insurance. The decisive mechanism here is: Passive identity mapping can associate an authenticated workstation user without requiring a repeated captive portal challenge.

B:

A single identity collector creates a failure domain for otherwise healthy firewall policies explains a different situation, fsso collector redundancy, where firewall identity policies stop matching after the single FSSO collector host becomes unavailable. It does not account for the specific observed passive sso versus captive portal condition at Fairmont Insurance. The decisive mechanism here is: Passive identity mapping can associate an authenticated workstation user without requiring a repeated captive portal challenge.

D:

Country-based address matching can differ from a partner's administrative location when egress IPs are elsewhere explains a different situation, geographic address policy exceptions, where legitimate partner traffic is blocked because a country address object was applied as a broad policy condition without verifying the partner's real egress. It does not account for the specific observed passive sso versus captive portal condition at Fairmont Insurance. The decisive mechanism here is: Passive identity mapping can associate an authenticated workstation user without requiring a repeated captive portal challenge.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests