Study Online FCP_FGT_AD-7.4 Exam Dumps to Pass

1. On FortiGate, which type of logs record information about traffic directly to and from the FortiGate management IP addresses?

2. What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

A. It limits the scanning of application traffic to the browser-based technology category only.

B. It limits the scanning of application traffic to the DNS protocol only.

C. It limits the scanning of application traffic to use parent signatures only.

D. It limits the scanning of application traffic to the application category only.

3. Refer to exhibit.

An administrator configured the web filtering profile shown in the exhibit to block access to all social networking sites except Twitter. However, when users try to access twitter.com, they are redirected to a FortiGuard web filtering block page.





Based on the exhibit, which configuration change can the administrator make to allow Twitter while blocking all other social networking sites?

4. Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?

A. Intrusion prevention system engine

B. Detection engine

C. Flow engine

D. Antivirus engine

5. Refer to the exhibits.

Exhibit A.





Exhibit B.





An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).

What must the administrator do to synchronize the address object?

6. An administrator is running the following sniffer command: diagnose sniffer packet any "host 10.0.2.10" 3

What information will be included in the sniffer output? (Choose three.)

7. Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two.)

8. Refer to the exhibit.





The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile.

An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category.

What are two solutions for satisfying the requirement? (Choose two.)

9. An administrator has configured two-factor authentication to strengthen SSL VPN access.

Which additional best practice can an administrator implement?

10. Refer to the exhibits.

Exhibit A shows system performance output.





Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds.





Based on the system performance output, which two results are correct? (Choose two.)

11. Which two IP pool types are useful for carrier-grade NAT deployments? (Choose two.)

A. Port block allocation

B. Fixed port range

C. One-to-one

D. Overload

12. Refer to the exhibit, which contains a radius server configuration.





An administrator added a configuration for a new RADIUS server. While configuring, the administrator selected the Include in every user group option.

What will be the impact of using Include in every user group option in a RADIUS configuration?

13. Which additional load balancing method is supported in equal cost multipath (ECMP) load balancing when SD-WAN is enabled?

14. Which three statements explain a flow-based antivirus profile? (Choose three.)

A. Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.

B. If a virus is detected, the last packet is delivered to the client.

C. The IPS engine handles the process as a standalone.

D. FortiGate buffers the whole file but transmits to the client at the same time.

E. Flow-based inspection optimizes performance compared to proxy-based inspection.

15. Examine this FortiGate configuration:





Examine the output of the following debug command:





Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?

16. NGFW mode allows policy-based configuration for most inspection rules.

Which security profile's configuration does not change when you enable policy-based inspection?

17. Which two statements about IPsec authentication on FortiGate are correct? (Choose two.)

A. For a stronger authentication, you can also enable extended authentication (XAuth) to request the remote peer to provide a username and password.

B. FortiGate supports pre-shared key and signature as authentication methods.

C. Enabling XAuth results in a faster authentication because fewer packets are exchanged.

D. A certificate is not required on the remote peer when you set the signature as the authentication

method.

18. Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?

19. A FortiGate administrator is required to reduce the attack surface on the SSL VPN portal.

Which SSL timer can you use to mitigate a denial of service (DoS) attack?

20. An administrator has a requirement to keep an application session from timing out on port 80.

What two changes can the administrator make to resolve the issue without affecting any existing services running through FortiGate? (Choose two.)

A. Create a new firewall policy with the new HTTP service and place it above the existing HTTP policy.

B. Create a new service object for HTTP service and set the session TTL to never

C. Set the TTL value to never under config system-ttl

D. Set the session TTL on the HTTP policy to maximum

21. Refer to the exhibits.









Exhibit A shows a topology for a FortiGate HA cluster that performs proxy-based inspection on traffic.

Exhibit B shows the HA configuration and the partial output of the get system ha status command.

Based on the exhibits, which two statements about the traffic passing through the cluster are true? (Choose two.)

A. For non-load balanced connections, packets forwarded by the cluster to the server contain the virtual MAC address of port2 as source.

B. The traffic sourced from the client and destined to the server is sent to FGT-1.

C. The cluster can load balance ICMP connections to the secondary.

D. For load balanced connections, the primary encapsulates TCP SYN packets before forwarding them

to the secondary.

22. An administrator wants to monitor their network for any probing attempts aimed to exploit existing vulnerabilities in their servers.

Which two items must they configure on their FortiGate to accomplish this? (Choose two.)

23. An administrator has configured outgoing interface any in a firewall policy.

Which statement is true about the policy list view?

24. Which statement regarding the firewall policy authentication timeout is true?

A. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source IP.

B. It is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address after this timer has expired.

C. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source MAC.

D. It is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address

after this timer has expired.

25. Refer to the exhibit.













The exhibit contains a network diagram, firewall policies, and a firewall address object configuration. An administrator created a Deny policy with default settings to deny Webserver access for Remote-user2. Remote-user2 is still able to access Webserver.

Which two changes can the administrator make to deny Webserver access for Remote-User2? (Choose two.)

26. Which of the following SD-WAN load Cbalancing method use interface weight value to distribute traffic? (Choose two.)

27. Which inspection mode does FortiGate use for application profiles if it is configured as a profile-based next-generation firewall (NGFW)?

28. Refer to the exhibit.





The exhibit shows a FortiGate configuration.

How does FortiGate handle web proxy traffic coming from the IP address 10.2.1.200, that requires authorization?

29. A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors.

What is the reason for the certificate warning errors?

30. Which two statements explain antivirus scanning modes? (Choose two.)

31. Refer to the web filter raw logs.





Based on the raw logs shown in the exhibit, which statement is correct?

32. An administrator configured a FortiGate to act as a collector for agentless polling mode.

What must the administrator add to the FortiGate device to retrieve AD user group information?

33. Which three statements about SD-WAN zones are true? (Choose three.)

34. What is the primary FortiGate election process when the HA override setting is disabled?

35. Refer to the exhibit.





Given the interfaces shown in the exhibit, which two statements are true? (Choose two.)

A. Traffic between port2 and port2-vlan1 is allowed by default.

B. port1-vlan10 and port2-vlan10 are part of the same broadcast domain.

C. port1-vlan1 and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.

D. port1 is a native VLAN.

36. Which timeout setting can be responsible for deleting SSL VPN associated sessions?

37. Refer to the exhibit.





The global settings on a FortiGate device must be changed to align with company security policies.

What does the Administrator account need to access the FortiGate global settings?

38. Refer to the exhibit, which contains a session list output.





Based on the information shown in the exhibit, which statement is true?

39. Which three strategies are valid SD-WAN rule strategies for member selection? (Choose three.)

40. Which statement is correct regarding the inspection of some of the services available by web applications embedded in third-party websites?

41. Refer to the exhibit showing a debug flow output.





What two conclusions can you make from the debug flow output? (Choose two.)

42. Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)

A. FortiSIEM

B. FortiCloud

C. FortiCache

D. FortiSandbox

E. FortiAnalyzer

43. Which two actions can you perform only from the root FortiGate in a Security Fabric? (Choose two.)

A. Shut down/reboot a downstream FortiGate device.

B. Disable FortiAnalyzer logging for a downstream FortiGate device.

C. Log in to a downstream FortiSwitch device.

D. Ban or unban compromised hosts.

44. Refer to the exhibit.





FortiGate is configured for firewall authentication. When attempting to access an external website, the user is not presented with a login prompt.

What is the most likely reason for this situation?

45. View the exhibit.

A user at 192.168.32.15 is trying to access the web server at 172.16.32.254.





Which two statements best describe how the FortiGate will perform reverse path forwarding (RPF)

checks on this traffic? (Choose two.)

46. FortiGate is configured as a policy-based next-generation firewall (NGFW) and is applying web filtering and application control directly on the security policy.

Which two other security profiles can you apply to the security policy? (Choose two.)

A. Antivirus scanning

B. File filter

C. DNS filter

D. Intrusion prevention

47. Refer to the exhibits.









The SSL VPN connection fails when a user attempts to connect to it.

What should the user do to successfully connect to the SSL VPN?

48. How can you disable RPF checking?

49. When FortiGate performs SSL/SSH full inspection, you can decide how it should react when it detects an invalid certificate.

Which three actions are valid actions that FortiGate can perform when it detects an invalid certificate? (Choose three.)

50. Which two statements are correct regarding FortiGate FSSO agentless polling mode? (Choose two.)

51. Which two attributes are required on a certificate so it can be used as a CA certificate on SSL inspection? (Choose two.)

52. What does the command diagnose debug fsso-polling refresh-user do?

53. Refer to the exhibit to view the application control profile.

















Based on the configuration, what will happen to Apple FaceTime?

54. Which security fabric feature causes an event trigger to monitor the network when a threat is detected?

55. When configuring a firewall virtual wire pair policy, which following statement is true?

56. An administrator has configured a strict RPF check on FortiGate.

How does strict RPF check work?

57. Refer to the exhibit.





The exhibit shows the IPS sensor configuration.

If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

A. The sensor will allow attackers matching the NTP.Spoofed.KoD.DoS signature.

B. The sensor will block all attacks aimed at Windows servers.

C. The sensor will reset all connections that match these signatures.

D. The sensor will gather a packet log for all matched traffic.

58. Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)

59. Refer to the exhibits.













An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).

What must the administrator do to synchronize the address object?

60. Refer to the exhibits.

The exhibits show a firewall policy (Exhibit A) and an antivirus profile (Exhibit B).









Why is the user unable to receive a block replacement message when downloading an infected file for the first time?

61. A network administrator is configuring an IPsec VPN tunnel for a sales employee travelling abroad.

Which IPsec Wizard template must the administrator apply?

62. How do you format the FortiGate flash disk?

63. An organization's employee needs to connect to the office through a high-latency internet connection.

Which SSL VPN setting should the administrator adjust to prevent the SSL VPN negotiation failure?

64. How does FortiGate act when using SSL VPN in web mode?

65. Which two inspection modes can you use to configure a firewall policy on a profile-based next-generation firewall (NGFW)? (Choose two.)

A. Proxy-based inspection

B. Certificate inspection

C. Flow-based inspection

D. Full Content inspection

66. Which two statements are correct when FortiGate enters conserve mode? (Choose two.)

67. Refer to the exhibit.





FortiGate has two separate firewall policies for Sales and Engineering to access the same web server with the same security profiles.

Which action must the administrator perform to consolidate the two policies into one?

68. Refer to the exhibit.





























The exhibit shows proxy policies and proxy addresses, the authentication rule and authentication scheme, users, and firewall address.

An explicit web proxy is configured for subnet range 10.0.1.0/24 with three explicit web proxy policies. The authentication rule is configured to authenticate HTTP requests for subnet range 10.0.1.0/24 with a form-based authentication scheme for the FortiGate local user database. Users will be prompted for authentication.

How will FortiGate process the traffic when the HTTP request comes from a machine with the source IP 10.0.1.10 to the destination http:// www.fortinet.com? (Choose three.)

69. An organization requires remote users to send external application data running on their PCs and access FTP resources through an SSUTLS connection.

Which FortiGate configuration can achieve this goal?

70. Which method allows management access to the FortiGate CLI without network connectivity?

71. FortiGate is integrated with FortiAnalyzer and FortiManager.

When a firewall policy is created, which attribute is added to the policy to improve functionality and to support recording logs to FortiAnalyzer or FortiManager?

72. Refer to the exhibits.









The exhibits contain a network diagram, and virtual IP, IP pool, and firewall policies configuration information.

The WAN (port1) interface has the IP address 10.200.1.1/24.

The LAN (port3) interface has the IP address 10.0.1.254/24.

The first firewall policy has NAT enabled using IP pool.

The second firewall policy is configured with a VIP as the destination address.

Which IP address will be used to source NAT (SNAT) the internet traffic coming from a workstation with the IP address 10.0.1.10?

73. Refer to the exhibits.













The exhibits show a diagram of a FortiGate device connected to the network, as well as the firewall policy and IP pool configuration on the FortiGate device.

Two PCs, PC1 and PC2, are connected behind FortiGate and can access the internet successfully. However, when the administrator adds a third PC to the network (PC3), the PC cannot connect to the internet.

Based on the information shown in the exhibit, which two configuration options can the administrator use to fix the connectivity issue for PC3? (Choose two.)

A. In the firewall policy configuration, add 10. o. l. 3 as an address object in the source field.

B. In the IP pool configuration, set endig to 192.2.0.12.

C. Configure another firewall policy that matches only the address of PC3 as source, and then place the policy on top of the list.

D. In the IP pool configuration, set cype to overload.

74. An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings.

What is true about the DNS connection to a FortiGuard server?

75. Refer to the exhibit.





In the network shown in the exhibit, the web client cannot connect to the HTTP web server.

The administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit.

What should the administrator do next to troubleshoot the problem?

76. Refer to the exhibits.

An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).









What must the administrator do to synchronize the address object?

77. An administrator must enable a DHCP server on one of the directly connected networks on FortiGate. However, the administrator is unable to complete the process on the GUI to enable the service on the interface.

In this scenario, what prevents the administrator from enabling DHCP service?

78. Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)

79. Which three authentication timeout types are availability for selection on FortiGate? (Choose three.)

A. hard-timeout

B. auth-on-demand

C. soft-timeout

D. new-session

E. Idle-timeout