Fortinet FCP_FGT_AD-7.6 Online Practice Questions and Exam Preparation

Fortinet FCP_FGT_AD-7.6 Online Questions & Answers

• Question 1:

  Refer to the exhibits.

  

  The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.

  The WAN (port2) interface has the IP address 100.65.0.101/24. The LAN (port4) interface has the IP address 10.0.11.254/24.

  Which IP address will be used to source NAT (SNAT) the traffic, if the user on HQ-PC-1 (10.0.11.50) pings the IP address of BR-FGT (100.65.1.111)?

  A. 100.65.0.101
  B. 100.65.0.49
  C. 100.65.0.99
  D. 100.65.0.149
  C. 100.65.0.99

  ---

  Explanation

  The ping traffic policy uses the IP pool named SNAT-Remote1, which has the external IP range 100.65.0.99. Therefore, traffic matching this policy (ping from HQ-PC-1 to BR1-FGT) will use 100.65.0.99 for source NAT.

• Question 2:

  A new administrator is configuring FSSO authentication on FortiGate using DC Agent Mode.

  Which step is NOT part of the expected process?

  A. The DC agent sends login event data directly to FortiGate.
  B. The user logs into the windows domain.
  C. The collector agent forwards login event data to FortiGate.
  D. FortiGate determines user identity based on the IP address in the FSSO list.
  A. The DC agent sends login event data directly to FortiGate.

• Question 3:

  Refer to the exhibits.

  

  An administrator wants to add HQ-ISFW-2 in the Security Fabric. HQ-ISFW-2 is in the same subnet as HQ-ISFW. After configuring the Security Fabric settings on HQ-ISFW-2, the status stays Pending.

  What can be the two possible reasons? (Choose two.)

  A. Upstream FortiGate IP must be set to 10.0.11.254.
  B. SAML Single Sign-On must be set to Manual.
  C. HQ-ISFW-2 must be authorized on HQ-ISFW.
  D. Management IP must be set to 10.0.13.254.
  A. Upstream FortiGate IP must be set to 10.0.11.254.
  C. HQ-ISFW-2 must be authorized on HQ-ISFW.

  ---

  Explanation

  The Upstream FortiGate IP should match the IP address of the Fabric Root interface, which is 10.0.11.254, not 10.0.13.254.

  The new device (HQ-ISFW-2) must be authorized on the Fabric Root (HQ-ISFW) before it can join the Security Fabric, otherwise the status remains pending.

• Question 4:

  Refer to the exhibit, which shows the IPS sensor configuration.

  

  If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

  A. The sensor will reset all connections that match these signatures.
  B. The sensor will gather a packet log for all matched traffic.
  C. The sensor will allow attackers matching the Microsoft.Windows.iSCSI.Target.DoS signature.
  D. The sensor will block all attacks aimed at Windows servers.
  C. The sensor will allow attackers matching the Microsoft.Windows.iSCSI.Target.DoS signature.
  D. The sensor will block all attacks aimed at Windows servers.

• Question 5:

  Refer to the exhibit.

  

  Why did the FortiGate device drop the packet?

  A. It matched the default implicit firewall policy.
  B. It matched an explicitly configured firewall policy with the action DENY.
  C. It cannot reach the next-hop IP.
  D. It failed the RPF check.
  A. It matched the default implicit firewall policy.

• Question 6:

  A network administrator has configured an SSL/SSH inspection profile defined for full SSL inspection and set with a private CA certificate. The firewall policy that allows the traffic uses this profile for SSL inspection and performs web filtering.

  When visiting any HTTPS websites, the browser reports certificate warning errors.

  What is the reason for the certificate warning errors?

  A. With full SSL inspection it is not possible to avoid certificate warning errors at the browser level.
  B. The browser does not recognize the certificate in use as signed by a trusted CA.
  C. The certificate used by FortiGate for SSL inspection does not contain the required certificate extensions
  D. The SSL cipher compliance option is not enabled on the SSL inspection profile. This setting is required when the SSL inspection profile is defined with a private CA certificate.
  B. The browser does not recognize the certificate in use as signed by a trusted CA.

• Question 7:

  Refer to the exhibit, which contains a RADIUS server configuration.

  

  An administrator added a configuration for a new RADIUS server. While configuring, the administrator enabled Include in every user group.

  What is the impact of enabling Include in every user group in a RADIUS configuration?

  A. This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.
  B. This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.
  C. This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.
  D. This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.
  A. This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.

  ---

  Explanation

  Enabling Include in every user group in the RADIUS configuration means the RADIUS server is automatically added to all FortiGate user groups. As a result, any user who can authenticate successfully against that RADIUS server becomes a member of every FortiGate user group, without needing to be manually assigned. This can inadvertently grant excessive access if not carefully controlled.

• Question 8:

  FortiGate is integrated with FortiAnalyzer and FortiManager. When a firewall policy is created, which attribute is added to the policy to improve functionality and to support recording logs to FortiAnalyzer or FortiManager?

  A. Sequence ID
  B. Log ID
  C. Policy ID
  D. Universally Unique Identifier
  D. Universally Unique Identifier

• Question 9:

  What are two features of FortiGate FSSO agentless polling mode? (Choose two.)

  A. FortiGate directs the collector agent to use a remote LDAP server.
  B. FortiGate uses the SMB protocol to read the event viewer logs from the DCs.
  C. FortiGate does not support workstation check.
  D. FortiGate uses the AD server as the collector agent.
  B. FortiGate uses the SMB protocol to read the event viewer logs from the DCs.
  C. FortiGate does not support workstation check.

• Question 10:

  A network administrator enabled antivirus and selected an SSL inspection profile on a firewall policy.

  When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and does not block the file, allowing it to be downloaded.

  The administrator confirms that the traffic matches the configured firewall policy.

  What are two reasons for the failed virus detection by FortiGate? (Choose two.)

  A. The selected SSL inspection profile has certificate inspection enabled.
  B. The website is exempted from SSL inspection.
  C. The El CAR test file exceeds the protocol options oversize limit.
  D. The browser does not trust the FortiGate self-signed CA certificate.
  A. The selected SSL inspection profile has certificate inspection enabled.
  B. The website is exempted from SSL inspection.