Fortinet FCP_FGT_AD-7.6 Questions & Answers

Antivirus scanning profiles on permitted flows (3.4) would demonstrate or implement: A safe vendor-provided benign malware test artifact is handled according to the policy and generates an expected AV event. The case states: A test site is intentionally blocked and operators must show both the user-facing result and firewall log cause. The most direct paired action and test is: Validate that FortiGate web-filter block responses and certificate prerequisites work for managed browsers in the chosen inspection mode.

Certificate inspection visibility versus decrypted inspection (3.1) would demonstrate or implement: Certificate-only inspection cannot inspect arbitrary encrypted application payload content for threats. This choice can be useful for that problem, but it does not establish the Web-filter block pages and certificate user experience control being assessed here.

Full ssl inspection trusted ca deployment (3.1) addresses another technical failure: Clients that do not trust the inspection certificate may show connection warnings and reject otherwise permitted websites. The required paired action and test concerns Web-filter block pages and certificate user experience; a passing result for this alternative could leave that requirement unresolved.

Antivirus inspection of encrypted downloads (3.4) addresses another technical failure: Certificate-only inspection cannot reveal arbitrary malicious file bytes encrypted within a TLS application payload. The case states: A company permits web browsing but needs to deny a named peer-to-peer application using HTTPS. The most direct diagnosis is: Attach a supported application-control profile with current signatures and suitable actions to the intended policy.

Ips signature sensor and firewall attachment (3.5) addresses another technical failure: An IPS profile that is absent from the matched allow rule cannot block a known threat against that traffic. This case instead tests Application control signature matching; the choice measures or changes another part of the system.

TLS inspection exceptions and sensitive traffic (3.1) addresses another technical failure: Overly broad exclusions can create uninspected channels; blanket interception can break approved confidential services. The required diagnosis concerns Application control signature matching; a passing result for this alternative could leave that requirement unresolved.

Ips false-positive exception and tuning (3.5) would demonstrate or implement: An authorized legitimate transaction works after tuning while the required nonmalicious detection validation still succeeds. The case states: A company permits web browsing but needs to deny a named peer-to-peer application using HTTPS. The most direct evidence is: An authorized application test appears under the correct signature and permitted or blocked action in logs.

Flow versus proxy inspection processing model (3.2) would demonstrate or implement: Policy readback and representative traffic show supported features are active with measured acceptable resource impact. This case instead tests Application control signature matching; the choice measures or changes another part of the system.

Ips signature sensor and firewall attachment (3.5) would demonstrate or implement: A controlled benign vendor-provided IPS test triggers the approved alert or block action on the matched policy. The required evidence concerns Application control signature matching; a passing result for this alternative could leave that requirement unresolved.

Ips signature sensor and firewall attachment (3.5) addresses another technical failure: An IPS profile that is absent from the matched allow rule cannot block a known threat against that traffic. This choice can be useful for that problem, but it does not establish the Application control signature matching control being assessed here.

Ips false-positive exception and tuning (3.5) addresses another technical failure: Globally disabling an IPS category to suppress one suspected false positive can expose unrelated vulnerable services. This case instead tests Application control signature matching; the choice measures or changes another part of the system.

Flow versus proxy inspection processing model (3.2) addresses another technical failure: Assuming proxy-only functions are present in flow mode can leave desired inspection capabilities unavailable. The required corrective action concerns Application control signature matching; a passing result for this alternative could leave that requirement unresolved.

Fortiguard web category filtering (3.2) would demonstrate or implement: Without current category intelligence or the right profile association, disallowed websites may still pass. The case states: A firewall rule permits TCP 443 and an operator assumes all traffic on that port is the same application. The most direct risk is: A generic port allow does not distinguish approved from prohibited applications sharing encrypted or common ports.

Ips resource pressure and measurement (3.5) would demonstrate or implement: Disabling IPS during high CPU without a constrained diagnosis can leave mission-critical services unprotected. This choice can be useful for that problem, but it does not establish the Application control signature matching control being assessed here.

Ips false-positive exception and tuning (3.5) would demonstrate or implement: Globally disabling an IPS category to suppress one suspected false positive can expose unrelated vulnerable services. This case instead tests Application control signature matching; the choice measures or changes another part of the system.

Ips false-positive exception and tuning (3.5) addresses another technical failure: Globally disabling an IPS category to suppress one suspected false positive can expose unrelated vulnerable services. The case states: An application signature database becomes stale and detection results change. The most direct corrective action is: Attach a supported application-control profile with current signatures and suitable actions to the intended policy.

Fortiguard web category filtering (3.2) addresses another technical failure: Without current category intelligence or the right profile association, disallowed websites may still pass. This choice can be useful for that problem, but it does not establish the Application control signature matching control being assessed here.

Ips resource pressure and measurement (3.5) addresses another technical failure: Disabling IPS during high CPU without a constrained diagnosis can leave mission-critical services unprotected. The required corrective action concerns Application control signature matching; a passing result for this alternative could leave that requirement unresolved.

Ips resource pressure and measurement (3.5) would demonstrate or implement: Comparative resource sampling shows acceptable CPU and the approved IPS tests still produce expected actions. The case states: An application signature database becomes stale and detection results change. The most direct evidence is: An authorized application test appears under the correct signature and permitted or blocked action in logs.

Static url filtering and rule precedence (3.2) would demonstrate or implement: Tests of the exact allowed and denied hostnames show the intended outcome and rule ID in logs. This choice can be useful for that problem, but it does not establish the Application control signature matching control being assessed here.

Certificate inspection visibility versus decrypted inspection (3.1) would demonstrate or implement: An approved TLS test demonstrates the expected certificate metadata visibility or controlled payload inspection as configured. This case instead tests Application control signature matching; the choice measures or changes another part of the system.

Static url filtering and rule precedence (3.2) addresses another technical failure: A broad URL wildcard or wrongly ordered exception can allow unrelated destinations or block required ones. This choice can be useful for that problem, but it does not establish the Application control signature matching control being assessed here.

Ips resource pressure and measurement (3.5) addresses another technical failure: Disabling IPS during high CPU without a constrained diagnosis can leave mission-critical services unprotected. This case instead tests Application control signature matching; the choice measures or changes another part of the system.

Certificate inspection visibility versus decrypted inspection (3.1) addresses another technical failure: Certificate-only inspection cannot inspect arbitrary encrypted application payload content for threats. The required corrective action concerns Application control signature matching; a passing result for this alternative could leave that requirement unresolved.

Full ssl inspection trusted ca deployment (3.1) would demonstrate or implement: Clients that do not trust the inspection certificate may show connection warnings and reject otherwise permitted websites. The case states: A new application-control profile exists but traffic matches an earlier rule without it. The most direct risk is: A generic port allow does not distinguish approved from prohibited applications sharing encrypted or common ports.

Web filtering with certificate-only visibility (3.2) would demonstrate or implement: Encrypted HTTPS paths or page content cannot always be evaluated when only un-decrypted certificate information is visible. This choice can be useful for that problem, but it does not establish the Application control signature matching control being assessed here.

Antivirus scanning profiles on permitted flows (3.4) would demonstrate or implement: Without applied antivirus inspection or fresh signatures, malicious transferred content may not be detected. This case instead tests Application control signature matching; the choice measures or changes another part of the system.

Full ssl inspection trusted ca deployment (3.1) addresses another technical failure: Clients that do not trust the inspection certificate may show connection warnings and reject otherwise permitted websites. The case states: A security analyst wants to block one unauthorized remote-control application without denying every TLS session. The most direct corrective action is: Attach a supported application-control profile with current signatures and suitable actions to the intended policy.

Web filtering with certificate-only visibility (3.2) addresses another technical failure: Encrypted HTTPS paths or page content cannot always be evaluated when only un-decrypted certificate information is visible. This case instead tests Application control signature matching; the choice measures or changes another part of the system.

Antivirus scanning profiles on permitted flows (3.4) addresses another technical failure: Without applied antivirus inspection or fresh signatures, malicious transferred content may not be detected. The required corrective action concerns Application control signature matching; a passing result for this alternative could leave that requirement unresolved.

Inbound protected ssl server certificate handling (3.1) addresses another technical failure: An appliance lacking the proper protected-server certificate cannot safely present the intended server identity during inspection. The case states: the most appropriate corrective action AND the specific evidence confirming success. The most direct paired action and test is: An authorized application test appears under the correct signature and permitted or blocked action in logs.

Web-filter authentication and policy mismatch diagnosis (3.2) would demonstrate or implement: Web-filter and traffic events identify which identity, category and policy produced the blocked or allowed result. This case instead tests Application control signature matching; the choice measures or changes another part of the system.

Flow versus proxy antivirus scan behavior (3.4) would demonstrate or implement: Using an incompatible inspection path can disable desired scan behavior or cause unnecessary disruption to large transfers. The required paired action and test concerns Application control signature matching; a passing result for this alternative could leave that requirement unresolved.