Fortinet FCP_FGT_AD-7.6 Questions & Answers

VPN encryption rekey and lifetime compatibility (5.1) addresses another technical failure: Mismatched peer behavior during SA renewal can create periodic outages even when initial tunnel establishment succeeds. The case states: the most appropriate corrective action AND the specific evidence confirming success. The most direct paired action and test is: Controlled inter-branch tests follow only authorized hub or direct tunnel paths and stay isolated where required.

VPN firewall policies and source nat exemptions (5.1) would demonstrate or implement: Protected hosts see approved original source networks and tests show firewall permits only the required services. This case instead tests VPN hub-and-spoke versus partial mesh topology; the choice measures or changes another part of the system.

IPsec peer and routing recovery after failover (5.1) would demonstrate or implement: A healthy replacement firewall can be active while tunnel security associations, NAT or route state have not recovered. The required paired action and test concerns VPN hub-and-spoke versus partial mesh topology; a passing result for this alternative could leave that requirement unresolved.

IPsec peer and routing recovery after failover (5.1) addresses another technical failure: A healthy replacement firewall can be active while tunnel security associations, NAT or route state have not recovered. The case states: An IKE log reports peer authentication failure but operators start changing application firewall policies. The most direct diagnosis is: Use FortiGate VPN event logs and approved bounded diagnostic data to distinguish IKE, phase-two, routing and firewall policy failures.

VPN firewall policies and source nat exemptions (5.1) addresses another technical failure: Translating local private addresses unexpectedly may cause remote VPN selectors or application allowlists to reject traffic. This choice can be useful for that problem, but it does not establish the IPsec tunnel logging and diagnosis control being assessed here.

Route-based IPsec tunnel interface design (5.1) addresses another technical failure: A valid tunnel negotiation alone does not install the necessary destination route or permit application traffic. This case instead tests IPsec tunnel logging and diagnosis; the choice measures or changes another part of the system.

IPsec phase-one ike identity and proposals (5.1) would demonstrate or implement: Both intended IKE peers report an established phase-one security association with approved algorithms and correct identities. This choice can be useful for that problem, but it does not establish the IPsec tunnel logging and diagnosis control being assessed here.

Redundant site-to-site IPsec peers (5.1) would demonstrate or implement: A primary path outage activates the approved alternate encrypted connection without unauthorized traffic bypass. This case instead tests IPsec tunnel logging and diagnosis; the choice measures or changes another part of the system.

VPN encryption rekey and lifetime compatibility (5.1) would demonstrate or implement: A monitored tunnel remains usable through planned rekey with approved proposals and no unexpected loss of reachability. The required evidence concerns IPsec tunnel logging and diagnosis; a passing result for this alternative could leave that requirement unresolved.

Redundant site-to-site IPsec peers (5.1) addresses another technical failure: Two configured tunnels do not guarantee recovery if both depend on the same WAN circuit or backup routes are missing. The case states: A child SA is up and packet counters transmit but return routing is missing. The most direct corrective action is: Use FortiGate VPN event logs and approved bounded diagnostic data to distinguish IKE, phase-two, routing and firewall policy failures.

IPsec phase-one ike identity and proposals (5.1) addresses another technical failure: Peer identity or proposal mismatch can prevent tunnel negotiation even when the internet path and gateway IP are reachable. This choice can be useful for that problem, but it does not establish the IPsec tunnel logging and diagnosis control being assessed here.

VPN encryption rekey and lifetime compatibility (5.1) addresses another technical failure: Mismatched peer behavior during SA renewal can create periodic outages even when initial tunnel establishment succeeds. This case instead tests IPsec tunnel logging and diagnosis; the choice measures or changes another part of the system.

VPN hub-and-spoke versus partial mesh topology (5.1) would demonstrate or implement: Assuming spoke-to-spoke reachability in a pure hub model without appropriate routes and policies can blackhole traffic. The case states: A child SA is up and packet counters transmit but return routing is missing. The most direct risk is: Treating all IPsec connectivity faults as cryptographic problems can cause unnecessary key or proposal changes.

IPsec anti-replay and time-drift troubleshooting (5.1) would demonstrate or implement: Large traffic reordering or stale security association state can cause legitimate encrypted packets to be discarded. This choice can be useful for that problem, but it does not establish the IPsec tunnel logging and diagnosis control being assessed here.

IPsec phase-two traffic selector agreement (5.1) would demonstrate or implement: Mismatched traffic selectors can leave phase one healthy while the protected application subnet remains unreachable. The required risk concerns IPsec tunnel logging and diagnosis; a passing result for this alternative could leave that requirement unresolved.

IPsec anti-replay and time-drift troubleshooting (5.1) addresses another technical failure: Large traffic reordering or stale security association state can cause legitimate encrypted packets to be discarded. The case states: A tunnel connects only after a partner changes an IP address and the gateway identity needs checking. The most direct corrective action is: Use FortiGate VPN event logs and approved bounded diagnostic data to distinguish IKE, phase-two, routing and firewall policy failures.

VPN hub-and-spoke versus partial mesh topology (5.1) addresses another technical failure: Assuming spoke-to-spoke reachability in a pure hub model without appropriate routes and policies can blackhole traffic. This case instead tests IPsec tunnel logging and diagnosis; the choice measures or changes another part of the system.

IPsec phase-two traffic selector agreement (5.1) addresses another technical failure: Mismatched traffic selectors can leave phase one healthy while the protected application subnet remains unreachable. The required corrective action concerns IPsec tunnel logging and diagnosis; a passing result for this alternative could leave that requirement unresolved.

IPsec tunnel mtu and fragmentation (5.1) would demonstrate or implement: Large representative authorized payloads pass over the tunnel after bounded MTU adjustments without severe retransmissions. The case states: A tunnel connects only after a partner changes an IP address and the gateway identity needs checking. The most direct evidence is: A test incident is isolated to the correct VPN lifecycle stage and the exact corrected phase is verified.

Route-based IPsec tunnel interface design (5.1) would demonstrate or implement: Route lookup, tunnel counters and narrow firewall policies confirm authorized packets cross the correct VPN interface. This choice can be useful for that problem, but it does not establish the IPsec tunnel logging and diagnosis control being assessed here.

VPN hub-and-spoke versus partial mesh topology (5.1) would demonstrate or implement: Controlled inter-branch tests follow only authorized hub or direct tunnel paths and stay isolated where required. This case instead tests IPsec tunnel logging and diagnosis; the choice measures or changes another part of the system.

VPN hub-and-spoke versus partial mesh topology (5.1) addresses another technical failure: Assuming spoke-to-spoke reachability in a pure hub model without appropriate routes and policies can blackhole traffic. The case states: A branch VPN disconnects every few hours and phase-one rekey events must be correlated with time. The most direct corrective action is: Use FortiGate VPN event logs and approved bounded diagnostic data to distinguish IKE, phase-two, routing and firewall policy failures.

Route-based IPsec tunnel interface design (5.1) addresses another technical failure: A valid tunnel negotiation alone does not install the necessary destination route or permit application traffic. This choice can be useful for that problem, but it does not establish the IPsec tunnel logging and diagnosis control being assessed here.

IPsec tunnel mtu and fragmentation (5.1) addresses another technical failure: IPsec encapsulation overhead can make large packets fail even while small ICMP connectivity tests succeed. The required corrective action concerns IPsec tunnel logging and diagnosis; a passing result for this alternative could leave that requirement unresolved.

IPsec peer and routing recovery after failover (5.1) would demonstrate or implement: A healthy replacement firewall can be active while tunnel security associations, NAT or route state have not recovered. This choice can be useful for that problem, but it does not establish the IPsec tunnel logging and diagnosis control being assessed here.

VPN encryption rekey and lifetime compatibility (5.1) would demonstrate or implement: Mismatched peer behavior during SA renewal can create periodic outages even when initial tunnel establishment succeeds. This case instead tests IPsec tunnel logging and diagnosis; the choice measures or changes another part of the system.

VPN firewall policies and source nat exemptions (5.1) would demonstrate or implement: Translating local private addresses unexpectedly may cause remote VPN selectors or application allowlists to reject traffic. The required risk concerns IPsec tunnel logging and diagnosis; a passing result for this alternative could leave that requirement unresolved.

IPsec peer and routing recovery after failover (5.1) addresses another technical failure: A healthy replacement firewall can be active while tunnel security associations, NAT or route state have not recovered. The case states: A support team needs to distinguish a negotiation failure from a permitted encrypted flow denied after decryption. The most direct corrective action is: Use FortiGate VPN event logs and approved bounded diagnostic data to distinguish IKE, phase-two, routing and firewall policy failures.

VPN encryption rekey and lifetime compatibility (5.1) addresses another technical failure: Mismatched peer behavior during SA renewal can create periodic outages even when initial tunnel establishment succeeds. This case instead tests IPsec tunnel logging and diagnosis; the choice measures or changes another part of the system.

VPN firewall policies and source nat exemptions (5.1) addresses another technical failure: Translating local private addresses unexpectedly may cause remote VPN selectors or application allowlists to reject traffic. The required corrective action concerns IPsec tunnel logging and diagnosis; a passing result for this alternative could leave that requirement unresolved.

Redundant site-to-site IPsec peers (5.1) would demonstrate or implement: A primary path outage activates the approved alternate encrypted connection without unauthorized traffic bypass. The case states: A support team needs to distinguish a negotiation failure from a permitted encrypted flow denied after decryption. The most direct paired action and test is: Use FortiGate VPN event logs and approved bounded diagnostic data to distinguish IKE, phase-two, routing and firewall policy failures.

IPsec anti-replay and time-drift troubleshooting (5.1) addresses another technical failure: Large traffic reordering or stale security association state can cause legitimate encrypted packets to be discarded. This choice can be useful for that problem, but it does not establish the IPsec tunnel logging and diagnosis control being assessed here.

IPsec phase-one ike identity and proposals (5.1) would demonstrate or implement: Peer identity or proposal mismatch can prevent tunnel negotiation even when the internet path and gateway IP are reachable. The paired-answer requirement concerns IPsec tunnel logging and diagnosis; this alternative does not provide the matching intervention and separate acceptance evidence.