McAfee Secure

Exam Code: FCP_FGT_AD-7.6

Exam Name: FCP - FortiGate 7.6 Administrator

Certification Provider: Fortinet

Corresponding Certification: NSE4

Questions & Answers

Fortinet FCP_FGT_AD-7.6 Questions & Answers

Study with Up-To-Date REAL Exam Questions and Answers from the ACTUAL Test

Questions & Answers

128 Questions & Answers with Testing Engine

"FCP - FortiGate 7.6 Administrator Exam", also known as FCP_FGT_AD-7.6 exam, is a Fortinet certification exam.

Pass your tests with the always up-to-date FCP_FGT_AD-7.6 Exam Engine. Your FCP_FGT_AD-7.6 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Fortinet FCP_FGT_AD-7.6 Practice Test 52

Question 510

At Greenridge Regional Hospital, the FortiGate 7.6 security administration team encounters the following authorized operational case: FortiGate learns user IPs via FSSO but authorized members of a particular AD group are never recognized. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What root condition most directly explains the described FortiGate symptom?

  1. A populated FSSO user table does not guarantee every AD group is included in identity policy mapping
  2. An earlier matching firewall rule can fully shadow a later rule with the same source and service scope
  3. A policy that permits traffic does not automatically translate a public destination to an RFC1918 host
  4. An LDAP connector cannot search users through an invalid service bind even if the user passwords are correct

Explanation

Correct Answer

A:

A populated FSSO user table does not guarantee every AD group is included in identity policy mapping. The mechanism is relevant because the stated fsso group filter scope incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to add the required approved domain group to the FSSO collector and FortiGate group filters; verify it through this observed condition: an eligible group member matches the intended identity rule without other groups being granted.

Incorrect Answers

B:

An earlier matching firewall rule can fully shadow a later rule with the same source and service scope explains a different situation, shadowed duplicate accept rule, where a specific new allow policy never records any hits because an earlier broad policy already permits the same packets. It does not account for the specific observed fsso group filter scope condition at Greenridge Regional Hospital. The decisive mechanism here is: A populated FSSO user table does not guarantee every AD group is included in identity policy mapping.

C:

A policy that permits traffic does not automatically translate a public destination to an RFC1918 host explains a different situation, vip destination nat publishing, where an outside application cannot reach an internal HTTPS service because only an allow firewall policy exists and no destination translation is configured. It does not account for the specific observed fsso group filter scope condition at Greenridge Regional Hospital. The decisive mechanism here is: A populated FSSO user table does not guarantee every AD group is included in identity policy mapping.

D:

An LDAP connector cannot search users through an invalid service bind even if the user passwords are correct explains a different situation, ldap bind account permissions, where fortiGate LDAP authentication begins failing after the enterprise directory bind account is disabled. It does not account for the specific observed fsso group filter scope condition at Greenridge Regional Hospital. The decisive mechanism here is: A populated FSSO user table does not guarantee every AD group is included in identity policy mapping.

Question 511

At Greenridge Regional Hospital, the FortiGate 7.6 security administration team encounters the following authorized operational case: FortiGate learns user IPs via FSSO but authorized members of a particular AD group are never recognized. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which observable result should the administrator require before closing this change?

  1. An eligible group member matches the intended identity rule without other groups being granted
  2. A controlled flow records hits on the intended rule after the change
  3. A controlled external HTTPS request is translated to the intended internal server
  4. An authorized directory account authenticates and the connector reports successful bind and search

Explanation

Correct Answer

A:

An eligible group member matches the intended identity rule without other groups being granted. This directly tests the corrective decision to add the required approved domain group to the FSSO collector and FortiGate group filters. It is a meaningful acceptance check because a populated FSSO user table does not guarantee every AD group is included in identity policy mapping. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

B:

A controlled flow records hits on the intended rule after the change would validate the separate control shadowed duplicate accept rule, not the fault reported for Greenridge Regional Hospital. To confirm this correction, the team instead needs: An eligible group member matches the intended identity rule without other groups being granted. That is the observable check related to fsso group filter scope.

C:

A controlled external HTTPS request is translated to the intended internal server would validate the separate control vip destination nat publishing, not the fault reported for Greenridge Regional Hospital. To confirm this correction, the team instead needs: An eligible group member matches the intended identity rule without other groups being granted. That is the observable check related to fsso group filter scope.

D:

An authorized directory account authenticates and the connector reports successful bind and search would validate the separate control ldap bind account permissions, not the fault reported for Greenridge Regional Hospital. To confirm this correction, the team instead needs: An eligible group member matches the intended identity rule without other groups being granted. That is the observable check related to fsso group filter scope.

Question 512

At Greenridge Regional Hospital, the FortiGate 7.6 security administration team encounters the following authorized operational case: FortiGate learns user IPs via FSSO but authorized members of a particular AD group are never recognized. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which ongoing safeguard best reduces recurrence of this problem?

  1. Review unused or shadowed policies using hit counts
  2. Review FSSO filters when application groups change
  3. Review VIP and permit rules together when publishing services
  4. Monitor service-account lifecycle and certificate rotation

Explanation

Correct Answer

B:

Review FSSO filters when application groups change. This recurring practice addresses fsso group filter scope because a populated FSSO user table does not guarantee every AD group is included in identity policy mapping. It reinforces the supported change to add the required approved domain group to the FSSO collector and FortiGate group filters rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Review unused or shadowed policies using hit counts reduces recurrence of shadowed duplicate accept rule, rather than the observed fsso group filter scope issue. The relevant preventive control for Greenridge Regional Hospital is: Review FSSO filters when application groups change. This distinction matters because a populated FSSO user table does not guarantee every AD group is included in identity policy mapping.

C:

Review VIP and permit rules together when publishing services reduces recurrence of vip destination nat publishing, rather than the observed fsso group filter scope issue. The relevant preventive control for Greenridge Regional Hospital is: Review FSSO filters when application groups change. This distinction matters because a populated FSSO user table does not guarantee every AD group is included in identity policy mapping.

D:

Monitor service-account lifecycle and certificate rotation reduces recurrence of ldap bind account permissions, rather than the observed fsso group filter scope issue. The relevant preventive control for Greenridge Regional Hospital is: Review FSSO filters when application groups change. This distinction matters because a populated FSSO user table does not guarantee every AD group is included in identity policy mapping.

Question 513

At Greenridge Retail Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: the FortiGate cannot retrieve login mappings after the FSSO collector password rotates. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What action should the network security administrator take for this specific fault?

  1. Update the supported FSSO collector connection credentials consistently on FortiGate and collector
  2. Add and verify the supported IPv6 policy and addressing controls for the same trust boundary
  3. Configure a supported VIP port-forward from the external TCP 443 to the permitted internal TCP 8443
  4. Update the LDAP group match to the current directory distinguished name and verify membership

Explanation

Correct Answer

A:

Update the supported FSSO collector connection credentials consistently on FortiGate and collector. This targets fsso collector shared secret: an authenticated agent connection rejects clients with a mismatched shared password. After applying the change, verify that the FortiGate reconnects to the collector and receives test user sessions. The Greenridge Retail Group case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

B:

Add and verify the supported IPv6 policy and addressing controls for the same trust boundary is a relevant remedy for a DIFFERENT problem—ipv6 security policy parity—when an application is blocked on IPv4 but remains accessible on its IPv6 address because administrators only reviewed IPv4 policy coverage. In this Greenridge Retail Group case that is not the failing component. Here the correct intervention is to update the supported FSSO collector connection credentials consistently on FortiGate and collector because an authenticated agent connection rejects clients with a mismatched shared password.

C:

Configure a supported VIP port-forward from the external TCP 443 to the permitted internal TCP 8443 is a relevant remedy for a DIFFERENT problem—vip destination port translation—when a reverse proxy on TCP 8443 is published through a standard external HTTPS endpoint but the FortiGate VIP has no port forwarding mapping. In this Greenridge Retail Group case that is not the failing component. Here the correct intervention is to update the supported FSSO collector connection credentials consistently on FortiGate and collector because an authenticated agent connection rejects clients with a mismatched shared password.

D:

Update the LDAP group match to the current directory distinguished name and verify membership is a relevant remedy for a DIFFERENT problem—ldap group distinguished name—when an LDAP-backed firewall policy rejects a valid employee because the group DN references a renamed organizational unit. In this Greenridge Retail Group case that is not the failing component. Here the correct intervention is to update the supported FSSO collector connection credentials consistently on FortiGate and collector because an authenticated agent connection rejects clients with a mismatched shared password.

Question 514

At Greenridge Retail Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: the FortiGate cannot retrieve login mappings after the FSSO collector password rotates. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which interpretation of the observed failure is technically supported?

  1. Dual-stack hosts may take IPv6 paths that differ from the configured IPv4 policy table
  2. An authenticated agent connection rejects clients with a mismatched shared password
  3. Destination NAT requires the specified port remap when external and internal listeners differ
  4. Group-based firewall identity matching depends on directory identifiers rather than the group's friendly label

Explanation

Correct Answer

B:

An authenticated agent connection rejects clients with a mismatched shared password. The mechanism is relevant because the stated fsso collector shared secret incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to update the supported FSSO collector connection credentials consistently on FortiGate and collector; verify it through this observed condition: the FortiGate reconnects to the collector and receives test user sessions.

Incorrect Answers

A:

Dual-stack hosts may take IPv6 paths that differ from the configured IPv4 policy table explains a different situation, ipv6 security policy parity, where an application is blocked on IPv4 but remains accessible on its IPv6 address because administrators only reviewed IPv4 policy coverage. It does not account for the specific observed fsso collector shared secret condition at Greenridge Retail Group. The decisive mechanism here is: An authenticated agent connection rejects clients with a mismatched shared password.

C:

Destination NAT requires the specified port remap when external and internal listeners differ explains a different situation, vip destination port translation, where a reverse proxy on TCP 8443 is published through a standard external HTTPS endpoint but the FortiGate VIP has no port forwarding mapping. It does not account for the specific observed fsso collector shared secret condition at Greenridge Retail Group. The decisive mechanism here is: An authenticated agent connection rejects clients with a mismatched shared password.

D:

Group-based firewall identity matching depends on directory identifiers rather than the group's friendly label explains a different situation, ldap group distinguished name, where an LDAP-backed firewall policy rejects a valid employee because the group DN references a renamed organizational unit. It does not account for the specific observed fsso collector shared secret condition at Greenridge Retail Group. The decisive mechanism here is: An authenticated agent connection rejects clients with a mismatched shared password.

Question 515

At Greenridge Retail Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: the FortiGate cannot retrieve login mappings after the FSSO collector password rotates. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which supervised observation would best verify the intended correction?

  1. Both IPv4 and IPv6 negative access tests enforce the required deny
  2. The outside client connects on 443 and the inside server receives 8443
  3. An eligible member matches the FortiGate remote group and an outsider is denied
  4. The FortiGate reconnects to the collector and receives test user sessions

Explanation

Correct Answer

D:

The FortiGate reconnects to the collector and receives test user sessions. This directly tests the corrective decision to update the supported FSSO collector connection credentials consistently on FortiGate and collector. It is a meaningful acceptance check because an authenticated agent connection rejects clients with a mismatched shared password. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

Both IPv4 and IPv6 negative access tests enforce the required deny would validate the separate control ipv6 security policy parity, not the fault reported for Greenridge Retail Group. To confirm this correction, the team instead needs: The FortiGate reconnects to the collector and receives test user sessions. That is the observable check related to fsso collector shared secret.

B:

The outside client connects on 443 and the inside server receives 8443 would validate the separate control vip destination port translation, not the fault reported for Greenridge Retail Group. To confirm this correction, the team instead needs: The FortiGate reconnects to the collector and receives test user sessions. That is the observable check related to fsso collector shared secret.

C:

An eligible member matches the FortiGate remote group and an outsider is denied would validate the separate control ldap group distinguished name, not the fault reported for Greenridge Retail Group. To confirm this correction, the team instead needs: The FortiGate reconnects to the collector and receives test user sessions. That is the observable check related to fsso collector shared secret.

Question 516

At Greenridge Retail Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: the FortiGate cannot retrieve login mappings after the FSSO collector password rotates. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What preventive control should the FortiGate operations team maintain?

  1. Include IPv6 in firewall policy acceptance checklists
  2. Document port mappings and test them after proxy upgrades
  3. Coordinate collector credential rotation with firewall configuration
  4. Review directory group object changes during identity maintenance

Explanation

Correct Answer

C:

Coordinate collector credential rotation with firewall configuration. This recurring practice addresses fsso collector shared secret because an authenticated agent connection rejects clients with a mismatched shared password. It reinforces the supported change to update the supported FSSO collector connection credentials consistently on FortiGate and collector rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Include IPv6 in firewall policy acceptance checklists reduces recurrence of ipv6 security policy parity, rather than the observed fsso collector shared secret issue. The relevant preventive control for Greenridge Retail Group is: Coordinate collector credential rotation with firewall configuration. This distinction matters because an authenticated agent connection rejects clients with a mismatched shared password.

B:

Document port mappings and test them after proxy upgrades reduces recurrence of vip destination port translation, rather than the observed fsso collector shared secret issue. The relevant preventive control for Greenridge Retail Group is: Coordinate collector credential rotation with firewall configuration. This distinction matters because an authenticated agent connection rejects clients with a mismatched shared password.

D:

Review directory group object changes during identity maintenance reduces recurrence of ldap group distinguished name, rather than the observed fsso collector shared secret issue. The relevant preventive control for Greenridge Retail Group is: Coordinate collector credential rotation with firewall configuration. This distinction matters because an authenticated agent connection rejects clients with a mismatched shared password.

Question 517

At Greenridge Transport Authority, the FortiGate 7.6 security administration team encounters the following authorized operational case: an employee moves from Ethernet to Wi-Fi and inherits another user's old FortiGate identity mapping. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which technically justified operational change fits the observed symptoms?

  1. Update policy source and destination interface or zone references consistently with the new zone membership
  2. Review the VIP external-interface association and make an intentional mapping for the required ingress path
  3. Import and trust the approved directory CA chain and check LDAP TLS hostname settings
  4. Correct FSSO logoff, logon and workstation IP update behavior with appropriate aging

Explanation

Correct Answer

D:

Correct FSSO logoff, logon and workstation IP update behavior with appropriate aging. This targets roaming user stale ip mapping: passive identity tied to an address can be stale when endpoint addresses are reassigned quickly. After applying the change, verify that a roaming test user receives the current correct identity and the stale mapping disappears. The Greenridge Transport Authority case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Update policy source and destination interface or zone references consistently with the new zone membership is a relevant remedy for a DIFFERENT problem—security zones and interface groups—when an outgoing policy works for one VLAN but fails after the interface is moved into a FortiGate security zone. In this Greenridge Transport Authority case that is not the failing component. Here the correct intervention is to correct FSSO logoff, logon and workstation IP update behavior with appropriate aging because passive identity tied to an address can be stale when endpoint addresses are reassigned quickly.

B:

Review the VIP external-interface association and make an intentional mapping for the required ingress path is a relevant remedy for a DIFFERENT problem—vip external-interface binding—when an internal server's VIP works on one WAN uplink but is not reachable via the newly introduced secondary uplink. In this Greenridge Transport Authority case that is not the failing component. Here the correct intervention is to correct FSSO logoff, logon and workstation IP update behavior with appropriate aging because passive identity tied to an address can be stale when endpoint addresses are reassigned quickly.

C:

Import and trust the approved directory CA chain and check LDAP TLS hostname settings is a relevant remedy for a DIFFERENT problem—encrypted ldap ca trust—when fortiGate fails LDAPS handshakes after the directory server's certificate rotates to a new internal issuing CA. In this Greenridge Transport Authority case that is not the failing component. Here the correct intervention is to correct FSSO logoff, logon and workstation IP update behavior with appropriate aging because passive identity tied to an address can be stale when endpoint addresses are reassigned quickly.

Question 518

At Greenridge Transport Authority, the FortiGate 7.6 security administration team encounters the following authorized operational case: an employee moves from Ethernet to Wi-Fi and inherits another user's old FortiGate identity mapping. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which technical explanation best identifies the underlying FortiGate behavior?

  1. Policy matching uses configured interfaces or zones, and topology changes can invalidate old references
  2. A VIP scoped to one outside interface may not match packets arriving through another
  3. Encrypted LDAP authentication can fail before user lookup when certificate trust is invalid
  4. Passive identity tied to an address can be stale when endpoint addresses are reassigned quickly

Explanation

Correct Answer

D:

Passive identity tied to an address can be stale when endpoint addresses are reassigned quickly. The mechanism is relevant because the stated roaming user stale ip mapping incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to correct FSSO logoff, logon and workstation IP update behavior with appropriate aging; verify it through this observed condition: a roaming test user receives the current correct identity and the stale mapping disappears.

Incorrect Answers

A:

Policy matching uses configured interfaces or zones, and topology changes can invalidate old references explains a different situation, security zones and interface groups, where an outgoing policy works for one VLAN but fails after the interface is moved into a FortiGate security zone. It does not account for the specific observed roaming user stale ip mapping condition at Greenridge Transport Authority. The decisive mechanism here is: Passive identity tied to an address can be stale when endpoint addresses are reassigned quickly.

B:

A VIP scoped to one outside interface may not match packets arriving through another explains a different situation, vip external-interface binding, where an internal server's VIP works on one WAN uplink but is not reachable via the newly introduced secondary uplink. It does not account for the specific observed roaming user stale ip mapping condition at Greenridge Transport Authority. The decisive mechanism here is: Passive identity tied to an address can be stale when endpoint addresses are reassigned quickly.

C:

Encrypted LDAP authentication can fail before user lookup when certificate trust is invalid explains a different situation, encrypted ldap ca trust, where fortiGate fails LDAPS handshakes after the directory server's certificate rotates to a new internal issuing CA. It does not account for the specific observed roaming user stale ip mapping condition at Greenridge Transport Authority. The decisive mechanism here is: Passive identity tied to an address can be stale when endpoint addresses are reassigned quickly.

Question 519

At Greenridge Transport Authority, the FortiGate 7.6 security administration team encounters the following authorized operational case: an employee moves from Ethernet to Wi-Fi and inherits another user's old FortiGate identity mapping. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What acceptance evidence most directly confirms the expected policy or network behavior?

  1. A roaming test user receives the current correct identity and the stale mapping disappears
  2. Authorized traffic in every intended zone member matches the correct policy
  3. Authorized traffic reaches the server from each supported public entry path
  4. A verified LDAPS connection succeeds with the expected directory server identity

Explanation

Correct Answer

A:

A roaming test user receives the current correct identity and the stale mapping disappears. This directly tests the corrective decision to correct FSSO logoff, logon and workstation IP update behavior with appropriate aging. It is a meaningful acceptance check because passive identity tied to an address can be stale when endpoint addresses are reassigned quickly. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

B:

Authorized traffic in every intended zone member matches the correct policy would validate the separate control security zones and interface groups, not the fault reported for Greenridge Transport Authority. To confirm this correction, the team instead needs: A roaming test user receives the current correct identity and the stale mapping disappears. That is the observable check related to roaming user stale ip mapping.

C:

Authorized traffic reaches the server from each supported public entry path would validate the separate control vip external-interface binding, not the fault reported for Greenridge Transport Authority. To confirm this correction, the team instead needs: A roaming test user receives the current correct identity and the stale mapping disappears. That is the observable check related to roaming user stale ip mapping.

D:

A verified LDAPS connection succeeds with the expected directory server identity would validate the separate control encrypted ldap ca trust, not the fault reported for Greenridge Transport Authority. To confirm this correction, the team instead needs: A roaming test user receives the current correct identity and the stale mapping disappears. That is the observable check related to roaming user stale ip mapping.

Question 520

At Greenridge Transport Authority, the FortiGate 7.6 security administration team encounters the following authorized operational case: an employee moves from Ethernet to Wi-Fi and inherits another user's old FortiGate identity mapping. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which recurring review is most relevant to the same root risk?

  1. Monitor identity aging and DHCP reassignment in FSSO deployments
  2. Review policy references before zone restructuring
  3. Revalidate VIP ingress binding after WAN moves
  4. Track issuing CA and directory certificate expiration

Explanation

Correct Answer

A:

Monitor identity aging and DHCP reassignment in FSSO deployments. This recurring practice addresses roaming user stale ip mapping because passive identity tied to an address can be stale when endpoint addresses are reassigned quickly. It reinforces the supported change to correct FSSO logoff, logon and workstation IP update behavior with appropriate aging rather than relying on an unrelated periodic audit.

Incorrect Answers

B:

Review policy references before zone restructuring reduces recurrence of security zones and interface groups, rather than the observed roaming user stale ip mapping issue. The relevant preventive control for Greenridge Transport Authority is: Monitor identity aging and DHCP reassignment in FSSO deployments. This distinction matters because passive identity tied to an address can be stale when endpoint addresses are reassigned quickly.

C:

Revalidate VIP ingress binding after WAN moves reduces recurrence of vip external-interface binding, rather than the observed roaming user stale ip mapping issue. The relevant preventive control for Greenridge Transport Authority is: Monitor identity aging and DHCP reassignment in FSSO deployments. This distinction matters because passive identity tied to an address can be stale when endpoint addresses are reassigned quickly.

D:

Track issuing CA and directory certificate expiration reduces recurrence of encrypted ldap ca trust, rather than the observed roaming user stale ip mapping issue. The relevant preventive control for Greenridge Transport Authority is: Monitor identity aging and DHCP reassignment in FSSO deployments. This distinction matters because passive identity tied to an address can be stale when endpoint addresses are reassigned quickly.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests