Fortinet FCP_FGT_AD-7.6 Questions & Answers

Reconcile sensor filters against threat model changes reduces recurrence of ips sensor severity filter, rather than the observed antivirus inspection resource cost issue. The relevant preventive control for Kingsford Manufacturing is: Include inspection concurrency in firewall capacity forecasts. This distinction matters because proxy-based file buffering and inspection can consume more memory than simple forwarding.

Document IPS encrypted-traffic visibility limits for protected services reduces recurrence of ssl encryption limits for ips, rather than the observed antivirus inspection resource cost issue. The relevant preventive control for Kingsford Manufacturing is: Include inspection concurrency in firewall capacity forecasts. This distinction matters because proxy-based file buffering and inspection can consume more memory than simple forwarding.

Review exemption necessity and affected destinations periodically reduces recurrence of ssl exempt site scope, rather than the observed antivirus inspection resource cost issue. The relevant preventive control for Kingsford Manufacturing is: Include inspection concurrency in firewall capacity forecasts. This distinction matters because proxy-based file buffering and inspection can consume more memory than simple forwarding.

Tune IPS signatures and traffic scope based on actual protected services and measured resource cost is a relevant remedy for a DIFFERENT problem—ips excessive cpu consumption—when a FortiGate becomes CPU-bound after enabling an overly broad all-signature IPS sensor on low-risk backup traffic. In this Kingsford Media Group case that is not the failing component. Here the correct intervention is to apply a narrowly scoped authorized AV exception following analysis rather than globally disabling antivirus because false positives can affect legitimate files but broad AV bypass exposes unrelated downloads.

Inspect the IPS event record including signature ID, action, source, destination and matching policy is a relevant remedy for a DIFFERENT problem—ips event log triage—when network responders see a dropped application request but cannot identify the signature that caused the IPS denial. In this Kingsford Media Group case that is not the failing component. Here the correct intervention is to apply a narrowly scoped authorized AV exception following analysis rather than globally disabling antivirus because false positives can affect legitimate files but broad AV bypass exposes unrelated downloads.

Fix the vendor certificate or apply a targeted temporary exception while retaining general validation is a relevant remedy for a DIFFERENT problem—certificate validation versus bypass—when a support engineer disables all SSL certificate checks to accommodate one malformed vendor chain. In this Kingsford Media Group case that is not the failing component. Here the correct intervention is to apply a narrowly scoped authorized AV exception following analysis rather than globally disabling antivirus because false positives can affect legitimate files but broad AV bypass exposes unrelated downloads.

Inspection cost rises when many signatures apply to traffic unrelated to their threat surface explains a different situation, ips excessive cpu consumption, where a FortiGate becomes CPU-bound after enabling an overly broad all-signature IPS sensor on low-risk backup traffic. It does not account for the specific observed antivirus false-positive exception condition at Kingsford Media Group. The decisive mechanism here is: False positives can affect legitimate files but broad AV bypass exposes unrelated downloads.

An IPS event identifies the intrusion signature decision separately from a generic traffic session log explains a different situation, ips event log triage, where network responders see a dropped application request but cannot identify the signature that caused the IPS denial. It does not account for the specific observed antivirus false-positive exception condition at Kingsford Media Group. The decisive mechanism here is: False positives can affect legitimate files but broad AV bypass exposes unrelated downloads.

Global invalid-certificate bypass removes protection for unrelated TLS destinations explains a different situation, certificate validation versus bypass, where a support engineer disables all SSL certificate checks to accommodate one malformed vendor chain. It does not account for the specific observed antivirus false-positive exception condition at Kingsford Media Group. The decisive mechanism here is: False positives can affect legitimate files but broad AV bypass exposes unrelated downloads.

Peak load stays within CPU targets while service-specific exploit checks still trigger would validate the separate control ips excessive cpu consumption, not the fault reported for Kingsford Media Group. To confirm this correction, the team instead needs: The approved package succeeds while an EICAR test remains blocked on other traffic. That is the observable check related to antivirus false-positive exception.

A controlled test maps one IPS detection to the intended sensor and rule would validate the separate control ips event log triage, not the fault reported for Kingsford Media Group. To confirm this correction, the team instead needs: The approved package succeeds while an EICAR test remains blocked on other traffic. That is the observable check related to antivirus false-positive exception.

The vendor test succeeds without granting acceptance to an unrelated invalid-certificate site would validate the separate control certificate validation versus bypass, not the fault reported for Kingsford Media Group. To confirm this correction, the team instead needs: The approved package succeeds while an EICAR test remains blocked on other traffic. That is the observable check related to antivirus false-positive exception.

Review IPS sensor performance before expanding inspection scope reduces recurrence of ips excessive cpu consumption, rather than the observed antivirus false-positive exception issue. The relevant preventive control for Kingsford Media Group is: Expire exceptions and retest after engine or signature updates. This distinction matters because false positives can affect legitimate files but broad AV bypass exposes unrelated downloads.

Maintain searchable IPS signature and policy context in central logs reduces recurrence of ips event log triage, rather than the observed antivirus false-positive exception issue. The relevant preventive control for Kingsford Media Group is: Expire exceptions and retest after engine or signature updates. This distinction matters because false positives can affect legitimate files but broad AV bypass exposes unrelated downloads.

Expire emergency certificate exceptions and require vendor remediation reduces recurrence of certificate validation versus bypass, rather than the observed antivirus false-positive exception issue. The relevant preventive control for Kingsford Media Group is: Expire exceptions and retest after engine or signature updates. This distinction matters because false positives can affect legitimate files but broad AV bypass exposes unrelated downloads.

Review the signature's protected-client or protected-server direction and matching service context is a relevant remedy for a DIFFERENT problem—ips signature directionality—when a test flow bypasses an IPS rule because its signature is configured for the opposite traffic direction. In this Kingsford Research Institute case that is not the failing component. Here the correct intervention is to verify FortiGate's supported block and logging behavior and coordinate separate endpoint quarantine controls because network antivirus traffic blocking and endpoint file quarantine are different enforcement points.

Evaluate supported protocol anomaly and relevant IPS detection settings for the affected network service is a relevant remedy for a DIFFERENT problem—ips packet anomaly handling—when unusual malformed packets disrupt a service and the team focuses only on known CVE signatures. In this Kingsford Research Institute case that is not the failing component. Here the correct intervention is to verify FortiGate's supported block and logging behavior and coordinate separate endpoint quarantine controls because network antivirus traffic blocking and endpoint file quarantine are different enforcement points.

Use a supported web filter and SSL profile combination matching the rule inspection mode is a relevant remedy for a DIFFERENT problem—ssl proxy versus flow profile alignment—when a flow-inspection firewall rule references a web filter profile configured for incompatible proxy-only features. In this Kingsford Research Institute case that is not the failing component. Here the correct intervention is to verify FortiGate's supported block and logging behavior and coordinate separate endpoint quarantine controls because network antivirus traffic blocking and endpoint file quarantine are different enforcement points.

Some intrusion signatures match specific request or response directions and protocol conditions explains a different situation, ips signature directionality, where a test flow bypasses an IPS rule because its signature is configured for the opposite traffic direction. It does not account for the specific observed anti-malware quarantine workflow condition at Kingsford Research Institute. The decisive mechanism here is: Network antivirus traffic blocking and endpoint file quarantine are different enforcement points.

Some disruptive network patterns exploit malformed protocol behavior rather than a named application vulnerability explains a different situation, ips packet anomaly handling, where unusual malformed packets disrupt a service and the team focuses only on known CVE signatures. It does not account for the specific observed anti-malware quarantine workflow condition at Kingsford Research Institute. The decisive mechanism here is: Network antivirus traffic blocking and endpoint file quarantine are different enforcement points.

Flow and proxy inspection modes expose different feature behavior and require compatible security profiles explains a different situation, ssl proxy versus flow profile alignment, where a flow-inspection firewall rule references a web filter profile configured for incompatible proxy-only features. It does not account for the specific observed anti-malware quarantine workflow condition at Kingsford Research Institute. The decisive mechanism here is: Network antivirus traffic blocking and endpoint file quarantine are different enforcement points.

A supervised flow in the protected direction triggers the intended signature would validate the separate control ips signature directionality, not the fault reported for Kingsford Research Institute. To confirm this correction, the team instead needs: A safe test is blocked at the firewall and the endpoint's separate response matches its own policy. That is the observable check related to anti-malware quarantine workflow.

An approved malformed-input test produces the intended protocol enforcement without harming normal traffic would validate the separate control ips packet anomaly handling, not the fault reported for Kingsford Research Institute. To confirm this correction, the team instead needs: A safe test is blocked at the firewall and the endpoint's separate response matches its own policy. That is the observable check related to anti-malware quarantine workflow.

An authorized test website receives the intended web-filter verdict under the selected mode would validate the separate control ssl proxy versus flow profile alignment, not the fault reported for Kingsford Research Institute. To confirm this correction, the team instead needs: A safe test is blocked at the firewall and the endpoint's separate response matches its own policy. That is the observable check related to anti-malware quarantine workflow.

Verify signature direction during policy rollout reduces recurrence of ips signature directionality, rather than the observed anti-malware quarantine workflow issue. The relevant preventive control for Kingsford Research Institute is: Document responsibilities for network AV and endpoint protection. This distinction matters because network antivirus traffic blocking and endpoint file quarantine are different enforcement points.

Track abnormal protocol indicators alongside CVE coverage reduces recurrence of ips packet anomaly handling, rather than the observed anti-malware quarantine workflow issue. The relevant preventive control for Kingsford Research Institute is: Document responsibilities for network AV and endpoint protection. This distinction matters because network antivirus traffic blocking and endpoint file quarantine are different enforcement points.

Check security profile feature-set alignment when changing inspection mode reduces recurrence of ssl proxy versus flow profile alignment, rather than the observed anti-malware quarantine workflow issue. The relevant preventive control for Kingsford Research Institute is: Document responsibilities for network AV and endpoint protection. This distinction matters because network antivirus traffic blocking and endpoint file quarantine are different enforcement points.

Confirm protocol compatibility and remediate the server to supported TLS rather than opening obsolete protocols globally is a relevant remedy for a DIFFERENT problem—tls protocol negotiation support—when a legacy HTTPS endpoint fails during full inspection because it supports only TLS versions prohibited by organization policy. In this Kingsford Regional Hospital case that is not the failing component. Here the correct intervention is to attach the intended IPS sensor to the matching permit policy with supported inspection mode because an IPS sensor not selected on a transit policy does not inspect that policy's sessions.

Deploy the appropriate supported DNS filtering control for DNS traffic in addition to web inspection is a relevant remedy for a DIFFERENT problem—dns-filter and web-filter distinction—when an administrator expects a web-filter category profile to block DNS lookups made directly through a separate resolver path. In this Kingsford Regional Hospital case that is not the failing component. Here the correct intervention is to attach the intended IPS sensor to the matching permit policy with supported inspection mode because an IPS sensor not selected on a transit policy does not inspect that policy's sessions.

Evaluate supported unknown-application handling and explicit service controls without claiming every encrypted protocol is identifiable is a relevant remedy for a DIFFERENT problem—unknown application coverage—when a custom encrypted application is allowed even though common application signatures are blocked by category. In this Kingsford Regional Hospital case that is not the failing component. Here the correct intervention is to attach the intended IPS sensor to the matching permit policy with supported inspection mode because an IPS sensor not selected on a transit policy does not inspect that policy's sessions.

TLS negotiation can fail before application inspection when no permitted protocol or cipher overlap exists explains a different situation, tls protocol negotiation support, where a legacy HTTPS endpoint fails during full inspection because it supports only TLS versions prohibited by organization policy. It does not account for the specific observed ips sensor missing from rule condition at Kingsford Regional Hospital. The decisive mechanism here is: An IPS sensor not selected on a transit policy does not inspect that policy's sessions.

HTTP URL filtering and DNS query filtering operate on different protocol events explains a different situation, dns-filter and web-filter distinction, where an administrator expects a web-filter category profile to block DNS lookups made directly through a separate resolver path. It does not account for the specific observed ips sensor missing from rule condition at Kingsford Regional Hospital. The decisive mechanism here is: An IPS sensor not selected on a transit policy does not inspect that policy's sessions.

Signature classification cannot identify all custom or obscured protocols automatically explains a different situation, unknown application coverage, where a custom encrypted application is allowed even though common application signatures are blocked by category. It does not account for the specific observed ips sensor missing from rule condition at Kingsford Regional Hospital. The decisive mechanism here is: An IPS sensor not selected on a transit policy does not inspect that policy's sessions.