Free FCP_FGT_AD-7.6: FCP - FortiGate 7.6 Administrator Exam Questions and Answers

Last updated: September 19, 2026

Provider

Fortinet

Questions in our bank

1000+

Free to read

First 10, with answers

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Practice format

Multiple choice

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   Refer to the exhibits. The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects. TheWAN (port2)interface has the IP address100.65.0.101/24. TheLAN (port4)interface has the IP address10.0.11.254/24. Which IP address will be used to source NAT (SNAT) the traffic, if the user on HQ-PC-1 (10.0.11.50) pings the IP address of BR-FGT (100.65.1.111)

   
   • A. 100.65.0.101
   • B. 100.65.0.49
   • C. 100.65.0.99
   • D. 100.65.0.149
   Reveal Answer

2. Question #2

   A FortiGate firewall policy is configured with active authentication, however, the user cannot authenticate when accessing a website. Which protocol must FortiGate allow even though the user cannot authenticate?

   • A. LDAP
   • B. TACASC+
   • C. Kerberos
   • D. DNS
   Reveal Answer

3. Question #3

   Refer to the exhibit, which shows a partial configuration from the remote authentication server. Why does the FortiGate administrator need this configuration?

   
   • A. To set up a RADIUS server Secret.
   • B. To authenticate Any FortiGate user groups.
   • C. To authenticate and match the Training OU on the RADIUS server.
   • D. To authenticate only the Training user group.
   Reveal Answer

4. Question #4

   An administrator wants to analyze and manage digital certificates to prevent browser warnings when users connect to the SSL VPN portal. Which two statements describe how to correctly do this? (Choose two.)

   Select 2 answers.

   • A. The administrator can rely on the default FortiGate self-signed certificate to prevent all security warnings in the browser.
   • B. The administrator must disable HTTPS administrative access entirely to avoid certificate warnings.
   • C. The administrator can use a publicly trusted certificate from a known certificate authority (CA) to stop browser warnings.
   • D. The administrator can import the FortiGate self-signed certificate into each user's browser as a trusted certificate.
   Reveal Answer

5. Question #5

   Refer to the exhibits. An administrator has observed the performance status outputs on an HA cluster for 55 seconds. Which FortiGate is the primary?

   
   • A. HQ-NGFW-2 with the parameter memory-failover-threshold setting
   • B. HQ-NGFW-2 with the parameter priority setting
   • C. HQ-NGFW-1 with the parameter memory-failover-flip-timeout setting
   • D. HQ-NGFW-1 with the parameter override setting
   Reveal Answer

6. Question #6

   Refer to the exhibit. What would be the impact of these settings on the Server certificate SNI check configuration on FortiGate?

   
   • A. FortiGate will accept and use the CN in the server certificate for URL filtering if the SNI does not match the CN or SAN fields.
   • B. FortiGate will accept the connection with a warning if the SNI does not match the CN or SAN fields.
   • C. FortiGate will close the connection if the SNI does not match the CN or SAN fields.
   • D. FortiGate will close the connection if the SNI does not match the CN and SAN fields
   Reveal Answer

7. Question #7

   An administrator notices that some users are unable to establish SSL VPN connections, while others can connect without any issues. What should the administrator check first?

   • A. Ensure that the affected users are using the correct port number.
   • B. Ensure that user traffic is hitting the firewall policy.
   • C. Ensure that forced tunneling is enabled to reroute all traffic through the SSL VPN
   • D. Ensure that the HTTPS service is enabled on SSL VPN tunnel interface
   Reveal Answer

8. Question #8

   Refer to the exhibits. Based on the current HA status, an administrator updates theoverrideandpriorityparameters on HQ-NGFW-1 and HQ-NGFW-2 as shown in the exhibit. What would be the expected outcome in the HA cluster?

   
   • A. HQ-NGFW-1 will synchronize the override disable setting with HQ-NGFW-2.
   • B. HQ-NGFW-2 will take over as the primary because it has the override enable setting and higher priority than HQ-NGFW-1.
   • C. HQ-NGFW-1 will remain the primary because HQ-NGFW-2 has lower priority.
   • D. The HA cluster will become out of sync because the override setting must match on all HA members.
   Reveal Answer

9. Question #9

   A network administrator is reviewing firewall policies in both Interface Pair View and By Sequence View. The policies appear in a different order in each view. Why is the policy order different in these two views?

   • A. Policies in Interface Pair View are prioritized by security levels, while By Sequence View strictly follows the administrator's manual ordering.
   • B. By Sequence View groups policies based on rule priority, while Interface Pair View always follows the order of traffic logs.
   • C. The firewall dynamically reorders policies in Interface Pair View based on recent traffic patterns, but By Sequence View remains static.
   • D. Interface Pair View sorts policies based on matching interfaces, while By Sequence View shows the actual processing order of rules.
   Reveal Answer

10. Question #10

    Refer to the exhibit. As an administrator you have created an IPS profile, but it is not performing as expected. While testing you got the output as shown in the exhibit. What could be the possible reason of the diagnose output shown in the exhibit?

    
    • A. There is a no firewall policy configured with an IPS security profile.
    • B. FortiGate entered into IPS fail open state.
    • C. Administrator entered the command diagnose test application ipsmonitor 5.
    • D. Administrator entered the command diagnose test application ipsmonitor 99.
    Reveal Answer