McAfee Secure

Exam Code: FCP_FGT_AD-7.6

Exam Name: FCP - FortiGate 7.6 Administrator

Certification Provider: Fortinet

Corresponding Certification: NSE4

Questions & Answers

Fortinet FCP_FGT_AD-7.6 Questions & Answers

Study with Up-To-Date REAL Exam Questions and Answers from the ACTUAL Test

Questions & Answers

128 Questions & Answers with Testing Engine

"FCP - FortiGate 7.6 Administrator Exam", also known as FCP_FGT_AD-7.6 exam, is a Fortinet certification exam.

Pass your tests with the always up-to-date FCP_FGT_AD-7.6 Exam Engine. Your FCP_FGT_AD-7.6 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Fortinet FCP_FGT_AD-7.6 Practice Test 91

Question 900

At Lakeview Manufacturing, the FortiGate 7.6 security administration team encounters the following authorized operational case: two routes to the same destination use different WANs but traffic chooses the unintended carrier. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which recurring review is most relevant to the same root risk?

  1. Track SLA latency distributions across provider changes
  2. Monitor link flaps and adjust SLA stability thresholds
  3. Record ECMP expectations when adding same-distance routes
  4. Document route-distance intent before changing secondary links

Explanation

Correct Answer

D:

Document route-distance intent before changing secondary links. This recurring practice addresses static route distance preference because for otherwise equivalent destinations, route preference depends on route distance and eligibility. It reinforces the supported change to review and set compatible administrative distance values for the preferred route rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Track SLA latency distributions across provider changes reduces recurrence of sla latency limit, rather than the observed static route distance preference issue. The relevant preventive control for Lakeview Manufacturing is: Document route-distance intent before changing secondary links. This distinction matters because for otherwise equivalent destinations, route preference depends on route distance and eligibility.

B:

Monitor link flaps and adjust SLA stability thresholds reduces recurrence of sd-wan failover recovery hysteresis, rather than the observed static route distance preference issue. The relevant preventive control for Lakeview Manufacturing is: Document route-distance intent before changing secondary links. This distinction matters because for otherwise equivalent destinations, route preference depends on route distance and eligibility.

C:

Record ECMP expectations when adding same-distance routes reduces recurrence of ecmp equal-cost forwarding, rather than the observed static route distance preference issue. The relevant preventive control for Lakeview Manufacturing is: Document route-distance intent before changing secondary links. This distinction matters because for otherwise equivalent destinations, route preference depends on route distance and eligibility.

Question 901

At Lakeview Media Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: equal-destination static routes have the same distance but operations needs deterministic primary and standby forwarding. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which FortiOS 7.6 administration action best addresses this incident?

  1. Use supported route priority settings to choose among otherwise comparable static routes
  2. Define and enforce a suitable SD-WAN jitter SLA for real-time conferencing
  3. Organize WAN members into suitable zones and restrict service rules by intended path
  4. Use suitable supported link-monitor and route withdrawal or SD-WAN health checks

Explanation

Correct Answer

A:

Use supported route priority settings to choose among otherwise comparable static routes. This targets static route priority tie-breaker: priority influences selection of eligible routes with matching specificity and distance. After applying the change, verify that the route lookup selects the intended low-priority path and fails over by design. The Lakeview Media Group case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

B:

Define and enforce a suitable SD-WAN jitter SLA for real-time conferencing is a relevant remedy for a DIFFERENT problem—sla jitter for conferencing—when video meetings stutter over a WAN whose average latency is acceptable but jitter is high. In this Lakeview Media Group case that is not the failing component. Here the correct intervention is to use supported route priority settings to choose among otherwise comparable static routes because priority influences selection of eligible routes with matching specificity and distance.

C:

Organize WAN members into suitable zones and restrict service rules by intended path is a relevant remedy for a DIFFERENT problem—sd-wan per-zone segmentation—when a guest internet link appears as eligible for private branch traffic because dissimilar links were placed in one broad SD-WAN selection pool. In this Lakeview Media Group case that is not the failing component. Here the correct intervention is to use supported route priority settings to choose among otherwise comparable static routes because priority influences selection of eligible routes with matching specificity and distance.

D:

Use suitable supported link-monitor and route withdrawal or SD-WAN health checks is a relevant remedy for a DIFFERENT problem—static route failover link monitoring—when a primary route stays active when its ISP gateway responds locally but the service beyond the ISP fails. In this Lakeview Media Group case that is not the failing component. Here the correct intervention is to use supported route priority settings to choose among otherwise comparable static routes because priority influences selection of eligible routes with matching specificity and distance.

Question 902

At Lakeview Media Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: equal-destination static routes have the same distance but operations needs deterministic primary and standby forwarding. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the primary mechanism responsible for the reported result?

  1. Priority influences selection of eligible routes with matching specificity and distance
  2. Variation in packet delay can degrade interactive media even when mean latency remains low
  3. SD-WAN zones and service-member scope help separate connectivity roles
  4. An interface's carrier state does not prove upstream end-to-end reachability

Explanation

Correct Answer

A:

Priority influences selection of eligible routes with matching specificity and distance. The mechanism is relevant because the stated static route priority tie-breaker incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to use supported route priority settings to choose among otherwise comparable static routes; verify it through this observed condition: the route lookup selects the intended low-priority path and fails over by design.

Incorrect Answers

B:

Variation in packet delay can degrade interactive media even when mean latency remains low explains a different situation, sla jitter for conferencing, where video meetings stutter over a WAN whose average latency is acceptable but jitter is high. It does not account for the specific observed static route priority tie-breaker condition at Lakeview Media Group. The decisive mechanism here is: Priority influences selection of eligible routes with matching specificity and distance.

C:

SD-WAN zones and service-member scope help separate connectivity roles explains a different situation, sd-wan per-zone segmentation, where a guest internet link appears as eligible for private branch traffic because dissimilar links were placed in one broad SD-WAN selection pool. It does not account for the specific observed static route priority tie-breaker condition at Lakeview Media Group. The decisive mechanism here is: Priority influences selection of eligible routes with matching specificity and distance.

D:

An interface's carrier state does not prove upstream end-to-end reachability explains a different situation, static route failover link monitoring, where a primary route stays active when its ISP gateway responds locally but the service beyond the ISP fails. It does not account for the specific observed static route priority tie-breaker condition at Lakeview Media Group. The decisive mechanism here is: Priority influences selection of eligible routes with matching specificity and distance.

Question 903

At Lakeview Media Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: equal-destination static routes have the same distance but operations needs deterministic primary and standby forwarding. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which validation result would demonstrate that the specified incident has been resolved?

  1. The route lookup selects the intended low-priority path and fails over by design
  2. A controlled jitter test moves the conferencing flow to an eligible stable member
  3. A protected branch flow cannot select the guest-only internet interface
  4. A controlled remote outage removes or deprioritizes the unusable path and uses the backup

Explanation

Correct Answer

A:

The route lookup selects the intended low-priority path and fails over by design. This directly tests the corrective decision to use supported route priority settings to choose among otherwise comparable static routes. It is a meaningful acceptance check because priority influences selection of eligible routes with matching specificity and distance. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

B:

A controlled jitter test moves the conferencing flow to an eligible stable member would validate the separate control sla jitter for conferencing, not the fault reported for Lakeview Media Group. To confirm this correction, the team instead needs: The route lookup selects the intended low-priority path and fails over by design. That is the observable check related to static route priority tie-breaker.

C:

A protected branch flow cannot select the guest-only internet interface would validate the separate control sd-wan per-zone segmentation, not the fault reported for Lakeview Media Group. To confirm this correction, the team instead needs: The route lookup selects the intended low-priority path and fails over by design. That is the observable check related to static route priority tie-breaker.

D:

A controlled remote outage removes or deprioritizes the unusable path and uses the backup would validate the separate control static route failover link monitoring, not the fault reported for Lakeview Media Group. To confirm this correction, the team instead needs: The route lookup selects the intended low-priority path and fails over by design. That is the observable check related to static route priority tie-breaker.

Question 904

At Lakeview Media Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: equal-destination static routes have the same distance but operations needs deterministic primary and standby forwarding. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which operational practice would most effectively prevent this specific fault?

  1. Review jitter targets and quality measurements after WAN upgrades
  2. Audit member zone assignments as new transports are added
  3. Audit priority after copying route objects
  4. Test remote failures rather than only unplugging local cables

Explanation

Correct Answer

C:

Audit priority after copying route objects. This recurring practice addresses static route priority tie-breaker because priority influences selection of eligible routes with matching specificity and distance. It reinforces the supported change to use supported route priority settings to choose among otherwise comparable static routes rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Review jitter targets and quality measurements after WAN upgrades reduces recurrence of sla jitter for conferencing, rather than the observed static route priority tie-breaker issue. The relevant preventive control for Lakeview Media Group is: Audit priority after copying route objects. This distinction matters because priority influences selection of eligible routes with matching specificity and distance.

B:

Audit member zone assignments as new transports are added reduces recurrence of sd-wan per-zone segmentation, rather than the observed static route priority tie-breaker issue. The relevant preventive control for Lakeview Media Group is: Audit priority after copying route objects. This distinction matters because priority influences selection of eligible routes with matching specificity and distance.

D:

Test remote failures rather than only unplugging local cables reduces recurrence of static route failover link monitoring, rather than the observed static route priority tie-breaker issue. The relevant preventive control for Lakeview Media Group is: Audit priority after copying route objects. This distinction matters because priority influences selection of eligible routes with matching specificity and distance.

Question 905

At Lakeview Research Institute, the FortiGate 7.6 security administration team encounters the following authorized operational case: a summarized partner route disappears and packets for an internal private network unexpectedly follow the internet default route. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the most appropriate first configuration correction for this case?

  1. Use representative reachable SLA server targets beyond the local gateway with appropriate redundancy
  2. Use path-level SD-WAN performance SLA probes for the required destination category
  3. Add an appropriate more-specific blackhole route when no safe backup path exists
  4. Correct the relevant static routes and reciprocal paths to preserve intended session symmetry

Explanation

Correct Answer

C:

Add an appropriate more-specific blackhole route when no safe backup path exists. This targets static blackhole route defense: a protective blackhole route prevents a private prefix from falling through to a less-specific default route. After applying the change, verify that a test toward the disconnected private prefix is dropped rather than sent to WAN. The Lakeview Research Institute case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Use representative reachable SLA server targets beyond the local gateway with appropriate redundancy is a relevant remedy for a DIFFERENT problem—health-check probe target choice—when fortiGate declares a circuit healthy because it probes only its local ISP gateway while overseas applications are unreachable. In this Lakeview Research Institute case that is not the failing component. Here the correct intervention is to add an appropriate more-specific blackhole route when no safe backup path exists because a protective blackhole route prevents a private prefix from falling through to a less-specific default route.

B:

Use path-level SD-WAN performance SLA probes for the required destination category is a relevant remedy for a DIFFERENT problem—sd-wan local-link versus full-path health—when interface monitoring marks the active broadband link up while its carrier loses DNS and application reachability upstream. In this Lakeview Research Institute case that is not the failing component. Here the correct intervention is to add an appropriate more-specific blackhole route when no safe backup path exists because a protective blackhole route prevents a private prefix from falling through to a less-specific default route.

D:

Correct the relevant static routes and reciprocal paths to preserve intended session symmetry is a relevant remedy for a DIFFERENT problem—asymmetric return route—when a remote branch reaches an internal service but replies exit a different FortiGate WAN and are rejected by stateful security. In this Lakeview Research Institute case that is not the failing component. Here the correct intervention is to add an appropriate more-specific blackhole route when no safe backup path exists because a protective blackhole route prevents a private prefix from falling through to a less-specific default route.

Question 906

At Lakeview Research Institute, the FortiGate 7.6 security administration team encounters the following authorized operational case: a summarized partner route disappears and packets for an internal private network unexpectedly follow the internet default route. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which diagnosis best distinguishes this case from other FortiOS problems?

  1. A gateway-only probe can stay green during upstream outages beyond the access router
  2. A protective blackhole route prevents a private prefix from falling through to a less-specific default route
  3. Physical carrier does not establish usable application reachability beyond the provider edge
  4. Stateful forwarding expects return packets to traverse the same usable security session path

Explanation

Correct Answer

B:

A protective blackhole route prevents a private prefix from falling through to a less-specific default route. The mechanism is relevant because the stated static blackhole route defense incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to add an appropriate more-specific blackhole route when no safe backup path exists; verify it through this observed condition: a test toward the disconnected private prefix is dropped rather than sent to WAN.

Incorrect Answers

A:

A gateway-only probe can stay green during upstream outages beyond the access router explains a different situation, health-check probe target choice, where fortiGate declares a circuit healthy because it probes only its local ISP gateway while overseas applications are unreachable. It does not account for the specific observed static blackhole route defense condition at Lakeview Research Institute. The decisive mechanism here is: A protective blackhole route prevents a private prefix from falling through to a less-specific default route.

C:

Physical carrier does not establish usable application reachability beyond the provider edge explains a different situation, sd-wan local-link versus full-path health, where interface monitoring marks the active broadband link up while its carrier loses DNS and application reachability upstream. It does not account for the specific observed static blackhole route defense condition at Lakeview Research Institute. The decisive mechanism here is: A protective blackhole route prevents a private prefix from falling through to a less-specific default route.

D:

Stateful forwarding expects return packets to traverse the same usable security session path explains a different situation, asymmetric return route, where a remote branch reaches an internal service but replies exit a different FortiGate WAN and are rejected by stateful security. It does not account for the specific observed static blackhole route defense condition at Lakeview Research Institute. The decisive mechanism here is: A protective blackhole route prevents a private prefix from falling through to a less-specific default route.

Question 907

At Lakeview Research Institute, the FortiGate 7.6 security administration team encounters the following authorized operational case: a summarized partner route disappears and packets for an internal private network unexpectedly follow the internet default route. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which controlled test outcome best proves that the required feature now works?

  1. A simulated upstream failure changes SLA status and steering according to design
  2. An approved upstream outage marks the link ineligible for affected services
  3. A bidirectional packet trace follows the expected ingress and return interfaces
  4. A test toward the disconnected private prefix is dropped rather than sent to WAN

Explanation

Correct Answer

D:

A test toward the disconnected private prefix is dropped rather than sent to WAN. This directly tests the corrective decision to add an appropriate more-specific blackhole route when no safe backup path exists. It is a meaningful acceptance check because a protective blackhole route prevents a private prefix from falling through to a less-specific default route. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

A simulated upstream failure changes SLA status and steering according to design would validate the separate control health-check probe target choice, not the fault reported for Lakeview Research Institute. To confirm this correction, the team instead needs: A test toward the disconnected private prefix is dropped rather than sent to WAN. That is the observable check related to static blackhole route defense.

B:

An approved upstream outage marks the link ineligible for affected services would validate the separate control sd-wan local-link versus full-path health, not the fault reported for Lakeview Research Institute. To confirm this correction, the team instead needs: A test toward the disconnected private prefix is dropped rather than sent to WAN. That is the observable check related to static blackhole route defense.

C:

A bidirectional packet trace follows the expected ingress and return interfaces would validate the separate control asymmetric return route, not the fault reported for Lakeview Research Institute. To confirm this correction, the team instead needs: A test toward the disconnected private prefix is dropped rather than sent to WAN. That is the observable check related to static blackhole route defense.

Question 908

At Lakeview Research Institute, the FortiGate 7.6 security administration team encounters the following authorized operational case: a summarized partner route disappears and packets for an internal private network unexpectedly follow the internet default route. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What continuing control matches this firewall administration scenario?

  1. Review probe destinations with application network paths
  2. Review summary and blackhole coverage during site withdrawal
  3. Include end-to-end service probes in WAN availability metrics
  4. Check both directions when static routes change

Explanation

Correct Answer

B:

Review summary and blackhole coverage during site withdrawal. This recurring practice addresses static blackhole route defense because a protective blackhole route prevents a private prefix from falling through to a less-specific default route. It reinforces the supported change to add an appropriate more-specific blackhole route when no safe backup path exists rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Review probe destinations with application network paths reduces recurrence of health-check probe target choice, rather than the observed static blackhole route defense issue. The relevant preventive control for Lakeview Research Institute is: Review summary and blackhole coverage during site withdrawal. This distinction matters because a protective blackhole route prevents a private prefix from falling through to a less-specific default route.

C:

Include end-to-end service probes in WAN availability metrics reduces recurrence of sd-wan local-link versus full-path health, rather than the observed static blackhole route defense issue. The relevant preventive control for Lakeview Research Institute is: Review summary and blackhole coverage during site withdrawal. This distinction matters because a protective blackhole route prevents a private prefix from falling through to a less-specific default route.

D:

Check both directions when static routes change reduces recurrence of asymmetric return route, rather than the observed static blackhole route defense issue. The relevant preventive control for Lakeview Research Institute is: Review summary and blackhole coverage during site withdrawal. This distinction matters because a protective blackhole route prevents a private prefix from falling through to a less-specific default route.

Question 909

At Lakeview Regional Hospital, the FortiGate 7.6 security administration team encounters the following authorized operational case: a FortiGate interface changes subnet but administrators expect the old connected network to remain routed. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which supported FortiGate response most directly resolves the stated requirement?

  1. Update interface addressing and dependent routes and confirm active connected prefixes
  2. Add the supported WAN interface to the intended SD-WAN zone and verify its gateway settings
  3. Place the specific application-aware service rule ahead of the generic fallback as appropriate
  4. Correct the member's interface gateway and verify underlay neighbor reachability

Explanation

Correct Answer

A:

Update interface addressing and dependent routes and confirm active connected prefixes. This targets connected route and interface state: connected routes derive from operational interface addressing and state, not static labels. After applying the change, verify that the routing table contains only the intended connected subnets after change. The Lakeview Regional Hospital case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

B:

Add the supported WAN interface to the intended SD-WAN zone and verify its gateway settings is a relevant remedy for a DIFFERENT problem—sd-wan member underlay onboarding—when a new secondary ISP circuit comes online but FortiGate SD-WAN never sends traffic through it because the physical interface is not configured as a member. In this Lakeview Regional Hospital case that is not the failing component. Here the correct intervention is to update interface addressing and dependent routes and confirm active connected prefixes because connected routes derive from operational interface addressing and state, not static labels.

C:

Place the specific application-aware service rule ahead of the generic fallback as appropriate is a relevant remedy for a DIFFERENT problem—sd-wan rule first-match ordering—when generic internet SD-WAN service selection consumes traffic before a later specialized finance application rule. In this Lakeview Regional Hospital case that is not the failing component. Here the correct intervention is to update interface addressing and dependent routes and confirm active connected prefixes because connected routes derive from operational interface addressing and state, not static labels.

D:

Correct the member's interface gateway and verify underlay neighbor reachability is a relevant remedy for a DIFFERENT problem—sd-wan member gateway mismatch—when a newly added broadband member is marked unavailable because its SD-WAN gateway IP points to a former router. In this Lakeview Regional Hospital case that is not the failing component. Here the correct intervention is to update interface addressing and dependent routes and confirm active connected prefixes because connected routes derive from operational interface addressing and state, not static labels.

Question 910

At Lakeview Regional Hospital, the FortiGate 7.6 security administration team encounters the following authorized operational case: a FortiGate interface changes subnet but administrators expect the old connected network to remain routed. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What root condition most directly explains the described FortiGate symptom?

  1. An up physical interface is not automatically eligible for SD-WAN service selection
  2. SD-WAN service rule order can determine which steering rule governs a matching session
  3. Connected routes derive from operational interface addressing and state, not static labels
  4. A wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member

Explanation

Correct Answer

C:

Connected routes derive from operational interface addressing and state, not static labels. The mechanism is relevant because the stated connected route and interface state incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to update interface addressing and dependent routes and confirm active connected prefixes; verify it through this observed condition: the routing table contains only the intended connected subnets after change.

Incorrect Answers

A:

An up physical interface is not automatically eligible for SD-WAN service selection explains a different situation, sd-wan member underlay onboarding, where a new secondary ISP circuit comes online but FortiGate SD-WAN never sends traffic through it because the physical interface is not configured as a member. It does not account for the specific observed connected route and interface state condition at Lakeview Regional Hospital. The decisive mechanism here is: Connected routes derive from operational interface addressing and state, not static labels.

B:

SD-WAN service rule order can determine which steering rule governs a matching session explains a different situation, sd-wan rule first-match ordering, where generic internet SD-WAN service selection consumes traffic before a later specialized finance application rule. It does not account for the specific observed connected route and interface state condition at Lakeview Regional Hospital. The decisive mechanism here is: Connected routes derive from operational interface addressing and state, not static labels.

D:

A wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member explains a different situation, sd-wan member gateway mismatch, where a newly added broadband member is marked unavailable because its SD-WAN gateway IP points to a former router. It does not account for the specific observed connected route and interface state condition at Lakeview Regional Hospital. The decisive mechanism here is: Connected routes derive from operational interface addressing and state, not static labels.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests