FCP_FGT_AD-7.6 Free Practice Test

Refer to the exhibits.

Based on the current HA status, an administrator updates theoverrideandpriorityparameters on HQ-NGFW-1 and HQ-NGFW-2 as shown in the exhibit.
What would be the expected outcome in the HA cluster?

1. A. HQ-NGFW-1 will synchronize the override disable setting with HQ-NGFW-2.
2. B. HQ-NGFW-2 will take over as the primary because it has the override enable setting and higher priority than HQ-NGFW-1.
3. C. HQ-NGFW-1 will remain the primary because HQ-NGFW-2 has lower priority.
4. D. The HA cluster will become out of sync because the override setting must match on all HA members.

Correct Answer: B
With override enabled on HQ-NGFW-2 and its higher priority (110 vs. 90), HQ-NGFW-2 will become the primary device, preempting HQ-NGFW-1 despite the current primary status.

An administrator notices that some users are unable to establish SSL VPN connections, while others can connect without any issues.
What should the administrator check first?

1. A. Ensure that the affected users are using the correct port number.
2. B. Ensure that user traffic is hitting the firewall policy.
3. C. Ensure that forced tunneling is enabled to reroute all traffic through the SSL VPN
4. D. Ensure that the HTTPS service is enabled on SSL VPN tunnel interface

Correct Answer: B
If user traffic is not matching the appropriate firewall policy that permits SSL VPN, users will be unable to establish connections, making this the first aspect to verify.

Refer to the exhibit.

As an administrator you have created an IPS profile, but it is not performing as expected. While testing you got the output as shown in the exhibit.
What could be the possible reason of the diagnose output shown in the exhibit?

1. A. There is a no firewall policy configured with an IPS security profile.
2. B. FortiGate entered into IPS fail open state.
3. C. Administrator entered the command diagnose test application ipsmonitor 5.
4. D. Administrator entered the command diagnose test application ipsmonitor 99.

Correct Answer: A
The output shows the IPS engine count as 0, indicating no active IPS engines are running. This typically means no firewall policy is referencing the IPS security profile, so the IPS profile is not being applied or triggered.

An administrator suspects that the Collector Agent is not forwarding login events to FortiGate. What is the most effective troubleshooting step?

1. A. Verify if DC agent is enabled on the FortiGate.
2. B. Restart the domain controller to refresh authentication services.
3. C. Verify if FortiGate is set to use LDAP authentication instead of FSSO.
4. D. Check if TCP port 8000 is open between the collector agent and FortiGate.

Correct Answer: D
The Collector Agent communicates with FortiGate over TCP port 8000. Ensuring this port is open and reachable is essential for forwarding login events.

Refer to the exhibit.

An administrator has created a new firewall address to use as the destination for a static route.
Why is the administrator not able to select the new address in theDestinationfield of the new static route?

1. A. In the new static route, the administrator must select Named Address.
2. B. In the new firewall address, the FQDN address must first beresolved.
3. C. In the new static route, the administrator must first set the interface to port2.
4. D. In the new firewall address, Routing configuration must be enabled.

Correct Answer: D
To use an FQDN-based address object as a destination in a static route, the "Routing configuration" option must be enabled in the firewall address settings. Without this, the address cannot be selected for routing.