Fortinet FCP_FGT_AD-7.6 Questions & Answers

Ldap directory authentication configuration (2.3) would demonstrate or implement: An approved directory test user authenticates and maps to the intended access group while invalid credentials fail. This choice can be useful for that problem, but it does not establish the Virtual IP destination nat for inbound services control being assessed here.

Fsso login troubleshooting and stale mappings (2.4) would demonstrate or implement: Guessing at a firewall address rule may conceal stale logon state or an actual collector synchronization failure. This case instead tests Virtual IP destination nat for inbound services; the choice measures or changes another part of the system.

Service and schedule restrictions (2.1) addresses another technical failure: An overly permissive service group or incorrect schedule window may grant continuous access to time-limited operations. The paired-answer requirement concerns Virtual IP destination nat for inbound services; this alternative does not provide the matching intervention and separate acceptance evidence.

Fsso login troubleshooting and stale mappings (2.4) addresses another technical failure: Guessing at a firewall address rule may conceal stale logon state or an actual collector synchronization failure. The case states: An administrator disables NAT on a firewall policy but the translated source IP remains unchanged. The most direct diagnosis is: Determine whether the FortiGate is using central SNAT or policy NAT and manage translations in the corresponding configuration model.

Address objects and policy scope (2.1) addresses another technical failure: Wrong subnet masks or interface directions can permit unrelated clients or cause expected traffic to miss the rule. This choice can be useful for that problem, but it does not establish the Central snat versus policy nat selection control being assessed here.

Authentication session visibility and revocation (2.3) addresses another technical failure: Removed group membership may not immediately terminate an already established authenticated session without lifecycle controls. This case instead tests Central snat versus policy nat selection; the choice measures or changes another part of the system.

Top-down firewall policy matching (2.1) would demonstrate or implement: A reproducible flow matches the intended policy identifier and the recorded action agrees with the approved design. The case states: An administrator disables NAT on a firewall policy but the translated source IP remains unchanged. The most direct evidence is: Session and translation inspections show the intended matched central or policy-based NAT rule for each tested flow.

Service and schedule restrictions (2.1) would demonstrate or implement: Authorized ports work only during the permitted schedule and disallowed services fail in controlled tests. This case instead tests Central snat versus policy nat selection; the choice measures or changes another part of the system.

Fsso collector agent mapping (2.4) would demonstrate or implement: A test logon appears with the expected user and client IP, and the corresponding policy match is confirmed. The required evidence concerns Central snat versus policy nat selection; a passing result for this alternative could leave that requirement unresolved.

Top-down firewall policy matching (2.1) addresses another technical failure: A broad early permit or deny may match before a later more-specific rule, causing unintended access or blockage. This choice can be useful for that problem, but it does not establish the Central snat versus policy nat selection control being assessed here.

Fsso collector agent mapping (2.4) addresses another technical failure: Incorrect or stale user-to-IP correlation can assign the wrong identity-based firewall privileges to shared addresses. This case instead tests Central snat versus policy nat selection; the choice measures or changes another part of the system.

Service and schedule restrictions (2.1) addresses another technical failure: An overly permissive service group or incorrect schedule window may grant continuous access to time-limited operations. The required corrective action concerns Central snat versus policy nat selection; a passing result for this alternative could leave that requirement unresolved.

Implicit deny and least privilege (2.1) would demonstrate or implement: Adding a catch-all allow to solve one client error exposes unrelated source and destination paths. This choice can be useful for that problem, but it does not establish the Central snat versus policy nat selection control being assessed here.

Security profiles attached to permitted policies (2.1) would demonstrate or implement: Creating a web-filter or IPS profile alone offers no protection when the matched allow policy does not apply it. This case instead tests Central snat versus policy nat selection; the choice measures or changes another part of the system.

Domain controller event collection for fsso (2.4) would demonstrate or implement: Uncollected security logon events leave user identity mappings missing even when LDAP connectivity works. The required risk concerns Central snat versus policy nat selection; a passing result for this alternative could leave that requirement unresolved.

Implicit deny and least privilege (2.1) addresses another technical failure: Adding a catch-all allow to solve one client error exposes unrelated source and destination paths. The case states: An environment migrated to central NAT and legacy policy-level assumptions confuse the support team. The most direct corrective action is: Determine whether the FortiGate is using central SNAT or policy NAT and manage translations in the corresponding configuration model.

Domain controller event collection for fsso (2.4) addresses another technical failure: Uncollected security logon events leave user identity mappings missing even when LDAP connectivity works. This choice can be useful for that problem, but it does not establish the Central snat versus policy nat selection control being assessed here.

Security profiles attached to permitted policies (2.1) addresses another technical failure: Creating a web-filter or IPS profile alone offers no protection when the matched allow policy does not apply it. This case instead tests Central snat versus policy nat selection; the choice measures or changes another part of the system.

Address objects and policy scope (2.1) would demonstrate or implement: Test clients from included and excluded subnets reach only the intended destinations and policy hit counters align. The case states: An environment migrated to central NAT and legacy policy-level assumptions confuse the support team. The most direct evidence is: Session and translation inspections show the intended matched central or policy-based NAT rule for each tested flow.

Firewall policy logging and traceability (2.1) would demonstrate or implement: An approved representative flow generates a retained event showing matched rule ID and expected enforcement action. This case instead tests Central snat versus policy nat selection; the choice measures or changes another part of the system.

Fsso group filter and policy authorization (2.4) would demonstrate or implement: Users from the approved directory group match the protected rule and other groups cannot reach the resource. The required evidence concerns Central snat versus policy nat selection; a passing result for this alternative could leave that requirement unresolved.

Address objects and policy scope (2.1) addresses another technical failure: Wrong subnet masks or interface directions can permit unrelated clients or cause expected traffic to miss the rule. The case states: A new private subnet has an allow policy but misses the central translation matching criteria. The most direct corrective action is: Determine whether the FortiGate is using central SNAT or policy NAT and manage translations in the corresponding configuration model.

Firewall policy logging and traceability (2.1) addresses another technical failure: Without consistent allowed and denied event visibility, teams cannot determine which policy produced an outage. This choice can be useful for that problem, but it does not establish the Central snat versus policy nat selection control being assessed here.

Fsso group filter and policy authorization (2.4) addresses another technical failure: A recognized domain user can still be allowed too broadly or denied if group selection and policy order differ. This case instead tests Central snat versus policy nat selection; the choice measures or changes another part of the system.

Ldap directory authentication configuration (2.3) would demonstrate or implement: A working network route to the directory does not prove bind credentials or group attribute mappings are valid. The case states: A new private subnet has an allow policy but misses the central translation matching criteria. The most direct risk is: Changing only firewall-policy NAT settings when central NAT is authoritative can leave the source address unchanged.

Service and schedule restrictions (2.1) would demonstrate or implement: An overly permissive service group or incorrect schedule window may grant continuous access to time-limited operations. This choice can be useful for that problem, but it does not establish the Central snat versus policy nat selection control being assessed here.

Fsso login troubleshooting and stale mappings (2.4) would demonstrate or implement: Guessing at a firewall address rule may conceal stale logon state or an actual collector synchronization failure. This case instead tests Central snat versus policy nat selection; the choice measures or changes another part of the system.

Fsso login troubleshooting and stale mappings (2.4) addresses another technical failure: Guessing at a firewall address rule may conceal stale logon state or an actual collector synchronization failure. The case states: Two departments need separate public source pools while the system uses a centralized NAT table. The most direct corrective action is: Determine whether the FortiGate is using central SNAT or policy NAT and manage translations in the corresponding configuration model.

Ldap directory authentication configuration (2.3) addresses another technical failure: A working network route to the directory does not prove bind credentials or group attribute mappings are valid. This choice can be useful for that problem, but it does not establish the Central snat versus policy nat selection control being assessed here.

Service and schedule restrictions (2.1) addresses another technical failure: An overly permissive service group or incorrect schedule window may grant continuous access to time-limited operations. This case instead tests Central snat versus policy nat selection; the choice measures or changes another part of the system.

Top-down firewall policy matching (2.1) would demonstrate or implement: A broad early permit or deny may match before a later more-specific rule, causing unintended access or blockage. This case instead tests Central snat versus policy nat selection; the choice measures or changes another part of the system.

Security profiles attached to permitted policies (2.1) addresses another technical failure: Creating a web-filter or IPS profile alone offers no protection when the matched allow policy does not apply it. The required paired action and test concerns Central snat versus policy nat selection; a passing result for this alternative could leave that requirement unresolved.

Radius authentication and shared secret checks (2.3) would demonstrate or implement: A controlled authentication request receives the expected accept or reject result and maps policy groups correctly. The paired-answer requirement concerns Central snat versus policy nat selection; this alternative does not provide the matching intervention and separate acceptance evidence.