McAfee Secure

Exam Code: FCP_FGT_AD-7.6

Exam Name: FCP - FortiGate 7.6 Administrator

Certification Provider: Fortinet

Corresponding Certification: NSE4

Questions & Answers

Fortinet FCP_FGT_AD-7.6 Questions & Answers

Study with Up-To-Date REAL Exam Questions and Answers from the ACTUAL Test

Questions & Answers

128 Questions & Answers with Testing Engine

"FCP - FortiGate 7.6 Administrator Exam", also known as FCP_FGT_AD-7.6 exam, is a Fortinet certification exam.

Pass your tests with the always up-to-date FCP_FGT_AD-7.6 Exam Engine. Your FCP_FGT_AD-7.6 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Fortinet FCP_FGT_AD-7.6 Practice Test 49

Question 480

At Fairmont Aviation, the FortiGate 7.6 security administration team encounters the following authorized operational case: a successful FortiGate login still matches a generic deny rule because the identity group is not referenced in the required permit policy. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which recurring review is most relevant to the same root risk?

  1. Audit domain-controller additions and agent health
  2. Monitor collector network reachability and approved firewall rules
  3. Review group membership and associated policy references quarterly
  4. Require logging coverage on security-critical block rules

Explanation

Correct Answer

C:

Review group membership and associated policy references quarterly. This recurring practice addresses user group policy selection because valid authentication and permission to a particular network service are separate policy decisions. It reinforces the supported change to include the intended authenticated user or group in the appropriate firewall policy and inspect rule order rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Audit domain-controller additions and agent health reduces recurrence of fsso domain-controller agent collection, rather than the observed user group policy selection issue. The relevant preventive control for Fairmont Aviation is: Review group membership and associated policy references quarterly. This distinction matters because valid authentication and permission to a particular network service are separate policy decisions.

B:

Monitor collector network reachability and approved firewall rules reduces recurrence of fsso collector server firewall, rather than the observed user group policy selection issue. The relevant preventive control for Fairmont Aviation is: Review group membership and associated policy references quarterly. This distinction matters because valid authentication and permission to a particular network service are separate policy decisions.

D:

Require logging coverage on security-critical block rules reduces recurrence of deny policy traffic logging, rather than the observed user group policy selection issue. The relevant preventive control for Fairmont Aviation is: Review group membership and associated policy references quarterly. This distinction matters because valid authentication and permission to a particular network service are separate policy decisions.

Question 481

At Greenridge Financial Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: short-term contractors continue to authenticate through old FortiGate guest identities after their authorized engagement ends. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which FortiOS 7.6 administration action best addresses this incident?

  1. Add the required approved domain group to the FSSO collector and FortiGate group filters
  2. Correct the configured collector endpoint and reliable DNS resolution or static addressing
  3. Set suitable guest-user expiry times and revoke stale guest accounts
  4. Review administrative interface access and supported local-in policy controls for traffic destined to the firewall

Explanation

Correct Answer

C:

Set suitable guest-user expiry times and revoke stale guest accounts. This targets guest account expiration: guest credentials without enforced expiry can outlast the intended access window. After applying the change, verify that a supervised expired guest account is rejected while a current approved guest still connects. The Greenridge Financial Services case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Add the required approved domain group to the FSSO collector and FortiGate group filters is a relevant remedy for a DIFFERENT problem—fsso group filter scope—when fortiGate learns user IPs via FSSO but authorized members of a particular AD group are never recognized. In this Greenridge Financial Services case that is not the failing component. Here the correct intervention is to set suitable guest-user expiry times and revoke stale guest accounts because guest credentials without enforced expiry can outlast the intended access window.

B:

Correct the configured collector endpoint and reliable DNS resolution or static addressing is a relevant remedy for a DIFFERENT problem—fsso hostname and dns resolution—when the primary FSSO collector moves to a new IP while FortiGate retains a stale host mapping and login detection stops. In this Greenridge Financial Services case that is not the failing component. Here the correct intervention is to set suitable guest-user expiry times and revoke stale guest accounts because guest credentials without enforced expiry can outlast the intended access window.

D:

Review administrative interface access and supported local-in policy controls for traffic destined to the firewall is a relevant remedy for a DIFFERENT problem—local-in versus forwarded traffic—when a management connection to the FortiGate itself is blocked but a technician adds a broad transit firewall accept policy. In this Greenridge Financial Services case that is not the failing component. Here the correct intervention is to set suitable guest-user expiry times and revoke stale guest accounts because guest credentials without enforced expiry can outlast the intended access window.

Question 482

At Greenridge Financial Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: short-term contractors continue to authenticate through old FortiGate guest identities after their authorized engagement ends. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the primary mechanism responsible for the reported result?

  1. A populated FSSO user table does not guarantee every AD group is included in identity policy mapping
  2. The FSSO connection targets a resolved endpoint address that must remain reachable after server moves
  3. Traffic targeting FortiGate control-plane services is governed differently from transit traffic
  4. Guest credentials without enforced expiry can outlast the intended access window

Explanation

Correct Answer

D:

Guest credentials without enforced expiry can outlast the intended access window. The mechanism is relevant because the stated guest account expiration incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to set suitable guest-user expiry times and revoke stale guest accounts; verify it through this observed condition: a supervised expired guest account is rejected while a current approved guest still connects.

Incorrect Answers

A:

A populated FSSO user table does not guarantee every AD group is included in identity policy mapping explains a different situation, fsso group filter scope, where fortiGate learns user IPs via FSSO but authorized members of a particular AD group are never recognized. It does not account for the specific observed guest account expiration condition at Greenridge Financial Services. The decisive mechanism here is: Guest credentials without enforced expiry can outlast the intended access window.

B:

The FSSO connection targets a resolved endpoint address that must remain reachable after server moves explains a different situation, fsso hostname and dns resolution, where the primary FSSO collector moves to a new IP while FortiGate retains a stale host mapping and login detection stops. It does not account for the specific observed guest account expiration condition at Greenridge Financial Services. The decisive mechanism here is: Guest credentials without enforced expiry can outlast the intended access window.

C:

Traffic targeting FortiGate control-plane services is governed differently from transit traffic explains a different situation, local-in versus forwarded traffic, where a management connection to the FortiGate itself is blocked but a technician adds a broad transit firewall accept policy. It does not account for the specific observed guest account expiration condition at Greenridge Financial Services. The decisive mechanism here is: Guest credentials without enforced expiry can outlast the intended access window.

Question 483

At Greenridge Financial Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: short-term contractors continue to authenticate through old FortiGate guest identities after their authorized engagement ends. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which validation result would demonstrate that the specified incident has been resolved?

  1. An eligible group member matches the intended identity rule without other groups being granted
  2. A supervised expired guest account is rejected while a current approved guest still connects
  3. Collector connection recovers and a fresh domain login matches the intended policy
  4. Approved management sources reach the control plane and unapproved sources remain blocked

Explanation

Correct Answer

B:

A supervised expired guest account is rejected while a current approved guest still connects. This directly tests the corrective decision to set suitable guest-user expiry times and revoke stale guest accounts. It is a meaningful acceptance check because guest credentials without enforced expiry can outlast the intended access window. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

An eligible group member matches the intended identity rule without other groups being granted would validate the separate control fsso group filter scope, not the fault reported for Greenridge Financial Services. To confirm this correction, the team instead needs: A supervised expired guest account is rejected while a current approved guest still connects. That is the observable check related to guest account expiration.

C:

Collector connection recovers and a fresh domain login matches the intended policy would validate the separate control fsso hostname and dns resolution, not the fault reported for Greenridge Financial Services. To confirm this correction, the team instead needs: A supervised expired guest account is rejected while a current approved guest still connects. That is the observable check related to guest account expiration.

D:

Approved management sources reach the control plane and unapproved sources remain blocked would validate the separate control local-in versus forwarded traffic, not the fault reported for Greenridge Financial Services. To confirm this correction, the team instead needs: A supervised expired guest account is rejected while a current approved guest still connects. That is the observable check related to guest account expiration.

Question 484

At Greenridge Financial Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: short-term contractors continue to authenticate through old FortiGate guest identities after their authorized engagement ends. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which operational practice would most effectively prevent this specific fault?

  1. Review FSSO filters when application groups change
  2. Track identity infrastructure DNS and address changes
  3. Reconcile active guests to current sponsor approvals
  4. Maintain a separate management-plane access standard

Explanation

Correct Answer

C:

Reconcile active guests to current sponsor approvals. This recurring practice addresses guest account expiration because guest credentials without enforced expiry can outlast the intended access window. It reinforces the supported change to set suitable guest-user expiry times and revoke stale guest accounts rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Review FSSO filters when application groups change reduces recurrence of fsso group filter scope, rather than the observed guest account expiration issue. The relevant preventive control for Greenridge Financial Services is: Reconcile active guests to current sponsor approvals. This distinction matters because guest credentials without enforced expiry can outlast the intended access window.

B:

Track identity infrastructure DNS and address changes reduces recurrence of fsso hostname and dns resolution, rather than the observed guest account expiration issue. The relevant preventive control for Greenridge Financial Services is: Reconcile active guests to current sponsor approvals. This distinction matters because guest credentials without enforced expiry can outlast the intended access window.

D:

Maintain a separate management-plane access standard reduces recurrence of local-in versus forwarded traffic, rather than the observed guest account expiration issue. The relevant preventive control for Greenridge Financial Services is: Reconcile active guests to current sponsor approvals. This distinction matters because guest credentials without enforced expiry can outlast the intended access window.

Question 485

At Greenridge Healthcare, the FortiGate 7.6 security administration team encounters the following authorized operational case: remote privileged firewall users authenticate through an external directory without the required multi-factor challenge. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the most appropriate first configuration correction for this case?

  1. Update the supported FSSO collector connection credentials consistently on FortiGate and collector
  2. Add or reorder the intended identity-based firewall policy and verify user-group matching
  3. Configure the supported central SNAT policy corresponding to policy-based NGFW behavior
  4. Configure a supported MFA-capable remote identity integration and verify enforcement for the privileged group

Explanation

Correct Answer

D:

Configure a supported MFA-capable remote identity integration and verify enforcement for the privileged group. This targets mfa through identity provider: remote directory password validation does not imply a second authentication factor is being enforced. After applying the change, verify that a privileged test login demands the approved second factor and a single-factor attempt fails. The Greenridge Healthcare case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Update the supported FSSO collector connection credentials consistently on FortiGate and collector is a relevant remedy for a DIFFERENT problem—fsso collector shared secret—when the FortiGate cannot retrieve login mappings after the FSSO collector password rotates. In this Greenridge Healthcare case that is not the failing component. Here the correct intervention is to configure a supported MFA-capable remote identity integration and verify enforcement for the privileged group because remote directory password validation does not imply a second authentication factor is being enforced.

B:

Add or reorder the intended identity-based firewall policy and verify user-group matching is a relevant remedy for a DIFFERENT problem—fsso log-to-policy correlation—when identity logs show a valid user mapping but traffic continues to follow a generic source-IP permit rule. In this Greenridge Healthcare case that is not the failing component. Here the correct intervention is to configure a supported MFA-capable remote identity integration and verify enforcement for the privileged group because remote directory password validation does not imply a second authentication factor is being enforced.

C:

Configure the supported central SNAT policy corresponding to policy-based NGFW behavior is a relevant remedy for a DIFFERENT problem—central nat interaction with policy mode—when a FortiGate changed to policy-based NGFW mode stops translating internal egress and the team only toggles NAT on the security rule. In this Greenridge Healthcare case that is not the failing component. Here the correct intervention is to configure a supported MFA-capable remote identity integration and verify enforcement for the privileged group because remote directory password validation does not imply a second authentication factor is being enforced.

Question 486

At Greenridge Healthcare, the FortiGate 7.6 security administration team encounters the following authorized operational case: remote privileged firewall users authenticate through an external directory without the required multi-factor challenge. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which diagnosis best distinguishes this case from other FortiOS problems?

  1. An authenticated agent connection rejects clients with a mismatched shared password
  2. A learned FSSO identity alone does not cause a flow to match a rule lacking the intended user condition
  3. Remote directory password validation does not imply a second authentication factor is being enforced
  4. Policy-based NGFW uses central SNAT rather than relying on traditional per-policy source NAT controls

Explanation

Correct Answer

C:

Remote directory password validation does not imply a second authentication factor is being enforced. The mechanism is relevant because the stated mfa through identity provider incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to configure a supported MFA-capable remote identity integration and verify enforcement for the privileged group; verify it through this observed condition: a privileged test login demands the approved second factor and a single-factor attempt fails.

Incorrect Answers

A:

An authenticated agent connection rejects clients with a mismatched shared password explains a different situation, fsso collector shared secret, where the FortiGate cannot retrieve login mappings after the FSSO collector password rotates. It does not account for the specific observed mfa through identity provider condition at Greenridge Healthcare. The decisive mechanism here is: Remote directory password validation does not imply a second authentication factor is being enforced.

B:

A learned FSSO identity alone does not cause a flow to match a rule lacking the intended user condition explains a different situation, fsso log-to-policy correlation, where identity logs show a valid user mapping but traffic continues to follow a generic source-IP permit rule. It does not account for the specific observed mfa through identity provider condition at Greenridge Healthcare. The decisive mechanism here is: Remote directory password validation does not imply a second authentication factor is being enforced.

D:

Policy-based NGFW uses central SNAT rather than relying on traditional per-policy source NAT controls explains a different situation, central nat interaction with policy mode, where a FortiGate changed to policy-based NGFW mode stops translating internal egress and the team only toggles NAT on the security rule. It does not account for the specific observed mfa through identity provider condition at Greenridge Healthcare. The decisive mechanism here is: Remote directory password validation does not imply a second authentication factor is being enforced.

Question 487

At Greenridge Healthcare, the FortiGate 7.6 security administration team encounters the following authorized operational case: remote privileged firewall users authenticate through an external directory without the required multi-factor challenge. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which controlled test outcome best proves that the required feature now works?

  1. A privileged test login demands the approved second factor and a single-factor attempt fails
  2. The FortiGate reconnects to the collector and receives test user sessions
  3. A controlled test session records the expected user and identity-specific firewall policy
  4. An authorized outbound test shows the correct translated source address and matched security rule

Explanation

Correct Answer

A:

A privileged test login demands the approved second factor and a single-factor attempt fails. This directly tests the corrective decision to configure a supported MFA-capable remote identity integration and verify enforcement for the privileged group. It is a meaningful acceptance check because remote directory password validation does not imply a second authentication factor is being enforced. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

B:

The FortiGate reconnects to the collector and receives test user sessions would validate the separate control fsso collector shared secret, not the fault reported for Greenridge Healthcare. To confirm this correction, the team instead needs: A privileged test login demands the approved second factor and a single-factor attempt fails. That is the observable check related to mfa through identity provider.

C:

A controlled test session records the expected user and identity-specific firewall policy would validate the separate control fsso log-to-policy correlation, not the fault reported for Greenridge Healthcare. To confirm this correction, the team instead needs: A privileged test login demands the approved second factor and a single-factor attempt fails. That is the observable check related to mfa through identity provider.

D:

An authorized outbound test shows the correct translated source address and matched security rule would validate the separate control central nat interaction with policy mode, not the fault reported for Greenridge Healthcare. To confirm this correction, the team instead needs: A privileged test login demands the approved second factor and a single-factor attempt fails. That is the observable check related to mfa through identity provider.

Question 488

At Greenridge Healthcare, the FortiGate 7.6 security administration team encounters the following authorized operational case: remote privileged firewall users authenticate through an external directory without the required multi-factor challenge. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What continuing control matches this firewall administration scenario?

  1. Coordinate collector credential rotation with firewall configuration
  2. Audit identity-based policy ordering after source IP rule changes
  3. Review MFA policies and exception accounts after directory changes
  4. Review central NAT requirements before changing NGFW policy mode

Explanation

Correct Answer

C:

Review MFA policies and exception accounts after directory changes. This recurring practice addresses mfa through identity provider because remote directory password validation does not imply a second authentication factor is being enforced. It reinforces the supported change to configure a supported MFA-capable remote identity integration and verify enforcement for the privileged group rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Coordinate collector credential rotation with firewall configuration reduces recurrence of fsso collector shared secret, rather than the observed mfa through identity provider issue. The relevant preventive control for Greenridge Healthcare is: Review MFA policies and exception accounts after directory changes. This distinction matters because remote directory password validation does not imply a second authentication factor is being enforced.

B:

Audit identity-based policy ordering after source IP rule changes reduces recurrence of fsso log-to-policy correlation, rather than the observed mfa through identity provider issue. The relevant preventive control for Greenridge Healthcare is: Review MFA policies and exception accounts after directory changes. This distinction matters because remote directory password validation does not imply a second authentication factor is being enforced.

D:

Review central NAT requirements before changing NGFW policy mode reduces recurrence of central nat interaction with policy mode, rather than the observed mfa through identity provider issue. The relevant preventive control for Greenridge Healthcare is: Review MFA policies and exception accounts after directory changes. This distinction matters because remote directory password validation does not imply a second authentication factor is being enforced.

Question 489

At Greenridge University, the FortiGate 7.6 security administration team encounters the following authorized operational case: directory authentication fails only for employees moved into a different organizational unit. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which supported FortiGate response most directly resolves the stated requirement?

  1. Expand the authorized LDAP search base or filter to include the intended directory subtree
  2. Correct FSSO logoff, logon and workstation IP update behavior with appropriate aging
  3. Select and configure a supported FSSO collection mode with the correct domain permissions and event access
  4. Map application and web-category requirements to the supported policy-based NGFW rule fields

Explanation

Correct Answer

A:

Expand the authorized LDAP search base or filter to include the intended directory subtree. This targets ldap search-base scope: lDAP searches do not find identities outside the configured base and filtering scope. After applying the change, verify that both affected and previously valid user accounts are resolved without including prohibited groups. The Greenridge University case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

B:

Correct FSSO logoff, logon and workstation IP update behavior with appropriate aging is a relevant remedy for a DIFFERENT problem—roaming user stale ip mapping—when an employee moves from Ethernet to Wi-Fi and inherits another user's old FortiGate identity mapping. In this Greenridge University case that is not the failing component. Here the correct intervention is to expand the authorized LDAP search base or filter to include the intended directory subtree because lDAP searches do not find identities outside the configured base and filtering scope.

C:

Select and configure a supported FSSO collection mode with the correct domain permissions and event access is a relevant remedy for a DIFFERENT problem—fsso polling versus dc agent mode—when a new domain-controller deployment fails to generate timely FSSO mappings because its chosen collection method cannot access the expected logon events. In this Greenridge University case that is not the failing component. Here the correct intervention is to expand the authorized LDAP search base or filter to include the intended directory subtree because lDAP searches do not find identities outside the configured base and filtering scope.

D:

Map application and web-category requirements to the supported policy-based NGFW rule fields is a relevant remedy for a DIFFERENT problem—profile-based versus policy-based ngfw—when a network team attempts to attach standalone application-control profiles exactly as before after switching a VDOM into policy-based NGFW mode. In this Greenridge University case that is not the failing component. Here the correct intervention is to expand the authorized LDAP search base or filter to include the intended directory subtree because lDAP searches do not find identities outside the configured base and filtering scope.

Question 490

At Greenridge University, the FortiGate 7.6 security administration team encounters the following authorized operational case: directory authentication fails only for employees moved into a different organizational unit. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What root condition most directly explains the described FortiGate symptom?

  1. Passive identity tied to an address can be stale when endpoint addresses are reassigned quickly
  2. Agent-based and polling collection rely on different event acquisition paths and prerequisites
  3. LDAP searches do not find identities outside the configured base and filtering scope
  4. NGFW mode changes where applications and URL categories are matched, not merely the graphical presentation

Explanation

Correct Answer

C:

LDAP searches do not find identities outside the configured base and filtering scope. The mechanism is relevant because the stated ldap search-base scope incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to expand the authorized LDAP search base or filter to include the intended directory subtree; verify it through this observed condition: both affected and previously valid user accounts are resolved without including prohibited groups.

Incorrect Answers

A:

Passive identity tied to an address can be stale when endpoint addresses are reassigned quickly explains a different situation, roaming user stale ip mapping, where an employee moves from Ethernet to Wi-Fi and inherits another user's old FortiGate identity mapping. It does not account for the specific observed ldap search-base scope condition at Greenridge University. The decisive mechanism here is: LDAP searches do not find identities outside the configured base and filtering scope.

B:

Agent-based and polling collection rely on different event acquisition paths and prerequisites explains a different situation, fsso polling versus dc agent mode, where a new domain-controller deployment fails to generate timely FSSO mappings because its chosen collection method cannot access the expected logon events. It does not account for the specific observed ldap search-base scope condition at Greenridge University. The decisive mechanism here is: LDAP searches do not find identities outside the configured base and filtering scope.

D:

NGFW mode changes where applications and URL categories are matched, not merely the graphical presentation explains a different situation, profile-based versus policy-based ngfw, where a network team attempts to attach standalone application-control profiles exactly as before after switching a VDOM into policy-based NGFW mode. It does not account for the specific observed ldap search-base scope condition at Greenridge University. The decisive mechanism here is: LDAP searches do not find identities outside the configured base and filtering scope.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests