McAfee Secure

Exam Code: FCP_FGT_AD-7.6

Exam Name: FCP - FortiGate 7.6 Administrator

Certification Provider: Fortinet

Corresponding Certification: NSE4

Questions & Answers

Fortinet FCP_FGT_AD-7.6 Questions & Answers

Study with Up-To-Date REAL Exam Questions and Answers from the ACTUAL Test

Questions & Answers

128 Questions & Answers with Testing Engine

"FCP - FortiGate 7.6 Administrator Exam", also known as FCP_FGT_AD-7.6 exam, is a Fortinet certification exam.

Pass your tests with the always up-to-date FCP_FGT_AD-7.6 Exam Engine. Your FCP_FGT_AD-7.6 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Fortinet FCP_FGT_AD-7.6 Practice Test 93

Question 920

At Lakeview Transport Authority, the FortiGate 7.6 security administration team encounters the following authorized operational case: a static route points to a remote next hop that itself is unresolved after an upstream routing change. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which recurring review is most relevant to the same root risk?

  1. Tune SLA thresholds against measured voice quality
  2. Measure member utilization and tune spillover thresholds
  3. Monitor recursive next-hop reachability when underlay topology changes
  4. Review steering and security policy together during service launches

Explanation

Correct Answer

C:

Monitor recursive next-hop reachability when underlay topology changes. This recurring practice addresses recursive static routing because recursive route resolution needs an independent path to the configured gateway. It reinforces the supported change to ensure the next hop is reachable through a valid supported recursive route and egress interface rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Tune SLA thresholds against measured voice quality reduces recurrence of sla packet loss threshold, rather than the observed recursive static routing issue. The relevant preventive control for Lakeview Transport Authority is: Monitor recursive next-hop reachability when underlay topology changes. This distinction matters because recursive route resolution needs an independent path to the configured gateway.

B:

Measure member utilization and tune spillover thresholds reduces recurrence of spillover on link utilization, rather than the observed recursive static routing issue. The relevant preventive control for Lakeview Transport Authority is: Monitor recursive next-hop reachability when underlay topology changes. This distinction matters because recursive route resolution needs an independent path to the configured gateway.

D:

Review steering and security policy together during service launches reduces recurrence of sd-wan policy and firewall permit, rather than the observed recursive static routing issue. The relevant preventive control for Lakeview Transport Authority is: Monitor recursive next-hop reachability when underlay topology changes. This distinction matters because recursive route resolution needs an independent path to the configured gateway.

Question 921

At Lakeview Municipal Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: firewall traffic stops at a static blackhole rule added as a temporary workaround and later forgotten. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which FortiOS 7.6 administration action best addresses this incident?

  1. Locate the selected blackhole route in the routing table and remove it only after restoring the approved path
  2. Add a relevant latency SLA target and suitable service rule for the affected traffic
  3. Select suitable supported bandwidth-aware SD-WAN load-balancing weights
  4. Include throughput and utilization capacity monitoring when tuning SD-WAN steering

Explanation

Correct Answer

A:

Locate the selected blackhole route in the routing table and remove it only after restoring the approved path. This targets static route blackhole diagnosis: a blackhole route intentionally discards matching packets even when an apparently usable default exists. After applying the change, verify that a corrected route forwards the intended private flow while protected prefixes remain contained. The Lakeview Municipal Services case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

B:

Add a relevant latency SLA target and suitable service rule for the affected traffic is a relevant remedy for a DIFFERENT problem—sla latency limit—when remote desktop sessions suffer delay when the lowest-cost WAN meets connectivity but exceeds the allowed round-trip latency. In this Lakeview Municipal Services case that is not the failing component. Here the correct intervention is to locate the selected blackhole route in the routing table and remove it only after restoring the approved path because a blackhole route intentionally discards matching packets even when an apparently usable default exists.

C:

Select suitable supported bandwidth-aware SD-WAN load-balancing weights is a relevant remedy for a DIFFERENT problem—bandwidth-based load distribution—when two ISP links have very different capacities but an equal distribution policy sends too much traffic to the smaller link. In this Lakeview Municipal Services case that is not the failing component. Here the correct intervention is to locate the selected blackhole route in the routing table and remove it only after restoring the approved path because a blackhole route intentionally discards matching packets even when an apparently usable default exists.

D:

Include throughput and utilization capacity monitoring when tuning SD-WAN steering is a relevant remedy for a DIFFERENT problem—sd-wan carrier capacity headroom—when one WAN link reaches sustained near-maximum bandwidth but the monitoring plan tracks only loss and latency. In this Lakeview Municipal Services case that is not the failing component. Here the correct intervention is to locate the selected blackhole route in the routing table and remove it only after restoring the approved path because a blackhole route intentionally discards matching packets even when an apparently usable default exists.

Question 922

At Lakeview Municipal Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: firewall traffic stops at a static blackhole rule added as a temporary workaround and later forgotten. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the primary mechanism responsible for the reported result?

  1. Basic link status alone cannot distinguish a high-latency but reachable WAN
  2. Equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets
  3. A link can approach congestion before existing SLA probes show a definitive outage
  4. A blackhole route intentionally discards matching packets even when an apparently usable default exists

Explanation

Correct Answer

D:

A blackhole route intentionally discards matching packets even when an apparently usable default exists. The mechanism is relevant because the stated static route blackhole diagnosis incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to locate the selected blackhole route in the routing table and remove it only after restoring the approved path; verify it through this observed condition: a corrected route forwards the intended private flow while protected prefixes remain contained.

Incorrect Answers

A:

Basic link status alone cannot distinguish a high-latency but reachable WAN explains a different situation, sla latency limit, where remote desktop sessions suffer delay when the lowest-cost WAN meets connectivity but exceeds the allowed round-trip latency. It does not account for the specific observed static route blackhole diagnosis condition at Lakeview Municipal Services. The decisive mechanism here is: A blackhole route intentionally discards matching packets even when an apparently usable default exists.

B:

Equal traffic distribution does not necessarily reflect different link bandwidth and congestion budgets explains a different situation, bandwidth-based load distribution, where two ISP links have very different capacities but an equal distribution policy sends too much traffic to the smaller link. It does not account for the specific observed static route blackhole diagnosis condition at Lakeview Municipal Services. The decisive mechanism here is: A blackhole route intentionally discards matching packets even when an apparently usable default exists.

C:

A link can approach congestion before existing SLA probes show a definitive outage explains a different situation, sd-wan carrier capacity headroom, where one WAN link reaches sustained near-maximum bandwidth but the monitoring plan tracks only loss and latency. It does not account for the specific observed static route blackhole diagnosis condition at Lakeview Municipal Services. The decisive mechanism here is: A blackhole route intentionally discards matching packets even when an apparently usable default exists.

Question 923

At Lakeview Municipal Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: firewall traffic stops at a static blackhole rule added as a temporary workaround and later forgotten. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which validation result would demonstrate that the specified incident has been resolved?

  1. A supervised delay condition causes the intended low-latency path selection
  2. The larger link carries a proportionate amount of supervised load without saturating the smaller
  3. A corrected route forwards the intended private flow while protected prefixes remain contained
  4. Peak-load tests distribute new sessions without exceeding approved provider headroom

Explanation

Correct Answer

C:

A corrected route forwards the intended private flow while protected prefixes remain contained. This directly tests the corrective decision to locate the selected blackhole route in the routing table and remove it only after restoring the approved path. It is a meaningful acceptance check because a blackhole route intentionally discards matching packets even when an apparently usable default exists. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

A supervised delay condition causes the intended low-latency path selection would validate the separate control sla latency limit, not the fault reported for Lakeview Municipal Services. To confirm this correction, the team instead needs: A corrected route forwards the intended private flow while protected prefixes remain contained. That is the observable check related to static route blackhole diagnosis.

B:

The larger link carries a proportionate amount of supervised load without saturating the smaller would validate the separate control bandwidth-based load distribution, not the fault reported for Lakeview Municipal Services. To confirm this correction, the team instead needs: A corrected route forwards the intended private flow while protected prefixes remain contained. That is the observable check related to static route blackhole diagnosis.

D:

Peak-load tests distribute new sessions without exceeding approved provider headroom would validate the separate control sd-wan carrier capacity headroom, not the fault reported for Lakeview Municipal Services. To confirm this correction, the team instead needs: A corrected route forwards the intended private flow while protected prefixes remain contained. That is the observable check related to static route blackhole diagnosis.

Question 924

At Lakeview Municipal Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: firewall traffic stops at a static blackhole rule added as a temporary workaround and later forgotten. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which operational practice would most effectively prevent this specific fault?

  1. Track SLA latency distributions across provider changes
  2. Assign expiry and change ownership to temporary routing blocks
  3. Recalibrate link weights after bandwidth contract changes
  4. Forecast traffic growth and link contract limits

Explanation

Correct Answer

B:

Assign expiry and change ownership to temporary routing blocks. This recurring practice addresses static route blackhole diagnosis because a blackhole route intentionally discards matching packets even when an apparently usable default exists. It reinforces the supported change to locate the selected blackhole route in the routing table and remove it only after restoring the approved path rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Track SLA latency distributions across provider changes reduces recurrence of sla latency limit, rather than the observed static route blackhole diagnosis issue. The relevant preventive control for Lakeview Municipal Services is: Assign expiry and change ownership to temporary routing blocks. This distinction matters because a blackhole route intentionally discards matching packets even when an apparently usable default exists.

C:

Recalibrate link weights after bandwidth contract changes reduces recurrence of bandwidth-based load distribution, rather than the observed static route blackhole diagnosis issue. The relevant preventive control for Lakeview Municipal Services is: Assign expiry and change ownership to temporary routing blocks. This distinction matters because a blackhole route intentionally discards matching packets even when an apparently usable default exists.

D:

Forecast traffic growth and link contract limits reduces recurrence of sd-wan carrier capacity headroom, rather than the observed static route blackhole diagnosis issue. The relevant preventive control for Lakeview Municipal Services is: Assign expiry and change ownership to temporary routing blocks. This distinction matters because a blackhole route intentionally discards matching packets even when an apparently usable default exists.

Question 925

At Lakeview Technology, the FortiGate 7.6 security administration team encounters the following authorized operational case: two equivalent WAN routes are installed but traffic is spread across them unexpectedly. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the most appropriate first configuration correction for this case?

  1. Define and enforce a suitable SD-WAN jitter SLA for real-time conferencing
  2. Narrow the SD-WAN service rule source to the intended corporate networks
  3. Set a supported maintenance-safe alternate member or route before draining the primary
  4. Review supported ECMP settings and choose a deliberate load-balancing or preferred-path design

Explanation

Correct Answer

D:

Review supported ECMP settings and choose a deliberate load-balancing or preferred-path design. This targets ecmp equal-cost forwarding: equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes. After applying the change, verify that a series of controlled sessions uses the documented link-selection behavior. The Lakeview Technology case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Define and enforce a suitable SD-WAN jitter SLA for real-time conferencing is a relevant remedy for a DIFFERENT problem—sla jitter for conferencing—when video meetings stutter over a WAN whose average latency is acceptable but jitter is high. In this Lakeview Technology case that is not the failing component. Here the correct intervention is to review supported ECMP settings and choose a deliberate load-balancing or preferred-path design because equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes.

B:

Narrow the SD-WAN service rule source to the intended corporate networks is a relevant remedy for a DIFFERENT problem—sd-wan source network matching—when a guest VLAN follows the corporate MPLS WAN rule because its SD-WAN source condition was configured too broadly. In this Lakeview Technology case that is not the failing component. Here the correct intervention is to review supported ECMP settings and choose a deliberate load-balancing or preferred-path design because equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes.

C:

Set a supported maintenance-safe alternate member or route before draining the primary is a relevant remedy for a DIFFERENT problem—sd-wan preferred route during maintenance—when an operator disables a WAN member for planned maintenance but the documentation says the service is pinned to that member with no fallback. In this Lakeview Technology case that is not the failing component. Here the correct intervention is to review supported ECMP settings and choose a deliberate load-balancing or preferred-path design because equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes.

Question 926

At Lakeview Technology, the FortiGate 7.6 security administration team encounters the following authorized operational case: two equivalent WAN routes are installed but traffic is spread across them unexpectedly. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which diagnosis best distinguishes this case from other FortiOS problems?

  1. Variation in packet delay can degrade interactive media even when mean latency remains low
  2. Service selection can match more than one subnet when broad source objects are used
  3. Explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable
  4. Equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes

Explanation

Correct Answer

D:

Equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes. The mechanism is relevant because the stated ecmp equal-cost forwarding incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to review supported ECMP settings and choose a deliberate load-balancing or preferred-path design; verify it through this observed condition: a series of controlled sessions uses the documented link-selection behavior.

Incorrect Answers

A:

Variation in packet delay can degrade interactive media even when mean latency remains low explains a different situation, sla jitter for conferencing, where video meetings stutter over a WAN whose average latency is acceptable but jitter is high. It does not account for the specific observed ecmp equal-cost forwarding condition at Lakeview Technology. The decisive mechanism here is: Equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes.

B:

Service selection can match more than one subnet when broad source objects are used explains a different situation, sd-wan source network matching, where a guest VLAN follows the corporate MPLS WAN rule because its SD-WAN source condition was configured too broadly. It does not account for the specific observed ecmp equal-cost forwarding condition at Lakeview Technology. The decisive mechanism here is: Equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes.

C:

Explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable explains a different situation, sd-wan preferred route during maintenance, where an operator disables a WAN member for planned maintenance but the documentation says the service is pinned to that member with no fallback. It does not account for the specific observed ecmp equal-cost forwarding condition at Lakeview Technology. The decisive mechanism here is: Equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes.

Question 927

At Lakeview Technology, the FortiGate 7.6 security administration team encounters the following authorized operational case: two equivalent WAN routes are installed but traffic is spread across them unexpectedly. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which controlled test outcome best proves that the required feature now works?

  1. A controlled jitter test moves the conferencing flow to an eligible stable member
  2. Guest flows use the authorized internet path while corporate traffic retains MPLS
  3. An authorized maintenance test continues service on the approved alternate path
  4. A series of controlled sessions uses the documented link-selection behavior

Explanation

Correct Answer

D:

A series of controlled sessions uses the documented link-selection behavior. This directly tests the corrective decision to review supported ECMP settings and choose a deliberate load-balancing or preferred-path design. It is a meaningful acceptance check because equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

A controlled jitter test moves the conferencing flow to an eligible stable member would validate the separate control sla jitter for conferencing, not the fault reported for Lakeview Technology. To confirm this correction, the team instead needs: A series of controlled sessions uses the documented link-selection behavior. That is the observable check related to ecmp equal-cost forwarding.

B:

Guest flows use the authorized internet path while corporate traffic retains MPLS would validate the separate control sd-wan source network matching, not the fault reported for Lakeview Technology. To confirm this correction, the team instead needs: A series of controlled sessions uses the documented link-selection behavior. That is the observable check related to ecmp equal-cost forwarding.

C:

An authorized maintenance test continues service on the approved alternate path would validate the separate control sd-wan preferred route during maintenance, not the fault reported for Lakeview Technology. To confirm this correction, the team instead needs: A series of controlled sessions uses the documented link-selection behavior. That is the observable check related to ecmp equal-cost forwarding.

Question 928

At Lakeview Technology, the FortiGate 7.6 security administration team encounters the following authorized operational case: two equivalent WAN routes are installed but traffic is spread across them unexpectedly. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What continuing control matches this firewall administration scenario?

  1. Record ECMP expectations when adding same-distance routes
  2. Review jitter targets and quality measurements after WAN upgrades
  3. Test representative source VLANs when refining SD-WAN rules
  4. Create WAN maintenance runbooks with rollback and SLA verification

Explanation

Correct Answer

A:

Record ECMP expectations when adding same-distance routes. This recurring practice addresses ecmp equal-cost forwarding because equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes. It reinforces the supported change to review supported ECMP settings and choose a deliberate load-balancing or preferred-path design rather than relying on an unrelated periodic audit.

Incorrect Answers

B:

Review jitter targets and quality measurements after WAN upgrades reduces recurrence of sla jitter for conferencing, rather than the observed ecmp equal-cost forwarding issue. The relevant preventive control for Lakeview Technology is: Record ECMP expectations when adding same-distance routes. This distinction matters because equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes.

C:

Test representative source VLANs when refining SD-WAN rules reduces recurrence of sd-wan source network matching, rather than the observed ecmp equal-cost forwarding issue. The relevant preventive control for Lakeview Technology is: Record ECMP expectations when adding same-distance routes. This distinction matters because equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes.

D:

Create WAN maintenance runbooks with rollback and SLA verification reduces recurrence of sd-wan preferred route during maintenance, rather than the observed ecmp equal-cost forwarding issue. The relevant preventive control for Lakeview Technology is: Record ECMP expectations when adding same-distance routes. This distinction matters because equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes.

Question 929

At Lakeview Energy Cooperative, the FortiGate 7.6 security administration team encounters the following authorized operational case: a primary route stays active when its ISP gateway responds locally but the service beyond the ISP fails. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which supported FortiGate response most directly resolves the stated requirement?

  1. Use representative reachable SLA server targets beyond the local gateway with appropriate redundancy
  2. Use suitable supported link-monitor and route withdrawal or SD-WAN health checks
  3. Use supported application or service matching with the correct security visibility prerequisites
  4. Configure routes in the correct virtual domain and use explicit inter-VDOM links if needed

Explanation

Correct Answer

B:

Use suitable supported link-monitor and route withdrawal or SD-WAN health checks. This targets static route failover link monitoring: an interface's carrier state does not prove upstream end-to-end reachability. After applying the change, verify that a controlled remote outage removes or deprioritizes the unusable path and uses the backup. The Lakeview Energy Cooperative case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Use representative reachable SLA server targets beyond the local gateway with appropriate redundancy is a relevant remedy for a DIFFERENT problem—health-check probe target choice—when fortiGate declares a circuit healthy because it probes only its local ISP gateway while overseas applications are unreachable. In this Lakeview Energy Cooperative case that is not the failing component. Here the correct intervention is to use suitable supported link-monitor and route withdrawal or SD-WAN health checks because an interface's carrier state does not prove upstream end-to-end reachability.

C:

Use supported application or service matching with the correct security visibility prerequisites is a relevant remedy for a DIFFERENT problem—application-aware steering—when critical voice sessions are routed as ordinary HTTPS because no application-aware matching is configured for the relevant SD-WAN service. In this Lakeview Energy Cooperative case that is not the failing component. Here the correct intervention is to use suitable supported link-monitor and route withdrawal or SD-WAN health checks because an interface's carrier state does not prove upstream end-to-end reachability.

D:

Configure routes in the correct virtual domain and use explicit inter-VDOM links if needed is a relevant remedy for a DIFFERENT problem—route monitoring across vdoms—when a route is added within one VDOM while the application interfaces belong to a different VDOM routing table. In this Lakeview Energy Cooperative case that is not the failing component. Here the correct intervention is to use suitable supported link-monitor and route withdrawal or SD-WAN health checks because an interface's carrier state does not prove upstream end-to-end reachability.

Question 930

At Lakeview Energy Cooperative, the FortiGate 7.6 security administration team encounters the following authorized operational case: a primary route stays active when its ISP gateway responds locally but the service beyond the ISP fails. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What root condition most directly explains the described FortiGate symptom?

  1. A gateway-only probe can stay green during upstream outages beyond the access router
  2. An interface's carrier state does not prove upstream end-to-end reachability
  3. Service-based steering cannot distinguish an application it has not correctly identified
  4. VDOMs maintain independent route contexts and do not automatically share forwarding entries

Explanation

Correct Answer

B:

An interface's carrier state does not prove upstream end-to-end reachability. The mechanism is relevant because the stated static route failover link monitoring incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to use suitable supported link-monitor and route withdrawal or SD-WAN health checks; verify it through this observed condition: a controlled remote outage removes or deprioritizes the unusable path and uses the backup.

Incorrect Answers

A:

A gateway-only probe can stay green during upstream outages beyond the access router explains a different situation, health-check probe target choice, where fortiGate declares a circuit healthy because it probes only its local ISP gateway while overseas applications are unreachable. It does not account for the specific observed static route failover link monitoring condition at Lakeview Energy Cooperative. The decisive mechanism here is: An interface's carrier state does not prove upstream end-to-end reachability.

C:

Service-based steering cannot distinguish an application it has not correctly identified explains a different situation, application-aware steering, where critical voice sessions are routed as ordinary HTTPS because no application-aware matching is configured for the relevant SD-WAN service. It does not account for the specific observed static route failover link monitoring condition at Lakeview Energy Cooperative. The decisive mechanism here is: An interface's carrier state does not prove upstream end-to-end reachability.

D:

VDOMs maintain independent route contexts and do not automatically share forwarding entries explains a different situation, route monitoring across vdoms, where a route is added within one VDOM while the application interfaces belong to a different VDOM routing table. It does not account for the specific observed static route failover link monitoring condition at Lakeview Energy Cooperative. The decisive mechanism here is: An interface's carrier state does not prove upstream end-to-end reachability.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests