View Full Fortinet FCSS_EFW_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 361

Which FortiGate feature can identify the security policy that would handle a specific traffic flow?

1. Policy lookup
2. FortiToken
3. DHCP
4. NTP

Correct Answer: 1

Explanation

Policy lookup helps administrators determine which firewall policy matches specified traffic characteristics. It can be used to check source and destination information, interfaces, services, and other relevant policy criteria. This is particularly useful when traffic appears to be handled by an unexpected rule or when an administrator wants to verify policy behavior before making configuration changes. If the expected policy is not selected, administrators should review policy order and matching criteria. If the correct policy is selected but traffic still fails, routing and security inspection should be investigated.

Question 362

Which FortiGate feature can provide protection by inspecting files for known malware signatures?

1. IPS
2. Antivirus
3. DNS Filter
4. SD-WAN

Correct Answer: 2

Explanation

Antivirus protection examines supported traffic and files for known malicious patterns and malware. When a threat is detected, FortiGate can apply the action configured in the Antivirus profile, such as blocking or logging the file. Antivirus works as one layer within a broader security architecture and can be combined with IPS, Web Filter, Application Control, and other controls. Administrators should ensure that the relevant security profile is attached to the correct firewall policy and that FortiGuard updates are available. Logs can help identify detected malware and affected traffic.

Question 363

What is the primary purpose of a firewall policy on FortiGate?

1. To define how matching network traffic is handled
2. To synchronize system time
3. To create administrator passwords
4. To store historical logs

Correct Answer: 1

Explanation

A firewall policy defines how FortiGate handles traffic that matches specified criteria. These criteria can include incoming and outgoing interfaces, source and destination addresses, services, schedules, users, and other policy elements. The policy can permit or deny traffic and may also apply NAT and security profiles. Because policies are evaluated according to their configured order, their sequence is important. Administrators should design policies according to least-privilege requirements and regularly review them for unnecessary access, overly broad rules, and conflicting configurations.

Question 364

Which firewall action prevents traffic matching a policy from being allowed through FortiGate?

1. Accept
2. Deny
3. Monitor
4. Forward

Correct Answer: 2

Explanation

The deny action prevents traffic matching that firewall policy from being permitted through FortiGate. Administrators can use deny policies to restrict unwanted communication between networks, services, users, or destinations. The exact policy match still depends on the configured interfaces, addresses, services, schedule, and other criteria. Because policy order matters, a deny rule placed after a broader allow rule may never handle the intended traffic. Traffic logs and policy lookup can help determine whether a connection was processed by the expected policy.

Question 365

Which feature allows FortiGate to apply a firewall policy only during specified recurring periods?

1. Policy schedule
2. IP pool
3. VLAN interface
4. Application Control

Correct Answer: 1

Explanation

A policy schedule defines when a firewall policy is active. Administrators can create recurring schedules for business hours, maintenance windows, temporary access, or other time-dependent requirements. When the configured period is inactive, the associated policy does not operate as it normally would for matching traffic. Accurate system time is important because schedule decisions depend on the FortiGate clock. Administrators should also consider other policies in the rule set because traffic may match another active policy when the intended scheduled policy is unavailable.

Question 366

Which feature can combine multiple TCP or UDP services into one reusable object?

1. Address group
2. Service group
3. IP pool
4. Interface zone

Correct Answer: 2

Explanation

A service group combines multiple service objects into a single logical object that can be referenced by firewall policies. This is useful when a policy needs to permit or restrict several related services without requiring each service to be listed separately. For example, several application ports can be grouped and reused in multiple policies. Administrators should review group membership carefully because changing a service group can affect every policy that references it. Clear naming and organized service definitions help make larger FortiGate configurations easier to maintain.

Question 367

Which feature can combine several network address objects into a single reusable object?

1. Address group
2. Service object
3. Performance SLA
4. FortiToken

Correct Answer: 1

Explanation

An address group combines multiple address objects so that they can be referenced as a single destination or source in firewall policies. This simplifies policy configuration when several hosts or networks share the same access requirements. Administrators can modify group membership without having to edit every policy individually. However, because one group may be referenced by many rules, changes should be reviewed carefully before deployment. Proper address-object naming and organization make it easier to understand which networks are included and reduce the risk of accidentally granting broader access than intended.

Question 368

Which FortiGate feature can identify the device type of endpoints observed on a network?

1. Device detection
2. Traffic shaping
3. NTP
4. Policy schedule

Correct Answer: 1

Explanation

Device detection provides information about endpoints observed by FortiGate and can identify characteristics such as device type when sufficient information is available. This improves network visibility and can help administrators discover unmanaged or unexpected devices. Device detection is primarily a visibility capability and should not automatically be treated as a substitute for strong authentication. Administrators can use the detected information alongside network access controls and security policies. Reviewing detected devices regularly can help identify changes in the environment and support investigations into unusual network activity.

Question 369

Which FortiGate feature can isolate a device that is considered a security risk?

1. NAC
2. NTP
3. IP pool
4. Service object

Correct Answer: 1

Explanation

Network Access Control can be used to enforce access decisions for connected devices and, depending on the deployment, place devices into restricted or isolated states. This can help contain endpoints that are unknown, noncompliant, or considered potentially compromised. NAC works as part of a broader access-control architecture and may use device information, authentication, and integrated security systems. Administrators should define clear enforcement policies and ensure that legitimate devices are not unnecessarily isolated. Monitoring and appropriate remediation procedures should accompany NAC decisions to maintain both security and network availability.

Question 370

Which FortiGate setting controls whether administrators can connect to the device through SSH on an interface?

1. Administrative access settings
2. Traffic shaping
3. DNS Filter
4. IP pool

Correct Answer: 1

Explanation

Administrative access settings determine which management protocols can be used through a FortiGate interface. If SSH is enabled for an interface, authorized administrators can use SSH for command-line management, subject to authentication and other access controls. Management services should only be enabled where they are required, particularly on interfaces exposed to untrusted networks. Trusted hosts, administrator profiles, and local-in policies can provide additional restrictions. When SSH access fails, administrators should verify interface settings, network reachability, account permissions, and any policies controlling local traffic.

Question 371

Which security feature can inspect encrypted web traffic after the traffic is decrypted for inspection?

1. Deep inspection
2. Policy schedule
3. Address group
4. DHCP

Correct Answer: 1

Explanation

Deep inspection enables FortiGate to decrypt supported encrypted traffic and inspect its payload using configured security profiles. This allows controls such as Antivirus, IPS, Web Filter, and Application Control to examine information that would otherwise remain encrypted. Deep inspection requires appropriate certificate deployment so that clients can establish trusted connections through the inspection process. Administrators should also account for privacy requirements and applications that may not work correctly under decryption. Proper exemptions and certificate management are important when deploying deep inspection across an organization.

Question 372

Which inspection method primarily examines the certificate and connection information without fully decrypting the application payload?

1. Deep inspection
2. Certificate inspection
3. Antivirus
4. Traffic shaping

Correct Answer: 2

Explanation

Certificate inspection examines information available from an encrypted connection, such as certificate and connection details, without performing full payload decryption. It provides less visibility than deep inspection but can be useful when organizations want to apply certain controls while avoiding full TLS decryption. Because the payload remains encrypted, some security profiles cannot inspect the underlying content in the same way they can with deep inspection. Administrators should select the inspection method according to security requirements, privacy considerations, application compatibility, and the visibility needed for the protected traffic.

Question 373

Which feature can help prevent unauthorized external access to services running on the FortiGate itself?

1. Local-in policy
2. Web Filter
3. IP pool
4. Service group

Correct Answer: 1

Explanation

Local-in policies control traffic destined for the FortiGate itself and can restrict access to local services. This makes them useful for protecting management and other services that are exposed on FortiGate interfaces. Administrators can specify source addresses, incoming interfaces, services, and actions to control which connections are permitted. Local-in policies should be designed carefully because they can affect administrative access to the firewall. Testing from approved management locations and maintaining an alternative administrative path can reduce the risk of accidentally locking out authorized administrators.

Question 374

Which feature can prioritize or limit network bandwidth for selected traffic?

1. Traffic shaping
2. FortiAnalyzer
3. LDAP
4. VLAN

Correct Answer: 1

Explanation

Traffic shaping manages bandwidth allocation for selected traffic. Administrators can use it to limit bandwidth consumption by noncritical applications or provide better treatment for important services. This can help prevent a high-volume traffic class from consuming the capacity required by business-critical applications. Effective traffic shaping requires realistic bandwidth values and appropriate traffic matching criteria. Administrators should monitor network usage after implementation to confirm that the desired traffic receives appropriate bandwidth and that legitimate applications are not unintentionally restricted.

Question 375

Which FortiGate feature can use application signatures to identify traffic rather than relying only on port numbers?

1. Application Control
2. NTP
3. DHCP
4. RADIUS

Correct Answer: 1

Explanation

Application Control uses application signatures and traffic analysis to identify applications. This allows FortiGate to recognize applications even when they use nonstandard ports or ports shared with other services. Administrators can then create application-specific controls through Application Control profiles and firewall policies. This provides more precise visibility than relying solely on service objects based on port numbers. Application identification can depend on inspection conditions, so administrators should verify that the traffic is visible to the inspection engine when an expected application is not being detected correctly.

Question 376

Which FortiGate feature can store and analyze security events from multiple devices over time?

1. FortiAnalyzer
2. FortiManager
3. FortiToken
4. FortiWeb

Correct Answer: 1

Explanation

FortiAnalyzer provides centralized log storage, analysis, reporting, and security-event investigation for supported Fortinet devices. By retaining information from multiple devices, it can help administrators investigate historical activity and identify patterns that may not be obvious from a single FortiGate. FortiAnalyzer differs from FortiManager, which is primarily focused on centralized device and policy management. Appropriate log forwarding, retention, storage, and access controls are necessary to make centralized analysis effective. Administrators can use historical logs to support troubleshooting, compliance activities, and security investigations.

Question 377

Which Fortinet platform is primarily designed to centrally manage multiple FortiGate configurations?

1. FortiAnalyzer
2. FortiManager
3. FortiEDR
4. FortiWeb

Correct Answer: 2

Explanation

FortiManager is designed for centralized management of multiple FortiGate devices. It can provide centralized policy administration, configuration management, device organization, and deployment workflows. This helps organizations maintain consistency when managing numerous firewalls across different locations. FortiManager and FortiAnalyzer serve different primary purposes: FortiManager focuses on configuration and policy management, while FortiAnalyzer focuses on logs and analysis. Administrators should use appropriate change-control procedures when deploying centralized configuration changes because a single deployment can affect multiple managed devices.

Question 378

Which Fortinet platform is designed to provide web application firewall protection?

1. FortiWeb
2. FortiManager
3. FortiAnalyzer
4. FortiToken

Correct Answer: 1

Explanation

FortiWeb is Fortinet’s web application firewall platform, designed to protect web applications from threats targeting application-layer services. It provides controls specifically focused on web traffic and application security rather than serving as a general network firewall management platform. FortiWeb can be deployed to protect web applications against various application-layer attacks and unwanted requests. Its role differs from FortiGate, which provides broader network security and firewall functions. Organizations should deploy web application protection according to application architecture, traffic flow, and security requirements.

Question 379

Which Fortinet product is primarily associated with centralized identity and authentication services?

1. FortiAuthenticator
2. FortiAnalyzer
3. FortiManager
4. FortiWeb

Correct Answer: 1

Explanation

FortiAuthenticator provides centralized identity and authentication capabilities within Fortinet environments. It can integrate with directory services and authentication mechanisms and can support identity-related functions used by network security devices. Centralizing authentication can simplify account management and provide a consistent identity source across multiple systems. FortiAuthenticator differs from FortiManager, which manages Fortinet device configurations, and FortiAnalyzer, which focuses on centralized logging and analysis. Administrators should configure appropriate identity sources, authentication methods, and access controls to maintain reliable and secure authentication services.

Question 380

Which Fortinet product is focused on endpoint detection and response?

1. FortiEDR
2. FortiWeb
3. FortiAnalyzer
4. FortiManager

Correct Answer: 1

Explanation

FortiEDR provides endpoint detection and response capabilities for supported endpoint systems. It monitors endpoint activity and helps security teams identify, investigate, and respond to suspicious behavior occurring on workstations and servers. This complements network-level controls because threats can sometimes bypass or originate outside traditional network inspection points. FortiEDR has a different primary role from FortiGate, FortiWeb, FortiAnalyzer, and FortiManager. Effective deployment requires appropriate endpoint policies, monitoring, response procedures, and integration with the organization’s broader security operations.