Fortinet FCP_FGT_AD-7.6 Questions & Answers

Static url filtering and rule precedence (3.2) addresses another technical failure: A broad URL wildcard or wrongly ordered exception can allow unrelated destinations or block required ones. The case states: A system accepts small test files but larger permitted packages fail due to the chosen scanning controls. The most direct paired action and test is: Select supported flow-based or proxy-based antivirus features to meet acceptable detection, file-size handling and latency requirements.

Application signatures and false-positive review (3.3) would demonstrate or implement: A targeted approved application completes while an unauthorized signature test remains blocked after the adjustment. This choice can be useful for that problem, but it does not establish the Flow versus proxy antivirus scan behavior control being assessed here.

Ips resource pressure and measurement (3.5) would demonstrate or implement: Disabling IPS during high CPU without a constrained diagnosis can leave mission-critical services unprotected. The required paired action and test concerns Flow versus proxy antivirus scan behavior; a passing result for this alternative could leave that requirement unresolved.

Inbound protected ssl server certificate handling (3.1) addresses another technical failure: An appliance lacking the proper protected-server certificate cannot safely present the intended server identity during inspection. The case states: A helpdesk ticket reports a blocked document but the security team has not inspected its antivirus event. The most direct diagnosis is: Review FortiGate antivirus logs, detected file type, action and supported quarantine or sandbox response before deciding on an exception.

Web-filter block pages and certificate user experience (3.2) addresses another technical failure: Improper certificate trust or unsupported browser behavior can turn an intended policy block into confusing TLS errors. This choice can be useful for that problem, but it does not establish the Antivirus event investigation and quarantine controls control being assessed here.

Certificate-chain expiry and handshake diagnosis (3.1) addresses another technical failure: Blanket bypass of certificate validation can conceal expired or untrusted servers and unsafe TLS behavior. This case instead tests Antivirus event investigation and quarantine controls; the choice measures or changes another part of the system.

Application control signature matching (3.3) would demonstrate or implement: An authorized application test appears under the correct signature and permitted or blocked action in logs. This choice can be useful for that problem, but it does not establish the Antivirus event investigation and quarantine controls control being assessed here.

TLS inspection exceptions and sensitive traffic (3.1) would demonstrate or implement: Approved sensitive flows work under narrow exclusions while ordinary eligible web traffic remains inspected. This case instead tests Antivirus event investigation and quarantine controls; the choice measures or changes another part of the system.

Certificate-chain expiry and handshake diagnosis (3.1) would demonstrate or implement: A test of the target site completes with a validated chain or produces a correctly identified and bounded exception decision. The required evidence concerns Antivirus event investigation and quarantine controls; a passing result for this alternative could leave that requirement unresolved.

TLS inspection exceptions and sensitive traffic (3.1) addresses another technical failure: Overly broad exclusions can create uninspected channels; blanket interception can break approved confidential services. The case states: An AV signature identifies a test file and the operator mistakes monitoring for quarantine. The most direct corrective action is: Review FortiGate antivirus logs, detected file type, action and supported quarantine or sandbox response before deciding on an exception.

Application control signature matching (3.3) addresses another technical failure: A generic port allow does not distinguish approved from prohibited applications sharing encrypted or common ports. This case instead tests Antivirus event investigation and quarantine controls; the choice measures or changes another part of the system.

Certificate-chain expiry and handshake diagnosis (3.1) addresses another technical failure: Blanket bypass of certificate validation can conceal expired or untrusted servers and unsafe TLS behavior. The required corrective action concerns Antivirus event investigation and quarantine controls; a passing result for this alternative could leave that requirement unresolved.

Flow versus proxy inspection processing model (3.2) would demonstrate or implement: Assuming proxy-only functions are present in flow mode can leave desired inspection capabilities unavailable. The case states: An AV signature identifies a test file and the operator mistakes monitoring for quarantine. The most direct risk is: Disabling antivirus for a broad source population after one false positive weakens protection without evidence.

Ips signature sensor and firewall attachment (3.5) would demonstrate or implement: An IPS profile that is absent from the matched allow rule cannot block a known threat against that traffic. This choice can be useful for that problem, but it does not establish the Antivirus event investigation and quarantine controls control being assessed here.

Application monitoring versus blocking (3.3) would demonstrate or implement: Confusing a monitor-only action with an enforcement action can leave a prohibited application available. The required risk concerns Antivirus event investigation and quarantine controls; a passing result for this alternative could leave that requirement unresolved.

Application monitoring versus blocking (3.3) addresses another technical failure: Confusing a monitor-only action with an enforcement action can leave a prohibited application available. The case states: A known clean signed software installer is misclassified and requires independent file validation. The most direct evidence is: Review FortiGate antivirus logs, detected file type, action and supported quarantine or sandbox response before deciding on an exception.

Flow versus proxy inspection processing model (3.2) addresses another technical failure: Assuming proxy-only functions are present in flow mode can leave desired inspection capabilities unavailable. This choice can be useful for that problem, but it does not establish the Antivirus event investigation and quarantine controls control being assessed here.

Ips signature sensor and firewall attachment (3.5) addresses another technical failure: An IPS profile that is absent from the matched allow rule cannot block a known threat against that traffic. The required evidence concerns Antivirus event investigation and quarantine controls; a passing result for this alternative could leave that requirement unresolved.

Application control profile and firewall policy scope (3.3) would demonstrate or implement: The intended clients show the specified application-control decisions while excluded groups remain on their own policies. This choice can be useful for that problem, but it does not establish the Antivirus event investigation and quarantine controls control being assessed here.

Ips false-positive exception and tuning (3.5) would demonstrate or implement: An authorized legitimate transaction works after tuning while the required nonmalicious detection validation still succeeds. This case instead tests Antivirus event investigation and quarantine controls; the choice measures or changes another part of the system.

Fortiguard web category filtering (3.2) would demonstrate or implement: Approved test URLs show expected category names and policy actions in the FortiGate web-filter events. The required evidence concerns Antivirus event investigation and quarantine controls; a passing result for this alternative could leave that requirement unresolved.

Application control profile and firewall policy scope (3.3) addresses another technical failure: A profile applied to the wrong policy can miss the affected clients or disrupt unrelated approved applications. This choice can be useful for that problem, but it does not establish the Antivirus event investigation and quarantine controls control being assessed here.

Ips false-positive exception and tuning (3.5) addresses another technical failure: Globally disabling an IPS category to suppress one suspected false positive can expose unrelated vulnerable services. This case instead tests Antivirus event investigation and quarantine controls; the choice measures or changes another part of the system.

Fortiguard web category filtering (3.2) addresses another technical failure: Without current category intelligence or the right profile association, disallowed websites may still pass. The required diagnosis concerns Antivirus event investigation and quarantine controls; a passing result for this alternative could leave that requirement unresolved.

Ips resource pressure and measurement (3.5) would demonstrate or implement: Disabling IPS during high CPU without a constrained diagnosis can leave mission-critical services unprotected. The case states: A user downloads a suspicious file and investigators need to know whether FortiGate actually blocked it. The most direct risk is: Disabling antivirus for a broad source population after one false positive weakens protection without evidence.

Static url filtering and rule precedence (3.2) would demonstrate or implement: A broad URL wildcard or wrongly ordered exception can allow unrelated destinations or block required ones. This case instead tests Antivirus event investigation and quarantine controls; the choice measures or changes another part of the system.

Application signatures and false-positive review (3.3) would demonstrate or implement: A broad category override can silently re-allow truly prohibited software while hiding identification errors. The required risk concerns Antivirus event investigation and quarantine controls; a passing result for this alternative could leave that requirement unresolved.

Ips resource pressure and measurement (3.5) addresses another technical failure: Disabling IPS during high CPU without a constrained diagnosis can leave mission-critical services unprotected. This choice can be useful for that problem, but it does not establish the Antivirus event investigation and quarantine controls control being assessed here.

Static url filtering and rule precedence (3.2) addresses another technical failure: A broad URL wildcard or wrongly ordered exception can allow unrelated destinations or block required ones. This case instead tests Antivirus event investigation and quarantine controls; the choice measures or changes another part of the system.

Application signatures and false-positive review (3.3) addresses another technical failure: A broad category override can silently re-allow truly prohibited software while hiding identification errors. The required corrective action concerns Antivirus event investigation and quarantine controls; a passing result for this alternative could leave that requirement unresolved.

Web filtering with certificate-only visibility (3.2) addresses another technical failure: Encrypted HTTPS paths or page content cannot always be evaluated when only un-decrypted certificate information is visible. This choice can be useful for that problem, but it does not establish the Antivirus event investigation and quarantine controls control being assessed here.

Certificate inspection visibility versus decrypted inspection (3.1) would demonstrate or implement: An approved TLS test demonstrates the expected certificate metadata visibility or controlled payload inspection as configured. This case instead tests Antivirus event investigation and quarantine controls; the choice measures or changes another part of the system.

Static url filtering and rule precedence (3.2) would demonstrate or implement: A broad URL wildcard or wrongly ordered exception can allow unrelated destinations or block required ones. The paired-answer requirement concerns Antivirus event investigation and quarantine controls; this alternative does not provide the matching intervention and separate acceptance evidence.