Fortinet FCP_FGT_AD-7.6 Questions & Answers

Alert on time drift and use standardized incident timestamps reduces recurrence of ntp alignment across fortianalyzer, rather than the observed dhcp fixed-host reservations issue. The relevant preventive control for Alderbrook Transport Authority is: Audit reservations and stale lease entries during device replacement. This distinction matters because dynamic address leases do not guarantee a specific device will retain its historical address.

Review logging capacity during traffic growth planning reduces recurrence of log disk versus traffic volume, rather than the observed dhcp fixed-host reservations issue. The relevant preventive control for Alderbrook Transport Authority is: Audit reservations and stale lease entries during device replacement. This distinction matters because dynamic address leases do not guarantee a specific device will retain its historical address.

Include heartbeat failure domains in infrastructure designs reduces recurrence of ha split-brain prevention, rather than the observed dhcp fixed-host reservations issue. The relevant preventive control for Alderbrook Transport Authority is: Audit reservations and stale lease entries during device replacement. This distinction matters because dynamic address leases do not guarantee a specific device will retain its historical address.

Update the syslog destination, transport and port to the approved collector configuration is a relevant remedy for a DIFFERENT problem—remote syslog transport—when the security information platform stops receiving FortiGate syslog after its destination port is changed. In this Alderbrook Municipal Services case that is not the failing component. Here the correct intervention is to correct the DNS-server and domain options in the relevant FortiGate DHCP server scope because incorrect DHCP option values can break name resolution while layer-three connectivity still functions.

Restore redundant dedicated HA heartbeat connections and check compatible cluster settings is a relevant remedy for a DIFFERENT problem—fgcp ha heartbeat cabling—when two FortiGates configured as a cluster both appear active after a heartbeat link fails. In this Alderbrook Municipal Services case that is not the failing component. Here the correct intervention is to correct the DNS-server and domain options in the relevant FortiGate DHCP server scope because incorrect DHCP option values can break name resolution while layer-three connectivity still functions.

Verify supported HA virtual MAC behavior and neighbor refresh on attached switches and routers is a relevant remedy for a DIFFERENT problem—ha virtual mac address transition—when hosts keep stale neighbor information after a cluster role swap and some traffic follows an old interface identity. In this Alderbrook Municipal Services case that is not the failing component. Here the correct intervention is to correct the DNS-server and domain options in the relevant FortiGate DHCP server scope because incorrect DHCP option values can break name resolution while layer-three connectivity still functions.

A working firewall log source cannot deliver events to a collector listening on another socket or transport explains a different situation, remote syslog transport, where the security information platform stops receiving FortiGate syslog after its destination port is changed. It does not account for the specific observed dhcp dns option mismatch condition at Alderbrook Municipal Services. The decisive mechanism here is: Incorrect DHCP option values can break name resolution while layer-three connectivity still functions.

Losing heartbeat communication can prevent members from confirming each other's HA state explains a different situation, fgcp ha heartbeat cabling, where two FortiGates configured as a cluster both appear active after a heartbeat link fails. It does not account for the specific observed dhcp dns option mismatch condition at Alderbrook Municipal Services. The decisive mechanism here is: Incorrect DHCP option values can break name resolution while layer-three connectivity still functions.

Failover can require layer-two neighbors to learn the active unit's forwarding identity explains a different situation, ha virtual mac address transition, where hosts keep stale neighbor information after a cluster role swap and some traffic follows an old interface identity. It does not account for the specific observed dhcp dns option mismatch condition at Alderbrook Municipal Services. The decisive mechanism here is: Incorrect DHCP option values can break name resolution while layer-three connectivity still functions.

A generated test event arrives at the correct protected syslog destination would validate the separate control remote syslog transport, not the fault reported for Alderbrook Municipal Services. To confirm this correction, the team instead needs: A renewed client obtains the intended DNS servers and resolves an internal hostname. That is the observable check related to dhcp dns option mismatch.

A controlled heartbeat cable failure leaves the intended healthy cluster membership intact would validate the separate control fgcp ha heartbeat cabling, not the fault reported for Alderbrook Municipal Services. To confirm this correction, the team instead needs: A renewed client obtains the intended DNS servers and resolves an internal hostname. That is the observable check related to dhcp dns option mismatch.

Neighbor tables converge to the active cluster and protected flows resume would validate the separate control ha virtual mac address transition, not the fault reported for Alderbrook Municipal Services. To confirm this correction, the team instead needs: A renewed client obtains the intended DNS servers and resolves an internal hostname. That is the observable check related to dhcp dns option mismatch.

Include syslog routing in network change verification reduces recurrence of remote syslog transport, rather than the observed dhcp dns option mismatch issue. The relevant preventive control for Alderbrook Municipal Services is: Regression-test DHCP options after each VLAN scope edit. This distinction matters because incorrect DHCP option values can break name resolution while layer-three connectivity still functions.

Verify heartbeat path diversity in change reviews reduces recurrence of fgcp ha heartbeat cabling, rather than the observed dhcp dns option mismatch issue. The relevant preventive control for Alderbrook Municipal Services is: Regression-test DHCP options after each VLAN scope edit. This distinction matters because incorrect DHCP option values can break name resolution while layer-three connectivity still functions.

Validate ARP and switch forwarding after topology adjustments reduces recurrence of ha virtual mac address transition, rather than the observed dhcp dns option mismatch issue. The relevant preventive control for Alderbrook Municipal Services is: Regression-test DHCP options after each VLAN scope edit. This distinction matters because incorrect DHCP option values can break name resolution while layer-three connectivity still functions.

Configure a supported FortiAnalyzer target and required device registration and logging delivery is a relevant remedy for a DIFFERENT problem—fortianalyzer log forwarding—when a FortiGate logs traffic locally but the central incident team cannot search those records on its designated FortiAnalyzer. In this Alderbrook Technology case that is not the failing component. Here the correct intervention is to export an appropriately protected configuration backup and record a verified restore point before the change because device-local configuration state can be lost after failure or a destructive migration.

Adjust log severity or event filters to include the required operational event category is a relevant remedy for a DIFFERENT problem—event log severity filtering—when a FortiGate has extensive local events but central monitoring never receives interface-down warnings because of overly restrictive severity filtering. In this Alderbrook Technology case that is not the failing component. Here the correct intervention is to export an appropriately protected configuration backup and record a verified restore point before the change because device-local configuration state can be lost after failure or a destructive migration.

Align the documented HA group identifier, password, mode and compatible member prerequisites is a relevant remedy for a DIFFERENT problem—ha group identity mismatch—when two intended FortiGate HA peers never join even though their heartbeat ports are physically connected. In this Alderbrook Technology case that is not the failing component. Here the correct intervention is to export an appropriately protected configuration backup and record a verified restore point before the change because device-local configuration state can be lost after failure or a destructive migration.

Local log generation alone does not populate a separate FortiAnalyzer collector explains a different situation, fortianalyzer log forwarding, where a FortiGate logs traffic locally but the central incident team cannot search those records on its designated FortiAnalyzer. It does not account for the specific observed configuration backup before changes condition at Alderbrook Technology. The decisive mechanism here is: Device-local configuration state can be lost after failure or a destructive migration.

Filtering before delivery can suppress useful warnings even when logging and transport are healthy explains a different situation, event log severity filtering, where a FortiGate has extensive local events but central monitoring never receives interface-down warnings because of overly restrictive severity filtering. It does not account for the specific observed configuration backup before changes condition at Alderbrook Technology. The decisive mechanism here is: Device-local configuration state can be lost after failure or a destructive migration.

HA members with incompatible cluster membership settings do not form the expected FGCP cluster explains a different situation, ha group identity mismatch, where two intended FortiGate HA peers never join even though their heartbeat ports are physically connected. It does not account for the specific observed configuration backup before changes condition at Alderbrook Technology. The decisive mechanism here is: Device-local configuration state can be lost after failure or a destructive migration.

A tagged test session appears in the correct FortiAnalyzer device and ADOM view would validate the separate control fortianalyzer log forwarding, not the fault reported for Alderbrook Technology. To confirm this correction, the team instead needs: A recovery rehearsal imports the approved backup on compatible test equipment. That is the observable check related to configuration backup before changes.

A controlled interface-state event appears in the central search would validate the separate control event log severity filtering, not the fault reported for Alderbrook Technology. To confirm this correction, the team instead needs: A recovery rehearsal imports the approved backup on compatible test equipment. That is the observable check related to configuration backup before changes.

Both devices appear in the same cluster with consistent member details would validate the separate control ha group identity mismatch, not the fault reported for Alderbrook Technology. To confirm this correction, the team instead needs: A recovery rehearsal imports the approved backup on compatible test equipment. That is the observable check related to configuration backup before changes.

Monitor log delivery queues and collector connectivity reduces recurrence of fortianalyzer log forwarding, rather than the observed configuration backup before changes issue. The relevant preventive control for Alderbrook Technology is: Retain versioned protected backups with tested recovery instructions. This distinction matters because device-local configuration state can be lost after failure or a destructive migration.

Review severity thresholds alongside incident detection requirements reduces recurrence of event log severity filtering, rather than the observed configuration backup before changes issue. The relevant preventive control for Alderbrook Technology is: Retain versioned protected backups with tested recovery instructions. This distinction matters because device-local configuration state can be lost after failure or a destructive migration.

Audit HA pairing settings after device replacement reduces recurrence of ha group identity mismatch, rather than the observed configuration backup before changes issue. The relevant preventive control for Alderbrook Technology is: Retain versioned protected backups with tested recovery instructions. This distinction matters because device-local configuration state can be lost after failure or a destructive migration.

Authorize and register the correct device serial number in FortiAnalyzer under the proper management scope is a relevant remedy for a DIFFERENT problem—fortianalyzer device authorization—when a newly added FortiGate sends connection attempts to FortiAnalyzer but is absent from the authorized device list. In this Alderbrook Energy Cooperative case that is not the failing component. Here the correct intervention is to validate firmware and hardware compatibility and adapt interface-dependent settings through a supported migration process because interface names and firmware feature schemas can differ across FortiGate models or releases.

Set an authorized FortiAnalyzer or SIEM retention and storage quota policy matching the required period is a relevant remedy for a DIFFERENT problem—remote logging retention quota—when a compliance reviewer cannot retrieve last month's firewall traffic because the remote logging plan retains only two days. In this Alderbrook Energy Cooperative case that is not the failing component. Here the correct intervention is to validate firmware and hardware compatibility and adapt interface-dependent settings through a supported migration process because interface names and firmware feature schemas can differ across FortiGate models or releases.

Configure appropriate HA port monitoring for the critical connected link and test role election is a relevant remedy for a DIFFERENT problem—ha monitored port failover—when an HA primary loses its only upstream carrier but retains active role because that WAN interface is not monitored for failure. In this Alderbrook Energy Cooperative case that is not the failing component. Here the correct intervention is to validate firmware and hardware compatibility and adapt interface-dependent settings through a supported migration process because interface names and firmware feature schemas can differ across FortiGate models or releases.

An unregistered logging device can fail acceptance even when the collector is reachable explains a different situation, fortianalyzer device authorization, where a newly added FortiGate sends connection attempts to FortiAnalyzer but is absent from the authorized device list. It does not account for the specific observed configuration restore compatibility condition at Alderbrook Energy Cooperative. The decisive mechanism here is: Interface names and firmware feature schemas can differ across FortiGate models or releases.

Historical log availability depends on collector storage and retention rules, not only firewall emission explains a different situation, remote logging retention quota, where a compliance reviewer cannot retrieve last month's firewall traffic because the remote logging plan retains only two days. It does not account for the specific observed configuration restore compatibility condition at Alderbrook Energy Cooperative. The decisive mechanism here is: Interface names and firmware feature schemas can differ across FortiGate models or releases.

A healthy heartbeat can mask a failed production interface unless link monitoring participates in failover decisions explains a different situation, ha monitored port failover, where an HA primary loses its only upstream carrier but retains active role because that WAN interface is not monitored for failure. It does not account for the specific observed configuration restore compatibility condition at Alderbrook Energy Cooperative. The decisive mechanism here is: Interface names and firmware feature schemas can differ across FortiGate models or releases.