Free FCP_FGT_AD-7.6: FCP - FortiGate 7.6 Administrator Exam Questions and Answers

Two static routes to the same destination network exist on a FortiGate. Which two statements about how FortiGate handles these routes are true? (Choose two.)

Select 2 answers.

• AA. The route with the lowest priority value is installed in the routing table, and routes with a higher priority value are discarded.
• BB. When the administrative distances differ, only the route with the lowest administrative distance is installed in the routing table.
• CC. When the administrative distances differ, both routes are installed in the routing table and FortiGate picks one by lowest metric.
• DD. When the administrative distances are equal, both routes are installed, and the lower priority value is preferred for forwarding.

Refer to the exhibit. Exhibit: id=20085 trace_id=14 func=print_pkt_detail line=5885 msg="vd-root:0 received a packet(proto=6, 10.1.10.15:53412->203.0.113.40:443) tun_id=0.0.0.0 from port3. flag [S], seq 2815443821, ack 0, win 64240" id=20085 trace_id=14 func=init_ip_session_common line=6070 msg="allocate a new session-00042a1c" id=20085 trace_id=14 func=vf_ip_route_input_common line=2605 msg="find a route: flag=04000000 gw-198.51.100.2 via port1" id=20085 trace_id=14 func=fw_forward_handler line=738 msg="Denied by forward policy check (policy 0)" A user on 10.1.10.15 cannot reach a web server. An administrator runs a debug flow and gets the output shown in the exhibit. What is the reason the session is dropped?

• AA. The source address failed the reverse path forwarding check on the ingress interface.
• BB. A matching firewall policy has its action set to deny and logs the session.
• CC. FortiGate has no route to the destination, so the session is dropped before policy lookup.
• DD. No firewall policy matches the session, so the implicit deny drops it.

An administrator wants the account auditor1 to be able to log in to FortiGate only from hosts in 10.0.5.0/24. What should the administrator configure?

• AA. Trusted hosts on the auditor1 administrator account
• BB. An administrator profile with read-only access for auditor1
• CC. Two-factor authentication on the auditor1 account
• DD. Administrative access for HTTPS on the LAN interface

Refer to the exhibit. Exhibit: config firewall policy edit 12 set name "LAN-to-WAN" set srcintf "port3" set dstintf "port1" set action accept set schedule "always" set service "ALL" set utm-status enable set ssl-ssh-profile "certificate-inspection" set application-list "block-social" set nat enable next end Application list "block-social": Social.Media = Block, Unknown Applications = Allow. Users can still post to a social media site over HTTPS, and the application control log shows app=HTTPS.BROWSER action=pass for these sessions. What is the most likely reason?

• AA. The Unknown Applications action of Allow takes precedence over the Social.Media category action.
• BB. Application control cannot run in a flow-based policy unless the proxy inspection option is enabled.
• CC. The Social.Media category must use the Reset action instead of Block before sessions are dropped.
• DD. The policy uses certificate inspection, so FortiGate cannot see the application signature inside the encrypted session.

A Collector Agent is installed on a Windows member server and the FSSO agent connector is configured on a FortiGate. The connector status stays disconnected. A firewall between the FortiGate and the Collector Agent allows only the ports the administrator has explicitly opened. Which port must be allowed for the FortiGate to connect to the Collector Agent?

• AA. TCP 389
• BB. UDP 514
• CC. TCP 8000
• DD. UDP 8002

Refer to the exhibit. Exhibit: config router static edit 1 set gateway 192.0.2.1 set device "port1" set distance 10 set priority 20 next edit 2 set gateway 198.51.100.1 set device "port2" set distance 10 set priority 5 next edit 3 set gateway 203.0.113.1 set device "port3" set distance 20 set priority 1 next end All three interfaces are up. Which interface does FortiGate use to forward traffic to 8.8.8.8?

• AA. port1
• BB. port1 and port2 with ECMP load balancing
• CC. port2
• DD. port3

Refer to the exhibit. FGT # diagnose debug authd fsso server-status Server Name Connection Status Version ----------- ----------------- ------- CollectorAgent connected FSAE server 1.2.5 FGT # diagnose debug authd fsso list ----FSSO logons---- Total number of logons listed: 0, filtered: 0 A FortiGate uses FSSO in DC Agent mode. Users are logging in to Active Directory workstations, but none of them match FSSO-based firewall policies. The Collector Agent console shows that it has received no events from either domain controller. What is the most likely cause?

• AA. The LDAP server object used for group lookups fails to bind because of an incorrect administrator password
• BB. The DC Agents cannot deliver logon events to the Collector Agent because UDP port 8002 is blocked on the path
• CC. A firewall between the FortiGate and the Collector Agent server blocks TCP port 8000 used by the FSSO connector
• DD. The Collector Agent group filter excludes the Active Directory groups that the firewall policies reference

A company connects five FortiGate devices in a full-mesh IPsec VPN topology. Each device has one tunnel to every other device. How many IPsec phase 1 interface configurations must be created in total across all five devices?

• AA. 5
• BB. 10
• CC. 15
• DD. 20

An administrator must protect internal servers by blocking all signatures with critical or high severity that target servers. The configuration must also cover signatures added by future FortiGuard IPS updates. Which IPS sensor configuration meets this requirement?

• AA. A filter entry for critical and high severity signatures with Target Server and the action set to Block
• BB. Individual signature entries for each critical and high severity server signature, with the action set to Block
• CC. A filter entry for Target Server with all severities selected and the action set to Monitor with logging
• DD. A filter entry for critical and high severity signatures with Target Client and the action set to Block

A company runs workloads in several AWS VPCs. The security team wants network firewall protection without deploying, patching or scaling any firewall instances. Which solution meets this requirement?

• AA. A pair of FortiGate-VM instances in separate availability zones behind a Gateway Load Balancer
• BB. FortiGate CNF with the firewall policies configured through the FortiCloud portal
• CC. A FortiGate-VM BYOL instance with FortiManager handling its firmware upgrades
• DD. FortiGate-VM instances in an AWS Auto Scaling group that the company manages