📘 Free FCP_FAZ_AN-7.6 Sample Questions
An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The
requirement is that FortiGate sends DPD probes only when there is no inbound traffic.
Which DPD mode on FortiGate meets this requirement?
A
Enabled
B
On Idle
C
Disabled
D
. On Demand
Correct Answer:
D. . On Demand
Explanation:
The correct answer is D. On Demand.
DPD mode "On Demand" is specifically designed to send probes only when the FortiGate device determines
that the peer is not responding, which aligns with the requirement to send DPD probes only in the absence of
inbound traffic. This minimizes unnecessary traffic while still ensuring the integrity and availability of the VPN
tunnel.
Evaluation of Options:
A. Enabled
This setting allows DPD probes to be continuously sent regardless of the traffic state. Consequently, it does
not satisfy the requirement to probe only when there is no inbound traffic, thereby increasing bandwidth
usage unnecessarily.
B. On Idle
While this option sends DPD probes when the tunnel is idle, it may still probe even if low levels of inbound
traffic are present. This could lead to false positives regarding tunnel status and does not adhere strictly to
the requirement for only sending probes during complete inactivity.
C. Disabled
not suitable for active monitoring.
D. On Demand
during inactivity.
References:
This option completely turns off DPD functionality, meaning that the FortiGate would not send any probes to
determine the status of the tunnel. Therefore, it fails to meet the requirement of detecting dead tunnels and is
This mode strategically sends DPD probes only when there is a detection of potential inaccessibility,
efficiently conserving resources while adhering to the intended operational model of proactive monitoring
https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/599088/dead-peer-detection
https://www.fortinet.com/content/dam/fortinet/assets/whitepapers/fortigate-ipsec-vpn.pdf
https://www.fortinet.com/content/dam/fortinet/assets/whitepapers/FortiOS-Admin-Guides.pdf
Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true? (Choose two.)
A
If SD-WAN is disabled, you can configure the parameter v4-ecmp-mode to volume-based.
B
If SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP.
C
If SD-WAN is disabled, you configure the load balancing algorithm in config system settings.
D
If SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance-mode.
Correct Answer:
C. If SD-WAN is disabled, you configure the load balancing algorithm in config system settings.
Explanation:
CD is correct because they accurately describe the configuration parameters of ECMP on FortiGate devices
under both SD-WAN enabled and disabled scenarios.
Reasoning:
Option C asserts that when SD-WAN is disabled, the load balancing algorithm can be configured under config
system settings. This is true, as traditional static routing supports ECMP with more basic algorithms when
SD-WAN features are not in play, allowing for straightforward load distribution based solely on routing
metrics.
Option D correctly states that with SD-WAN enabled, the load balancing algorithm is managed via the load-
balance-mode parameter. This reflects FortiGate's capability to utilize advanced load balancing techniques
that optimize bandwidth and application performance across multiple paths.
Evaluation of Incorrect Options:
functionalities.
References:
Option A incorrectly states that when SD-WAN is disabled, the v4-ecmp-mode can be set to volume-based.
This is misleading because when not using SD-WAN, the ECMP options are generally limited to uniform cost
paths rather than sophisticated volume-based metrics, which are typically characteristic of SD-WAN
Option B misrepresents the application of ECMP under SD-WAN, implying that routes with unequal distances
and priorities can participate in ECMP, which is not feasible. ECMP inherently requires equal-cost paths; thus,
differential metrics prevent the participation of such routes in load balancing.
https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/393969/fortigate-routing-and-
routing-protocols
https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/391487/performance
https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/393959/sd-wan
You have created a web filter profile named restrict_media-profile with a daily category usage quota.
When you are adding the profile to the firewall policy, the restrict_media-profile is not listed in the available web
profile drop down.
What could be the reason?
A
The firewall policy is in no-inspection mode instead of deep-inspection.
B
The inspection mode in the firewall policy is not matching with web filter profile feature set.
C
The web filter profile is already referenced in another firewall policy.
D
The naming convention used in the web filter profile is restricting it in the firewall policy.
Correct Answer:
B. The inspection mode in the firewall policy is not matching with web filter profile feature set.
Explanation:
B is correct because the inspection mode in the firewall policy does not match the capabilities required by the
In Fortinet's architecture, web filtering operations vary based on the inspection mode employed in a firewall
policy. The restrict_media-profile requires deep inspection to effectively enforce daily category usage quotas.
If the policy is set to no-inspection mode, this feature cannot be applied, thus excluding the profile from the
dropdown menu. Consequently, a mismatch in inspection mode directly impacts the operational compatibility
of the profile.
Evaluation of Other Options:
A. The firewall policy is in no-inspection mode instead of deep-inspection.
While this option identifies a potential issue, it is ultimately encompassed within option B. No-inspection mode
being the reason for exclusion confirms that the inspection mode must align with the profile’s feature set for
visibility in the dropdown.
C. The web filter profile is already referenced in another firewall policy.
Fortinet allows the same web filter profile to be referenced by multiple policies simultaneously. Therefore, a
restriction due to pre-usage in another policy would not prevent it from appearing in the selection list.
D. The naming convention used in the web filter profile is restricting it in the firewall policy.
Naming conventions do not play a role in the functionality or visibility of profiles within the Fortinet
configuration interface. Profiles are primarily restricted based on functional compatibility rather than naming
criteria.
Authoritative References:
https://docs.fortinet.com/document/fortigate/7.2.0/administration-guide/108452/configuring-web-filtering
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/196831/advanced-web-filtering-
features
https://community.fortinet.com/t5/FortiGate/Technical-Note-Web-filter-profile-missing-in-firewall-policy/ta-
p/192786
As an administrator you have created an IPS profile, but it is not performing as expected. While testing you got the
output as shown in the exhibit .What could be the possible reason of the diagnose output shown in the exhibit?
A
There is a no firewall policy configured with an IPS security profile.
B
FortiGate entered into IPS fail open state.
C
Administrator entered the command diagnose test application ipsmonitor 5.
D
Administrator entered the command diagnose test application ipsmonitor 99.
Correct Answer:
A. There is a no firewall policy configured with an IPS security profile.
The predefined deep-inspection and custom-deep-inspection profiles exclude some web categories from SSL
inspection, as shown in the exhibit.
For which two reasons are these web categories exempted? (Choose two.)
A
The FortiGate temporary certificate denies the browser’s access to websites that use HTTP Strict Transport
Security.
B
These websites are in an allowlist of reputable domain names maintained by FortiGuard.
C
The resources utilization is optimized because these websites are in the trusted domain list on FortiGate.
D
The legal regulation aims to prioritize user privacy and protect sensitive information for these websites.
Correct Answer:
B. These websites are in an allowlist of reputable domain names maintained by FortiGuard.
The NOC team connects to the FortiGate GUI with the NOC_Access admin profile. They request that their GUI
sessions do not disconnect too early during inactivity. What must the administrator configure to answer this specific request from the NOC team?
A
Move NOC_Access to the top of the list to ensure all profile settings take effect.
B
Increase the offline value of the Override Idle Timeout parameter in the NOC_Access admin profile.
C
Ensure that all NOC_Access users are assigned the super_admin role to guarantee access
D
Increase the admintimeout value under config system accprofile NOC_Access.
Correct Answer:
B. Increase the offline value of the Override Idle Timeout parameter in the NOC_Access admin profile.
Based on this partial configuration, what are the two possible outcomes when FortiGate enters conserve mode?
(Choose two.)
A
Administrators cannot change the configuration.
B
. FortiGate skips quarantine actions.
C
Administrators must restart FortiGate to allow new session.
D
FortiGate drops new sessions requiring inspection.
Correct Answer:
A. Administrators cannot change the configuration.
What is the primary FortiGate election process when the HA override setting is enabled?
A
Connected monitored ports > Priority > HA uptime > FortiGate serial number
B
B. Connected monitored ports > Priority > System uptime > FortiGate serial number
C
Connected monitored ports > HA uptime > Priority > FortiGate serial number
D
Connected monitored ports > System uptime > Priority > FortiGate serial number
Correct Answer:
B. B. Connected monitored ports > Priority > System uptime > FortiGate serial number
Explanation:
B is correct because in the FortiGate HA election process with override enabled, the system prioritizes
connected monitored ports, then evaluates priority, followed by system uptime, and finally the FortiGate
Reasoning for Correct Answer (B):
The HA election algorithm aims to maintain high availability by selecting the most suitable active unit based
on multiple criteria.
1. Connected monitored ports: The availability of connected interfaces is crucial; units with more active
interfaces can better service clients.
2. Priority: This user-defined metric allows administrators to influence which unit should take control,
enhancing customizability.
3. System uptime: Units that have been operational longer are preferred, reflecting stability and
reliability.
4. FortiGate serial number: As a tie-breaker, lower serial numbers indicate older hardware, which is
typically less desirable.
Critique of Other Options:
the HA status.
References:
Option A: Incorrect because it incorrectly places HA uptime before system uptime, which is not the
FortiGate's operational principle. The system uptime reflects the actual running time, which is prioritized over
Option C: Incorrect as it includes HA uptime instead of system uptime. The HA uptime does not adequately
reflect the unit's overall reliability and service capability, which is what the system uptime provides.
Option D: Misplaces system uptime by placing it after priority. While priority holds importance, system uptime
must come before it to ensure the most stable, trusted device is elected during an HA quorum.
1. https://docs.fortinet.com/document/fortigate/6.4.3/administration-guide/186867/high-availability
2. https://fortinet.com/resources-catalog/factory-default-settings-fortigate
3. https://docs.fortinet.com/document/fortigate/6.2.0/administration-guide/746817/high-availability-
overview
An administrator wanted to configure an IPS sensor to block traffic that triggers a signature set number of times
during a specific time period.
How can the administrator achieve the objective?
A
Use IPS group signatures, set rate-mode 60.
B
. Use IPS packet logging option with periodical filter option.
C
Use IPS filter, rate-mode periodical option.
D
. Use IPS filter, rate-mode periodical option.
Correct Answer:
C. Use IPS filter, rate-mode periodical option.
Explanation:
C is correct because using an IPS filter with the rate-mode set to "periodical" effectively allows the
administrator to configure a threshold that will block traffic based on a predefined number of signature
The "periodical" rate mode facilitates fine-tuning the IPS behavior, enabling the setting of thresholds that
align with network behavior patterns, thus enhancing security by minimizing false positives while effectively
mitigating potential threats. By defining a specific time period and threshold limit, this approach allows for
real-time response to attacks based on statistical analysis of network traffic.
Evaluation of Incorrect Options:
Option A: Use IPS group signatures, set rate-mode 60.
This option is incorrect as it does not specify a time frame for measuring signature triggers, which is essential
for effective threshold management. It could lead to either excessive blocking or inadequate protection
depending on the network's traffic patterns.
Option B: Use IPS packet logging option with periodical filter option.
While logging is vital for forensic analysis, this option does not address the requirement to block traffic based
on a specific rate of signature hits. Logging does not actively intervene in traffic flow, making it ineffective for
prevention.
Option D: Use IPS filter, rate-mode periodical option.
a redundant choice rather than an alternate correct answer.
References:
This option is essentially a repeat of Option C but does not add any distinct functionality or clarity, resulting in
In conclusion, option C stands out in enabling the precise control required to automatically block malicious
traffic based on defined behavior, aligning with best practices in IPS configuration.
https://www.fortiguard.com/web/guest/ips-db
https://docs.fortinet.com/document/fortigate/latest/administration-guide/780178/ips
https://www.fortinet.com/resources/cybersecurity-101/fortigate-ips
A FortiGate firewall policy is configured with active authentication, however, the user cannot authenticate when
accessing a website. Which protocol must FortiGate allow even though the user cannot authenticate?
A
LDAP
B
TACASC+
C
Kerberos
D
DNS
Correct Answer:
D. DNS
Explanation:
DNS must be allowed because unauthenticated clients need name resolution to build DNS->IP mappings so
their browsers can reach web destinations or be redirected to the FortiGate captive-portal authentication
page.
Active authentication (captive portal) workflows depend on the client initiating an HTTP/HTTPS request to a
hostname; without DNS the browser cannot resolve the FQDN and therefore cannot establish an HTTP
connection that the firewall can intercept or redirect to an authentication page. FortiGate also uses DNS to
resolve portal hostnames, FQDN-based policies, and to validate server certificates when presenting or
proxying authentication pages, so port 53 (UDP/TCP) must be permitted for unauthenticated users. Allowing
DNS does not bypass authentication controls; it merely enables the client to reach the portal and complete
the auth flow. In many deployments administrators explicitly allow DNS traffic from the unauthenticated zone
to ensure captive portal and site access processes function.
Why the other options are incorrect:
LDAP: Directory access protocol between FortiGate and an LDAP server for credential verification; enabling
LDAP only helps backend verification once a user can reach the auth flow - it does not permit the initial web
request or captive-portal redirect.
TACACS+: Device administration authentication protocol used for managing network devices, not for end-user
web access; permitting TACACS+ has no impact on a user's ability to reach or be redirected to a web
authentication portal.
Kerberos: Kerberos is an AD/SSO ticketing protocol used for transparent authentication in domain
environments and requires a KDC and client tickets; it is neither necessary nor sufficient to allow an
unauthenticated browser to resolve hostnames or be redirected to a captive portal.
https://docs.fortinet.com/document/fortigate/7.6.0/administration-
guidehttps://datatracker.ietf.org/doc/html/rfc1034https://learn.microsoft.com/en-us/windows-
server/security/kerberos/kerberos-authentication-overview
Questions: 1-10 out of 53
Continue Full Practice..
GET ALL 53 QUESTIONS