Fortinet FCP_FGT_AD-7.6 Online Practice Questions and Exam Preparation

Fortinet FCP_FGT_AD-7.6 Online Questions & Answers

• Question 81:

  Refer to the exhibits.

  

  

  

  

  The exhibits show a diagram of a FortiGate device connected to the network, and the firewall policies, VIP, and IP pool configurations on the FortiGate device.

  The WAN (port2) interface has the IP address 100.65.0.101/24. The LAN (port4) interface has the IP address 10.0.11.254/24.

  The first firewall policy has NAT enabled using the IP pool. The second firewall policy is configured with a VIP as the destination address.

  Which IP address will be used to source NAT (SNAT) the internet traffic coming from a workstation with the

  IP address 10.0.11.50?

  A. 100.65.0.101
  B. 100.65.0.200
  C. 100.65.0.102
  D. 10.0.11.254
  C. 100.65.0.102

  ---

  Explanation

  Traffic from the workstation 10.0.11.50 going to the internet matches the Internet(1) policy (LAN WAN) which has NAT enabled and is configured to use the IP Pool. The IP pool specifies the external address 100.65.0.102.

  FortiGate will perform source NAT (SNAT) on the outbound traffic, translating the source IP of the workstation to 100.65.0.102.

• Question 82:

  An administrator wants to form an HA cluster using the FGCP protocol.

  Which two requirements must the administrator ensure both members fulfill? (Choose two.)

  A. They must have the same HA group ID.
  B. They must have the heartbeat interfaces in the same subnet.
  C. They must have the same number of configured VDOMs.
  D. They must have the same hard drive configuration.
  A. They must have the same HA group ID.
  D. They must have the same hard drive configuration.

• Question 83:

  What are two features of the NGFW profile-based mode? (Choose two.)

  A. NGFW profile-based mode policies support both flow inspection and proxy inspection.
  B. NGFW profile-based mode supports applying applications and web filtering profiles in a firewall policy.
  C. NGFW profile-based mode can only be applied globally and not on individual VDOMs.
  D. NGFW profile-based mode must require the use of central source NAT policy.
  A. NGFW profile-based mode policies support both flow inspection and proxy inspection.
  B. NGFW profile-based mode supports applying applications and web filtering profiles in a firewall policy.

• Question 84:

  You are encountering connectivity problems caused by intermediate devices blocking IPsec traffic.

  In which two ways can you effectively resolve the problem? (Choose two.)

  A. You can use SSL VPN tunnel mode to prevent problems with blocked ESP and UDP ports (500 or 4500).
  B. You can configure a hub-and-spoke topology with SSL VPN tunnels to bypass blocked UDP ports.
  C. You can turn on fragmentation to fix large certificate negotiation problems.
  D. You should use the protocol IKEv2.
  A. You can use SSL VPN tunnel mode to prevent problems with blocked ESP and UDP ports (500 or 4500).
  D. You should use the protocol IKEv2.

  ---

  Explanation

  Using SSL VPN tunnel mode avoids issues with blocked ESP (IP protocol 50) and UDP ports (500/4500), since SSL VPN uses HTTPS (TCP 443), which is usually allowed. Switching to IKEv2 helps with NAT traversal and firewall compatibility because it supports UDP encapsulation on port 4500 and is more robust than IKEv1.

• Question 85:

  A network administrator is configuring an IPsec VPN tunnel for a sales employee travelling abroad.

  Which IPsec Wizard template must the administrator apply?

  A. Hub-and-Spoke
  B. Site to Site
  C. Remote Access
  D. Dial up User
  C. Remote Access

• Question 86:

  A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors.

  What is the reason for the certificate warning errors?

  A. The browser does not trust the certificate used by FortiGate for SSL inspection.
  B. The option invalid SSL certificates is set to allow on the SSL/SSH inspection profile
  C. The matching firewall policy is set to proxy inspection mode.
  D. The certificate used by FortiGate for SSL inspection does not contain the required certificate extensions.
  A. The browser does not trust the certificate used by FortiGate for SSL inspection.

  ---

  Explanation

  When full SSL inspection is enabled, FortiGate decrypts and re-signs HTTPS traffic using its own SSL inspection certificate. If the FortiGate CA certificate is not imported and trusted by the client's browser or OS, the browser sees it as untrusted and displays certificate warning errors. HTTP traffic is unaffected since it does not use certificates.

• Question 87:

  Which inspection mode does FortiGate use for application profiles if it is configured as a profile-based next-generation firewall (NGFW)?

  A. Certificate inspection
  B. Flow-based inspection
  C. Proxy-based inspection
  D. Full content inspection
  B. Flow-based inspection

• Question 88:

  Refer to the exhibits.

  

  

  ht

  

  You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.

  Which two factors can you observe from these configurations? (Choose two.)

  A. Facebook access is allowed but you cannot play Facebook videos based on Video/Audio category filter settings.
  B. Facebook access is blocked based on the category filter settings.
  C. YouTube search is allowed based on the Google Application and Filter override settings.
  D. YouTube access is blocked based on Excessive-Bandwidth Application and Filter override settings.
  B. Facebook access is blocked based on the category filter settings.
  D. YouTube access is blocked based on Excessive-Bandwidth Application and Filter override settings.

• Question 89:

  Refer to the exhibits.

  

  

  

  

  FGT-1 and FGT-2 are updated with HA configuration commands shown in the exhibit.

  What would be the expected outcome in the HA cluster?

  A. FGT-2 will take over as the primary because it has the override enable setting and higher priority than FGT-1.
  B. FGT-1 will synchronize the override disable setting with FGT-2.
  C. The HA cluster will become out of sync because the override setting must match on all HA members.
  D. FGT-1 will remain the primary because FGT-2 has lower priority.
  A. FGT-2 will take over as the primary because it has the override enable setting and higher priority than FGT-1.

• Question 90:

  Which two statements about the Security Fabric rating are true? (Choose two.)

  A. A license is required to obtain an executive summary in the Security Rating section.
  B. The root FortiGate provides executive summaries of all the FortiGate devices in the Security Fabric.
  C. The Security Posture category provides PCI compliance results.
  D. Security Rating Insights are available only in the Security Rating page.
  B. The root FortiGate provides executive summaries of all the FortiGate devices in the Security Fabric.
  C. The Security Posture category provides PCI compliance results.