Fortinet FCP_FGT_AD-7.4 Online Practice Questions and Exam Preparation

Fortinet FCP_FGT_AD-7.4 Online Questions & Answers

• Question 31:

  Refer to the exhibit.

  

  A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 failed to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.

  Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes can the administrator make to bring phase 1 up? (Choose two.)

  A. On HQ-FortiGate, disable Diffie-Helman group 2.
  B. On Remote-FortiGate, set port2 as Interface.
  C. On both FortiGate devices, set Dead Peer Detection to On Demand.
  D. On HQ-FortiGate, set IKE mode to Main (ID protection).
  B. On Remote-FortiGate, set port2 as Interface.
  D. On HQ-FortiGate, set IKE mode to Main (ID protection).

  ---

  Based on the phase 1 configuration and the diagram shown in the exhibit, the administrator can make the following two configuration changes to bring phase 1 up: B. On Remote-FortiGate, set port2 as Interface: The diagram indicates that port2 is currently not selected under `Interface' for Remote-FortiGate. Aligning this setting with HQ- FortiGate, which has port1 set as Interface, might resolve inconsistencies. D. On HQ-FortiGate, set IKE mode to Main (ID protection): The current setting on HQ- FortiGate is Aggressive for IKE mode, while Remote-FortiGate is set to Main mode. Matching these settings may help in establishing phase 1 of the IPsec tunnel.

• Question 32:

  Which method allows management access to the FortiGate CLI without network connectivity?

  A. SSH console
  B. CLI console widget
  C. Serial console
  D. Telnet console
  C. Serial console

  ---

  Explanation Explanation/Reference: The serial console method allows management access to the FortiGate CLI without relying on network connectivity. This method involves directly connecting a computer to the FortiGate device using a serial cable (such as a DB-9 to RJ-45 cable or USB to RJ-45 cable) and using terminal emulation software to interact with the FortiGate CLI. This method is essential for situations where network-based access methods (such as SSH or Telnet) are not available or feasible. References: FortiOS 7.4.1 Administration Guide: Console connection

• Question 33:

  An administrator is configuring an IPsec VPN between site A and site . The Remote Gateway setting in both sites has been configured as Static IP Address.

  For site A, the local quick mode selector is 192.168.1.0/24 and the remote quick mode selector is 192.168.2.0/24.

  Which subnet must the administrator configure for the local quick mode selector for site B?

  A. 192.168.3.0/24
  B. 192.168.0.0/8
  C. 192.168.2.0/24
  D. 192.168.1.0/24
  C. 192.168.2.0/24

• Question 34:

  FortiGate is integrated with FortiAnalyzer and FortiManager.

  When a firewall policy is created, which attribute is added to the policy to improve functionality and to support recording logs to FortiAnalyzer or FortiManager?

  A. Log ID
  B. Policy ID
  C. Sequence ID
  D. Universally Unique Identifier
  D. Universally Unique Identifier

  ---

  Explanation Explanation/Reference:When a firewall policy is created in FortiGate integrated with FortiAnalyzer and FortiManager, a Universally Unique Identifier (UUID) is added to the policy to support logging and management.

• Question 35:

  FortiGuard categories can be overridden and defined in different categories. To create a web rating override for the example.com home page the override must be configured using a specific syntax.

  Which two syntaxes are correct to configure a web rating override for the home page? (Choose two.)

  A. www.example.com:443
  B. www.example.com
  C. www.example.com/index.hrml
  D. example.com
  B. www.example.com
  D. example.com

  ---

  www.example.com This syntax targets the main domain, which is a common way to configure a web rating override for the home page of a website. example.com This syntax also correctly targets the main domain without specifying a subdomain (like "www"), which is valid for configuring a web rating override for the entire site, including the home page.

• Question 36:

  A network administrator is configuring an IPsec VPN tunnel for a sales employee travelling abroad. Which IPsec Wizard template must the administrator apply?

  A. Remote Access
  B. Site to Site
  C. Dial up User
  D. iHub-and-Spoke
  A. Remote Access

  ---

  Explanation For configuring an IPsec VPN tunnel for a sales employee traveling abroad, the "Remote Access" template is the most appropriate choice. This template is designed to allow remote users to securely connect to the internal network of an organization from any location using FortiClient or a compatible client. The other options, such as "Site to Site," "Dial up User," and "iHub-and-Spoke," are used for connecting different networks or sites, not individual remote users. References: FortiOS 7.4.1 Administration Guide: IPsec Wizard Template Types

• Question 37:

  Refer to the exhibit.

  

  The exhibit shows a diagram of a FortiGate device connected to the network, the firewall policy and VIP configuration on the FortiGate device, and the routing table on the ISP router.

  When the administrator tries to access the web server public address (203.0.113.2) from the internet, the connection times out. At the same time the administrator runs a sniffer on FortiGate to capture incoming web traffic to the server and does not see any output.

  Based on the information shown in the exhibit, what configuration change must the administrator make to fix the connectivity issue?

  A. Configure a loopback interface with address 203.0.113.2/32.
  B. In the VIP configuration, enable arp-reply.
  C. In the firewall policy configuration, enable match-vip.
  D. Enable port forwarding on the server to map the external service port to the internal service port.
  B. In the VIP configuration, enable arp-reply.

  ---

  Explanation Explanation/Reference: In this scenario, the FortiGate device is using a Virtual IP (VIP) to map the public IP address (203.0.113.2) to the internal IP address of the web server (172.16.1.10). The fact that the administrator does not see any sniffer output for incoming traffic suggests that the FortiGate is not responding to ARP requests for the public IP address (203.0.113.2). Enabling arp-reply in the VIP configuration allows the FortiGate to respond to ARP requests for the public IP, thereby allowing traffic to reach the FortiGate, which will then forward it to the web server based on the VIP mapping.

• Question 38:

  Which three statements explain a flow-based antivirus profile? (Choose three.)

  A. Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection
  B. Flow-based inspection optimizes performance compared to proxy-based inspection
  C. FortiGate buffers the whole file but transmits to the client at the same time.
  D. If a virus is detected, the last packet is delivered to the client.
  E. The IPS engine handles the process as a standalone.
  A. Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection
  B. Flow-based inspection optimizes performance compared to proxy-based inspection
  C. FortiGate buffers the whole file but transmits to the client at the same time.

• Question 39:

  Refer to the exhibit.

  

  Examine the intrusion prevention system (IPS) diagnostic command shown in the exhibit. If option 5 is used with the IPS diagnostic command and the outcome is a decrease in the CPU usage, what is the correct conclusion?

  A. The IPS engine is blocking all traffic.
  B. The IPS engine is inspecting a high volume of traffic.
  C. The IPS engine is unable to prevent an intrusion attack.
  D. The IPS engine will continue to run in a normal state.
  B. The IPS engine is inspecting a high volume of traffic.

  ---

  If there are high-CPU use problems caused by the IPS, you can use the diagnose test application ipsmonitor command with option 5 to isolate where the problem might be. Option 5 enables IPS bypass mode. In this mode, the IPS engine is still running, but it is not inspecting traffic. If the CPU use decreases after that, it usually indicates that the volume of traffic being inspected is too high for that FortiGate model.

• Question 40:

  When FortiGate performs SSL/SSH full inspection, you can decide how it should react when it detects an invalid certificate.

  Which three actions are valid actions that FortiGate can perform when it detects an invalid certificate? (Choose three.)

  A. Allow and Warning
  B. Trust and Allow
  C. Allow
  D. Block and Warning
  E. Block
  B. Trust and Allow
  C. Allow
  E. Block

  ---

  When a certificate fails for any of the reasons above, you can configure any of the following actions: ?Keep untrustedand; Allow: FortiGate allows the website and lets the browser decide the action to take. FortiGate takes the certificate as untrusted. ?Block: FortiGate blocks the content of the site. ?Trustand; Allow: FortiGate allows the website and takes the certificate as trusted.