When FortiGate performs SSL/SSH full inspection, you can decide how it should react when it detects an invalid certificate.Which three actions are valid actions that FortiGate can perform when it detects an invalid certificate? (Choose three.)
Answer(s): A,B,D
You want to ensure that an SSL VPN user's authenticated session does not remain active after they disconnect from the VPN.Which configuration will ensure this?
Answer(s): D
To ensure that an authenticated SSL VPN user session does not persist after disconnecting, you must enable the setting that forces the firewall authentication session to end when the SSL VPN session ends. This ensures that once the VPN disconnects, the associated firewall authentication state is immediately cleared, preventing unintended access.
Refer to the exhibit, which shows a firewall policy to enable active authentication.When attempting to access an external website using an active authentication method, the user is not presented with a login prompt.What is the most likely reason for this situation?
Answer(s): A
For active authentication (such as captive portal) to trigger, the FortiGate must intercept the user's initial web request. This requires DNS traffic to pass through the FortiGate so it can redirect the request to the login page.If the firewall policy does not include the DNS service, the user's browser resolves domains directly, and the authentication portal is never triggered.
Refer to the exhibit.Why did the FortiGate device drop the packet?
The packet trace shows policy-0 is matched, act-drop and Denied by forward policy check (policy 0). This means the packet matched an explicitly configured firewall policy (policy ID 0 in this case) whose action is set to DENY, and the traffic was dropped accordingly.
Refer to the exhibit, which shows a routing table.An administrator wants to create a new static route so the traffic to the subnet 172.20.1.0/24 is routed through port2 only.What are the two criteria that the administrator can use to achieve this objective? (Choose two.)
Answer(s): A,B
Post your Comments and Discuss Fortinet FCP_FGT_AD-7.6 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the FCP_FGT_AD-7.6 content, but please register or login to continue.