Fortinet FCP_FGT_AD-7.6 Questions & Answers

Antivirus event investigation and quarantine controls (3.4) would demonstrate or implement: Disabling antivirus for a broad source population after one false positive weakens protection without evidence. This case instead tests Application monitoring versus blocking; the choice measures or changes another part of the system.

Certificate-chain expiry and handshake diagnosis (3.1) addresses another technical failure: Blanket bypass of certificate validation can conceal expired or untrusted servers and unsafe TLS behavior. The required paired action and test concerns Application monitoring versus blocking; a passing result for this alternative could leave that requirement unresolved.

Web-filter block pages and certificate user experience (3.2) would demonstrate or implement: An authorized test user receives a clear expected block result and the firewall records the matching category or URL rule. The paired-answer requirement concerns Application monitoring versus blocking; this alternative does not provide the matching intervention and separate acceptance evidence.

Fortiguard web category filtering (3.2) addresses another technical failure: Without current category intelligence or the right profile association, disallowed websites may still pass. The case states: Contractor traffic uses a guest policy and never encounters the staff application-control profile. The most direct diagnosis is: Apply application-control inspection only to appropriate policy traffic and validate the intended user, interface and application combination.

Ips false-positive exception and tuning (3.5) addresses another technical failure: Globally disabling an IPS category to suppress one suspected false positive can expose unrelated vulnerable services. This choice can be useful for that problem, but it does not establish the Application control profile and firewall policy scope control being assessed here.

Ips resource pressure and measurement (3.5) addresses another technical failure: Disabling IPS during high CPU without a constrained diagnosis can leave mission-critical services unprotected. This case instead tests Application control profile and firewall policy scope; the choice measures or changes another part of the system.

Static url filtering and rule precedence (3.2) would demonstrate or implement: Tests of the exact allowed and denied hostnames show the intended outcome and rule ID in logs. The case states: Contractor traffic uses a guest policy and never encounters the staff application-control profile. The most direct evidence is: The intended clients show the specified application-control decisions while excluded groups remain on their own policies.

Certificate inspection visibility versus decrypted inspection (3.1) would demonstrate or implement: An approved TLS test demonstrates the expected certificate metadata visibility or controlled payload inspection as configured. This choice can be useful for that problem, but it does not establish the Application control profile and firewall policy scope control being assessed here.

Ips resource pressure and measurement (3.5) would demonstrate or implement: Comparative resource sampling shows acceptable CPU and the approved IPS tests still produce expected actions. This case instead tests Application control profile and firewall policy scope; the choice measures or changes another part of the system.

Ips resource pressure and measurement (3.5) addresses another technical failure: Disabling IPS during high CPU without a constrained diagnosis can leave mission-critical services unprotected. The case states: A security team deploys an aggressive profile to a server-to-server policy not included in the change. The most direct corrective action is: Apply application-control inspection only to appropriate policy traffic and validate the intended user, interface and application combination.

Certificate inspection visibility versus decrypted inspection (3.1) addresses another technical failure: Certificate-only inspection cannot inspect arbitrary encrypted application payload content for threats. This choice can be useful for that problem, but it does not establish the Application control profile and firewall policy scope control being assessed here.

Static url filtering and rule precedence (3.2) addresses another technical failure: A broad URL wildcard or wrongly ordered exception can allow unrelated destinations or block required ones. The required corrective action concerns Application control profile and firewall policy scope; a passing result for this alternative could leave that requirement unresolved.

Full ssl inspection trusted ca deployment (3.1) would demonstrate or implement: Clients that do not trust the inspection certificate may show connection warnings and reject otherwise permitted websites. The case states: A security team deploys an aggressive profile to a server-to-server policy not included in the change. The most direct risk is: A profile applied to the wrong policy can miss the affected clients or disrupt unrelated approved applications.

Web filtering with certificate-only visibility (3.2) would demonstrate or implement: Encrypted HTTPS paths or page content cannot always be evaluated when only un-decrypted certificate information is visible. This choice can be useful for that problem, but it does not establish the Application control profile and firewall policy scope control being assessed here.

Antivirus scanning profiles on permitted flows (3.4) would demonstrate or implement: Without applied antivirus inspection or fresh signatures, malicious transferred content may not be detected. The required risk concerns Application control profile and firewall policy scope; a passing result for this alternative could leave that requirement unresolved.

Full ssl inspection trusted ca deployment (3.1) addresses another technical failure: Clients that do not trust the inspection certificate may show connection warnings and reject otherwise permitted websites. The case states: An application is blocked for one department but should be permitted for another authorized group. The most direct corrective action is: Apply application-control inspection only to appropriate policy traffic and validate the intended user, interface and application combination.

Antivirus scanning profiles on permitted flows (3.4) addresses another technical failure: Without applied antivirus inspection or fresh signatures, malicious transferred content may not be detected. This choice can be useful for that problem, but it does not establish the Application control profile and firewall policy scope control being assessed here.

Web filtering with certificate-only visibility (3.2) addresses another technical failure: Encrypted HTTPS paths or page content cannot always be evaluated when only un-decrypted certificate information is visible. The required corrective action concerns Application control profile and firewall policy scope; a passing result for this alternative could leave that requirement unresolved.

Web-filter authentication and policy mismatch diagnosis (3.2) would demonstrate or implement: Web-filter and traffic events identify which identity, category and policy produced the blocked or allowed result. The case states: An application is blocked for one department but should be permitted for another authorized group. The most direct evidence is: The intended clients show the specified application-control decisions while excluded groups remain on their own policies.

Inbound protected ssl server certificate handling (3.1) would demonstrate or implement: An authorized external TLS client validates the protected service certificate and the required inspection policy generates expected logs. This case instead tests Application control profile and firewall policy scope; the choice measures or changes another part of the system.

Flow versus proxy antivirus scan behavior (3.4) would demonstrate or implement: Test files of allowed sizes and types are inspected as specified and resource metrics meet the operating target. The required evidence concerns Application control profile and firewall policy scope; a passing result for this alternative could leave that requirement unresolved.

Web-filter authentication and policy mismatch diagnosis (3.2) addresses another technical failure: An apparent web-filter failure can arise from a different matched policy or an authentication group mismatch. The case states: A policy inherits a default profile with monitoring actions rather than the required block actions. The most direct corrective action is: Apply application-control inspection only to appropriate policy traffic and validate the intended user, interface and application combination.

Inbound protected ssl server certificate handling (3.1) addresses another technical failure: An appliance lacking the proper protected-server certificate cannot safely present the intended server identity during inspection. This choice can be useful for that problem, but it does not establish the Application control profile and firewall policy scope control being assessed here.

Flow versus proxy antivirus scan behavior (3.4) addresses another technical failure: Using an incompatible inspection path can disable desired scan behavior or cause unnecessary disruption to large transfers. The required corrective action concerns Application control profile and firewall policy scope; a passing result for this alternative could leave that requirement unresolved.

Web-filter block pages and certificate user experience (3.2) would demonstrate or implement: Improper certificate trust or unsupported browser behavior can turn an intended policy block into confusing TLS errors. The case states: A policy inherits a default profile with monitoring actions rather than the required block actions. The most direct risk is: A profile applied to the wrong policy can miss the affected clients or disrupt unrelated approved applications.

Certificate-chain expiry and handshake diagnosis (3.1) would demonstrate or implement: Blanket bypass of certificate validation can conceal expired or untrusted servers and unsafe TLS behavior. This case instead tests Application control profile and firewall policy scope; the choice measures or changes another part of the system.

Antivirus event investigation and quarantine controls (3.4) would demonstrate or implement: Disabling antivirus for a broad source population after one false positive weakens protection without evidence. The required risk concerns Application control profile and firewall policy scope; a passing result for this alternative could leave that requirement unresolved.

Web-filter block pages and certificate user experience (3.2) addresses another technical failure: Improper certificate trust or unsupported browser behavior can turn an intended policy block into confusing TLS errors. The case states: A newly created SD-WAN zone changes the matched firewall rule and application events disappear. The most direct corrective action is: Apply application-control inspection only to appropriate policy traffic and validate the intended user, interface and application combination.

Certificate-chain expiry and handshake diagnosis (3.1) addresses another technical failure: Blanket bypass of certificate validation can conceal expired or untrusted servers and unsafe TLS behavior. This case instead tests Application control profile and firewall policy scope; the choice measures or changes another part of the system.

Antivirus event investigation and quarantine controls (3.4) addresses another technical failure: Disabling antivirus for a broad source population after one false positive weakens protection without evidence. The required corrective action concerns Application control profile and firewall policy scope; a passing result for this alternative could leave that requirement unresolved.

Antivirus inspection of encrypted downloads (3.4) would demonstrate or implement: A controlled HTTPS test shows the approved file is inspected under the intended full-inspection policy without trust errors. The case states: A newly created SD-WAN zone changes the matched firewall rule and application events disappear. The most direct paired action and test is: Apply application-control inspection only to appropriate policy traffic and validate the intended user, interface and application combination.

Certificate-chain expiry and handshake diagnosis (3.1) would demonstrate or implement: Blanket bypass of certificate validation can conceal expired or untrusted servers and unsafe TLS behavior. This choice can be useful for that problem, but it does not establish the Application control profile and firewall policy scope control being assessed here.

TLS inspection exceptions and sensitive traffic (3.1) addresses another technical failure: Overly broad exclusions can create uninspected channels; blanket interception can break approved confidential services. The required paired action and test concerns Application control profile and firewall policy scope; a passing result for this alternative could leave that requirement unresolved.