Fortinet FCP_FGT_AD-7.6 Questions & Answers

TLS inspection exceptions and sensitive traffic (3.1) would demonstrate or implement: Approved sensitive flows work under narrow exclusions while ordinary eligible web traffic remains inspected. The case states: A department needs review evidence that productivity website categories are monitored but permitted. The most direct paired action and test is: Apply a licensed FortiGuard web-filter profile with appropriate category actions to the correct user firewall policy.

Application control signature matching (3.3) would demonstrate or implement: A generic port allow does not distinguish approved from prohibited applications sharing encrypted or common ports. This choice can be useful for that problem, but it does not establish the Fortiguard web category filtering control being assessed here.

Ips signature sensor and firewall attachment (3.5) addresses another technical failure: An IPS profile that is absent from the matched allow rule cannot block a known threat against that traffic. The paired-answer requirement concerns Fortiguard web category filtering; this alternative does not provide the matching intervention and separate acceptance evidence.

Certificate inspection visibility versus decrypted inspection (3.1) addresses another technical failure: Certificate-only inspection cannot inspect arbitrary encrypted application payload content for threats. This choice can be useful for that problem, but it does not establish the Static url filtering and rule precedence control being assessed here.

Application signatures and false-positive review (3.3) addresses another technical failure: A broad category override can silently re-allow truly prohibited software while hiding identification errors. This case instead tests Static url filtering and rule precedence; the choice measures or changes another part of the system.

Antivirus scanning profiles on permitted flows (3.4) addresses another technical failure: Without applied antivirus inspection or fresh signatures, malicious transferred content may not be detected. The required evidence concerns Static url filtering and rule precedence; a passing result for this alternative could leave that requirement unresolved.

Flow versus proxy antivirus scan behavior (3.4) would demonstrate or implement: Test files of allowed sizes and types are inspected as specified and resource metrics meet the operating target. The case states: A single approved vendor domain must bypass a broad category block without opening every subdomain. The most direct evidence is: Tests of the exact allowed and denied hostnames show the intended outcome and rule ID in logs.

Full ssl inspection trusted ca deployment (3.1) would demonstrate or implement: A managed test workstation trusts the authorized inspection CA and a TLS session completes without unexpected certificate warnings. This choice can be useful for that problem, but it does not establish the Static url filtering and rule precedence control being assessed here.

Antivirus scanning profiles on permitted flows (3.4) would demonstrate or implement: A safe vendor-provided benign malware test artifact is handled according to the policy and generates an expected AV event. This case instead tests Static url filtering and rule precedence; the choice measures or changes another part of the system.

Flow versus proxy antivirus scan behavior (3.4) addresses another technical failure: Using an incompatible inspection path can disable desired scan behavior or cause unnecessary disruption to large transfers. The case states: A new static block entry accidentally matches the entire company domain. The most direct corrective action is: Use precise URL-filter patterns and appropriate FortiGate rule action or precedence to handle approved site exceptions.

Antivirus scanning profiles on permitted flows (3.4) addresses another technical failure: Without applied antivirus inspection or fresh signatures, malicious transferred content may not be detected. This case instead tests Static url filtering and rule precedence; the choice measures or changes another part of the system.

Full ssl inspection trusted ca deployment (3.1) addresses another technical failure: Clients that do not trust the inspection certificate may show connection warnings and reject otherwise permitted websites. The required corrective action concerns Static url filtering and rule precedence; a passing result for this alternative could leave that requirement unresolved.

Inbound protected ssl server certificate handling (3.1) would demonstrate or implement: An appliance lacking the proper protected-server certificate cannot safely present the intended server identity during inspection. The case states: A new static block entry accidentally matches the entire company domain. The most direct risk is: A broad URL wildcard or wrongly ordered exception can allow unrelated destinations or block required ones.

Flow versus proxy antivirus scan behavior (3.4) would demonstrate or implement: Using an incompatible inspection path can disable desired scan behavior or cause unnecessary disruption to large transfers. This choice can be useful for that problem, but it does not establish the Static url filtering and rule precedence control being assessed here.

Antivirus event investigation and quarantine controls (3.4) would demonstrate or implement: Disabling antivirus for a broad source population after one false positive weakens protection without evidence. The required risk concerns Static url filtering and rule precedence; a passing result for this alternative could leave that requirement unresolved.

Inbound protected ssl server certificate handling (3.1) addresses another technical failure: An appliance lacking the proper protected-server certificate cannot safely present the intended server identity during inspection. The case states: An administrator writes an overly wide wildcard to exempt one software update endpoint. The most direct corrective action is: Use precise URL-filter patterns and appropriate FortiGate rule action or precedence to handle approved site exceptions.

Antivirus event investigation and quarantine controls (3.4) addresses another technical failure: Disabling antivirus for a broad source population after one false positive weakens protection without evidence. This choice can be useful for that problem, but it does not establish the Static url filtering and rule precedence control being assessed here.

Flow versus proxy antivirus scan behavior (3.4) addresses another technical failure: Using an incompatible inspection path can disable desired scan behavior or cause unnecessary disruption to large transfers. This case instead tests Static url filtering and rule precedence; the choice measures or changes another part of the system.

Antivirus event investigation and quarantine controls (3.4) would demonstrate or implement: A safe test produces the expected detection record while a documented legitimate file exception remains narrowly scoped. The case states: An administrator writes an overly wide wildcard to exempt one software update endpoint. The most direct evidence is: Tests of the exact allowed and denied hostnames show the intended outcome and rule ID in logs.

Antivirus inspection of encrypted downloads (3.4) would demonstrate or implement: A controlled HTTPS test shows the approved file is inspected under the intended full-inspection policy without trust errors. This case instead tests Static url filtering and rule precedence; the choice measures or changes another part of the system.

Certificate-chain expiry and handshake diagnosis (3.1) would demonstrate or implement: A test of the target site completes with a validated chain or produces a correctly identified and bounded exception decision. The required evidence concerns Static url filtering and rule precedence; a passing result for this alternative could leave that requirement unresolved.

Antivirus event investigation and quarantine controls (3.4) addresses another technical failure: Disabling antivirus for a broad source population after one false positive weakens protection without evidence. The case states: A URL exception works for HTTP but the HTTPS inspection method cannot observe the necessary path. The most direct corrective action is: Use precise URL-filter patterns and appropriate FortiGate rule action or precedence to handle approved site exceptions.

Certificate-chain expiry and handshake diagnosis (3.1) addresses another technical failure: Blanket bypass of certificate validation can conceal expired or untrusted servers and unsafe TLS behavior. This choice can be useful for that problem, but it does not establish the Static url filtering and rule precedence control being assessed here.

Antivirus inspection of encrypted downloads (3.4) addresses another technical failure: Certificate-only inspection cannot reveal arbitrary malicious file bytes encrypted within a TLS application payload. This case instead tests Static url filtering and rule precedence; the choice measures or changes another part of the system.

TLS inspection exceptions and sensitive traffic (3.1) would demonstrate or implement: Overly broad exclusions can create uninspected channels; blanket interception can break approved confidential services. The case states: A URL exception works for HTTP but the HTTPS inspection method cannot observe the necessary path. The most direct risk is: A broad URL wildcard or wrongly ordered exception can allow unrelated destinations or block required ones.

Application control signature matching (3.3) would demonstrate or implement: A generic port allow does not distinguish approved from prohibited applications sharing encrypted or common ports. This choice can be useful for that problem, but it does not establish the Static url filtering and rule precedence control being assessed here.

Ips signature sensor and firewall attachment (3.5) would demonstrate or implement: An IPS profile that is absent from the matched allow rule cannot block a known threat against that traffic. The required risk concerns Static url filtering and rule precedence; a passing result for this alternative could leave that requirement unresolved.

Application control signature matching (3.3) addresses another technical failure: A generic port allow does not distinguish approved from prohibited applications sharing encrypted or common ports. This choice can be useful for that problem, but it does not establish the Static url filtering and rule precedence control being assessed here.

TLS inspection exceptions and sensitive traffic (3.1) addresses another technical failure: Overly broad exclusions can create uninspected channels; blanket interception can break approved confidential services. This case instead tests Static url filtering and rule precedence; the choice measures or changes another part of the system.

Ips signature sensor and firewall attachment (3.5) addresses another technical failure: An IPS profile that is absent from the matched allow rule cannot block a known threat against that traffic. The required corrective action concerns Static url filtering and rule precedence; a passing result for this alternative could leave that requirement unresolved.

Ips signature sensor and firewall attachment (3.5) would demonstrate or implement: An IPS profile that is absent from the matched allow rule cannot block a known threat against that traffic. The case states: A helpdesk must distinguish a static URL-filter deny from a FortiGuard category deny for a website. The most direct paired action and test is: Use precise URL-filter patterns and appropriate FortiGate rule action or precedence to handle approved site exceptions.

Ips false-positive exception and tuning (3.5) addresses another technical failure: Globally disabling an IPS category to suppress one suspected false positive can expose unrelated vulnerable services. This choice can be useful for that problem, but it does not establish the Static url filtering and rule precedence control being assessed here.

Application monitoring versus blocking (3.3) would demonstrate or implement: A controlled application session produces the configured log and is blocked only when the authorized rule requires enforcement. This case instead tests Static url filtering and rule precedence; the choice measures or changes another part of the system.