McAfee Secure

Exam Code: FCP_FGT_AD-7.6

Exam Name: FCP - FortiGate 7.6 Administrator

Certification Provider: Fortinet

Corresponding Certification: NSE4

Questions & Answers

Fortinet FCP_FGT_AD-7.6 Questions & Answers

Study with Up-To-Date REAL Exam Questions and Answers from the ACTUAL Test

Questions & Answers

128 Questions & Answers with Testing Engine

"FCP - FortiGate 7.6 Administrator Exam", also known as FCP_FGT_AD-7.6 exam, is a Fortinet certification exam.

Pass your tests with the always up-to-date FCP_FGT_AD-7.6 Exam Engine. Your FCP_FGT_AD-7.6 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Fortinet FCP_FGT_AD-7.6 Practice Test 99

Question 980

At Merriton Manufacturing, the FortiGate 7.6 security administration team encounters the following authorized operational case: video meetings stutter over a WAN whose average latency is acceptable but jitter is high. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which recurring review is most relevant to the same root risk?

  1. Review route impact when renumbering FortiGate VLAN interfaces
  2. Monitor route withdrawal during interface maintenance
  3. Review jitter targets and quality measurements after WAN upgrades
  4. Revalidate application matching after protocol updates

Explanation

Correct Answer

C:

Review jitter targets and quality measurements after WAN upgrades. This recurring practice addresses sla jitter for conferencing because variation in packet delay can degrade interactive media even when mean latency remains low. It reinforces the supported change to define and enforce a suitable SD-WAN jitter SLA for real-time conferencing rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Review route impact when renumbering FortiGate VLAN interfaces reduces recurrence of connected route and interface state, rather than the observed sla jitter for conferencing issue. The relevant preventive control for Merriton Manufacturing is: Review jitter targets and quality measurements after WAN upgrades. This distinction matters because variation in packet delay can degrade interactive media even when mean latency remains low.

B:

Monitor route withdrawal during interface maintenance reduces recurrence of route table after interface failure, rather than the observed sla jitter for conferencing issue. The relevant preventive control for Merriton Manufacturing is: Review jitter targets and quality measurements after WAN upgrades. This distinction matters because variation in packet delay can degrade interactive media even when mean latency remains low.

D:

Revalidate application matching after protocol updates reduces recurrence of application-aware steering, rather than the observed sla jitter for conferencing issue. The relevant preventive control for Merriton Manufacturing is: Review jitter targets and quality measurements after WAN upgrades. This distinction matters because variation in packet delay can degrade interactive media even when mean latency remains low.

Question 981

At Merriton Media Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: FortiGate declares a circuit healthy because it probes only its local ISP gateway while overseas applications are unreachable. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which FortiOS 7.6 administration action best addresses this incident?

  1. Correct next-hop address or interface membership and validate ARP resolution
  2. Correct one device's upstream route and apply protected summaries or blackhole entries where appropriate
  3. Configure supported DSCP-aware SD-WAN service matching or related traffic policy
  4. Use representative reachable SLA server targets beyond the local gateway with appropriate redundancy

Explanation

Correct Answer

D:

Use representative reachable SLA server targets beyond the local gateway with appropriate redundancy. This targets health-check probe target choice: a gateway-only probe can stay green during upstream outages beyond the access router. After applying the change, verify that a simulated upstream failure changes SLA status and steering according to design. The Merriton Media Group case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Correct next-hop address or interface membership and validate ARP resolution is a relevant remedy for a DIFFERENT problem—next-hop arp resolution—when a valid static route remains installed but traffic fails because the upstream next-hop IP is not on the reachable VLAN. In this Merriton Media Group case that is not the failing component. Here the correct intervention is to use representative reachable SLA server targets beyond the local gateway with appropriate redundancy because a gateway-only probe can stay green during upstream outages beyond the access router.

B:

Correct one device's upstream route and apply protected summaries or blackhole entries where appropriate is a relevant remedy for a DIFFERENT problem—routing loop caused by opposing defaults—when a FortiGate and upstream router point their fallback default routes at each other and unknown destinations loop. In this Merriton Media Group case that is not the failing component. Here the correct intervention is to use representative reachable SLA server targets beyond the local gateway with appropriate redundancy because a gateway-only probe can stay green during upstream outages beyond the access router.

C:

Configure supported DSCP-aware SD-WAN service matching or related traffic policy is a relevant remedy for a DIFFERENT problem—sd-wan dscp handling—when voice packets carry the expected DSCP marking but FortiGate sends them through an unintended WAN member. In this Merriton Media Group case that is not the failing component. Here the correct intervention is to use representative reachable SLA server targets beyond the local gateway with appropriate redundancy because a gateway-only probe can stay green during upstream outages beyond the access router.

Question 982

At Merriton Media Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: FortiGate declares a circuit healthy because it probes only its local ISP gateway while overseas applications are unreachable. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the primary mechanism responsible for the reported result?

  1. A gateway-only probe can stay green during upstream outages beyond the access router
  2. A route entry does not guarantee layer-two adjacency to its gateway
  3. Mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss
  4. Packet QoS markings do not automatically change link steering absent a matching rule

Explanation

Correct Answer

A:

A gateway-only probe can stay green during upstream outages beyond the access router. The mechanism is relevant because the stated health-check probe target choice incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to use representative reachable SLA server targets beyond the local gateway with appropriate redundancy; verify it through this observed condition: a simulated upstream failure changes SLA status and steering according to design.

Incorrect Answers

B:

A route entry does not guarantee layer-two adjacency to its gateway explains a different situation, next-hop arp resolution, where a valid static route remains installed but traffic fails because the upstream next-hop IP is not on the reachable VLAN. It does not account for the specific observed health-check probe target choice condition at Merriton Media Group. The decisive mechanism here is: A gateway-only probe can stay green during upstream outages beyond the access router.

C:

Mutually recursive forwarding between default gateways can cause TTL expiration and traffic loss explains a different situation, routing loop caused by opposing defaults, where a FortiGate and upstream router point their fallback default routes at each other and unknown destinations loop. It does not account for the specific observed health-check probe target choice condition at Merriton Media Group. The decisive mechanism here is: A gateway-only probe can stay green during upstream outages beyond the access router.

D:

Packet QoS markings do not automatically change link steering absent a matching rule explains a different situation, sd-wan dscp handling, where voice packets carry the expected DSCP marking but FortiGate sends them through an unintended WAN member. It does not account for the specific observed health-check probe target choice condition at Merriton Media Group. The decisive mechanism here is: A gateway-only probe can stay green during upstream outages beyond the access router.

Question 983

At Merriton Media Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: FortiGate declares a circuit healthy because it probes only its local ISP gateway while overseas applications are unreachable. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which validation result would demonstrate that the specified incident has been resolved?

  1. FortiGate resolves the next hop and the approved destination becomes reachable
  2. A simulated upstream failure changes SLA status and steering according to design
  3. A controlled unreachable-prefix trace stops safely rather than circulating between devices
  4. A tagged test voice flow is forwarded through the planned member

Explanation

Correct Answer

B:

A simulated upstream failure changes SLA status and steering according to design. This directly tests the corrective decision to use representative reachable SLA server targets beyond the local gateway with appropriate redundancy. It is a meaningful acceptance check because a gateway-only probe can stay green during upstream outages beyond the access router. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

FortiGate resolves the next hop and the approved destination becomes reachable would validate the separate control next-hop arp resolution, not the fault reported for Merriton Media Group. To confirm this correction, the team instead needs: A simulated upstream failure changes SLA status and steering according to design. That is the observable check related to health-check probe target choice.

C:

A controlled unreachable-prefix trace stops safely rather than circulating between devices would validate the separate control routing loop caused by opposing defaults, not the fault reported for Merriton Media Group. To confirm this correction, the team instead needs: A simulated upstream failure changes SLA status and steering according to design. That is the observable check related to health-check probe target choice.

D:

A tagged test voice flow is forwarded through the planned member would validate the separate control sd-wan dscp handling, not the fault reported for Merriton Media Group. To confirm this correction, the team instead needs: A simulated upstream failure changes SLA status and steering according to design. That is the observable check related to health-check probe target choice.

Question 984

At Merriton Media Group, the FortiGate 7.6 security administration team encounters the following authorized operational case: FortiGate declares a circuit healthy because it probes only its local ISP gateway while overseas applications are unreachable. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which operational practice would most effectively prevent this specific fault?

  1. Validate gateway adjacency and VLAN tagging during routing changes
  2. Review default route responsibilities at each network boundary
  3. Review probe destinations with application network paths
  4. Verify markings and rule order across the path

Explanation

Correct Answer

C:

Review probe destinations with application network paths. This recurring practice addresses health-check probe target choice because a gateway-only probe can stay green during upstream outages beyond the access router. It reinforces the supported change to use representative reachable SLA server targets beyond the local gateway with appropriate redundancy rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Validate gateway adjacency and VLAN tagging during routing changes reduces recurrence of next-hop arp resolution, rather than the observed health-check probe target choice issue. The relevant preventive control for Merriton Media Group is: Review probe destinations with application network paths. This distinction matters because a gateway-only probe can stay green during upstream outages beyond the access router.

B:

Review default route responsibilities at each network boundary reduces recurrence of routing loop caused by opposing defaults, rather than the observed health-check probe target choice issue. The relevant preventive control for Merriton Media Group is: Review probe destinations with application network paths. This distinction matters because a gateway-only probe can stay green during upstream outages beyond the access router.

D:

Verify markings and rule order across the path reduces recurrence of sd-wan dscp handling, rather than the observed health-check probe target choice issue. The relevant preventive control for Merriton Media Group is: Review probe destinations with application network paths. This distinction matters because a gateway-only probe can stay green during upstream outages beyond the access router.

Question 985

At Merriton Research Institute, the FortiGate 7.6 security administration team encounters the following authorized operational case: generic internet SD-WAN service selection consumes traffic before a later specialized finance application rule. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What is the most appropriate first configuration correction for this case?

  1. Ensure the next hop is reachable through a valid supported recursive route and egress interface
  2. Place the specific application-aware service rule ahead of the generic fallback as appropriate
  3. Configure routes in the correct virtual domain and use explicit inter-VDOM links if needed
  4. Tune supported health-check failure and recovery thresholds for stable link selection

Explanation

Correct Answer

B:

Place the specific application-aware service rule ahead of the generic fallback as appropriate. This targets sd-wan rule first-match ordering: sD-WAN service rule order can determine which steering rule governs a matching session. After applying the change, verify that a tagged finance session uses its intended provider and other traffic follows fallback. The Merriton Research Institute case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Ensure the next hop is reachable through a valid supported recursive route and egress interface is a relevant remedy for a DIFFERENT problem—recursive static routing—when a static route points to a remote next hop that itself is unresolved after an upstream routing change. In this Merriton Research Institute case that is not the failing component. Here the correct intervention is to place the specific application-aware service rule ahead of the generic fallback as appropriate because sD-WAN service rule order can determine which steering rule governs a matching session.

C:

Configure routes in the correct virtual domain and use explicit inter-VDOM links if needed is a relevant remedy for a DIFFERENT problem—route monitoring across vdoms—when a route is added within one VDOM while the application interfaces belong to a different VDOM routing table. In this Merriton Research Institute case that is not the failing component. Here the correct intervention is to place the specific application-aware service rule ahead of the generic fallback as appropriate because sD-WAN service rule order can determine which steering rule governs a matching session.

D:

Tune supported health-check failure and recovery thresholds for stable link selection is a relevant remedy for a DIFFERENT problem—sd-wan failover recovery hysteresis—when a flapping WAN repeatedly regains preferred status and disrupts interactive connections. In this Merriton Research Institute case that is not the failing component. Here the correct intervention is to place the specific application-aware service rule ahead of the generic fallback as appropriate because sD-WAN service rule order can determine which steering rule governs a matching session.

Question 986

At Merriton Research Institute, the FortiGate 7.6 security administration team encounters the following authorized operational case: generic internet SD-WAN service selection consumes traffic before a later specialized finance application rule. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which diagnosis best distinguishes this case from other FortiOS problems?

  1. SD-WAN service rule order can determine which steering rule governs a matching session
  2. Recursive route resolution needs an independent path to the configured gateway
  3. VDOMs maintain independent route contexts and do not automatically share forwarding entries
  4. Overly sensitive probes can alternate link eligibility during transient packet loss

Explanation

Correct Answer

A:

SD-WAN service rule order can determine which steering rule governs a matching session. The mechanism is relevant because the stated sd-wan rule first-match ordering incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to place the specific application-aware service rule ahead of the generic fallback as appropriate; verify it through this observed condition: a tagged finance session uses its intended provider and other traffic follows fallback.

Incorrect Answers

B:

Recursive route resolution needs an independent path to the configured gateway explains a different situation, recursive static routing, where a static route points to a remote next hop that itself is unresolved after an upstream routing change. It does not account for the specific observed sd-wan rule first-match ordering condition at Merriton Research Institute. The decisive mechanism here is: SD-WAN service rule order can determine which steering rule governs a matching session.

C:

VDOMs maintain independent route contexts and do not automatically share forwarding entries explains a different situation, route monitoring across vdoms, where a route is added within one VDOM while the application interfaces belong to a different VDOM routing table. It does not account for the specific observed sd-wan rule first-match ordering condition at Merriton Research Institute. The decisive mechanism here is: SD-WAN service rule order can determine which steering rule governs a matching session.

D:

Overly sensitive probes can alternate link eligibility during transient packet loss explains a different situation, sd-wan failover recovery hysteresis, where a flapping WAN repeatedly regains preferred status and disrupts interactive connections. It does not account for the specific observed sd-wan rule first-match ordering condition at Merriton Research Institute. The decisive mechanism here is: SD-WAN service rule order can determine which steering rule governs a matching session.

Question 987

At Merriton Research Institute, the FortiGate 7.6 security administration team encounters the following authorized operational case: generic internet SD-WAN service selection consumes traffic before a later specialized finance application rule. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which controlled test outcome best proves that the required feature now works?

  1. The route is resolved and forwards an authorized test without a routing loop
  2. The expected route is visible in the correct VDOM and traffic follows its permitted path
  3. A simulated intermittent outage produces the intended stable hold-down and recovery
  4. A tagged finance session uses its intended provider and other traffic follows fallback

Explanation

Correct Answer

D:

A tagged finance session uses its intended provider and other traffic follows fallback. This directly tests the corrective decision to place the specific application-aware service rule ahead of the generic fallback as appropriate. It is a meaningful acceptance check because sD-WAN service rule order can determine which steering rule governs a matching session. Unrelated service availability alone would not confirm this FortiGate policy or path.

Incorrect Answers

A:

The route is resolved and forwards an authorized test without a routing loop would validate the separate control recursive static routing, not the fault reported for Merriton Research Institute. To confirm this correction, the team instead needs: A tagged finance session uses its intended provider and other traffic follows fallback. That is the observable check related to sd-wan rule first-match ordering.

B:

The expected route is visible in the correct VDOM and traffic follows its permitted path would validate the separate control route monitoring across vdoms, not the fault reported for Merriton Research Institute. To confirm this correction, the team instead needs: A tagged finance session uses its intended provider and other traffic follows fallback. That is the observable check related to sd-wan rule first-match ordering.

C:

A simulated intermittent outage produces the intended stable hold-down and recovery would validate the separate control sd-wan failover recovery hysteresis, not the fault reported for Merriton Research Institute. To confirm this correction, the team instead needs: A tagged finance session uses its intended provider and other traffic follows fallback. That is the observable check related to sd-wan rule first-match ordering.

Question 988

At Merriton Research Institute, the FortiGate 7.6 security administration team encounters the following authorized operational case: generic internet SD-WAN service selection consumes traffic before a later specialized finance application rule. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What continuing control matches this firewall administration scenario?

  1. Monitor recursive next-hop reachability when underlay topology changes
  2. Label VDOM context in all routing work instructions
  3. Review specific-to-general rule precedence during changes
  4. Monitor link flaps and adjust SLA stability thresholds

Explanation

Correct Answer

C:

Review specific-to-general rule precedence during changes. This recurring practice addresses sd-wan rule first-match ordering because sD-WAN service rule order can determine which steering rule governs a matching session. It reinforces the supported change to place the specific application-aware service rule ahead of the generic fallback as appropriate rather than relying on an unrelated periodic audit.

Incorrect Answers

A:

Monitor recursive next-hop reachability when underlay topology changes reduces recurrence of recursive static routing, rather than the observed sd-wan rule first-match ordering issue. The relevant preventive control for Merriton Research Institute is: Review specific-to-general rule precedence during changes. This distinction matters because sD-WAN service rule order can determine which steering rule governs a matching session.

B:

Label VDOM context in all routing work instructions reduces recurrence of route monitoring across vdoms, rather than the observed sd-wan rule first-match ordering issue. The relevant preventive control for Merriton Research Institute is: Review specific-to-general rule precedence during changes. This distinction matters because sD-WAN service rule order can determine which steering rule governs a matching session.

D:

Monitor link flaps and adjust SLA stability thresholds reduces recurrence of sd-wan failover recovery hysteresis, rather than the observed sd-wan rule first-match ordering issue. The relevant preventive control for Merriton Research Institute is: Review specific-to-general rule precedence during changes. This distinction matters because sD-WAN service rule order can determine which steering rule governs a matching session.

Question 989

At Merriton Regional Hospital, the FortiGate 7.6 security administration team encounters the following authorized operational case: a rule forces all finance traffic onto one provider and keeps attempting the unhealthy member during a fault. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. Which supported FortiGate response most directly resolves the stated requirement?

  1. Locate the selected blackhole route in the routing table and remove it only after restoring the approved path
  2. Organize WAN members into suitable zones and restrict service rules by intended path
  3. Configure supported SLA-aware primary and fallback member behavior
  4. Set a supported maintenance-safe alternate member or route before draining the primary

Explanation

Correct Answer

C:

Configure supported SLA-aware primary and fallback member behavior. This targets sd-wan preferred-member failover: a fixed preferred member without relevant health conditions can remain selected despite degraded service. After applying the change, verify that an authorized loss test moves new finance sessions to the approved healthy backup. The Merriton Regional Hospital case requires these specific FortiOS 7.6 conditions, not an unrelated permit or platform change.

Incorrect Answers

A:

Locate the selected blackhole route in the routing table and remove it only after restoring the approved path is a relevant remedy for a DIFFERENT problem—static route blackhole diagnosis—when firewall traffic stops at a static blackhole rule added as a temporary workaround and later forgotten. In this Merriton Regional Hospital case that is not the failing component. Here the correct intervention is to configure supported SLA-aware primary and fallback member behavior because a fixed preferred member without relevant health conditions can remain selected despite degraded service.

B:

Organize WAN members into suitable zones and restrict service rules by intended path is a relevant remedy for a DIFFERENT problem—sd-wan per-zone segmentation—when a guest internet link appears as eligible for private branch traffic because dissimilar links were placed in one broad SD-WAN selection pool. In this Merriton Regional Hospital case that is not the failing component. Here the correct intervention is to configure supported SLA-aware primary and fallback member behavior because a fixed preferred member without relevant health conditions can remain selected despite degraded service.

D:

Set a supported maintenance-safe alternate member or route before draining the primary is a relevant remedy for a DIFFERENT problem—sd-wan preferred route during maintenance—when an operator disables a WAN member for planned maintenance but the documentation says the service is pinned to that member with no fallback. In this Merriton Regional Hospital case that is not the failing component. Here the correct intervention is to configure supported SLA-aware primary and fallback member behavior because a fixed preferred member without relevant health conditions can remain selected despite degraded service.

Question 990

At Merriton Regional Hospital, the FortiGate 7.6 security administration team encounters the following authorized operational case: a rule forces all finance traffic onto one provider and keeps attempting the unhealthy member during a fault. They need a defensible FortiOS configuration, diagnosis, validation or prevention decision. What root condition most directly explains the described FortiGate symptom?

  1. A blackhole route intentionally discards matching packets even when an apparently usable default exists
  2. SD-WAN zones and service-member scope help separate connectivity roles
  3. A fixed preferred member without relevant health conditions can remain selected despite degraded service
  4. Explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable

Explanation

Correct Answer

C:

A fixed preferred member without relevant health conditions can remain selected despite degraded service. The mechanism is relevant because the stated sd-wan preferred-member failover incident concerns the actual selected path, policy, identity or inspection state. The appropriate response is to configure supported SLA-aware primary and fallback member behavior; verify it through this observed condition: an authorized loss test moves new finance sessions to the approved healthy backup.

Incorrect Answers

A:

A blackhole route intentionally discards matching packets even when an apparently usable default exists explains a different situation, static route blackhole diagnosis, where firewall traffic stops at a static blackhole rule added as a temporary workaround and later forgotten. It does not account for the specific observed sd-wan preferred-member failover condition at Merriton Regional Hospital. The decisive mechanism here is: A fixed preferred member without relevant health conditions can remain selected despite degraded service.

B:

SD-WAN zones and service-member scope help separate connectivity roles explains a different situation, sd-wan per-zone segmentation, where a guest internet link appears as eligible for private branch traffic because dissimilar links were placed in one broad SD-WAN selection pool. It does not account for the specific observed sd-wan preferred-member failover condition at Merriton Regional Hospital. The decisive mechanism here is: A fixed preferred member without relevant health conditions can remain selected despite degraded service.

D:

Explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable explains a different situation, sd-wan preferred route during maintenance, where an operator disables a WAN member for planned maintenance but the documentation says the service is pinned to that member with no fallback. It does not account for the specific observed sd-wan preferred-member failover condition at Merriton Regional Hospital. The decisive mechanism here is: A fixed preferred member without relevant health conditions can remain selected despite degraded service.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests