Fortinet FCP_FGT_AD-7.6 Online Practice Questions and Exam Preparation

Fortinet FCP_FGT_AD-7.6 Online Questions & Answers

• Question 41:

  Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

  A. The collector agent uses a Windows API to query DCs for user logins.
  B. NetAPI polling can increase bandwidth usage in large networks.
  C. The NetSessionEnum function is used to track user logouts.
  D. The collector agent must search Windows application event logs.
  C. The NetSessionEnum function is used to track user logouts.

• Question 42:

  Refer to the exhibit.

  

  The exhibit shows the FortiGuard Category-Based Filter section of a corporate web filter profile.

  An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category.

  What are two solutions for satisfying the requirement? (Choose two.)

  A. Configure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.
  B. Configure a web rating override for download.com and select Malicious Websites as the subcategory.
  C. Configure a separate firewall policy with action Deny and an FQDN address object for *.download.com as the destination address.
  D. Set the Freeware and Software Downloads category Action to Warning.
  A. Configure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.
  B. Configure a web rating override for download.com and select Malicious Websites as the subcategory.

• Question 43:

  Refer to the exhibits.

  

  An administrator has observed the performance status outputs on an HA cluster for 55 seconds.

  Which FortiGate is the primary?

  A. HQ-NGFW-2 with the parameter memory-failover-threshold setting
  B. HQ-NGFW-2 with the parameter priority setting
  C. HQ-NGFW-1 with the parameter memory-failover-flip-timeout setting
  D. HQ-NGFW-1 with the parameter override setting
  A. HQ-NGFW-2 with the parameter memory-failover-threshold setting

• Question 44:

  Refer to the exhibits.

  

  The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration.

  An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2.

  The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver.

  Which additional configuration can the administrator add to a deny firewall policy, beyond the default behavior, to block Remote-User2 from accessing the Webserver?

  A. Disable match-vip in the Allow_access policy
  B. Configure a One-to-One IP Pool object in a new policy.
  C. Set the Destination address as Webserver in the Deny policy.
  D. Set the Destination address as Deny_IP in the Allow_access policy.
  C. Set the Destination address as Webserver in the Deny policy.

  ---

  Explanation

  To block Remote-User2's access to the Webserver, the deny policy must explicitly specify the Webserver as the destination address; otherwise, it denies traffic to all destinations, which is not the desired behavior.

• Question 45:

  You have configured the FortiGate device for FSSO. A user is successful in log-in to windows, but their access to the internet is denied.

  What should the administrator check first?

  A. Whether the user is assigned to the correct AD group.
  B. The FortiGate firewall policy settings for SSL decryption.
  C. The FortiGate FSSO active users list for user's IP address.
  D. The windows event viewer for failed login attempts.
  C. The FortiGate FSSO active users list for user's IP address.

  ---

  Explanation

  Checking the active users list verifies if FortiGate correctly associates the user with their IP address, ensuring proper policy enforcement for internet access.

• Question 46:

  Refer to the exhibit, which shows an SD-WAN zone configuration on the FortiGate GUI.

  

  Based on the exhibit, which statement is true?

  A. The sd-wan zone cannot be deleted.
  B. The underlay zone contains port1 and port2.
  C. The sd-wan zone contains no members.
  D. The virtual-wan-link zone contains no members.
  C. The sd-wan zone contains no members.

• Question 47:

  Refer to the exhibits.

  

  

  Based on the current HA status, an administrator updates the override and priority parameters on HQ- NGFW-1 and HQ-NGFW-2 as shown in the exhibit.

  What would be the expected outcome in the HA cluster?

  A. HQ-NGFW-1 will synchronize the override disable setting with HQ-NGFW-2.
  B. HQ-NGFW-2 will take over as the primary because it has the override enable setting and higher priority than HQ-NGFW-1.
  C. HQ-NGFW-1 will remain the primary because HQ-NGFW-2 has lower priority.
  D. The HA cluster will become out of sync because the override setting must match on all HA members.
  B. HQ-NGFW-2 will take over as the primary because it has the override enable setting and higher priority than HQ-NGFW-1.

  ---

  Explanation

  With override enabled on HQ-NGFW-2 and its higher priority (110 vs. 90), HQ-NGFW-2 will become the primary device, preempting HQ-NGFW-1 despite the current primary status.

• Question 48:

  FortiGate is integrated with FortiAnalyzer and FortiManager. When creating a firewall policy, which attribute must an administrator include to enhance functionality and enable log recording on FortiAnalyzer and FortiManager?

  A. Policy ID
  B. Log ID
  C. Universally Unique Identifier
  D. Sequence ID
  C. Universally Unique Identifier

  ---

  Explanation

  FortiGate uses a Universally Unique Identifier (UUID) for each firewall policy. This UUID is synchronized with FortiAnalyzer and FortiManager, allowing them to reliably identify the policy even if the policy ID or sequence changes. This ensures consistent log recording and enhanced functionality across integrated devices.

• Question 49:

  Refer to the exhibits.

  

  

  

  

  An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).

  What must the administrator do to synchronize the address object?

  A. Change the csf setting on both devices to set downstream-access enable.
  B. Change the csf setting on Local-FortiGate (root) to set fabric object-unification default.
  C. Change the csf setting on ISFW (downstream) to set authorization-request-type certificate.
  D. Change the csf setting on ISFW (downstream) to set configuration-sync local.
  A. Change the csf setting on both devices to set downstream-access enable.

• Question 50:

  Refer to the exhibit.

  

  FortiGate has two separate firewall policies for Sales and Engineering to access the same web server with the same security profiles.

  Which action must the administrator perform to consolidate the two policies into one?

  A. Create an Aggregate interface that includes port1 and port2 to create a single firewall policy.
  B. Select port1 and port2 subnets in a single firewall policy.
  C. Replace port1 and port2 with the any interface in a single firewall policy.
  D. Enable Multiple Interface Policies to select port1 and port2 in the same firewall policy.
  D. Enable Multiple Interface Policies to select port1 and port2 in the same firewall policy.

  ---

  Explanation

  Enabling Multiple Interface Policies allows you to select multiple interfaces (like port1 and port2) in a single firewall policy, consolidating access rules for both Sales and Engineering to the web server.