FCP_FGT_AD-7-6 Practice Questions

FortiGate SSL VPN can use DTLS (Datagram Transport Layer Security) over UDP to improve performance. However, DTLS is sensitive to network conditions like high latency and packet loss, which are characteristic of "poor internet connectivity." When DTLS packets are delayed, the connection may time out and attempt to re-establish or fall back to TLS over TCP, causing performance degradation and perceived disconnections. By increasing the DTLS timeout value, the FortiGate will wait longer for responses, making the VPN tunnel more resilient to high-latency connections and reducing the frequency of disconnections for users on unstable networks.

A. Enable split tunneling to reduce VPN traffic.

This reduces the volume of traffic over the VPN, which can improve performance by saving bandwidth, but it does not directly address connection instability caused by high latency or packet loss.

B. Change the SSL VPN port to a non-standard port.

This is a technique to bypass port-blocking or throttling by an ISP or local network firewall. It does not improve the VPN's tolerance to poor network quality like high latency.

C. Increase the session timeout for inactive sessions.

This setting (idle-timeout) applies to sessions with no activity. The user is actively using the VPN and experiencing disconnections, so this setting is not relevant to the problem.

1. FortiOS 7.6.0 CLI Reference:

Under the config vpn ssl settings command context

the dtls-hello-timeout option is described. The purpose of this timer is to manage the initial DTLS handshake. The documentation notes its range and default value

and adjusting it is a standard procedure for accommodating slow or high-latency networks. (See config vpn ssl settings section).

2. FortiOS 7.6.0 Administration Guide:

In the "SSL VPN" chapter

the guide discusses the use of DTLS for tunneling. It explains that DTLS runs over UDP for better performance but can be impacted by unreliable networks. The guide implicitly supports tuning related parameters to stabilize connections in such environments. (See "SSL VPN best practices" and "Troubleshooting" sections).

When a FortiGate device enters conserve mode due to high memory utilization, it activates a self-protection mechanism to maintain critical network functions. In this state, the device prioritizes memory for essential processes by shedding load. This involves dropping new sessions that require security profile inspection to prevent further memory allocation. Additionally, non-essential, memory-intensive tasks such as quarantining files or users are skipped to conserve resources. The device automatically exits conserve mode and resumes normal operations once memory usage drops below the configured threshold.

A. Administrators cannot change the configuration.

This is incorrect. While GUI access may become unresponsive, CLI access is typically maintained to allow administrators to diagnose and resolve the high memory issue, which may involve configuration changes.

C. Administrators must restart FortiGate to allow new session.

This is incorrect. FortiGate automatically exits conserve mode and begins accepting new sessions once memory utilization falls below the exit threshold. A manual restart is not a required step for recovery.

1. FortiOS 7.6.1 Administration Guide

System > Advanced > Conserve mode

Page 61:

"When a FortiGate enters conserve mode

it starts dropping new connections and sessions to conserve memory." (Supports option D)

"The following actions occur: ... New sessions are not accepted and are dropped

except for management traffic... Some logging

reporting

and quarantine actions are skipped." (Supports options B and D

and refutes option A)

"The FortiGate leaves conserve mode when the memory usage drops below the green threshold." (Refutes option C)

Rate-based IPS blocking is configured under an IPS filter, where you specify how many times (rate-count) a signature may fire within a defined window (rate-expiration). To make the counter restart every window, you set rate-mode periodical. When the threshold is exceeded, the action defined in the filter (for example, block) is applied, thus preventing traffic that repeatedly triggers the signature in the chosen time period.

A. Group signatures have no rate-count / rate-expiration / rate-mode settings; they cannot enforce period-based thresholds.

B. Packet logging only records matching packets; it does not influence detection thresholds or blocking behaviour.

D. Duplicate of C in the list—only option C is needed once.

1. Fortinet

“FortiOS 7.4 CLI Reference – Intrusion Prevention

” section “config ips filter”

parameters: ratecount

rateexpiration

ratemode {periodical|continuous}

pp. 1700-1701.

2. Fortinet

“FortiOS 7.4 Administration Guide

” chapter “Intrusion Prevention System”

subsection “Rate-based signatures”

pp. 476-477.

In FortiOS Application Control, the Allow action is designed to permit traffic matching a specific signature without generating a security log entry by default. This behavior is distinct from the Monitor action, which both allows the traffic and creates a log entry for visibility. The exhibit shows an application override where the action for "ABC.Com" is explicitly set to Allow, and the associated "Log" option is disabled. Therefore, even though the firewall policy has logging enabled for traffic sessions, the Application Control profile itself will not generate a specific security event log for this allowed application.

A. The ABC.Com Type is set as Application instead of Filter.

This is incorrect. The "Application" type is the correct setting for creating an override based on a specific, named application signature like "ABC.Com".

B. The ABC.Com is configured under application profile, which must be configured as a web filter profile.

This is incorrect. Application signatures are correctly managed within an Application Control profile. Web Filter profiles are used for URL/web content filtering, not application signature control.

D. The ABC.Com is hitting the category Excessive-Bandwidth.

This is incorrect. An application override rule takes precedence over any category-based settings. Since a specific override for "ABC.Com" exists, the action defined in that override is applied, regardless of its category.

1. FortiOS 7.6.0 Administration Guide

Page 1061

Section: "Application Control".

The guide details the actions available in Application Control. It specifies that the Allow action permits traffic but does not generate logs

whereas the Monitor action allows traffic and generates logs. The document states: "Allow: Allows the traffic. No log messages are generated." and "Monitor: Allows the traffic and generates log messages." This directly supports the correct answer.

2. FortiOS 7.6.0 Security Profiles Guide

Page 115

Section: "Application and filter overrides".

This section explains how to create overrides. The description of the Action setting confirms the logging behavior: Allow does not log by default

while Monitor and Block do. The GUI screenshots and descriptions align with the behavior described in the question.

Flow-based antivirus inspection is designed for performance. It scans files as they transit the FortiGate, forwarding packets to the client simultaneously. This method significantly enhances throughput compared to proxy-based inspection, which must buffer the entire file before scanning and forwarding. The official documentation describes this process as buffering the file while sending it at the same time. Furthermore, flow-based inspection employs a hybrid scanning approach, combining techniques from the modes available in proxy-based inspection to balance security and performance. If a virus is detected, the final packets are dropped, preventing the complete file from reaching the client.

C. If a virus is detected, the FortiGate drops the last packet(s) containing the malicious signature and sends a reset packet, ensuring the client receives an incomplete and unusable file.

E. Flow-based antivirus scanning is handled by the integrated IPS engine as part of FortiOS's single-pass architecture; it is not a standalone process.

1. Fortinet FortiOS 7.6.1 Administration Guide

Security Profiles > Antivirus > AV scanning modes

p. 1031:

"Flow-based inspection enhances throughput compared to proxy-based inspection." (Supports option D)

"The FortiGate buffers the file and sends it to the client at the same time." (Supports option A)

"Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection." (Supports option B)

"If a virus is found

the FortiGate unit caches the virus and drops the packets... The FortiGate unit also sends a reset packet to the client." (Refutes option C)

2. Fortinet FortiOS Handbook 7.6 - Security Profiles

Antivirus > Inspection Modes:

"In flow-based mode

antivirus scanning is done by the IPS engine." (Explains the mechanism

refuting the "standalone" nature in option E

as the IPS engine is an integrated component).

A firewall policy ID is a unique integer that serves as the primary identifier for a policy object within the FortiGate configuration. Once a policy is created, either automatically by the GUI or manually in the CLI, this ID is permanently assigned and cannot be altered. While other attributes of the policy can be modified, the ID itself is immutable. To "change" a policy ID, one would need to delete the existing policy and create a new one with the desired ID, assuming it is available.

A. It is mandatory to provide a policy ID while creating a firewall policy regardless of GUI or CLI.

This is incorrect. When using the GUI, the FortiGate automatically assigns the next available ID. In the CLI, using the command edit 0 instructs the system to create a new policy and assign an ID automatically.

B. A firewall policy ID identifies the order of policy execution in firewall policies.

This is incorrect. Policy execution is determined by the sequence or position of the policy in the list, evaluated from top to bottom. The policy ID is only a unique identifier and has no bearing on the execution order.

C. You can create a policy in CLI with policy ID 0.

This is incorrect. In the CLI, the command edit 0 is a special instruction used to create a new policy entry. The FortiGate then assigns the new policy the next available non-zero ID. A policy cannot have a permanent ID of 0.

1. Fortinet FortiOS 7.6.0 Administration Guide

"Firewall policies > Sequence" section: "FortiGate tests traffic against policies in the order that they appear in the policy list

starting with the policy at the top of the list." This confirms that sequence

not ID

determines execution order

invalidating option B.

2. Fortinet FortiOS 7.6.0 CLI Reference

config firewall policy command section: The documentation specifies that to create a new entry

one should use edit 0. This demonstrates that an ID is not mandatory (invalidating option A) and that 0 is a command for creation

not a final ID (invalidating option C).

3. Fortinet FortiOS 7.6.0 CLI Reference

config firewall policy command section: Within the available set commands for an existing policy

there is no command such as set policyid or set id. This confirms the immutability of the policy ID once created

supporting option D.

Statement A is correct because when SD-WAN is disabled, FortiGate uses a global setting for the ECMP load-balancing algorithm. This is configured using the v4-ecmp-mode parameter. One of the available modes is usage-based, which the official FortiOS Administration Guide explicitly refers to as "also known as volume-based." This algorithm distributes traffic based on bandwidth utilization.

Statement D is correct because when SD-WAN is enabled, it overrides the global ECMP settings for traffic matching an SD-WAN rule. The load-balancing algorithm for SD-WAN traffic is configured within each specific SD-WAN rule (service) using the load-balance-mode parameter, allowing for granular control.

B: ECMP stands for Equal-Cost Multi-Path. By definition, all routes in an ECMP set must have identical administrative distance and metric (cost). SD-WAN can use unequal cost paths, but this is not ECMP.

C: This statement is incomplete and therefore misleading. While the ECMP algorithm mode is selected in config system settings, fully configuring certain modes like weight-based or usage-based requires additional configuration elsewhere (e.g., on static routes or interfaces).

1. FortiOS Administration Guide 7.6.1

Chapter "Routing"

Section "ECMP load balancing methods"

p. 1010.

This section states for the usage-based method: "Also known as volume-based

this method directs new sessions to the interface with the most available bandwidth." This directly supports statement A.

2. FortiOS SD-WAN Architecture Guide 7.6

Section "SD-WAN rules"

Subsection "Load balancing algorithms"

p. 21.

This section details the load balancing algorithms for SD-WAN rules

stating they are "configured in SD-WAN rules" and shows the parameter is load-balance-mode. This directly supports statement D.

3. FortiOS SD-WAN Architecture Guide 7.6

Section "Routing"

Subsection "ECMP"

p. 38.

This section defines ECMP: "ECMP allows the router to load balance traffic over multiple links that have the same destination

administrative distance

and metric." This directly refutes statement B.

4. FortiOS CLI Reference 7.6.1

config system settings and config system sdwan sections.

The reference confirms that v4-ecmp-mode is the parameter under config system settings for global ECMP and that load-balance-mode is the parameter under config system sdwan -> config service for SD-WAN rules. This supports the context for statements A

C

and D.

When a FortiGate attempts to join a Security Fabric as a member, its status will remain "Pending" for two primary reasons. First, the join request may not have reached the root FortiGate due to a network connectivity issue or a misconfiguration, such as an incorrect Upstream FortiGate IP. Option A suggests the configured upstream IP is incorrect, which would prevent the join request from being sent to the right device. Second, even if the request is successfully received by the root FortiGate, the member device will not be fully joined until an administrator manually authorizes it on the root FortiGate. If this authorization step is not completed, the member's status will remain "Pending".

B. SAML Single Sign-On must be set to Manual. SAML SSO settings relate to administrator login synchronization across the fabric and do not impact the initial device authorization and join process. D. Management IP must be set to 10.0.13.254. The Management IP is the address of the local device (HQ-ISFW-2). An incorrect Management IP affects how the root manages the device after it joins, not the initial join request itself.

1. Fortinet FortiOS 7.6.0 Administration Guide, Chapter: "Security Fabric", Section: "Building the Security Fabric".

Reference for A: The guide states, "On the downstream FortiGate, go to Security Fabric > Fabric Connectors and edit the FortiGate connector. Set Upstream FortiGate IP to the IP address of the root FortiGate that the downstream FortiGate will connect to." This highlights that a correct Upstream FortiGate IP is required for the connection to be established. An incorrect IP, as implied by option A, is a valid reason for failure.

Reference for C: The guide details the authorization step: "On the root FortiGate... Go to Security Fabric > Fabric Connectors. The downstream FortiGate is listed with a status of Pending. Select the downstream FortiGate and select Authorize." This confirms that lack of authorization leaves the device in a pending state.

In a multi-WAN environment, routing changes (such as a link failover) can cause the FortiGate to re-evaluate active sessions and move them to a new, better path. This can break stateful connections like SSL VPNs, VoIP calls, or long-lived TCP sessions that are sensitive to changes in the egress interface or source IP address. Enabling session preservation (preserve-session-route) on an interface instructs the FortiGate to not re-evaluate existing sessions originating from or passing through that interface. This ensures that established connections, like SSL VPNs, are "stuck" to their original path for the duration of the session, preventing disruption and maintaining connectivity even when the routing table changes.

A. This describes the default behavior when session preservation is disabled. The feature is enabled specifically to prevent sessions from dynamically changing interfaces.

B. Session preservation is independent of whether source NAT is used and its purpose is to maintain the current path, not force sessions to a designated primary link.

C. This is the opposite of the feature's intent. Session preservation is used to prevent session breaks that would force users to re-authenticate.

1. FortiOS 7.6.0 CLI Reference:

Under the config system interface command context

the set preserve-session-route {enable | disable} option is defined. The purpose is to "Enable/disable preservation of session route." This command directly controls the behavior described. (p. 1139)

2. FortiOS Administration Guide 7.6:

In the "SD-WAN" chapter

section "Session failover"

the guide explains the default behavior: "When an SD-WAN member fails

sessions are redirected to the next available member." It then discusses scenarios where this is undesirable

such as for SIP calls. Session preservation is the mechanism to prevent this redirection for sensitive traffic.

3. Fortinet Certified Professional - Network Security 7.6 Study Guide:

In the "Routing" chapter

the concept of session handling during route changes is discussed. It clarifies that by default

FortiGate is route-based

and if a route changes

the session is re-evaluated. It highlights that for services like SSL VPN

this can cause disconnection

and features like session preservation are used to maintain the original session path.

The FortiGate GUI offers different ways to visualize firewall policies. The 'By Sequence' view displays all policies in a single list, ordered numerically by their sequence ID. This view reflects the precise top-down order in which the FortiGate firewall engine evaluates policies. Conversely, the 'Interface Pair' view organizes policies into groups based on their source and destination interfaces. While policies within each interface-pair group are still ordered by their sequence ID, the overall view is segmented by these pairs, causing the apparent order to differ from the global processing sequence shown in the 'By Sequence' view.

A: Interface Pair View is grouped by interfaces, not arbitrary security levels.

B: The order in Interface Pair View is determined by interface grouping, not traffic logs.

C: Policy order is determined by administrator configuration and is not dynamically reordered by the firewall based on traffic patterns.

1. Fortinet FortiOS 7.6.0 Administration Guide

Page 678

Section: "Firewall policies > Viewing the firewall policies list".

The documentation states: "The firewall policies list can be viewed By Interface Pair or By Sequence. Viewing by interface pair groups policies by the configured incoming and outgoing interfaces. Viewing by sequence shows all policies in the order that they are checked for matching traffic." This directly confirms that 'By Sequence' shows the processing order and 'Interface Pair' groups by interfaces.