FCP - FortiGate 7.6 Administrator

Last checked October 22, 2026 against the official Fortinet exam page.

1. Question 1System & VDOM Deployment

   An administrator wants two departments on one FortiGate to have separate routing tables, firewall policies and administrators. Which feature provides this isolation?

   1. ASeparate interface aliases on the same VDOM, which group the ports for each department
   2. BVirtual domains (VDOMs), each with its own policies, routes and administrators
   3. CMultiple firewall policy tabs in the GUI, one tab for each department's rules
   4. DA second FortiGate in transparent mode, placed behind the first unit for each department
   Show answer and explanationHide answer

   Correct answer: B

   VDOMs split one FortiGate into independent virtual firewalls, each with its own routing, policies and administrators, which gives the required isolation. Interface aliases only label ports, GUI tabs change nothing on the device, and a second unit is a hardware answer the scenario does not need.

2. Question 2Firewall Policies & NAT

   A FortiGate receives traffic that matches no firewall policy. What is the default action?

   1. AThe traffic is sent to the FortiGuard service for classification before any action is taken
   2. BThe traffic is accepted and logged, so that the administrator can review it later
   3. CThe traffic is forwarded to the default route without any inspection by the unit
   4. DThe traffic is dropped by the implicit deny policy at the end of the policy list
   Show answer and explanationHide answer

   Correct answer: D

   The implicit deny policy at the end of the list drops any traffic that matches no explicit policy, which is the default behaviour. Accepting traffic by default would be a serious gap, forwarding without inspection bypasses the policy, and FortiGuard classification does not decide the default action.

3. Question 3Content Inspection & Security Profiles

   An administrator wants to stop malware from being downloaded through HTTP and HTTPS traffic that passes the firewall. Which security profile should be applied to the policy?

   1. AAn antivirus profile, applied to the policy that allows web traffic, with the relevant protocols inspected
   2. BAn IPS sensor profile, which is designed to detect malware file hashes in every web session
   3. CA web filter profile that blocks only the categories of websites, without inspecting any downloads
   4. DA DNS filter profile that blocks the domains of known malware sites, and nothing else
   Show answer and explanationHide answer

   Correct answer: A

   An antivirus profile applied to the web policy scans downloaded files for malware for the protocols it inspects. IPS detects network attacks, web filters block by category, and DNS filters block domains, so none of those scans file content.

4. Question 4VPN

   Two FortiGates in different offices must connect securely over the internet so that the networks behind each unit can reach each other. Which VPN type is the standard choice?

   1. AAn SSL VPN web portal, which each office user opens through a browser to reach the other office
   2. BA site-to-site IPsec VPN, with Phase 1 and Phase 2 configured between the two units
   3. CA GRE tunnel with no encryption, which is combined with a firewall policy for each office
   4. DA VLAN trunk over the public internet, which carries the traffic between the offices directly
   Show answer and explanationHide answer

   Correct answer: B

   A site-to-site IPsec VPN is the standard way to connect two FortiGates so that the networks behind them can reach each other securely. A web portal serves individual users, a VLAN trunk cannot traverse the internet securely, and an unencrypted GRE tunnel does not meet the security requirement.

5. Question 5Logging, Monitoring & HA

   A FortiGate must send its traffic and event logs to a central FortiAnalyzer for long-term reporting. Which configuration is needed?

   1. ACreate a firewall policy that allows the FortiAnalyzer to pull the logs over ICMP
   2. BCopy the log files from the disk by hand each week, and upload them to a shared folder
   3. CEnable logging to FortiAnalyzer in the log settings, and set the FortiAnalyzer address on the unit
   4. DTurn off local logging, so that the logs are sent to the central server only
   Show answer and explanationHide answer

   Correct answer: D

   Enabling FortiAnalyzer logging in the log settings and pointing the unit to the FortiAnalyzer sends the logs centrally, which is the standard configuration. Manual copying is slow and error-prone, turning off local logging loses the logs if the link fails, and ICMP does not carry logs.