View Full Fortinet FCP_FGT_AD-7.6 Exam Dumps and Practice Test Dumps

 

Question 321. What is the purpose of configuring a FortiGate administrator account with an appropriate access profile?

1. To define the administrator’s permitted management operations
   2. To assign DHCP addresses
   3. To configure an IPsec phase 2 selector
   4. To create a web-filter category

Answer: 1. To define the administrator’s permitted management operations

Explanation:

An administrator access profile determines which FortiGate management functions an administrator can access and what level of permissions are available. This supports the principle of least privilege by ensuring that administrators receive only the permissions required for their responsibilities. For example, one administrator may need full configuration access, while another may only need read-only access for monitoring. Access profiles can help separate operational responsibilities and reduce the risk of unauthorized configuration changes. They are different from firewall policies, which control network traffic. Properly designed administrator profiles are an important part of securing administrative access to FortiGate devices.

Question 322. Which FortiGate feature can identify applications based on traffic characteristics rather than relying only on destination ports?

1. DHCP server
   2. Application Control
   3. Static route
   4. NTP

Answer: 2. Application Control

Explanation:

Application Control is designed to identify and manage applications detected in network traffic. Traditional firewall rules may rely heavily on IP addresses and service ports, but modern applications can use common ports such as TCP 443, making port-based identification alone insufficient. Application Control uses application signatures and traffic characteristics to identify supported applications. Administrators can then define actions such as monitoring, allowing, or blocking selected applications according to organizational requirements. This capability works as part of FortiGate’s security inspection framework and can be associated with firewall policies. Application Control therefore provides more application-aware traffic management than simple port matching.

Question 323. What is the main purpose of a firewall policy schedule on FortiGate?

1. Synchronize firewall configurations between HA members
   2. Define when a policy is active
   3. Assign DNS records
   4. Monitor CPU temperature

Answer: 2. Define when a policy is active

Explanation:

A firewall policy schedule determines the time period during which a policy can process matching traffic. Administrators can use schedules when access should be available only during specific periods, such as business hours, maintenance windows, or temporary access periods. A schedule can help enforce time-based security requirements without repeatedly modifying the policy itself. When the configured schedule is inactive, the policy does not process traffic as it normally would during its active period. Schedules are therefore useful for controlling when a rule applies. They should be considered together with policy order and other matching criteria when troubleshooting time-dependent traffic behavior.

Question 324. Which configuration is commonly used to provide a fixed one-to-one mapping between an internal host and a public IP address?

1. Per-IP traffic shaper
   2. DNS filter
   3. Static NAT or a suitable VIP configuration
   4. OSPF passive interface

Answer: 3. Static NAT or a suitable VIP configuration

Explanation:

A one-to-one NAT arrangement maps an internal private address to a corresponding public address. This type of mapping can be useful when an internal server needs consistent external reachability or when a specific public address must represent a particular internal host. On FortiGate, suitable VIP or static NAT configuration can provide the required address translation depending on the traffic direction and design. The exact configuration depends on whether the requirement is inbound destination NAT, outbound source NAT, or a bidirectional mapping. Administrators should also consider firewall policies because address translation alone does not automatically permit traffic through the firewall.

Question 325. What does the FortiGate session table provide to an administrator?

1. A list of active network sessions and associated connection information
   2. A list of FortiGuard licenses
   3. A database of administrator passwords
   4. A list of DHCP reservations only

Answer: 1. A list of active network sessions and associated connection information

Explanation:

The FortiGate session table contains information about active traffic sessions being processed by the firewall. Depending on the displayed information, administrators can examine details such as source and destination addresses, ports, interfaces, protocols, policy references, and session state. This makes the session table useful during troubleshooting because it can show how active traffic is currently being handled. For example, an administrator can investigate whether a connection exists, which policy is associated with it, or whether traffic is using the expected interface. Session information changes dynamically as connections are created and terminated, so it represents current traffic state rather than historical logs.

Question 326. Which feature can help prevent unauthorized users from repeatedly attempting administrator authentication?

1. IP pool
   2. Authentication lockout controls
   3. Static routing
   4. Web Filter

Answer: 2. Authentication lockout controls

Explanation:

Authentication lockout controls can limit repeated unsuccessful administrator login attempts. When configured appropriately, repeated failed authentication attempts can trigger a temporary lockout or other protective behavior. This reduces the usefulness of automated password-guessing attempts against administrative accounts. Lockout settings should be balanced carefully so that legitimate administrators are not unnecessarily prevented from accessing the device. Strong passwords, multifactor authentication, trusted hosts, and restricted management interfaces provide additional layers of protection. Authentication lockout is therefore one component of administrative security rather than a replacement for broader access-control practices. Administrators should review authentication events to identify suspicious repeated login failures.

Question 327. What is the purpose of a FortiGate address object?

1. Define a reusable representation of an IP address or network
   2. Configure an administrator password
   3. Generate an IPS signature
   4. Create a DHCP relay tunnel

Answer: 1. Define a reusable representation of an IP address or network

Explanation:

A FortiGate firewall address object represents an IP address, subnet, range, or another supported network object that can be referenced in firewall policies and other configurations. Instead of entering the same network information repeatedly, administrators can create an object with a meaningful name and reuse it. This improves configuration consistency and makes policies easier to understand and maintain. If the underlying network changes, updating the object can reduce the need to modify multiple policies individually. Address objects can also be combined into address groups when several networks need to be referenced together. They are fundamental building blocks of FortiGate firewall policy configuration.

Question 328. Which FortiGate feature can provide a warning page when a user attempts to access a website requiring an administrative acknowledgment?

1. OSPF
   2. DHCP relay
   3. Web Filter replacement or warning behavior
   4. HA heartbeat

Answer: 3. Web Filter replacement or warning behavior

Explanation:

Web Filter can be configured to handle website categories according to defined organizational rules. Depending on the selected action and supported configuration, FortiGate can display a warning or replacement page instead of simply allowing the requested content. This provides users with information about the filtering decision and, where supported, can require acknowledgment before proceeding. The behavior is different from a straightforward block because the user receives an interactive response explaining the filtering condition. Administrators can customize relevant replacement messages and configure category actions according to security requirements. Web filtering therefore provides both traffic-control functionality and user-facing responses for certain access decisions.

Question 329. What is the purpose of configuring a FortiGate IPsec tunnel monitor?

1. Track whether a VPN tunnel is operational and reachable
   2. Assign VLAN IDs to switches
   3. Modify antivirus signatures
   4. Create administrator profiles

Answer: 1. Track whether a VPN tunnel is operational and reachable

Explanation:

An IPsec tunnel monitor can help administrators determine whether a VPN connection remains operational. Monitoring provides useful information about tunnel status and can help detect connectivity problems that are not immediately obvious from the configuration alone. Depending on the VPN design, monitoring may involve checking reachability through the tunnel or evaluating tunnel state. This information can assist troubleshooting and, in some designs, support automated responses when connectivity changes. A configured IPsec tunnel does not necessarily guarantee end-to-end communication, so monitoring can provide an additional operational check. Administrators should also review routing, phase settings, logs, and remote-peer connectivity when investigating VPN problems.

Question 330. Which IPsec phase 2 setting determines which traffic selectors are protected by a tunnel?

1. Administrator profile
   2. Phase 2 selectors
   3. DHCP option
   4. Web Filter category

Answer: 2. Phase 2 selectors

Explanation:

IPsec phase 2 selectors define the traffic networks or addresses that are protected by an IPsec security association. They identify the local and remote traffic ranges that should be encrypted through the tunnel. Correct selectors are important because mismatched selectors between VPN peers can prevent the expected traffic from establishing or passing through the IPsec tunnel. Administrators should ensure that the local and remote selectors correspond to the intended network topology. Phase 1 establishes the initial secure negotiation and peer relationship, while phase 2 establishes the parameters used to protect actual data traffic. Troubleshooting therefore requires examining both phases when a VPN fails to carry expected traffic.

Question 331. What is the primary purpose of FortiGate SSL certificate inspection?

1. Assign IP addresses to clients
   2. Validate and inspect certificate information without decrypting the full application payload
   3. Replace firewall policies
   4. Configure OSPF neighbors

Answer: 2. Validate and inspect certificate information without decrypting the full application payload

Explanation:

Certificate inspection allows FortiGate to inspect information associated with an SSL/TLS connection, such as certificate details, without performing full deep inspection of the encrypted application payload. This can provide visibility into the certificate and connection characteristics while avoiding the same level of decryption required for full SSL deep inspection. Certificate inspection can be useful when security policies need basic TLS awareness but the organization does not want to decrypt all application content. Administrators should understand the difference between certificate inspection and deep inspection because their visibility and privacy implications are different. Correct certificate configuration is also important for reliable inspection.

Question 332. Which FortiGate feature can detect and control sensitive information patterns leaving the network?

1. DLP
   2. NTP
   3. Static routing
   4. DHCP reservation

Answer: 1. DLP

Explanation:

Data Loss Prevention, or DLP, is designed to identify sensitive information patterns and apply configured actions when matching content is detected. Organizations can use DLP to help control the movement of information such as confidential records, identification patterns, or other protected data. The exact detection capabilities depend on the configured data patterns and supported FortiOS features. DLP can be integrated with firewall policies and other security inspection mechanisms. Administrators should carefully define patterns and actions because overly broad rules can generate unnecessary alerts or block legitimate business traffic. DLP is therefore focused on information protection rather than basic network connectivity or routing.

Question 333. What is the purpose of configuring an external threat feed on FortiGate?

1. Provide additional threat-related indicators that FortiGate can reference in security policies
   2. Synchronize administrator passwords
   3. Configure HA heartbeat timing
   4. Create DHCP reservations

Answer: 1. Provide additional threat-related indicators that FortiGate can reference in security policies

Explanation:

An external threat feed can provide FortiGate with indicators such as IP addresses, domains, or other supported information associated with known threats. Administrators can use these externally maintained indicators as part of security policies or other supported security controls. This can supplement built-in threat intelligence and allow an organization to incorporate intelligence from an approved external source. The quality and reliability of the feed are important because inaccurate indicators can result in unnecessary blocking or other unwanted actions. External threat feeds should therefore be evaluated, maintained, and monitored. Their purpose is to provide additional intelligence that can strengthen context-aware security enforcement.

Question 334. What is the primary purpose of a FortiGate local-in policy?

1. Control traffic destined for the FortiGate itself
   2. Control traffic passing between two internal hosts only
   3. Assign addresses to DHCP clients
   4. Configure application signatures

Answer: 1. Control traffic destined for the FortiGate itself

Explanation:

Local-in policies control traffic directed to FortiGate interfaces or services on the FortiGate itself. This is different from ordinary firewall policies, which primarily control traffic passing through the firewall between network interfaces. Local-in policies can help restrict management access and other traffic destined for the FortiGate according to source, destination, service, interface, and policy action. They are useful for protecting exposed management services and reducing unnecessary access to the firewall itself. Administrators should design local-in rules carefully because overly restrictive policies can interfere with legitimate management or required services. Reviewing the intended management interfaces and allowed sources is important before applying restrictions.

Question 335. Which FortiGate feature can display graphical summaries of traffic, applications, and security activity for administrators?

1. FortiView
   2. DHCP server
   3. IPsec phase 1
   4. Static NAT

Answer: 1. FortiView

Explanation:

FortiView provides an interactive visibility interface for examining traffic, applications, users, security events, and other operational information available from the FortiGate. It can help administrators identify traffic patterns and investigate activity without manually examining every individual log entry. Depending on the selected view, administrators can drill into details such as sources, destinations, applications, bandwidth, or security events. FortiView is primarily a monitoring and analysis capability rather than a mechanism for defining firewall rules. It can nevertheless support troubleshooting because administrators can use the displayed information to identify unusual activity or determine how network resources are being used.

Question 336. What is the purpose of configuring an administrator’s trusted hosts?

1. Restrict where that administrator account can authenticate from
   2. Configure the FortiGate default route
   3. Create a virtual IP mapping
   4. Assign an antivirus signature

Answer: 1. Restrict where that administrator account can authenticate from

Explanation:

Trusted hosts restrict administrator authentication to specified source IP addresses or networks. This provides an additional security boundary around management access because a valid username and password alone are not sufficient if the connection originates outside the configured trusted locations. Trusted hosts are especially useful when administrative access should be limited to dedicated management networks or known administrator workstations. They should be combined with strong authentication, appropriate administrator profiles, and secure management protocols. Administrators should keep trusted-host definitions accurate because legitimate access can be blocked if a required management network is omitted. This feature focuses specifically on limiting the source locations of administrative access.

Question 337. What does FortiGate conserve mode generally indicate?

1. The firewall has entered a resource-conservation state because memory usage is high
   2. All firewall policies have been deleted
   3. The device has switched to IPv6-only operation
   4. The FortiGate has disabled routing permanently

Answer: 1. The firewall has entered a resource-conservation state because memory usage is high

Explanation:

Conserve mode is associated with high memory utilization on FortiGate. When available memory becomes critically limited, FortiGate can take measures intended to protect system stability and reduce additional resource consumption. Administrators should treat conserve mode as an indication that system resources require investigation. Useful troubleshooting steps include reviewing memory usage, identifying resource-intensive processes, examining session counts, and checking system logs. The specific behavior can depend on FortiOS and system conditions. Conserve mode does not mean that routing or all firewall functionality has permanently been disabled. Instead, it represents a protective state associated with resource pressure.

Question 338. Which FortiGate feature can automatically execute actions when a defined system event or condition occurs?

1. Automation Stitch
   2. DHCP reservation
   3. Static route
   4. Address group

Answer: 1. Automation Stitch

Explanation:

An Automation Stitch allows FortiGate to connect an event or trigger with one or more automated actions. This can reduce the need for administrators to manually respond to certain recurring operational or security events. Depending on the available triggers and actions, an automation workflow can respond to events such as system conditions, security detections, or other supported FortiOS events. Automation stitches should be designed carefully because an incorrectly configured automated action may produce unintended changes or notifications. Testing and monitoring are important before using automation in production. The feature is particularly useful when organizations want consistent responses to predictable events.

Question 339. What is the purpose of enabling administrative access only over HTTPS rather than HTTP?

1. Encrypt administrator credentials and management traffic in transit
   2. Increase DHCP lease duration
   3. Improve OSPF convergence
   4. Create a source NAT pool

Answer: 1. Encrypt administrator credentials and management traffic in transit

Explanation:

HTTPS protects web-based FortiGate administrative communication by encrypting the connection between the administrator’s browser and the FortiGate. This helps protect credentials, configuration information, and other management data from being exposed to someone monitoring the network path. HTTP does not provide the same transport encryption and can expose sensitive information. Administrators should also use valid certificates where appropriate, restrict management access to trusted networks, and apply strong authentication. HTTPS is therefore an important component of secure web administration, but it should be combined with other controls rather than treated as the only protection for the management interface.

Question 340. What is the main benefit of using configuration revision history on FortiGate?

1. Automatically increase interface bandwidth
   2. Track and compare previous configuration states
   3. Replace antivirus scanning
   4. Assign application signatures

Answer: 2. Track and compare previous configuration states

Explanation:

Configuration revision history provides administrators with a way to track previous configuration states and review changes over time. This can be valuable when troubleshooting a problem that appeared after a configuration modification. By comparing revisions, administrators can identify what changed and determine whether a particular modification may be related to the observed behavior. Revision management can also support controlled rollback procedures where supported by the configuration workflow. It should not be confused with traffic logs, which record network activity rather than configuration changes. Maintaining useful configuration revisions improves administrative visibility and can make recovery from unintended configuration changes more manageable.