Fortinet FCP_FGT_AD-7.6 Questions & Answers

Flow versus proxy antivirus scan behavior (3.4) addresses another technical failure: Using an incompatible inspection path can disable desired scan behavior or cause unnecessary disruption to large transfers. The case states: A certificate error appears only on unmanaged devices missing the enterprise root CA. The most direct paired action and test is: Diagnose SSL inspection failures using server certificate chain, validity dates, client trust and supported protocol negotiation evidence.

Antivirus scanning profiles on permitted flows (3.4) would demonstrate or implement: Without applied antivirus inspection or fresh signatures, malicious transferred content may not be detected. This choice can be useful for that problem, but it does not establish the Certificate-chain expiry and handshake diagnosis control being assessed here.

Web filtering with certificate-only visibility (3.2) would demonstrate or implement: A controlled HTTPS test demonstrates the rule applies only to attributes observable under the selected inspection level. This case instead tests Certificate-chain expiry and handshake diagnosis; the choice measures or changes another part of the system.

Application control signature matching (3.3) addresses another technical failure: A generic port allow does not distinguish approved from prohibited applications sharing encrypted or common ports. The case states: A company banking application uses certificate pinning and fails through full SSL inspection. The most direct diagnosis is: Define precise, documented SSL inspection exceptions for legitimate certificate-pinned or privacy-sensitive applications.

Ips signature sensor and firewall attachment (3.5) addresses another technical failure: An IPS profile that is absent from the matched allow rule cannot block a known threat against that traffic. This case instead tests TLS inspection exceptions and sensitive traffic; the choice measures or changes another part of the system.

Application monitoring versus blocking (3.3) addresses another technical failure: Confusing a monitor-only action with an enforcement action can leave a prohibited application available. The required diagnosis concerns TLS inspection exceptions and sensitive traffic; a passing result for this alternative could leave that requirement unresolved.

Application control profile and firewall policy scope (3.3) would demonstrate or implement: The intended clients show the specified application-control decisions while excluded groups remain on their own policies. The case states: A company banking application uses certificate pinning and fails through full SSL inspection. The most direct evidence is: Approved sensitive flows work under narrow exclusions while ordinary eligible web traffic remains inspected.

Ips false-positive exception and tuning (3.5) would demonstrate or implement: An authorized legitimate transaction works after tuning while the required nonmalicious detection validation still succeeds. This choice can be useful for that problem, but it does not establish the TLS inspection exceptions and sensitive traffic control being assessed here.

Flow versus proxy inspection processing model (3.2) would demonstrate or implement: Policy readback and representative traffic show supported features are active with measured acceptable resource impact. The required evidence concerns TLS inspection exceptions and sensitive traffic; a passing result for this alternative could leave that requirement unresolved.

Flow versus proxy inspection processing model (3.2) addresses another technical failure: Assuming proxy-only functions are present in flow mode can leave desired inspection capabilities unavailable. The case states: A healthcare portal requires documented handling of private information in decrypted inspection logs. The most direct corrective action is: Define precise, documented SSL inspection exceptions for legitimate certificate-pinned or privacy-sensitive applications.

Ips false-positive exception and tuning (3.5) addresses another technical failure: Globally disabling an IPS category to suppress one suspected false positive can expose unrelated vulnerable services. This choice can be useful for that problem, but it does not establish the TLS inspection exceptions and sensitive traffic control being assessed here.

Application control profile and firewall policy scope (3.3) addresses another technical failure: A profile applied to the wrong policy can miss the affected clients or disrupt unrelated approved applications. The required corrective action concerns TLS inspection exceptions and sensitive traffic; a passing result for this alternative could leave that requirement unresolved.

Ips resource pressure and measurement (3.5) would demonstrate or implement: Disabling IPS during high CPU without a constrained diagnosis can leave mission-critical services unprotected. The case states: A healthcare portal requires documented handling of private information in decrypted inspection logs. The most direct risk is: Overly broad exclusions can create uninspected channels; blanket interception can break approved confidential services.

Application signatures and false-positive review (3.3) would demonstrate or implement: A broad category override can silently re-allow truly prohibited software while hiding identification errors. This choice can be useful for that problem, but it does not establish the TLS inspection exceptions and sensitive traffic control being assessed here.

Fortiguard web category filtering (3.2) would demonstrate or implement: Without current category intelligence or the right profile association, disallowed websites may still pass. The required risk concerns TLS inspection exceptions and sensitive traffic; a passing result for this alternative could leave that requirement unresolved.

Application signatures and false-positive review (3.3) addresses another technical failure: A broad category override can silently re-allow truly prohibited software while hiding identification errors. The case states: An engineer disables deep inspection for all internet destinations to fix one unsupported app. The most direct corrective action is: Define precise, documented SSL inspection exceptions for legitimate certificate-pinned or privacy-sensitive applications.

Fortiguard web category filtering (3.2) addresses another technical failure: Without current category intelligence or the right profile association, disallowed websites may still pass. This choice can be useful for that problem, but it does not establish the TLS inspection exceptions and sensitive traffic control being assessed here.

Ips resource pressure and measurement (3.5) addresses another technical failure: Disabling IPS during high CPU without a constrained diagnosis can leave mission-critical services unprotected. This case instead tests TLS inspection exceptions and sensitive traffic; the choice measures or changes another part of the system.

Static url filtering and rule precedence (3.2) would demonstrate or implement: Tests of the exact allowed and denied hostnames show the intended outcome and rule ID in logs. This choice can be useful for that problem, but it does not establish the TLS inspection exceptions and sensitive traffic control being assessed here.

Antivirus scanning profiles on permitted flows (3.4) would demonstrate or implement: A safe vendor-provided benign malware test artifact is handled according to the policy and generates an expected AV event. This case instead tests TLS inspection exceptions and sensitive traffic; the choice measures or changes another part of the system.

Application signatures and false-positive review (3.3) would demonstrate or implement: A targeted approved application completes while an unauthorized signature test remains blocked after the adjustment. The required evidence concerns TLS inspection exceptions and sensitive traffic; a passing result for this alternative could leave that requirement unresolved.

Antivirus scanning profiles on permitted flows (3.4) addresses another technical failure: Without applied antivirus inspection or fresh signatures, malicious transferred content may not be detected. The case states: A mobile client certificate validation cannot accept a substituted certificate on one approved service. The most direct evidence is: Define precise, documented SSL inspection exceptions for legitimate certificate-pinned or privacy-sensitive applications.

Static url filtering and rule precedence (3.2) addresses another technical failure: A broad URL wildcard or wrongly ordered exception can allow unrelated destinations or block required ones. This choice can be useful for that problem, but it does not establish the TLS inspection exceptions and sensitive traffic control being assessed here.

Application signatures and false-positive review (3.3) addresses another technical failure: A broad category override can silently re-allow truly prohibited software while hiding identification errors. The required evidence concerns TLS inspection exceptions and sensitive traffic; a passing result for this alternative could leave that requirement unresolved.

Web filtering with certificate-only visibility (3.2) would demonstrate or implement: Encrypted HTTPS paths or page content cannot always be evaluated when only un-decrypted certificate information is visible. The case states: A mobile client certificate validation cannot accept a substituted certificate on one approved service. The most direct evidence is: Overly broad exclusions can create uninspected channels; blanket interception can break approved confidential services.

Antivirus scanning profiles on permitted flows (3.4) would demonstrate or implement: Without applied antivirus inspection or fresh signatures, malicious transferred content may not be detected. This choice can be useful for that problem, but it does not establish the TLS inspection exceptions and sensitive traffic control being assessed here.

Flow versus proxy antivirus scan behavior (3.4) would demonstrate or implement: Using an incompatible inspection path can disable desired scan behavior or cause unnecessary disruption to large transfers. This case instead tests TLS inspection exceptions and sensitive traffic; the choice measures or changes another part of the system.

Flow versus proxy antivirus scan behavior (3.4) addresses another technical failure: Using an incompatible inspection path can disable desired scan behavior or cause unnecessary disruption to large transfers. The case states: A compliance review requests a list of narrowly scoped TLS decryption exceptions and their business owners. The most direct corrective action is: Define precise, documented SSL inspection exceptions for legitimate certificate-pinned or privacy-sensitive applications.

Web filtering with certificate-only visibility (3.2) addresses another technical failure: Encrypted HTTPS paths or page content cannot always be evaluated when only un-decrypted certificate information is visible. This case instead tests TLS inspection exceptions and sensitive traffic; the choice measures or changes another part of the system.

Antivirus scanning profiles on permitted flows (3.4) addresses another technical failure: Without applied antivirus inspection or fresh signatures, malicious transferred content may not be detected. The required corrective action concerns TLS inspection exceptions and sensitive traffic; a passing result for this alternative could leave that requirement unresolved.

Web-filter authentication and policy mismatch diagnosis (3.2) would demonstrate or implement: Web-filter and traffic events identify which identity, category and policy produced the blocked or allowed result. The case states: A compliance review requests a list of narrowly scoped TLS decryption exceptions and their business owners. The most direct paired action and test is: Define precise, documented SSL inspection exceptions for legitimate certificate-pinned or privacy-sensitive applications.

Antivirus event investigation and quarantine controls (3.4) addresses another technical failure: Disabling antivirus for a broad source population after one false positive weakens protection without evidence. This case instead tests TLS inspection exceptions and sensitive traffic; the choice measures or changes another part of the system.

Flow versus proxy antivirus scan behavior (3.4) would demonstrate or implement: Using an incompatible inspection path can disable desired scan behavior or cause unnecessary disruption to large transfers. The required paired action and test concerns TLS inspection exceptions and sensitive traffic; a passing result for this alternative could leave that requirement unresolved.