[Aug 15, 2026] Free Network Security FCP_FGT_AD-7.6 Exam Question [Q65-Q84]

NO.65 An administrator needs to analyze and resolve port conflicts between SSL VPN and HTTPS administrative access on the same interface.
In which two ways can this be done? (Choose two.)

Disable SSL VPN if HTTPS administrative access is using port 443 on any interface.

Change the port number for either the SSL VPN service or the HTTPS administrative service if both are on the same interface.

Keep port 443 for both SSL VPN and HTTPS administrative access on the same interface without any problems.

Run SSL VPN on one interface using port 443 and enable HTTPS administrative access on a different interface, also using port 443.

NO.66 Refer to the exhibits. A web filter profile configuration and firewall policy configuration are shown.
You are trying to access www.facebook.com, but you are redirected to a FortiGuard web filtering block page.
Based on the exhibits, what is the possible cause of the issue?

The web filter profile feature set is configured incorrectly.

The web rating override configuration is incorrect.

The firewall policy inspection mode is incorrect.

For www.facebook.com, the URL filter action is incorrect.

NO.67 An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is no inbound traffic.
Which DPD mode on FortiGate meets this requirement?

On Idle

On Demand

Enabled

Disabled

NO.68 Refer to the exhibit. The administrator configured SD-WAN rules and set the FortiGate traffic log page to display SD-WAN-specific columns: SD-WAN Quality and SD- WAN Rule Name.
FortiGate allows the traffic according to policy ID 1 placed at the top. This is the policy that allows SD-WAN traffic. Despite these settings, the traffic logs do not show the name of the SD-WAN rule used to steer those traffic flows.
What could be the reason?

SD-WAN rule names do not appear immediately. The administrator must refresh the page.

There is no application control profile applied to the firewall policy.

FortiGate load balanced the traffic according to the implicit SD-WAN rule.

Destinations in the SD-WAN rules are configured for each application, but feature visibility is not enabled.

NO.69 Refer to the exhibit. Which two statements about the FortiGuard connection are true? (Choose two.)

FortiGate is using the default port for FortiGuard communication.

FortiGate identified the FortiGuard Server using DNS lookup.

The weight increases as the number of failed packets rises.

You can configure unreliable protocols to communicate with FortiGuard Server.

NO.70 Which three strategies are valid SD-WAN rule strategies for member selection? (Choose three.)

Lowest Cost (SLA) without load balancing

Manual with load balancing

Lowest Quality (SLA) with load balancing

Lowest Cost (SLA) with load balancing

Best Quality with load balancing

NO.71 Refer to the exhibit.

The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile.
An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category.
What are two solutions for satisfying the requirement? (Choose two.)

Configure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.

Configure a web override rating for download.com and select Malicious Websites as the subcategory.

Configure a separate firewall policy with action Deny and an FQDN address object for*.download.com as destination address.

Set the Freeware and Software Downloads category Action to Warning.

NO.72 Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)

The host field in the HTTP header.

The server name indication (SNI) extension in the client hello message.

The subject alternative name (SAN) field in the server certificate.

The subject field in the server certificate.

The serial number in the server certificate.

NO.73 When configuring a FortiGate in a multi-WAN setup, why would an administrator enable session preservation on an interface?

To allow the FortiGate to dynamically change interfaces for all active sessions when a WAN link fails

To make sure all sessions without source NAT enabled always use the primary WAN link

To improve security by forcing users to authenticate again when the WAN link changes

To ensure that existing SSL VPN connections remain on the same interface even if route changes occur

NO.74 Refer to the exhibit. An administrator has created a new firewall address to use as the destination for a static route. Why is the administrator not able to select the new address in the Destination field of the new static route?

In the new static route, the administrator must select Named Address.

In the new firewall address, the FQDN address must first beresolved.

In the new static route, the administrator must first set the interface to port2.

In the new firewall address, Routing configuration must be enabled.

NO.75 Refer to the exhibits.

The exhibits show a diagram of a FortiGate device connected to the network, as well as the firewall policy and IP pool configuration on the FortiGate device Two PCs PC1 and PC2, are connected behind FortiGate and can access the internet successfully However, when the administrator adds a third PC to the network (PC3), the PC cannot connect to the internet Based on the information shown in the exhibit, which two configuration options can the administrator use to fa the connectivity issue for PC3? (Choose two.)

In the system settings sot Multiple Interface Policies to enable

In the firewall policy, set match-vip to enable using CLI.

ln the IP pool configuration, set endip to 100.65.0.112.

In the IP pool configuration, set type to overload.

NO.76

Refer to the exhibits.
You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
Which two factors can you observe from these configurations? (Choose two.)

YouTube search is allowed based on the Google Application and Filter override settings.

YouTube access is blocked based on Excessive-Bandwidth Application and Filter override settings.

Facebook access is allowed but you cannot play Facebook videos based on Video/Audio category filter settings.

Facebook access is blocked based on the category filter settings.

NO.77 An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings.
What is true about the DNS connection to a FortiGuard server?

It uses DNS over TLS.

It uses DNS over HTTPS.

It uses UDP 8888.

It uses UDP 53.

NO.78 When configuring firewall policies which of the following is true regarding the policy ID?

It is mandatory to provide a policy ID while creating a firewall policy regardless of GUI or CLI.

A firewall policy ID identifies the order of policy execution in firewall policies.

You can create a policy in CLI with policy ID 0.

A policy ID cannot be edited once a policy is created.

NO.79 Refer to the exhibits.

The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
Which IP address will be used to source NAT (SNAT) the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?

10.200.1.1

10.200.1.149

10.200.1.99

10.200.1.49

NO.80 Refer to the exhibit. Why is the Antivirus scan switch grayed out when you are creating a new antivirus profile for FTP?

None of the inspected protocols are active in this profile.

FortiGate, with less than 2 GB RAM, does not support the Antivirus scan feature.

Antivirus scan is disabled under System -> Feature visibility.

The Feature Set for the profile is Flow-based but it must be Proxy-based.

NO.81 Refer to the exhibit.

FortiGate has two separate firewall policies for Sales and Engineering to access the same web server with the same security profiles.
Which action must the administrator perform to consolidate the two policies into one?

Create an Aggregate interface that includes port1 and port2 to create a single firewall policy.

Select port1 and port2 subnets in a single firewall policy.

Replace port1 and port2 with the any interface in a single firewall policy.

Enable Multiple Interface Policies to select port1 and port2 in the same firewall policy.

NO.82 Refer to the exhibits.

The SSL VPN connection fails when a user attempts to connect to it.
What should the user do to successfully connect to the SSL VPN?

Change the SSL VPN port on the client.

Change the SSL VPN portal to the tunnel.

Change the server IP address.

Change the idle-timeout.

NO.83 Which two statements are true about an HA cluster? (Choose two.)

An HA cluster cannot have both in-band and out-of-band management interfaces at the same time.

Link failover triggers a failover if the administrator sets the interface down on the primary device.

When sniffing the heartbeat interface, the administrator must see the IP address 169.254.0.2.

HA incremental synchronization includes FIB entries and IPsec SAs.

NO.84 Which two statements are true about an HA cluster? (Choose two.)

An HA cluster cannot have both in-band and out-of-band management interfaces at the same time.

Link failover triggers a failover if the administrator sets the interface down on the primary device.

When sniffing the heartbeat interface, the administrator must see the IP address 169.254.0.2.

HA incremental synchronization includes FIB entries and IPsec SAs.

Leave a Reply Cancel reply