McAfee Secure

Exam Code: FCP_FGT_AD-7.6

Exam Name: FCP - FortiGate 7.6 Administrator

Certification Provider: Fortinet

Corresponding Certification: NSE4

Questions & Answers

Fortinet FCP_FGT_AD-7.6 Questions & Answers

Study with Up-To-Date REAL Exam Questions and Answers from the ACTUAL Test

Questions & Answers

128 Questions & Answers with Testing Engine

"FCP - FortiGate 7.6 Administrator Exam", also known as FCP_FGT_AD-7.6 exam, is a Fortinet certification exam.

Pass your tests with the always up-to-date FCP_FGT_AD-7.6 Exam Engine. Your FCP_FGT_AD-7.6 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Fortinet FCP_FGT_AD-7.6 Practice Test 57

Question 560

At Greenridge Aviation, the FortiGate 7.6 security administration team encounters the following authorized operational case: security officers expect certificate-only SSL inspection to detect sensitive keywords inside an HTTPS POST body. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which recurring review is most relevant to the same root risk?

  1. Monitor rating query errors and confirm defined fail-open or fail-close policy
  2. Revalidate group and category exceptions after role changes
  3. Document encrypted visibility limits and privacy approvals before enabling payload inspection
  4. Check application control attachment on each copied internet policy

Explanation

Correct Answer

C:

Document encrypted visibility limits and privacy approvals before enabling payload inspection. This recurring practice addresses certificate inspection hostname limitation because certificate inspection can examine handshake or certificate metadata but cannot expose encrypted HTTP request bodies. It reinforces the supported change to use appropriate authorized full SSL inspection where payload analysis is required and supported rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Monitor rating query errors and confirm defined fail-open or fail-close policy reduces recurrence of fortiguard rating outage behavior, rather than the observed certificate inspection hostname limitation issue. The relevant preventive control for Greenridge Aviation is: Document encrypted visibility limits and privacy approvals before enabling payload inspection. This distinction matters because certificate inspection can examine handshake or certificate metadata but cannot expose encrypted HTTP request bodies.

B:

Revalidate group and category exceptions after role changes reduces recurrence of web-filter user-based exception, rather than the observed certificate inspection hostname limitation issue. The relevant preventive control for Greenridge Aviation is: Document encrypted visibility limits and privacy approvals before enabling payload inspection. This distinction matters because certificate inspection can examine handshake or certificate metadata but cannot expose encrypted HTTP request bodies.

D:

Check application control attachment on each copied internet policy reduces recurrence of application control on accepting policy, rather than the observed certificate inspection hostname limitation issue. The relevant preventive control for Greenridge Aviation is: Document encrypted visibility limits and privacy approvals before enabling payload inspection. This distinction matters because certificate inspection can examine handshake or certificate metadata but cannot expose encrypted HTTP request bodies.

Question 561

At Harborview Financial Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: an outbound HTTPS connection is rejected by a strict SSL profile when its server presents a certificate for a different hostname. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which FortiOS 7.6 administration action best addresses this incident?

  1. Correct the server certificate or use only a justified narrowly scoped exception after validation
  2. Apply a narrowly scoped verified rating override or specific authorized URL exception
  3. Inspect SSL handshake and certificate events before changing the web filter category action
  4. Change the intended application signature action from monitor to block in the relevant profile

Explanation

Correct Answer

A:

Correct the server certificate or use only a justified narrowly scoped exception after validation. This targets remote certificate name mismatch: certificate identity validation compares expected hostnames against the certificate's valid identities. After applying the change, verify that the corrected test endpoint presents a matching certificate and establishes a valid TLS session. The Harborview Financial Services case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

B:

Apply a narrowly scoped verified rating override or specific authorized URL exception is a relevant remedy for a DIFFERENT problem—web filter category override—when a business-critical approved portal is classified under a FortiGuard category the organization normally blocks. In this Harborview Financial Services case that is not the failing component. Here the correct intervention is to correct the server certificate or use only a justified narrowly scoped exception after validation because certificate identity validation compares expected hostnames against the certificate's valid identities.

C:

Inspect SSL handshake and certificate events before changing the web filter category action is a relevant remedy for a DIFFERENT problem—website certificate failure versus category block—when a site fails in the browser and staff blame web categorization even though FortiGate logs a TLS certificate-validation error. In this Harborview Financial Services case that is not the failing component. Here the correct intervention is to correct the server certificate or use only a justified narrowly scoped exception after validation because certificate identity validation compares expected hostnames against the certificate's valid identities.

D:

Change the intended application signature action from monitor to block in the relevant profile is a relevant remedy for a DIFFERENT problem—application-control monitor action—when a team selects monitor for remote-control tools and then reports that those applications are still allowed. In this Harborview Financial Services case that is not the failing component. Here the correct intervention is to correct the server certificate or use only a justified narrowly scoped exception after validation because certificate identity validation compares expected hostnames against the certificate's valid identities.

Question 562

At Harborview Financial Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: an outbound HTTPS connection is rejected by a strict SSL profile when its server presents a certificate for a different hostname. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the primary mechanism responsible for the reported result?

  1. Global category blocking can affect legitimate sites when ratings do not reflect the business exception
  2. A TLS certificate failure can stop a session before the web filter assigns its normal URL category verdict
  3. Monitor observes and logs a detected application without enforcing a blocking action
  4. Certificate identity validation compares expected hostnames against the certificate's valid identities

Explanation

Correct Answer

D:

Certificate identity validation compares expected hostnames against the certificate's valid identities. The mechanism is relevant because the stated remote certificate name mismatch incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to correct the server certificate or use only a justified narrowly scoped exception after validation; verify it through this observed condition: the corrected test endpoint presents a matching certificate and establishes a valid TLS session.

Incorrect Answers

A:

Global category blocking can affect legitimate sites when ratings do not reflect the business exception explains a different situation, web filter category override, where a business-critical approved portal is classified under a FortiGuard category the organization normally blocks. It does not account for the specific observed remote certificate name mismatch condition at Harborview Financial Services. The decisive mechanism here is: Certificate identity validation compares expected hostnames against the certificate's valid identities.

B:

A TLS certificate failure can stop a session before the web filter assigns its normal URL category verdict explains a different situation, website certificate failure versus category block, where a site fails in the browser and staff blame web categorization even though FortiGate logs a TLS certificate-validation error. It does not account for the specific observed remote certificate name mismatch condition at Harborview Financial Services. The decisive mechanism here is: Certificate identity validation compares expected hostnames against the certificate's valid identities.

C:

Monitor observes and logs a detected application without enforcing a blocking action explains a different situation, application-control monitor action, where a team selects monitor for remote-control tools and then reports that those applications are still allowed. It does not account for the specific observed remote certificate name mismatch condition at Harborview Financial Services. The decisive mechanism here is: Certificate identity validation compares expected hostnames against the certificate's valid identities.

Question 563

At Harborview Financial Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: an outbound HTTPS connection is rejected by a strict SSL profile when its server presents a certificate for a different hostname. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which validation result would demonstrate that the specified incident has been resolved?

  1. The corrected test endpoint presents a matching certificate and establishes a valid TLS session
  2. The single portal is accessible and other blocked-category domains remain denied
  3. After certificate remediation the site receives the intended category decision
  4. A supervised prohibited application connection is denied and logged

Explanation

Correct Answer

A:

The corrected test endpoint presents a matching certificate and establishes a valid TLS session. This directly tests the corrective decision to correct the server certificate or use only a justified narrowly scoped exception after validation. It is a meaningful acceptance check because certificate identity validation compares expected hostnames against the certificate's valid identities. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

B:

The single portal is accessible and other blocked-category domains remain denied would validate the separate control web filter category override, not the fault reported for Harborview Financial Services. To confirm this correction, the team instead needs: The corrected test endpoint presents a matching certificate and establishes a valid TLS session. That is the observable check related to remote certificate name mismatch.

C:

After certificate remediation the site receives the intended category decision would validate the separate control website certificate failure versus category block, not the fault reported for Harborview Financial Services. To confirm this correction, the team instead needs: The corrected test endpoint presents a matching certificate and establishes a valid TLS session. That is the observable check related to remote certificate name mismatch.

D:

A supervised prohibited application connection is denied and logged would validate the separate control application-control monitor action, not the fault reported for Harborview Financial Services. To confirm this correction, the team instead needs: The corrected test endpoint presents a matching certificate and establishes a valid TLS session. That is the observable check related to remote certificate name mismatch.

Question 564

At Harborview Financial Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: an outbound HTTPS connection is rejected by a strict SSL profile when its server presents a certificate for a different hostname. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which operational practice would most effectively prevent this specific fault?

  1. Monitor certificate name errors rather than suppressing validation globally
  2. Review category overrides for ownership and expiry
  3. Use separate TLS and URL diagnostics in web access incidents
  4. Verify enforcement actions rather than relying on profile labels

Explanation

Correct Answer

A:

Monitor certificate name errors rather than suppressing validation globally. This recurring practice addresses remote certificate name mismatch because certificate identity validation compares expected hostnames against the certificate's valid identities. It reinforces the supported change to correct the server certificate or use only a justified narrowly scoped exception after validation rather than relying on an unrelated periodic audit.

Incorrect Answers

B:

Review category overrides for ownership and expiry reduces recurrence of web filter category override, rather than the observed remote certificate name mismatch issue. The relevant preventive control for Harborview Financial Services is: Monitor certificate name errors rather than suppressing validation globally. This distinction matters because certificate identity validation compares expected hostnames against the certificate's valid identities.

C:

Use separate TLS and URL diagnostics in web access incidents reduces recurrence of website certificate failure versus category block, rather than the observed remote certificate name mismatch issue. The relevant preventive control for Harborview Financial Services is: Monitor certificate name errors rather than suppressing validation globally. This distinction matters because certificate identity validation compares expected hostnames against the certificate's valid identities.

D:

Verify enforcement actions rather than relying on profile labels reduces recurrence of application-control monitor action, rather than the observed remote certificate name mismatch issue. The relevant preventive control for Harborview Financial Services is: Monitor certificate name errors rather than suppressing validation globally. This distinction matters because certificate identity validation compares expected hostnames against the certificate's valid identities.

Question 565

At Harborview Healthcare, the FortiGate 7.6 security administration team encounters the following authorized operational case: FortiGate flags a trusted internal HTTPS portal as untrusted after the enterprise PKI adds a new intermediate CA. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the most appropriate first configuration correction for this case?

  1. Import or supply the required approved certificate chain and verify trust policy
  2. Select the supported warning or authentication action matching the intended user experience
  3. Use a supported file filter or appropriate HTTP inspection control for the prohibited file type
  4. Evaluate supported unknown-application handling and explicit service controls without claiming every encrypted protocol is identifiable

Explanation

Correct Answer

A:

Import or supply the required approved certificate chain and verify trust policy. This targets untrusted certificate chain: missing or unknown intermediate certificates can prevent a chain from reaching a recognized trust anchor. After applying the change, verify that the internal site negotiates TLS with an independently verified approved chain. The Harborview Healthcare case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

B:

Select the supported warning or authentication action matching the intended user experience is a relevant remedy for a DIFFERENT problem—web-filter action monitor versus warning—when the security team expects a browser warning and user acknowledgment but the category action is configured only to monitor. In this Harborview Healthcare case that is not the failing component. Here the correct intervention is to import or supply the required approved certificate chain and verify trust policy because missing or unknown intermediate certificates can prevent a chain from reaching a recognized trust anchor.

C:

Use a supported file filter or appropriate HTTP inspection control for the prohibited file type is a relevant remedy for a DIFFERENT problem—url filter file-type download restriction—when a secure browsing policy needs to stop downloads of certain executable file types but the team uses a broad URL domain block. In this Harborview Healthcare case that is not the failing component. Here the correct intervention is to import or supply the required approved certificate chain and verify trust policy because missing or unknown intermediate certificates can prevent a chain from reaching a recognized trust anchor.

D:

Evaluate supported unknown-application handling and explicit service controls without claiming every encrypted protocol is identifiable is a relevant remedy for a DIFFERENT problem—unknown application coverage—when a custom encrypted application is allowed even though common application signatures are blocked by category. In this Harborview Healthcare case that is not the failing component. Here the correct intervention is to import or supply the required approved certificate chain and verify trust policy because missing or unknown intermediate certificates can prevent a chain from reaching a recognized trust anchor.

Question 566

At Harborview Healthcare, the FortiGate 7.6 security administration team encounters the following authorized operational case: FortiGate flags a trusted internal HTTPS portal as untrusted after the enterprise PKI adds a new intermediate CA. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which diagnosis best distinguishes this case from other FortiOS problems?

  1. Missing or unknown intermediate certificates can prevent a chain from reaching a recognized trust anchor
  2. A monitor action logs activity without necessarily interrupting the user's browsing flow
  3. A website's domain identity does not uniquely determine the file types delivered from it
  4. Signature classification cannot identify all custom or obscured protocols automatically

Explanation

Correct Answer

A:

Missing or unknown intermediate certificates can prevent a chain from reaching a recognized trust anchor. The mechanism is relevant because the stated untrusted certificate chain incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to import or supply the required approved certificate chain and verify trust policy; verify it through this observed condition: the internal site negotiates TLS with an independently verified approved chain.

Incorrect Answers

B:

A monitor action logs activity without necessarily interrupting the user's browsing flow explains a different situation, web-filter action monitor versus warning, where the security team expects a browser warning and user acknowledgment but the category action is configured only to monitor. It does not account for the specific observed untrusted certificate chain condition at Harborview Healthcare. The decisive mechanism here is: Missing or unknown intermediate certificates can prevent a chain from reaching a recognized trust anchor.

C:

A website's domain identity does not uniquely determine the file types delivered from it explains a different situation, url filter file-type download restriction, where a secure browsing policy needs to stop downloads of certain executable file types but the team uses a broad URL domain block. It does not account for the specific observed untrusted certificate chain condition at Harborview Healthcare. The decisive mechanism here is: Missing or unknown intermediate certificates can prevent a chain from reaching a recognized trust anchor.

D:

Signature classification cannot identify all custom or obscured protocols automatically explains a different situation, unknown application coverage, where a custom encrypted application is allowed even though common application signatures are blocked by category. It does not account for the specific observed untrusted certificate chain condition at Harborview Healthcare. The decisive mechanism here is: Missing or unknown intermediate certificates can prevent a chain from reaching a recognized trust anchor.

Question 567

At Harborview Healthcare, the FortiGate 7.6 security administration team encounters the following authorized operational case: FortiGate flags a trusted internal HTTPS portal as untrusted after the enterprise PKI adds a new intermediate CA. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which controlled test outcome best proves that the required feature now works?

  1. A test user receives the intended warning and a policy event records the result
  2. A harmless file downloads while a supervised prohibited file type is blocked
  3. A supervised unknown test flow follows the documented default enforcement behavior
  4. The internal site negotiates TLS with an independently verified approved chain

Explanation

Correct Answer

D:

The internal site negotiates TLS with an independently verified approved chain. This directly tests the corrective decision to import or supply the required approved certificate chain and verify trust policy. It is a meaningful acceptance check because missing or unknown intermediate certificates can prevent a chain from reaching a recognized trust anchor. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

A test user receives the intended warning and a policy event records the result would validate the separate control web-filter action monitor versus warning, not the fault reported for Harborview Healthcare. To confirm this correction, the team instead needs: The internal site negotiates TLS with an independently verified approved chain. That is the observable check related to untrusted certificate chain.

B:

A harmless file downloads while a supervised prohibited file type is blocked would validate the separate control url filter file-type download restriction, not the fault reported for Harborview Healthcare. To confirm this correction, the team instead needs: The internal site negotiates TLS with an independently verified approved chain. That is the observable check related to untrusted certificate chain.

C:

A supervised unknown test flow follows the documented default enforcement behavior would validate the separate control unknown application coverage, not the fault reported for Harborview Healthcare. To confirm this correction, the team instead needs: The internal site negotiates TLS with an independently verified approved chain. That is the observable check related to untrusted certificate chain.

Question 568

At Harborview Healthcare, the FortiGate 7.6 security administration team encounters the following authorized operational case: FortiGate flags a trusted internal HTTPS portal as untrusted after the enterprise PKI adds a new intermediate CA. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What continuing control matches this firewall administration scenario?

  1. Validate interactive web-filter actions after profile edits
  2. Track changes to internal certificate authorities and chain distribution
  3. Reevaluate inspected content types when applications change
  4. Review signature coverage and default unknown traffic policy

Explanation

Correct Answer

B:

Track changes to internal certificate authorities and chain distribution. This recurring practice addresses untrusted certificate chain because missing or unknown intermediate certificates can prevent a chain from reaching a recognized trust anchor. It reinforces the supported change to import or supply the required approved certificate chain and verify trust policy rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Validate interactive web-filter actions after profile edits reduces recurrence of web-filter action monitor versus warning, rather than the observed untrusted certificate chain issue. The relevant preventive control for Harborview Healthcare is: Track changes to internal certificate authorities and chain distribution. This distinction matters because missing or unknown intermediate certificates can prevent a chain from reaching a recognized trust anchor.

C:

Reevaluate inspected content types when applications change reduces recurrence of url filter file-type download restriction, rather than the observed untrusted certificate chain issue. The relevant preventive control for Harborview Healthcare is: Track changes to internal certificate authorities and chain distribution. This distinction matters because missing or unknown intermediate certificates can prevent a chain from reaching a recognized trust anchor.

D:

Review signature coverage and default unknown traffic policy reduces recurrence of unknown application coverage, rather than the observed untrusted certificate chain issue. The relevant preventive control for Harborview Healthcare is: Track changes to internal certificate authorities and chain distribution. This distinction matters because missing or unknown intermediate certificates can prevent a chain from reaching a recognized trust anchor.

Question 569

At Harborview University, the FortiGate 7.6 security administration team encounters the following authorized operational case: a FortiGate deep-inspection CA certificate expires during a maintenance freeze and browsers stop trusting generated site certificates. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which supported FortiGate response most directly resolves the stated requirement?

  1. Renew and deploy the compatible inspection CA and update managed client trust in an approved sequence
  2. Set the prohibited FortiGuard category to block in the correct web filter profile and apply it to the student policy
  3. Attach the intended web filter profile to the actual accepting firewall policy
  4. Replace the overly broad exemption with a precise supported destination and a documented justification

Explanation

Correct Answer

A:

Renew and deploy the compatible inspection CA and update managed client trust in an approved sequence. This targets tls inspection certificate expiration: inspection trust fails when substituted certificates chain to an expired or no longer accepted issuing identity. After applying the change, verify that a test client validates current inspection certificates and security filtering remains active. The Harborview University case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

B:

Set the prohibited FortiGuard category to block in the correct web filter profile and apply it to the student policy is a relevant remedy for a DIFFERENT problem—fortiguard category deny—when student browsing rules allow gambling websites because a FortiGuard web filter profile has that category set to monitor. In this Harborview University case that is not the failing component. Here the correct intervention is to renew and deploy the compatible inspection CA and update managed client trust in an approved sequence because inspection trust fails when substituted certificates chain to an expired or no longer accepted issuing identity.

C:

Attach the intended web filter profile to the actual accepting firewall policy is a relevant remedy for a DIFFERENT problem—web filter profile not applied—when a newly created marketing category profile is correct but social-network sites are unaffected on the production VLAN. In this Harborview University case that is not the failing component. Here the correct intervention is to renew and deploy the compatible inspection CA and update managed client trust in an approved sequence because inspection trust fails when substituted certificates chain to an expired or no longer accepted issuing identity.

D:

Replace the overly broad exemption with a precise supported destination and a documented justification is a relevant remedy for a DIFFERENT problem—webfilter exemption policy scope—when a site-level SSL inspection exemption expands to an entire content-delivery domain and unexpectedly bypasses other security scanning. In this Harborview University case that is not the failing component. Here the correct intervention is to renew and deploy the compatible inspection CA and update managed client trust in an approved sequence because inspection trust fails when substituted certificates chain to an expired or no longer accepted issuing identity.

Question 570

At Harborview University, the FortiGate 7.6 security administration team encounters the following authorized operational case: a FortiGate deep-inspection CA certificate expires during a maintenance freeze and browsers stop trusting generated site certificates. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What root condition most directly explains the described FortiGate symptom?

  1. Inspection trust fails when substituted certificates chain to an expired or no longer accepted issuing identity
  2. Category monitor records a match but does not deny access unless the configured action requires it
  3. A configured security profile has no effect on flows that never traverse a policy referencing it
  4. A broad exemption can suppress inspection for unrelated traffic sharing the allowed domain scope

Explanation

Correct Answer

A:

Inspection trust fails when substituted certificates chain to an expired or no longer accepted issuing identity. The mechanism is relevant because the stated tls inspection certificate expiration incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to renew and deploy the compatible inspection CA and update managed client trust in an approved sequence; verify it through this observed condition: a test client validates current inspection certificates and security filtering remains active.

Incorrect Answers

B:

Category monitor records a match but does not deny access unless the configured action requires it explains a different situation, fortiguard category deny, where student browsing rules allow gambling websites because a FortiGuard web filter profile has that category set to monitor. It does not account for the specific observed tls inspection certificate expiration condition at Harborview University. The decisive mechanism here is: Inspection trust fails when substituted certificates chain to an expired or no longer accepted issuing identity.

C:

A configured security profile has no effect on flows that never traverse a policy referencing it explains a different situation, web filter profile not applied, where a newly created marketing category profile is correct but social-network sites are unaffected on the production VLAN. It does not account for the specific observed tls inspection certificate expiration condition at Harborview University. The decisive mechanism here is: Inspection trust fails when substituted certificates chain to an expired or no longer accepted issuing identity.

D:

A broad exemption can suppress inspection for unrelated traffic sharing the allowed domain scope explains a different situation, webfilter exemption policy scope, where a site-level SSL inspection exemption expands to an entire content-delivery domain and unexpectedly bypasses other security scanning. It does not account for the specific observed tls inspection certificate expiration condition at Harborview University. The decisive mechanism here is: Inspection trust fails when substituted certificates chain to an expired or no longer accepted issuing identity.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests