Fortinet FCP_FGT_AD-7.6 Questions & Answers

Sd-wan performance sla probes (4.2) addresses another technical failure: An unreachable or unsuitable probe target can make a healthy WAN look failed or fail to detect real application degradation. The case states: the most appropriate corrective action AND the specific evidence confirming success. The most direct paired action and test is: Traffic logs and route diagnostics show both the intended route and an approved first-match firewall policy.

Sd-wan members and zones (4.2) would demonstrate or implement: An omitted WAN member or wrong zone can prevent an uplink from participating even while the physical port is operational. This choice can be useful for that problem, but it does not establish the Routing versus firewall policy separation control being assessed here.

Sd-wan rule order and route interaction (4.2) would demonstrate or implement: A test flow records the expected SD-WAN rule, selected member, eligible route and firewall policy. The paired-answer requirement concerns Routing versus firewall policy separation; this alternative does not provide the matching intervention and separate acceptance evidence.

Static route next-hop reachability (4.1) addresses another technical failure: A route to an unreachable next hop can blackhole permitted packets even when its configuration appears syntactically valid. The case states: A dual-ISP FortiGate has a second WAN link but it never appears as an SD-WAN member. The most direct diagnosis is: Assign supported WAN interfaces to appropriate FortiGate SD-WAN members and zones before applying zone-scoped policy and steering.

Static route distance and priority (4.1) addresses another technical failure: Mismatched distance or priority can select a slower WAN path while the preferred next hop remains available. This choice can be useful for that problem, but it does not establish the Sd-wan members and zones control being assessed here.

Routing versus firewall policy separation (4.1) addresses another technical failure: A successful route lookup does not itself authorize a packet, and an allow rule does not create a missing return route. The required diagnosis concerns Sd-wan members and zones; a passing result for this alternative could leave that requirement unresolved.

Static route distance and priority (4.1) would demonstrate or implement: Route-table inspection and a controlled primary-path test confirm expected route preference and backup behavior. The case states: A dual-ISP FortiGate has a second WAN link but it never appears as an SD-WAN member. The most direct evidence is: SD-WAN member status, zone membership and a controlled flow agree with the approved path selection.

Static route next-hop reachability (4.1) would demonstrate or implement: A bounded trace and route lookup show the gateway is reachable and the authorized flow leaves by the intended interface. This choice can be useful for that problem, but it does not establish the Sd-wan members and zones control being assessed here.

Equal-cost route redundancy and path verification (4.1) would demonstrate or implement: Controlled client tests demonstrate permitted traffic distribution and recovery after one approved path becomes unavailable. This case instead tests Sd-wan members and zones; the choice measures or changes another part of the system.

Static route next-hop reachability (4.1) addresses another technical failure: A route to an unreachable next hop can blackhole permitted packets even when its configuration appears syntactically valid. The case states: A firewall policy references an individual uplink when the deployment requires zone-based policies. The most direct corrective action is: Assign supported WAN interfaces to appropriate FortiGate SD-WAN members and zones before applying zone-scoped policy and steering.

Static route distance and priority (4.1) addresses another technical failure: Mismatched distance or priority can select a slower WAN path while the preferred next hop remains available. This case instead tests Sd-wan members and zones; the choice measures or changes another part of the system.

Equal-cost route redundancy and path verification (4.1) addresses another technical failure: Assuming equal-cost paths provide perfect balancing or fast failover without link monitoring can cause session disruption. The required corrective action concerns Sd-wan members and zones; a passing result for this alternative could leave that requirement unresolved.

Longest-prefix match and route lookup (4.1) would demonstrate or implement: A broad default route cannot override an installed more-specific matching prefix solely because its interface is healthy. The case states: A firewall policy references an individual uplink when the deployment requires zone-based policies. The most direct risk is: An omitted WAN member or wrong zone can prevent an uplink from participating even while the physical port is operational.

Equal-cost route redundancy and path verification (4.1) would demonstrate or implement: Assuming equal-cost paths provide perfect balancing or fast failover without link monitoring can cause session disruption. This case instead tests Sd-wan members and zones; the choice measures or changes another part of the system.

Routing versus firewall policy separation (4.1) would demonstrate or implement: A successful route lookup does not itself authorize a packet, and an allow rule does not create a missing return route. The required risk concerns Sd-wan members and zones; a passing result for this alternative could leave that requirement unresolved.

Routing versus firewall policy separation (4.1) addresses another technical failure: A successful route lookup does not itself authorize a packet, and an allow rule does not create a missing return route. This choice can be useful for that problem, but it does not establish the Sd-wan members and zones control being assessed here.

Equal-cost route redundancy and path verification (4.1) addresses another technical failure: Assuming equal-cost paths provide perfect balancing or fast failover without link monitoring can cause session disruption. This case instead tests Sd-wan members and zones; the choice measures or changes another part of the system.

Longest-prefix match and route lookup (4.1) addresses another technical failure: A broad default route cannot override an installed more-specific matching prefix solely because its interface is healthy. The required corrective action concerns Sd-wan members and zones; a passing result for this alternative could leave that requirement unresolved.

Longest-prefix match and route lookup (4.1) would demonstrate or implement: A test destination uses the expected longest-prefix route and packet output agrees with the selected next hop. The case states: An MPLS path needs different inspection policy from public internet traffic in the SD-WAN design. The most direct evidence is: SD-WAN member status, zone membership and a controlled flow agree with the approved path selection.

Routing versus firewall policy separation (4.1) would demonstrate or implement: Traffic logs and route diagnostics show both the intended route and an approved first-match firewall policy. This case instead tests Sd-wan members and zones; the choice measures or changes another part of the system.

Static route distance and priority (4.1) would demonstrate or implement: Route-table inspection and a controlled primary-path test confirm expected route preference and backup behavior. The required evidence concerns Sd-wan members and zones; a passing result for this alternative could leave that requirement unresolved.

Static route distance and priority (4.1) addresses another technical failure: Mismatched distance or priority can select a slower WAN path while the preferred next hop remains available. The case states: A new virtual tunnel is added to the wrong zone and cannot be selected by the intended rule. The most direct corrective action is: Assign supported WAN interfaces to appropriate FortiGate SD-WAN members and zones before applying zone-scoped policy and steering.

Longest-prefix match and route lookup (4.1) addresses another technical failure: A broad default route cannot override an installed more-specific matching prefix solely because its interface is healthy. This choice can be useful for that problem, but it does not establish the Sd-wan members and zones control being assessed here.

Routing versus firewall policy separation (4.1) addresses another technical failure: A successful route lookup does not itself authorize a packet, and an allow rule does not create a missing return route. This case instead tests Sd-wan members and zones; the choice measures or changes another part of the system.

Static route next-hop reachability (4.1) would demonstrate or implement: A route to an unreachable next hop can blackhole permitted packets even when its configuration appears syntactically valid. The case states: A new virtual tunnel is added to the wrong zone and cannot be selected by the intended rule. The most direct risk is: An omitted WAN member or wrong zone can prevent an uplink from participating even while the physical port is operational.

Static route distance and priority (4.1) would demonstrate or implement: Mismatched distance or priority can select a slower WAN path while the preferred next hop remains available. This choice can be useful for that problem, but it does not establish the Sd-wan members and zones control being assessed here.

Routing versus firewall policy separation (4.1) would demonstrate or implement: A successful route lookup does not itself authorize a packet, and an allow rule does not create a missing return route. The required risk concerns Sd-wan members and zones; a passing result for this alternative could leave that requirement unresolved.

Static route next-hop reachability (4.1) addresses another technical failure: A route to an unreachable next hop can blackhole permitted packets even when its configuration appears syntactically valid. This choice can be useful for that problem, but it does not establish the Sd-wan members and zones control being assessed here.

Static route distance and priority (4.1) addresses another technical failure: Mismatched distance or priority can select a slower WAN path while the preferred next hop remains available. This case instead tests Sd-wan members and zones; the choice measures or changes another part of the system.

Routing versus firewall policy separation (4.1) addresses another technical failure: A successful route lookup does not itself authorize a packet, and an allow rule does not create a missing return route. The required corrective action concerns Sd-wan members and zones; a passing result for this alternative could leave that requirement unresolved.

Static route distance and priority (4.1) would demonstrate or implement: Mismatched distance or priority can select a slower WAN path while the preferred next hop remains available. The case states: the most appropriate corrective action AND the specific evidence confirming success. The most direct paired action and test is: SD-WAN member status, zone membership and a controlled flow agree with the approved path selection.

Equal-cost route redundancy and path verification (4.1) addresses another technical failure: Assuming equal-cost paths provide perfect balancing or fast failover without link monitoring can cause session disruption. This choice can be useful for that problem, but it does not establish the Sd-wan members and zones control being assessed here.

Static route next-hop reachability (4.1) would demonstrate or implement: A bounded trace and route lookup show the gateway is reachable and the authorized flow leaves by the intended interface. The paired-answer requirement concerns Sd-wan members and zones; this alternative does not provide the matching intervention and separate acceptance evidence.