2026 Actual Fortinet FCSS_EFW_AD-7.6 Dumps, Updated Exam Questions for Guaranteed Pass

FCSS_EFW_AD-7.6 free sample questions and answers

Fortinet FCSS_EFW_AD-7.6 practice quiz with correct answers for search indexing.

1. Question 1

   Which two options should you consider to scale performance using an additional FortiGate?

   AFGSP
   

   BFGCP Active-Active
   

   CVRRP
   

   DFGCP Active-Passive
   

   Correct answer: A, B

   
   

2. Question 2

   Refer to the exhibit, which shows an ADVPN network

   

   An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2.

   What two options must the administrator configure in BGP? (Choose two.)

   Aset ebgp-enforce-multrhop enable
   

   Bset next-hop-self enable
   

   Cset ibgp-enforce-multihop advpn
   

   Dset attribute-unchanged next-hop
   

   Correct answer: A, B

   In this ADVPN (Auto-Discovery VPN) network, there are two hubs (Hub A and Hub B) connected via EBGP, while IBGP is used within each overlay. To ensure proper BGP routing between the overlays, the administrator must configure specific BGP options..

   set ebgp-enforce-multihop enable

   By default, EBGP requires directly connected neighbors. Since Hub A and Hub B are not directly connected but reach each other over an IPsec tunnel, multihop must be enabled for EBGP sessions to work.

   set next-hop-self enable

   In IBGP, the next-hop attribute does not change by default. When an IBGP route is advertised from a spoke to another hub or spoke, the next-hop needs to be updated to ensure proper reachability. Enabling next-hop-self forces the BGP speaker to advertise itself as the next-hop, ensuring that all spokes properly reach routes across the overlays.

   
   

3. Question 3

   Refer to the exhibit, which shows a partial troubleshooting command output.

   

   An administrator is extensively using IPsec on FortiGate. Many tunnels show information similar to the output shown in the exhibit.

   What can the administrator conclude?

   AIPsec SAs cannot be offloaded.
   

   BThe two IPsec SAs, inbound and outbound, are copied to the NPU.
   

   COnly the outbound IPsec SA is copied to the NPU.
   

   DOnly the inbound IPsec SA is copied to the NPU.
   

   Correct answer: A

   Based on the FortiGate Infrastructure 7.6 study guide and the Hardware Acceleration technical documentation, the diagnose vpn tunnel list command provides the status of IPsec tunnel offloading to the Network Processor (NPU).

   In the provided exhibit, the specific value npu_flag=20 (which corresponds to 0x20 in hexadecimal) indicates that the IPsec Security Association (SA) cannot be offloaded to the NPU. While the NPU may have visibility of the gateway IPs (npu_rgwy and npu_lgwy), the flag itself serves as a diagnostic indicator that the traffic must be processed by the system CPU rather than the hardware accelerator.

   This lack of offloading typically occurs when the tunnel configuration uses a cipher (encryption algorithm) or an HMAC (authentication algorithm) that is not supported by the specific NPU model installed in the FortiGate. For example, if a tunnel is configured with a legacy or highly complex algorithm that the NP6 or NP7 chip is not designed to process in hardware, the FortiOS kernel handles the encryption and decryption, resulting in the npu_flag=20 status. Therefore, despite the presence of NPU-related fields, the specific flag value confirms that hardware acceleration is not active for these SAs.

   
   

4. Question 4

   In which two ways does FortiGate utilize the Internet Service Database (ISDB)?

   ABlocks IPs and ports
   

   BLimits by URL
   

   CWorks in proxy mode
   

   DProvides predefined IPs and ports
   

   Correct answer: A, D

   
   

5. Question 5

   An organization's guest Internet policy, operating in proxy mode, blocks access to artificial intelligence technology sites using FortiGuard.

   However, a guest user accessed a page in this category using port 8443

   Which configuration change must you make for FortiGate to analyze HTTPS traffic on nonstandard ports like 8443. when full SSL inspection is active in the guest policy?

   ABlock traffic on nonstandard ports by enabling server certificate SNI check in the SSL/SSH inspection profile.
   

   BEnable network protocol enforcement for port 8443 with the protocol HTTPS in FortiGuard application control.
   

   CEnter 443, 8443 to analyze both standard (443) and non-standard (8443) HTTPS ports in the protocol port mapping section of the SSL/SSH inspection profile.
   

   DBlock untrusted SSL certificates in the SSL/SSH inspection profile.
   

   Correct answer: C