McAfee Secure

Exam Code: FCP_FGT_AD-7.6

Exam Name: FCP - FortiGate 7.6 Administrator

Certification Provider: Fortinet

Corresponding Certification: NSE4

Questions & Answers

Fortinet FCP_FGT_AD-7.6 Questions & Answers

Study with Up-To-Date REAL Exam Questions and Answers from the ACTUAL Test

Questions & Answers

128 Questions & Answers with Testing Engine

"FCP - FortiGate 7.6 Administrator Exam", also known as FCP_FGT_AD-7.6 exam, is a Fortinet certification exam.

Pass your tests with the always up-to-date FCP_FGT_AD-7.6 Exam Engine. Your FCP_FGT_AD-7.6 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Fortinet FCP_FGT_AD-7.6 Practice Test 96

Question 950

At Lakeview Insurance, the FortiGate 7.6 security administration team encounters the following authorized operational case: the WAN interface is administratively shut down but staff still depend on a route formerly tied to it. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What root condition most directly explains the described FortiGate symptom?

  1. Variation in packet delay can degrade interactive media even when mean latency remains low
  2. An unavailable outgoing interface can render its associated route inactive or unusable
  3. Service selection can match more than one subnet when broad source objects are used
  4. A wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member

Explanation

Correct Answer

B:

An unavailable outgoing interface can render its associated route inactive or unusable. The mechanism is relevant because the stated route table after interface failure incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to restore the approved interface or provide an alternate supported active route; verify it through this observed condition: an operational egress route appears after recovery and an authorized flow completes.

Incorrect Answers

A:

Variation in packet delay can degrade interactive media even when mean latency remains low explains a different situation, sla jitter for conferencing, where video meetings stutter over a WAN whose average latency is acceptable but jitter is high. It does not account for the specific observed route table after interface failure condition at Lakeview Insurance. The decisive mechanism here is: An unavailable outgoing interface can render its associated route inactive or unusable.

C:

Service selection can match more than one subnet when broad source objects are used explains a different situation, sd-wan source network matching, where a guest VLAN follows the corporate MPLS WAN rule because its SD-WAN source condition was configured too broadly. It does not account for the specific observed route table after interface failure condition at Lakeview Insurance. The decisive mechanism here is: An unavailable outgoing interface can render its associated route inactive or unusable.

D:

A wrong next-hop configuration can prevent SLA probes or selected flows from leaving the member explains a different situation, sd-wan member gateway mismatch, where a newly added broadband member is marked unavailable because its SD-WAN gateway IP points to a former router. It does not account for the specific observed route table after interface failure condition at Lakeview Insurance. The decisive mechanism here is: An unavailable outgoing interface can render its associated route inactive or unusable.

Question 951

At Lakeview Insurance, the FortiGate 7.6 security administration team encounters the following authorized operational case: the WAN interface is administratively shut down but staff still depend on a route formerly tied to it. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which observable result should the administrator require before closing this change?

  1. A controlled jitter test moves the conferencing flow to an eligible stable member
  2. Guest flows use the authorized internet path while corporate traffic retains MPLS
  3. The member becomes healthy and forwards a supervised flow to the intended upstream
  4. An operational egress route appears after recovery and an authorized flow completes

Explanation

Correct Answer

D:

An operational egress route appears after recovery and an authorized flow completes. This directly tests the corrective decision to restore the approved interface or provide an alternate supported active route. It is a meaningful acceptance check because an unavailable outgoing interface can render its associated route inactive or unusable. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

A controlled jitter test moves the conferencing flow to an eligible stable member would validate the separate control sla jitter for conferencing, not the fault reported for Lakeview Insurance. To confirm this correction, the team instead needs: An operational egress route appears after recovery and an authorized flow completes. That is the observable check related to route table after interface failure.

B:

Guest flows use the authorized internet path while corporate traffic retains MPLS would validate the separate control sd-wan source network matching, not the fault reported for Lakeview Insurance. To confirm this correction, the team instead needs: An operational egress route appears after recovery and an authorized flow completes. That is the observable check related to route table after interface failure.

C:

The member becomes healthy and forwards a supervised flow to the intended upstream would validate the separate control sd-wan member gateway mismatch, not the fault reported for Lakeview Insurance. To confirm this correction, the team instead needs: An operational egress route appears after recovery and an authorized flow completes. That is the observable check related to route table after interface failure.

Question 952

At Lakeview Insurance, the FortiGate 7.6 security administration team encounters the following authorized operational case: the WAN interface is administratively shut down but staff still depend on a route formerly tied to it. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which ongoing safeguard best reduces recurrence of this problem?

  1. Review jitter targets and quality measurements after WAN upgrades
  2. Test representative source VLANs when refining SD-WAN rules
  3. Monitor route withdrawal during interface maintenance
  4. Revalidate gateways after ISP equipment replacement

Explanation

Correct Answer

C:

Monitor route withdrawal during interface maintenance. This recurring practice addresses route table after interface failure because an unavailable outgoing interface can render its associated route inactive or unusable. It reinforces the supported change to restore the approved interface or provide an alternate supported active route rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Review jitter targets and quality measurements after WAN upgrades reduces recurrence of sla jitter for conferencing, rather than the observed route table after interface failure issue. The relevant preventive control for Lakeview Insurance is: Monitor route withdrawal during interface maintenance. This distinction matters because an unavailable outgoing interface can render its associated route inactive or unusable.

B:

Test representative source VLANs when refining SD-WAN rules reduces recurrence of sd-wan source network matching, rather than the observed route table after interface failure issue. The relevant preventive control for Lakeview Insurance is: Monitor route withdrawal during interface maintenance. This distinction matters because an unavailable outgoing interface can render its associated route inactive or unusable.

D:

Revalidate gateways after ISP equipment replacement reduces recurrence of sd-wan member gateway mismatch, rather than the observed route table after interface failure issue. The relevant preventive control for Lakeview Insurance is: Monitor route withdrawal during interface maintenance. This distinction matters because an unavailable outgoing interface can render its associated route inactive or unusable.

Question 953

At Lakeview Government Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: a FortiGate and upstream router point their fallback default routes at each other and unknown destinations loop. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What action should the network security administrator take for this specific fault?

  1. Use representative reachable SLA server targets beyond the local gateway with appropriate redundancy
  2. Use supported application or service matching with the correct security visibility prerequisites
  3. Review historical SD-WAN SLA latency, jitter and loss events for the affected period
  4. Correct one device's upstream route and apply protected summaries or blackhole entries where appropriate

Explanation

Correct Answer

D:

Correct one device's upstream route and apply protected summaries or blackhole entries where appropriate. This targets routing loop caused by opposing defaults: mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss. After applying the change, verify that a controlled unreachable-prefix trace stops safely rather than circulating between devices. The Lakeview Government Services case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Use representative reachable SLA server targets beyond the local gateway with appropriate redundancy is a relevant remedy for a DIFFERENT problem—health-check probe target choice—when fortiGate declares a circuit healthy because it probes only its local ISP gateway while overseas applications are unreachable. In this Lakeview Government Services case that is not the failing component. Here the correct intervention is to correct one device's upstream route and apply protected summaries or blackhole entries where appropriate because mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss.

B:

Use supported application or service matching with the correct security visibility prerequisites is a relevant remedy for a DIFFERENT problem—application-aware steering—when critical voice sessions are routed as ordinary HTTPS because no application-aware matching is configured for the relevant SD-WAN service. In this Lakeview Government Services case that is not the failing component. Here the correct intervention is to correct one device's upstream route and apply protected summaries or blackhole entries where appropriate because mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss.

C:

Review historical SD-WAN SLA latency, jitter and loss events for the affected period is a relevant remedy for a DIFFERENT problem—sd-wan diagnostic sla history—when users report intermittent slow internet but operations inspects only the current green member state. In this Lakeview Government Services case that is not the failing component. Here the correct intervention is to correct one device's upstream route and apply protected summaries or blackhole entries where appropriate because mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss.

Question 954

At Lakeview Government Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: a FortiGate and upstream router point their fallback default routes at each other and unknown destinations loop. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which interpretation of the observed failure is technically supported?

  1. A gateway-only probe can stay green during upstream outages beyond the access router
  2. Service-based steering cannot distinguish an application it has not correctly identified
  3. Mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss
  4. A present healthy status does not exclude earlier performance deterioration

Explanation

Correct Answer

C:

Mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss. The mechanism is relevant because the stated routing loop caused by opposing defaults incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to correct one device's upstream route and apply protected summaries or blackhole entries where appropriate; verify it through this observed condition: a controlled unreachable-prefix trace stops safely rather than circulating between devices.

Incorrect Answers

A:

A gateway-only probe can stay green during upstream outages beyond the access router explains a different situation, health-check probe target choice, where fortiGate declares a circuit healthy because it probes only its local ISP gateway while overseas applications are unreachable. It does not account for the specific observed routing loop caused by opposing defaults condition at Lakeview Government Services. The decisive mechanism here is: Mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss.

B:

Service-based steering cannot distinguish an application it has not correctly identified explains a different situation, application-aware steering, where critical voice sessions are routed as ordinary HTTPS because no application-aware matching is configured for the relevant SD-WAN service. It does not account for the specific observed routing loop caused by opposing defaults condition at Lakeview Government Services. The decisive mechanism here is: Mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss.

D:

A present healthy status does not exclude earlier performance deterioration explains a different situation, sd-wan diagnostic sla history, where users report intermittent slow internet but operations inspects only the current green member state. It does not account for the specific observed routing loop caused by opposing defaults condition at Lakeview Government Services. The decisive mechanism here is: Mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss.

Question 955

At Lakeview Government Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: a FortiGate and upstream router point their fallback default routes at each other and unknown destinations loop. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which supervised observation would best verify the intended correction?

  1. A simulated upstream failure changes SLA status and steering according to design
  2. A supervised voice test uses the intended SLA rule while unrelated HTTPS remains on its normal path
  3. A controlled unreachable-prefix trace stops safely rather than circulating between devices
  4. The archived SLA evidence correlates with a reproduced quality incident

Explanation

Correct Answer

C:

A controlled unreachable-prefix trace stops safely rather than circulating between devices. This directly tests the corrective decision to correct one device's upstream route and apply protected summaries or blackhole entries where appropriate. It is a meaningful acceptance check because mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

A simulated upstream failure changes SLA status and steering according to design would validate the separate control health-check probe target choice, not the fault reported for Lakeview Government Services. To confirm this correction, the team instead needs: A controlled unreachable-prefix trace stops safely rather than circulating between devices. That is the observable check related to routing loop caused by opposing defaults.

B:

A supervised voice test uses the intended SLA rule while unrelated HTTPS remains on its normal path would validate the separate control application-aware steering, not the fault reported for Lakeview Government Services. To confirm this correction, the team instead needs: A controlled unreachable-prefix trace stops safely rather than circulating between devices. That is the observable check related to routing loop caused by opposing defaults.

D:

The archived SLA evidence correlates with a reproduced quality incident would validate the separate control sd-wan diagnostic sla history, not the fault reported for Lakeview Government Services. To confirm this correction, the team instead needs: A controlled unreachable-prefix trace stops safely rather than circulating between devices. That is the observable check related to routing loop caused by opposing defaults.

Question 956

At Lakeview Government Services, the FortiGate 7.6 security administration team encounters the following authorized operational case: a FortiGate and upstream router point their fallback default routes at each other and unknown destinations loop. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What preventive control should the FortiGate operations team maintain?

  1. Review probe destinations with application network paths
  2. Revalidate application matching after protocol updates
  3. Review default route responsibilities at each network boundary
  4. Retain link-quality history for troubleshooting and ISP escalation

Explanation

Correct Answer

C:

Review default route responsibilities at each network boundary. This recurring practice addresses routing loop caused by opposing defaults because mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss. It reinforces the supported change to correct one device's upstream route and apply protected summaries or blackhole entries where appropriate rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Review probe destinations with application network paths reduces recurrence of health-check probe target choice, rather than the observed routing loop caused by opposing defaults issue. The relevant preventive control for Lakeview Government Services is: Review default route responsibilities at each network boundary. This distinction matters because mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss.

B:

Revalidate application matching after protocol updates reduces recurrence of application-aware steering, rather than the observed routing loop caused by opposing defaults issue. The relevant preventive control for Lakeview Government Services is: Review default route responsibilities at each network boundary. This distinction matters because mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss.

D:

Retain link-quality history for troubleshooting and ISP escalation reduces recurrence of sd-wan diagnostic sla history, rather than the observed routing loop caused by opposing defaults issue. The relevant preventive control for Lakeview Government Services is: Review default route responsibilities at each network boundary. This distinction matters because mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss.

Question 957

At Lakeview Aviation, the FortiGate 7.6 security administration team encounters the following authorized operational case: a route is added within one VDOM while the application interfaces belong to a different VDOM routing table. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which technically justified operational change fits the observed symptoms?

  1. Configure routes in the correct virtual domain and use explicit inter-VDOM links if needed
  2. Place the specific application-aware service rule ahead of the generic fallback as appropriate
  3. Configure supported DSCP-aware SD-WAN service matching or related traffic policy
  4. Create or adjust a matching least-privilege firewall permit policy for the selected SD-WAN zone

Explanation

Correct Answer

A:

Configure routes in the correct virtual domain and use explicit inter-VDOM links if needed. This targets route monitoring across vdoms: vDOMs maintain independent route contexts and do not automatically share forwarding entries. After applying the change, verify that the expected route is visible in the correct VDOM and traffic follows its permitted path. The Lakeview Aviation case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

B:

Place the specific application-aware service rule ahead of the generic fallback as appropriate is a relevant remedy for a DIFFERENT problem—sd-wan rule first-match ordering—when generic internet SD-WAN service selection consumes traffic before a later specialized finance application rule. In this Lakeview Aviation case that is not the failing component. Here the correct intervention is to configure routes in the correct virtual domain and use explicit inter-VDOM links if needed because vDOMs maintain independent route contexts and do not automatically share forwarding entries.

C:

Configure supported DSCP-aware SD-WAN service matching or related traffic policy is a relevant remedy for a DIFFERENT problem—sd-wan dscp handling—when voice packets carry the expected DSCP marking but FortiGate sends them through an unintended WAN member. In this Lakeview Aviation case that is not the failing component. Here the correct intervention is to configure routes in the correct virtual domain and use explicit inter-VDOM links if needed because vDOMs maintain independent route contexts and do not automatically share forwarding entries.

D:

Create or adjust a matching least-privilege firewall permit policy for the selected SD-WAN zone is a relevant remedy for a DIFFERENT problem—sd-wan policy and firewall permit—when sD-WAN selects the correct member for an approved application but sessions remain denied by an unrelated firewall policy. In this Lakeview Aviation case that is not the failing component. Here the correct intervention is to configure routes in the correct virtual domain and use explicit inter-VDOM links if needed because vDOMs maintain independent route contexts and do not automatically share forwarding entries.

Question 958

At Lakeview Aviation, the FortiGate 7.6 security administration team encounters the following authorized operational case: a route is added within one VDOM while the application interfaces belong to a different VDOM routing table. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which technical explanation best identifies the underlying FortiGate behavior?

  1. SD-WAN service rule order can determine which steering rule governs a matching session
  2. Packet QoS markings do not automatically change link steering absent a matching rule
  3. Link steering and firewall traffic authorization are separate decisions
  4. VDOMs maintain independent route contexts and do not automatically share forwarding entries

Explanation

Correct Answer

D:

VDOMs maintain independent route contexts and do not automatically share forwarding entries. The mechanism is relevant because the stated route monitoring across vdoms incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to configure routes in the correct virtual domain and use explicit inter-VDOM links if needed; verify it through this observed condition: the expected route is visible in the correct VDOM and traffic follows its permitted path.

Incorrect Answers

A:

SD-WAN service rule order can determine which steering rule governs a matching session explains a different situation, sd-wan rule first-match ordering, where generic internet SD-WAN service selection consumes traffic before a later specialized finance application rule. It does not account for the specific observed route monitoring across vdoms condition at Lakeview Aviation. The decisive mechanism here is: VDOMs maintain independent route contexts and do not automatically share forwarding entries.

B:

Packet QoS markings do not automatically change link steering absent a matching rule explains a different situation, sd-wan dscp handling, where voice packets carry the expected DSCP marking but FortiGate sends them through an unintended WAN member. It does not account for the specific observed route monitoring across vdoms condition at Lakeview Aviation. The decisive mechanism here is: VDOMs maintain independent route contexts and do not automatically share forwarding entries.

C:

Link steering and firewall traffic authorization are separate decisions explains a different situation, sd-wan policy and firewall permit, where sD-WAN selects the correct member for an approved application but sessions remain denied by an unrelated firewall policy. It does not account for the specific observed route monitoring across vdoms condition at Lakeview Aviation. The decisive mechanism here is: VDOMs maintain independent route contexts and do not automatically share forwarding entries.

Question 959

At Lakeview Aviation, the FortiGate 7.6 security administration team encounters the following authorized operational case: a route is added within one VDOM while the application interfaces belong to a different VDOM routing table. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What acceptance evidence most directly confirms the expected policy or network behavior?

  1. A tagged finance session uses its intended provider and other traffic follows fallback
  2. A tagged test voice flow is forwarded through the planned member
  3. A controlled flow matches the intended SD-WAN rule and an accepting firewall policy
  4. The expected route is visible in the correct VDOM and traffic follows its permitted path

Explanation

Correct Answer

D:

The expected route is visible in the correct VDOM and traffic follows its permitted path. This directly tests the corrective decision to configure routes in the correct virtual domain and use explicit inter-VDOM links if needed. It is a meaningful acceptance check because vDOMs maintain independent route contexts and do not automatically share forwarding entries. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

A tagged finance session uses its intended provider and other traffic follows fallback would validate the separate control sd-wan rule first-match ordering, not the fault reported for Lakeview Aviation. To confirm this correction, the team instead needs: The expected route is visible in the correct VDOM and traffic follows its permitted path. That is the observable check related to route monitoring across vdoms.

B:

A tagged test voice flow is forwarded through the planned member would validate the separate control sd-wan dscp handling, not the fault reported for Lakeview Aviation. To confirm this correction, the team instead needs: The expected route is visible in the correct VDOM and traffic follows its permitted path. That is the observable check related to route monitoring across vdoms.

C:

A controlled flow matches the intended SD-WAN rule and an accepting firewall policy would validate the separate control sd-wan policy and firewall permit, not the fault reported for Lakeview Aviation. To confirm this correction, the team instead needs: The expected route is visible in the correct VDOM and traffic follows its permitted path. That is the observable check related to route monitoring across vdoms.

Question 960

At Lakeview Aviation, the FortiGate 7.6 security administration team encounters the following authorized operational case: a route is added within one VDOM while the application interfaces belong to a different VDOM routing table. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which recurring review is most relevant to the same root risk?

  1. Label VDOM context in all routing work instructions
  2. Review specific-to-general rule precedence during changes
  3. Verify markings and rule order across the path
  4. Review steering and security policy together during service launches

Explanation

Correct Answer

A:

Label VDOM context in all routing work instructions. This recurring practice addresses route monitoring across vdoms because vDOMs maintain independent route contexts and do not automatically share forwarding entries. It reinforces the supported change to configure routes in the correct virtual domain and use explicit inter-VDOM links if needed rather than relying on an unrelated periodic audit.

Incorrect Answers

B:

Review specific-to-general rule precedence during changes reduces recurrence of sd-wan rule first-match ordering, rather than the observed route monitoring across vdoms issue. The relevant preventive control for Lakeview Aviation is: Label VDOM context in all routing work instructions. This distinction matters because vDOMs maintain independent route contexts and do not automatically share forwarding entries.

C:

Verify markings and rule order across the path reduces recurrence of sd-wan dscp handling, rather than the observed route monitoring across vdoms issue. The relevant preventive control for Lakeview Aviation is: Label VDOM context in all routing work instructions. This distinction matters because vDOMs maintain independent route contexts and do not automatically share forwarding entries.

D:

Review steering and security policy together during service launches reduces recurrence of sd-wan policy and firewall permit, rather than the observed route monitoring across vdoms issue. The relevant preventive control for Lakeview Aviation is: Label VDOM context in all routing work instructions. This distinction matters because vDOMs maintain independent route contexts and do not automatically share forwarding entries.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests