Fortinet FCP_FGT_AD-7.6 Questions & Answers

Audit group contents after subnet allocation changes reduces recurrence of address group membership, rather than the observed fsso log-to-policy correlation issue. The relevant preventive control for Greenridge Biotechnology is: Audit identity-based policy ordering after source IP rule changes. This distinction matters because a learned FSSO identity alone does not cause a flow to match a rule lacking the intended user condition.

Include security profile fingerprints in rule-copy reviews reduces recurrence of default web profile mismatch, rather than the observed fsso log-to-policy correlation issue. The relevant preventive control for Greenridge Biotechnology is: Audit identity-based policy ordering after source IP rule changes. This distinction matters because a learned FSSO identity alone does not cause a flow to match a rule lacking the intended user condition.

Review NAT decisions separately for internal and internet traffic reduces recurrence of local network without unnecessary nat, rather than the observed fsso log-to-policy correlation issue. The relevant preventive control for Greenridge Biotechnology is: Audit identity-based policy ordering after source IP rule changes. This distinction matters because a learned FSSO identity alone does not cause a flow to match a rule lacking the intended user condition.

Use precise approved partner source addresses or justified geographic exceptions is a relevant remedy for a DIFFERENT problem—geographic address policy exceptions—when legitimate partner traffic is blocked because a country address object was applied as a broad policy condition without verifying the partner's real egress. In this Greenridge Distribution case that is not the failing component. Here the correct intervention is to select and configure a supported FSSO collection mode with the correct domain permissions and event access because agent-based and polling collection rely on different event acquisition paths and prerequisites.

Select the appropriate all-session or detailed traffic logging for the relevant firewall policy is a relevant remedy for a DIFFERENT problem—logging only security events—when a security investigation finds malware blocks but cannot reconstruct accepted session destinations because the policy logs only security events. In this Greenridge Distribution case that is not the failing component. Here the correct intervention is to select and configure a supported FSSO collection mode with the correct domain permissions and event access because agent-based and polling collection rely on different event acquisition paths and prerequisites.

Correct the server default or specific return routes for stateful symmetric translation is a relevant remedy for a DIFFERENT problem—nat return path selection—when a server's inbound DNAT service works for SYN packets but response traffic escapes a different gateway outside the FortiGate session path. In this Greenridge Distribution case that is not the failing component. Here the correct intervention is to select and configure a supported FSSO collection mode with the correct domain permissions and event access because agent-based and polling collection rely on different event acquisition paths and prerequisites.

Country-based address matching can differ from a partner's administrative location when egress IPs are elsewhere explains a different situation, geographic address policy exceptions, where legitimate partner traffic is blocked because a country address object was applied as a broad policy condition without verifying the partner's real egress. It does not account for the specific observed fsso polling versus dc agent mode condition at Greenridge Distribution. The decisive mechanism here is: Agent-based and polling collection rely on different event acquisition paths and prerequisites.

Security-event logging may omit normal accepted sessions necessary for full network activity reconstruction explains a different situation, logging only security events, where a security investigation finds malware blocks but cannot reconstruct accepted session destinations because the policy logs only security events. It does not account for the specific observed fsso polling versus dc agent mode condition at Greenridge Distribution. The decisive mechanism here is: Agent-based and polling collection rely on different event acquisition paths and prerequisites.

Stateful DNAT sessions depend on return packets reaching the translating firewall context explains a different situation, nat return path selection, where a server's inbound DNAT service works for SYN packets but response traffic escapes a different gateway outside the FortiGate session path. It does not account for the specific observed fsso polling versus dc agent mode condition at Greenridge Distribution. The decisive mechanism here is: Agent-based and polling collection rely on different event acquisition paths and prerequisites.

Authorized partner requests match the specific exception while unsolicited geographic traffic remains denied would validate the separate control geographic address policy exceptions, not the fault reported for Greenridge Distribution. To confirm this correction, the team instead needs: A fresh domain login reaches the collector within the accepted detection interval. That is the observable check related to fsso polling versus dc agent mode.

A benign matching session appears with source, destination, service and policy ID would validate the separate control logging only security events, not the fault reported for Greenridge Distribution. To confirm this correction, the team instead needs: A fresh domain login reaches the collector within the accepted detection interval. That is the observable check related to fsso polling versus dc agent mode.

A packet capture shows forward and reverse tuples correctly translated in the same session would validate the separate control nat return path selection, not the fault reported for Greenridge Distribution. To confirm this correction, the team instead needs: A fresh domain login reaches the collector within the accepted detection interval. That is the observable check related to fsso polling versus dc agent mode.

Review geolocation rules against actual source IP ownership reduces recurrence of geographic address policy exceptions, rather than the observed fsso polling versus dc agent mode issue. The relevant preventive control for Greenridge Distribution is: Document FSSO mode prerequisites when replacing domain controllers. This distinction matters because agent-based and polling collection rely on different event acquisition paths and prerequisites.

Match policy log level to investigation and retention objectives reduces recurrence of logging only security events, rather than the observed fsso polling versus dc agent mode issue. The relevant preventive control for Greenridge Distribution is: Document FSSO mode prerequisites when replacing domain controllers. This distinction matters because agent-based and polling collection rely on different event acquisition paths and prerequisites.

Include return-route verification in every VIP publication reduces recurrence of nat return path selection, rather than the observed fsso polling versus dc agent mode issue. The relevant preventive control for Greenridge Distribution is: Document FSSO mode prerequisites when replacing domain controllers. This distinction matters because agent-based and polling collection rely on different event acquisition paths and prerequisites.

Use the appropriate DNS service objects that account for required TCP and UDP transport is a relevant remedy for a DIFFERENT problem—service object protocol specificity—when an allow rule permits TCP port 53 but DNS requests using UDP 53 fail for an approved application. In this Greenridge Public Schools case that is not the failing component. Here the correct intervention is to configure a supported redundant collector arrangement and verify FortiGate connection behavior because a single identity collector creates a failure domain for otherwise healthy firewall policies.

Enable supported source NAT using the approved FortiGate egress interface address is a relevant remedy for a DIFFERENT problem—interface-address source nat—when a branch LAN uses RFC1918 addressing and has a permit policy to the internet, but upstream hosts cannot return packets to private source addresses. In this Greenridge Public Schools case that is not the failing component. Here the correct intervention is to configure a supported redundant collector arrangement and verify FortiGate connection behavior because a single identity collector creates a failure domain for otherwise healthy firewall policies.

Build and validate equivalent central SNAT mappings for affected traffic before switching modes is a relevant remedy for a DIFFERENT problem—central nat migration testing—when a profile-based firewall moves from policy SNAT to central SNAT and some published application flows lose their intended identity. In this Greenridge Public Schools case that is not the failing component. Here the correct intervention is to configure a supported redundant collector arrangement and verify FortiGate connection behavior because a single identity collector creates a failure domain for otherwise healthy firewall policies.

Service matching differentiates protocol and port even if the application uses the same well-known number explains a different situation, service object protocol specificity, where an allow rule permits TCP port 53 but DNS requests using UDP 53 fail for an approved application. It does not account for the specific observed fsso collector redundancy condition at Greenridge Public Schools. The decisive mechanism here is: A single identity collector creates a failure domain for otherwise healthy firewall policies.

Private source addresses normally require translation for return routing over a public internet connection explains a different situation, interface-address source nat, where a branch LAN uses RFC1918 addressing and has a permit policy to the internet, but upstream hosts cannot return packets to private source addresses. It does not account for the specific observed fsso collector redundancy condition at Greenridge Public Schools. The decisive mechanism here is: A single identity collector creates a failure domain for otherwise healthy firewall policies.

Changing NAT control location can leave implicit per-policy translation behavior unrepresented explains a different situation, central nat migration testing, where a profile-based firewall moves from policy SNAT to central SNAT and some published application flows lose their intended identity. It does not account for the specific observed fsso collector redundancy condition at Greenridge Public Schools. The decisive mechanism here is: A single identity collector creates a failure domain for otherwise healthy firewall policies.

Both approved DNS transport test cases pass without opening unrelated UDP services would validate the separate control service object protocol specificity, not the fault reported for Greenridge Public Schools. To confirm this correction, the team instead needs: A controlled collector shutdown leaves the approved identity mapping service available through its backup. That is the observable check related to fsso collector redundancy.

An outbound test shows the expected public translated source and receives its response would validate the separate control interface-address source nat, not the fault reported for Greenridge Public Schools. To confirm this correction, the team instead needs: A controlled collector shutdown leaves the approved identity mapping service available through its backup. That is the observable check related to fsso collector redundancy.

Traffic tests show the planned translated addresses before and after the change would validate the separate control central nat migration testing, not the fault reported for Greenridge Public Schools. To confirm this correction, the team instead needs: A controlled collector shutdown leaves the approved identity mapping service available through its backup. That is the observable check related to fsso collector redundancy.

Check required protocol variants before defining custom services reduces recurrence of service object protocol specificity, rather than the observed fsso collector redundancy issue. The relevant preventive control for Greenridge Public Schools is: Rehearse collector failover and reconcile mapping consistency. This distinction matters because a single identity collector creates a failure domain for otherwise healthy firewall policies.

Validate SNAT on each newly created internet permit rule reduces recurrence of interface-address source nat, rather than the observed fsso collector redundancy issue. The relevant preventive control for Greenridge Public Schools is: Rehearse collector failover and reconcile mapping consistency. This distinction matters because a single identity collector creates a failure domain for otherwise healthy firewall policies.

Maintain NAT migration matrices and rollback configuration reduces recurrence of central nat migration testing, rather than the observed fsso collector redundancy issue. The relevant preventive control for Greenridge Public Schools is: Rehearse collector failover and reconcile mapping consistency. This distinction matters because a single identity collector creates a failure domain for otherwise healthy firewall policies.

Enable suitable traffic logging on the matching deny rule and reproduce the authorized flow is a relevant remedy for a DIFFERENT problem—deny policy traffic logging—when an internal application unexpectedly receives TCP resets but the broad deny policy has logging disabled. In this Greenridge Insurance case that is not the failing component. Here the correct intervention is to enable appropriate logoff detection and identity entry aging in the FSSO integration because a passive session table can preserve an outdated user-to-IP association until a logout or timeout update arrives.

Use an appropriate overload SNAT or IP pool that supports multiple concurrent private sources is a relevant remedy for a DIFFERENT problem—source nat overload pool—when many internal clients need outbound internet access but an engineer configures a single fixed one-to-one IP mapping for all of them. In this Greenridge Insurance case that is not the failing component. Here the correct intervention is to enable appropriate logoff detection and identity entry aging in the FSSO integration because a passive session table can preserve an outdated user-to-IP association until a logout or timeout update arrives.

Restore the correct inside route and interface connectivity toward the mapped server is a relevant remedy for a DIFFERENT problem—vip mapped address subnet gateway—when an administrator defines a public VIP to a mapped server on a disconnected internal subnet and assumes translation alone establishes the path. In this Greenridge Insurance case that is not the failing component. Here the correct intervention is to enable appropriate logoff detection and identity entry aging in the FSSO integration because a passive session table can preserve an outdated user-to-IP association until a logout or timeout update arrives.

A denied session may leave insufficient evidence when its matching firewall policy does not log traffic explains a different situation, deny policy traffic logging, where an internal application unexpectedly receives TCP resets but the broad deny policy has logging disabled. It does not account for the specific observed fsso logout cleanup condition at Greenridge Insurance. The decisive mechanism here is: A passive session table can preserve an outdated user-to-IP association until a logout or timeout update arrives.

One-to-one mapping does not supply address-port multiplexing for many simultaneous hosts explains a different situation, source nat overload pool, where many internal clients need outbound internet access but an engineer configures a single fixed one-to-one IP mapping for all of them. It does not account for the specific observed fsso logout cleanup condition at Greenridge Insurance. The decisive mechanism here is: A passive session table can preserve an outdated user-to-IP association until a logout or timeout update arrives.

DNAT changes an address but does not create a valid route to an unreachable internal destination explains a different situation, vip mapped address subnet gateway, where an administrator defines a public VIP to a mapped server on a disconnected internal subnet and assumes translation alone establishes the path. It does not account for the specific observed fsso logout cleanup condition at Greenridge Insurance. The decisive mechanism here is: A passive session table can preserve an outdated user-to-IP association until a logout or timeout update arrives.