Fortinet FCSS_EFW_AD-7.6 Practice Test

FCSS_EFW_AD-7.6 practice test: what's covered

• Security Fabric & HA
• VDOM/VLAN
• SSL Inspection
• IPS/Web Filter/App Control
• OSPF/BGP
• IPsec IKEv2 & ADVPN
• FortiManager
• CLI Troubleshooting

Free FCSS_EFW_AD-7.6 sample questions

1. A team deploys a Security Fabric with a root FortiGate and several downstream FortiGates. They want every downstream device to authorize automatically only when it presents a serial number already pre-authorized on the root. Which root-side setting controls whether a downstream FortiGate joins the fabric?

   • A. Fabric Connectors / Security Fabric device authorization (authorize the downstream serial on the root)
   • B. An OSPF neighbor statement matching the downstream serial
   • C. A static route to the downstream WAN IP
   • D. An SD-WAN performance SLA health check
   Show answer

   Correct: A. Downstream FortiGates appear as pending until the root administrator authorizes their serial number under Security Fabric settings; only then do they fully join. Routing or SD-WAN settings do not gate fabric membership.

2. An admin configures an FGCP HA cluster of two FortiGates and wants the unit with the highest uptime/priority to actively pass traffic while the second stays as a hot standby. Which HA mode matches this active-passive failover requirement?

   • A. Active-Passive (A-P) mode
   • B. Active-Active (A-A) session load balancing
   • C. FGSP session synchronization between standalone units
   • D. Standalone with config sync only
   Show answer

   Correct: A. FGCP active-passive elects one primary that handles all traffic while the subordinate stays synchronized and ready to take over. Active-active load-balances proxy/UTM sessions across members, and FGSP is for peering standalone units, not a single A-P cluster.

3. Refer to the CLI output: # diagnose sys ha status HA Health Status: OK Model: FortiGate-100F Mode: HA A-P Group: 0 Debug: 0 Cluster Uptime: 7 days 02:14:55 Master:128 FGT-A FG100F0000000001 0 Slave :128 FGT-B FG100F0000000002 1 The two members have the same priority (128) yet FGT-A is Master. With override disabled, which factor most likely made FGT-A the primary?

   • A. It had more monitored interfaces up, then higher uptime, before serial number was used as the final tiebreaker
   • B. It has the lower serial number, which always wins regardless of anything else
   • C. It was simply powered on first, which is the only criterion
   • D. It has a larger FortiGuard license, which raises HA priority
   Show answer

   Correct: A. With equal priority and override disabled, FGCP elects the primary by most monitored interfaces up, then longest HA uptime, and finally the highest serial number as a tiebreaker. License size and power-on order are not part of the election logic.

4. An engineer builds an FGCP active-passive cluster between two FortiGate-100F units. Which conditions must be satisfied for the cluster to form and synchronize correctly? (Choose TWO)

   • A. Both units run the same FortiOS firmware version and build
   • B. Both units are the same hardware model
   • C. Each unit must have a unique HA group name
   • D. The heartbeat interfaces must be on different subnets per unit
   • E. Each member must run a different set of security profiles
   Show answer

   Correct: A and B. FGCP requires identical hardware model and matching firmware version/build for members to synchronize. The HA group name must be identical (not unique), heartbeat links share the HA segment, and configuration including profiles is synchronized across members.

5. A FortiGate carries large volumes of IPsec and IPv4 firewall traffic. The admin wants the bulk session forwarding offloaded to hardware so the CPU is freed for inspection. Which FortiGate hardware component performs this fast-path session and crypto offload?

   • A. The NP (Network Processor, e.g., NP6/NP7) for fast-path session offload
   • B. The FortiGuard ISDB database
   • C. The SPU management CPU only
   • D. The FortiAnalyzer log processor
   Show answer

   Correct: A. Network Processors (NP6/NP7) offload established sessions and IPsec crypto onto the fast path, reducing CPU load. Content Processors (CP) accelerate UTM/SSL; FortiGuard ISDB and FortiAnalyzer are unrelated to hardware forwarding.

Last updated: 2026-10-19

FCSS_EFW_AD-7.6 practice test FAQ

Related practice tests

• FortiGate FCP_FGT_AD-7.4 practice test
• Fortinet NSE4 practice test
• Fortinet NSE 5 practice test
• Fortinet NSE7-EFW practice test
• Fortinet NSE 8 practice test