View Full Fortinet FCP_FGT_AD-7.6 Exam Dumps and Practice Test Dumps

 

Question 201. Which FortiGate feature can restrict administrative access based on the source IP address?

1. Trusted hosts
   2. IP pool
   3. DNS Filter
   4. Virtual server

Answer: 1. Trusted hosts

Explanation:

Trusted hosts allow administrators to restrict management access to specific source IP addresses or networks. When trusted hosts are configured for an administrator account, FortiGate accepts management authentication only from the permitted addresses. This provides an additional security layer because possession of valid administrator credentials alone is not sufficient when the connection originates from an unauthorized location. Trusted hosts can be especially useful for limiting management access to dedicated administration networks or jump hosts. They should be configured carefully so that legitimate administrative access is not accidentally blocked. This control complements authentication, administrative profiles, and secure management protocols.

Question 202. Which FortiGate feature can identify the physical device type connecting to the network?

1. Static route
   2. Device identification
   3. IPsec phase 2
   4. Traffic shaper

Answer: 2. Device identification

Explanation:

Device identification allows FortiGate to gather information that can help determine what type of endpoint is connected to the network. The firewall can use available network characteristics and identification mechanisms to classify devices such as computers, mobile devices, printers, or other endpoints. This information can then support monitoring and policy decisions. Device identification is different from user authentication because it focuses on the endpoint rather than proving the identity of a particular user. Accurate device information can improve visibility and help administrators create more appropriate security controls for different types of network-connected equipment.

Question 203. What is the primary purpose of a firewall address group?

1. Encrypt VPN traffic
   2. Monitor CPU usage
   3. Combine multiple address objects for policy use
   4. Assign administrator privileges

Answer: 3. Combine multiple address objects for policy use

Explanation:

A firewall address group combines multiple address objects into a single logical object that can be referenced by security policies. This simplifies policy administration because administrators do not need to repeatedly add individual addresses to every applicable rule. For example, several internal application servers can be placed into one address group and then referenced as a destination in a firewall policy. Changes to group membership can also be easier to manage than modifying many separate policies. Address groups do not perform encryption or authentication; they primarily provide an organized way to represent multiple network addresses in firewall configuration.

Question 204. Which configuration helps prevent unauthorized users from accessing FortiGate management services from the Internet?

1. Restrict management access to trusted interfaces and sources
   2. Increase the DHCP lease time
   3. Disable all firewall logging
   4. Add more DNS records

Answer: 1. Restrict management access to trusted interfaces and sources

Explanation:

Management services such as HTTPS and SSH should be exposed only where administrative access is required. FortiGate allows administrators to control which interfaces provide management services and can further restrict access using trusted hosts or related controls. Limiting management exposure reduces the number of potential entry points available to unauthorized users. Strong authentication and multi-factor authentication can provide additional protection. Simply increasing DHCP lease duration or changing DNS records does not secure administrative services. A properly designed management configuration should follow least-privilege principles and permit administrative access only from approved networks, interfaces, and users.

Question 205. Which IPsec setting can allow FortiGate to authenticate a remote peer based on its configured identifier?

1. Service group
   2. Interface zone
   3. Peer ID
   4. DNS filter

Answer: 3. Peer ID

Explanation:

Peer ID provides an identity value that can be used to distinguish an IPsec peer during VPN negotiation. This is particularly useful in dial-up or dynamic peer scenarios where the remote peer’s IP address may not provide a reliable method of identification. FortiGate can use the peer identity as part of the phase 1 matching and authentication process. Correct configuration ensures that the connecting device matches the intended VPN settings. Peer ID should not be confused with an IP address, because the identity is an authentication or matching attribute rather than simply a network location.

Question 206. Which IPv6 feature allows a host to automatically configure an address using information advertised by a router?

1. Static NAT
   2. SLAAC
   3. DHCP relay
   4. VIP

Answer: 2. SLAAC

Explanation:

Stateless Address Autoconfiguration, or SLAAC, allows IPv6 hosts to automatically configure their addresses using information provided through Router Advertisements. The router communicates network-prefix information, enabling hosts to construct IPv6 addresses without requiring a traditional stateful DHCP service for address assignment. SLAAC is an important part of IPv6 network configuration and works with Neighbor Discovery mechanisms. Administrators should ensure that required IPv6 control traffic is permitted and that router advertisements are properly configured. Depending on the environment, DHCPv6 can also provide additional configuration information. SLAAC therefore provides a flexible method for automatically configuring IPv6 hosts.

Question 207. What is the purpose of a DNS filter category rating in FortiGate?

1. Determine the security category associated with a domain
   2. Assign an IPsec tunnel address
   3. Configure administrator profiles
   4. Create VLAN interfaces

Answer: 1. Determine the security category associated with a domain

Explanation:

DNS filtering can use domain-category information to determine whether a requested domain belongs to a category that should be permitted, monitored, or blocked. Category-based filtering allows administrators to apply broad controls without manually entering every individual website address. When a client requests a domain, FortiGate can evaluate the domain against configured filtering rules and category information before allowing or denying resolution according to policy. This can simplify web-access management for organizations. DNS filtering operates at the domain-resolution level and therefore differs from deeper inspection methods that analyze web content or encrypted application traffic.

Question 208. Which DLP action can prevent a detected sensitive file or data pattern from being transmitted?

1. Allow
   2. Block
   3. Monitor route
   4. Establish VPN

Answer: 2. Block

Explanation:

A DLP block action prevents traffic or content matching a configured sensitive-data condition from being transmitted when the relevant inspection and policy conditions are satisfied. This provides an enforcement mechanism for protecting confidential information from unauthorized transfer. DLP policies can be designed around specific data patterns, file characteristics, or other criteria depending on the deployment. Administrators should test DLP rules carefully because overly broad patterns can generate false positives and disrupt legitimate business activity. Logging and monitoring can help verify that the configured rule identifies the intended information before stronger enforcement actions are applied.

Question 209. What does a per-IP traffic shaper primarily control?

1. Certificate validation
   2. Routing protocol updates
   3. Bandwidth allocated to individual IP addresses
   4. DNS record creation

Answer: 3. Bandwidth allocated to individual IP addresses

Explanation:

A per-IP traffic shaper controls bandwidth independently for individual IP addresses. This can help distribute network capacity more fairly when many clients share an Internet connection. Instead of applying one combined limit to all traffic, the configured rate can be enforced separately for each identified IP address. This is useful in environments where administrators want to prevent a single endpoint from consuming an excessive amount of available bandwidth. Traffic shaping does not determine certificate trust, routing relationships, or DNS records. Its primary function is controlling network traffic rates according to the configured shaping policy.

Question 210. Which FortiGate component provides detailed visibility into applications, users, destinations, and traffic activity?

1. FortiView
   2. DHCP server
   3. Certificate store
   4. IPsec peer ID

Answer: 1. FortiView

Explanation:

FortiView provides graphical visibility into network and security activity. Administrators can use it to examine information such as applications, users, destinations, traffic volume, and other session-related details, depending on the available logs and configuration. This makes FortiView useful for operational monitoring and investigation. Instead of examining every individual firewall rule manually, an administrator can use FortiView to identify traffic patterns and then investigate areas of interest. FortiView is primarily a visibility and analysis capability; policy enforcement remains the responsibility of firewall policies and associated security profiles.

Question 211. Which feature can protect an administrator account by requiring a certificate in addition to other authentication information?

1. Certificate-based authentication
   2. ECMP
   3. DHCP relay
   4. IP pool

Answer: 1. Certificate-based authentication

Explanation:

Certificate-based authentication uses a digital certificate as an identity credential. When configured for an appropriate authentication scenario, FortiGate can validate the certificate against a trusted certificate authority and use it as part of the authentication process. This can provide stronger identity verification than relying solely on a password. Administrators must maintain the certificate infrastructure carefully, including trusted CA certificates and certificate validity. Certificate-based authentication is particularly useful where organizations already operate a public key infrastructure. It is separate from routing, DHCP, and NAT functions, which have different purposes within the FortiGate configuration.

Question 212. What is the main benefit of using a security profile group in a firewall policy?

1. It replaces the routing table
   2. It groups multiple security profiles for easier policy assignment
   3. It assigns public IP addresses
   4. It creates VPN tunnels automatically

Answer: 2. It groups multiple security profiles for easier policy assignment

Explanation:

A security profile group allows several security profiles to be associated and applied together through a firewall policy. Instead of selecting each individual security profile separately whenever similar protection is required, administrators can use the group as a convenient policy-level configuration. Depending on the profiles included, the group can provide protections such as antivirus, web filtering, application control, or intrusion prevention. This improves consistency and simplifies administration across policies that require the same security controls. Security profile groups do not replace routing, NAT, or VPN configuration; they organize security inspection settings for policy enforcement.

Question 213. Which method can help identify whether a firewall policy is matching the intended source and destination addresses?

1. Policy lookup or matching diagnostics
   2. DHCP lease renewal
   3. Certificate renewal
   4. DNS zone transfer

Answer: 1. Policy lookup or matching diagnostics

Explanation:

Policy lookup and matching diagnostics help administrators determine which firewall policy would apply to specific traffic. When traffic is unexpectedly allowed or denied, checking the source interface, destination interface, source address, destination address, service, schedule, and other policy criteria can reveal why a particular rule was selected. This is useful because FortiGate evaluates policies according to their configured matching conditions and order. A policy lookup can reduce troubleshooting time by showing whether the intended rule actually matches the traffic. DHCP, certificate, and DNS operations do not directly determine firewall policy selection.

Question 214. Which FortiGate feature can automatically send an alert when a predefined security event occurs?

1. Static route
   2. Automation stitch
   3. VLAN interface
   4. IP pool

Answer: 2. Automation stitch

Explanation:

An automation stitch can connect a defined event trigger with one or more automated actions. When the configured event occurs, FortiGate can execute actions such as sending notifications or performing another supported response. This allows administrators to reduce manual intervention for recurring operational or security events. The trigger determines when the workflow starts, while the configured action determines what FortiGate does in response. Automation stitches should be tested carefully because an incorrectly configured trigger can generate excessive notifications or unwanted responses. They provide an event-driven mechanism for extending FortiGate’s built-in operational automation capabilities.

Question 215. Which virtual server load-balancing method generally distributes new connections sequentially among available servers?

1. Source-IP-only
   2. Certificate matching
   3. Round robin
   4. DNS forwarding

Answer: 3. Round robin

Explanation:

Round-robin load balancing distributes new connections sequentially across available backend servers. If several real servers are available, requests are typically sent to each server in turn before the sequence starts again. This method is straightforward and works well when backend servers have relatively similar capabilities and workloads. It does not necessarily measure the current number of active sessions or resource consumption on each server. Other load-balancing algorithms can use different criteria. Administrators should select the method based on application requirements, server capacity, expected traffic patterns, and whether session persistence is required.

Question 216. What is the purpose of a FortiGate administrator password expiration setting?

1. Automatically changes routing protocols
   2. Forces administrator credentials to be changed after a defined period
   3. Deletes firewall policies
   4. Disables antivirus inspection

Answer: 2. Forces administrator credentials to be changed after a defined period

Explanation:

An administrator password expiration setting can require local administrative credentials to be changed after a configured period. Regular credential rotation can reduce the long-term usefulness of a compromised or exposed password. Password expiration should be combined with strong password requirements and, where appropriate, multi-factor authentication and trusted-host restrictions. Administrators should also maintain secure procedures for recovering or changing credentials so that legitimate management access is not interrupted. The setting applies to administrative authentication and does not alter routing, firewall policy configuration, or antivirus inspection behavior.

Question 217. Which configuration is most appropriate for allowing only HTTPS management access on a specific FortiGate interface?

1. Enable HTTPS administrative access on that interface and disable unnecessary services
   2. Enable every management protocol
   3. Disable the interface completely
   4. Create a DNS filter

Answer: 1. Enable HTTPS administrative access on that interface and disable unnecessary services

Explanation:

FortiGate interfaces can be configured with specific administrative access services. If HTTPS is the required management protocol, administrators can enable HTTPS on the intended interface while disabling unnecessary services such as HTTP or other management protocols. Limiting available management services reduces the exposed attack surface. Additional restrictions, such as trusted hosts and strong authentication, can further protect the management plane. The goal is to provide only the administrative access that is actually required. A DNS filter or disabling the entire interface would not provide the same targeted management configuration.

Question 218. What is the purpose of a firewall policy comment?

1. Encrypt traffic
   2. Store descriptive administrative information about the policy
   3. Assign an IP address
   4. Create a routing neighbor

Answer: 2. Store descriptive administrative information about the policy

Explanation:

A firewall policy comment provides descriptive information that can help administrators understand the purpose or operational context of a policy. Comments can document items such as the business purpose, application owner, change reference, or reason the rule exists. Good documentation is particularly useful in environments containing many firewall policies because it makes future administration and troubleshooting easier. A comment does not change how traffic is encrypted, routed, or addressed. It is primarily an administrative documentation feature. Maintaining clear comments can also help during configuration reviews and security audits.

Question 219. Which FortiGate feature can identify and display active sessions associated with network traffic?

1. Session table
   2. DNS category rating
   3. Password policy
   4. Certificate authority

Answer: 1. Session table

Explanation:

The FortiGate session table contains information about active network sessions handled by the firewall. Administrators can use session information during troubleshooting to determine whether traffic is currently being established and how sessions are represented by the firewall. Depending on the available details, session information can include source and destination addresses, ports, interfaces, protocols, and other connection attributes. This is particularly useful when investigating unexpected connectivity or confirming whether traffic is reaching the firewall. The session table is different from FortiView, which provides a broader graphical and analytical presentation of network activity.

Question 220. Which practice best supports secure administration of a FortiGate device?

1. Allow management access from every Internet address
   2. Use shared administrator passwords
   3. Disable authentication requirements
   4. Apply least privilege and restrict management access

Answer: 4. Apply least privilege and restrict management access

Explanation:

Secure FortiGate administration should follow least-privilege principles and restrict management access to authorized administrators and trusted networks. Administrative profiles should provide only the permissions required for each role, while trusted hosts or interface restrictions can reduce unnecessary exposure. Strong authentication, multi-factor authentication where appropriate, secure management protocols, and session controls provide additional protection. Shared administrator credentials should generally be avoided because they reduce accountability and make auditing more difficult. Combining restricted access with individual accounts and appropriate privileges creates a more controlled management environment and helps protect the firewall’s configuration and security functions.