Fortinet FCSS_EFW_AD-7.4 Online Practice Questions and Exam Preparation

Fortinet FCSS_EFW_AD-7.4 Online Questions & Answers

• Question 1:

  A company's guest internet policy, operating in proxy mode, blocks access to Artificial Intelligence Technology sites using FortiGuard. However, a guest user accessed a page in this category using port 8443. Which configuration changes are required for FortiGate to analyze HTTPS traffic on nonstandard ports like 8443 when full SSL inspection is active in the guest policy?

  A. Add a URL wildcard domain to the website CA certificate and use it in the SSL/SSH Inspection Profile.
  B. In the Protocol Port Mapping section of the SSL/SSH Inspection Profile, enter 443, 8443 to analyze both standard (443) and non-standard (8443) HTTPS ports.
  C. To analyze nonstandard ports in web filter profiles, use TLSv1.3 in the SSL/SSH Inspection Profile.
  D. Administrators can block traffic on nonstandard ports by enabling the SNI check in the SSL/SSH Inspection Profile.
  B. In the Protocol Port Mapping section of the SSL/SSH Inspection Profile, enter 443, 8443 to analyze both standard (443) and non-standard (8443) HTTPS ports.

  ---

  Explanation

  When FortiGate is operating in proxy mode with full SSL inspection enabled , it inspects encrypted HTTPS traffic by default on port 443 . However, some websites may use non-standard HTTPS ports (such as 8443), which FortiGate does not inspect unless explicitly configured.

  To ensure that FortiGate inspects HTTPS traffic on port 8443 , administrators must manually add port 8443 in the Protocol Port Mapping section of the SSL/SSH Inspection Profile . This allows FortiGate to treat HTTPS traffic on port 8443 the same as traffic on port 443, enabling proper inspection and enforcement of FortiGuard category-based web filtering .

• Question 2:

  Refer to the exhibit, which shows a physical topology and a traffic log.

  

  The administrator is checking on FortiAnalyzer traffic from the device with IP address10.1.10.1, located behind the FortiGate ISFW device.

  The firewall policy in on the ISFW device does not have UTM enabled and the administrator is surprised to see a log with the action Malware , as shown in the exhibit. What are the two reasons FortiAnalyzer would display this log? (Choose two.)

  A. Security rating is enabled in ISFW.
  B. ISFW is in a Security Fabric environment.
  C. ISFW is not connected to FortiAnalyzer and must go through NGFW-1.
  D. The firewall policy in NGFW-1 has UTM enabled.
  B. ISFW is in a Security Fabric environment.
  D. The firewall policy in NGFW-1 has UTM enabled.

  ---

  Explanation

  From the exhibit, ISFW is part of a Security Fabric environment with NGFW-1 as the Fabric Root. In this architecture, FortiGate devices share security intelligence, including logs and detected threats.

  ISFW is in a Security Fabric environment:

  Security Fabric allows devices like ISFW to receive threat intelligence from NGFW-1, even if UTM is not enabled locally.

  If NGFW-1 detects malware from IP 10.1.10.1 to 89.238.73.97 , this information can be propagated to ISFW and FortiAnalyzer .

  The firewall policy in NGFW-1 has UTM enabled:

  Even though ISFW does not have UTM enabled , NGFW-1 (which sits between ISFW and the external network) does have UTM enabled and is scanning traffic.

  Since NGFW-1 detects malware in the session, it logs the event, which is then sent to FortiAnalyzer .

• Question 3:

  Refer to the exhibit, which shows an OSPF network.

  

  Which configuration must the administrator apply to optimize the OSPF database?

  A. Set a route map in the AS boundary FortiGate.
  B. Set the area 0.0.0.1 to the type STUB in the area border FortiGate.
  C. Set an access list in the AS boundary FortiGate.
  D. Set the area 0.0.0.1 to the type NSSA in the area border FortiGate.
  B. Set the area 0.0.0.1 to the type STUB in the area border FortiGate.

  ---

  Explanation

  The OSPF database optimization is necessary to reduce unnecessary routing information and improve network performance. In the given topology, Area 0.0.0.1 is a non-backbone area connected to Area 0.0.0.0 (the backbone area) through

  an Area Border Router (ABR) .

  To optimize OSPF in this scenario, configuring Area 0.0.0.1 as a Stub Area will:

  Reduce the size of the OSPF database by preventing external routes (from outside OSPF) from being injected into Area 0.0.0.1. Allow only intra-area and inter-area routes , meaning routers in Area 0.0.0.1 will rely on a default route for external destinations.

  Improve convergence time and reduce router processing load since fewer LSAs (Link-State Advertisements) are exchanged.

• Question 4:

  An administrator applied a block-all IPS profile for client and server targets to secure the server, but the database team reported the application stopped working immediately after. How can an administrator apply IPS in a way that ensures it does not disrupt existing applications in the network?

  A. Use an IPS profile with all signatures in monitor mode and verify patterns before blocking.
  B. Limit the IPS profile to server targets only to avoid blocking connections from the server to clients.
  C. Select flow mode in the IPS profile to accurately analyze application patterns.
  D. Set the IPS profile signature action to default to discard all possible false positives.
  A. Use an IPS profile with all signatures in monitor mode and verify patterns before blocking.

  ---

  Explanation

  Applying an aggressive IPS profile without prior testing can disrupt legitimate applications by incorrectly identifying normal traffic as malicious. To prevent disruptions while still monitoring for threats:

  Enable IPS in "Monitor Mode" first:

  This allows FortiGate to log and analyze potential threats without actively blocking traffic.

  Administrators can review logs and fine-tune IPS signatures to minimize false positives before switching to blocking mode.

  Verify and adjust signature patterns:

  Some signatures might trigger unnecessary blocks for legitimate application traffic.

  By analyzing logs, administrators can disable or modify specific rules causing false positives.

• Question 5:

  Refer to the exhibit, which shows the ADVPN network topology and partial BGP configuration.

  

  Which two parameters must an administrator configure in the config neighbor range for spokes shown in the exhibit? (Choose two.)

  A. set max-neighbor-num 2
  B. set neighbor-group advpn
  C. set route-reflector-client enable
  D. set prefix 172.16.1.0 255.255.255.0
  B. set neighbor-group advpn
  C. set route-reflector-client enable

  ---

  Explanation

• Question 6:

  Refer to the exhibit, which shows a revision history window in the FortiManager device layer.

  

  The IT team is trying to identify the administrator responsible for the most recent update in the FortiGate device database. Which conclusion can you draw about this scenario?

  A. This retrieved process was automatically triggered by a Remote FortiGate Directly (via CLI) script.
  B. The user script_manager is an API user from the Fortinet Developer Network (FDN) retrieving a configuration.
  C. To identify the user who created the event, check it on the Configuration and Installation widget on FortiGate within the FortiManager device layer.
  D. Find the user in the FortiManager system logs and use the type=script command to find the administrator user in the user field.
  D. Find the user in the FortiManager system logs and use the type=script command to find the administrator user in the user field.

  ---

  Explanation

  The Configuration Revision History window in FortiManager shows that the most recent configuration change (ID 10) was created by script_manager with the action Retrieved .

  Since script_manager is a system-level script execution user, the IT team needs to find who actually triggered this script . This can be done by:

  Checking the FortiManager system logs for script execution events .

  Using the type=script filter to locate the administrator associated with the script execution.

• Question 7:

  Refer to the exhibit, which contains a partial VPN configuration.

  

  What can you conclude from this VPN IPsec phase 1 configuration?

  A. This configuration is the best for networks with regular traffic intervals, providing a balance between connectivity assurance and resource utilization.
  B. Peer IDs are unencrypted and exposed, creating a security risk.
  C. FortiGate will not add a route to its routing or forwarding information base when the dynamic tunnel is negotiated.
  D. A separate interface is created for each dial-up tunnel, which can be slower and more resource intensive, especially in large networks.
  A. This configuration is the best for networks with regular traffic intervals, providing a balance between connectivity assurance and resource utilization.

  ---

  Explanation

  This IPsec Phase 1 configuration defines a dynamic VPN tunnel that can accept connections from multiple peers. The settings chosen here suggest a configuration optimized fornetworks with intermittent traffic patterns while ensuring

  resources are used efficiently.

  Key configurations and their impact:

  set type dynamic This allows multiple peers to establish connections dynamically without needing predefined IP addresses.

  set ike-version 2 Uses IKEv2 , which is more efficient and supports features like EAP authentication and reduced rekeying overhead.

  set dpd on-idle Dead Peer Detection (DPD) is triggered only when the tunnel is idle , reducing unnecessary keep-alive packets and improving resource utilization. set add-route enable FortiGate automatically adds the route to the routing table

  when the tunnel is established, ensuring connectivity when needed.

  set proposal aes128-sha256 aes256-sha256 Uses strong encryption and hashing algorithms, ensuring a secure connection.

  set keylife 28800 Sets a longer key lifetime (8 hours), reducing the frequency of rekeying, which is beneficial for stable connections.

  Because DPD is set to on-idle , the tunnel will not constantly send keep-alive messages but will still ensure connectivity when traffic is detected. This makes the configuration ideal fornetworks with regular but non- continuous traffic , balancing

  security and resource efficiency.

• Question 8:

  Refer to the exhibit, which contains a partial command output.

  

  The administrator has configured BGP on FortiGate. The status of this new BGP configuration is shown in the exhibit. What configuration must the administrator consider next?

  A. Configure a static route to 100.65.4.1.
  B. Configure the local AS to 65300.
  C. Contact the remote peer administrator to enable BGP
  D. Enable ebgp-enforce-multihop.
  D. Enable ebgp-enforce-multihop.

  ---

  Explanation

  From the BGP neighbor status output , the key issue is that BGP is stuck in the "Idle" state , meaning the FortiGate is unable to establish a BGP session with its peer 100.65.4.1 (Remote AS 65300).

  The output also shows:

  "Not directly connected EBGP" This means the BGP peer is not on the same subnet, requiring multihop BGP.

  "Update source is Loopback" Since a loopback interface is used, FortiGate must be configured to allow BGP neighbors over multiple hops.

  To resolve this issue, the administrator must enable ebgp-enforce-multihop , which allows BGP sessions to be established even when the neighbors are not directly connected.

• Question 9:

  What does the command set forward-domain in a transparent VDOM interface do?

  A. It configures the interface to prioritize traffic based on the domain ID, enhancing quality of service for specified VLANs.
  B. It isolates traffic within a specific VLAN by assigning a broadcast domain to an interface based on the VLAN ID.
  C. It restricts the interface to managing traffic only from the specified VLAN, effectively segregating network traffic.
  D. It assigns a unique domain ID to the interface, allowing it to operate across multiple VLANs within the same VDOM.
  B. It isolates traffic within a specific VLAN by assigning a broadcast domain to an interface based on the VLAN ID.

  ---

  Explanation

  In a transparent mode Virtual Domain (VDOM) configuration, FortiGate operates as a Layer 2 bridge rather than performing Layer 3 routing. The set forward-domain command is used to control how traffic is forwarded between interfaces within the same transparent VDOM .

  A forward-domain acts as a broadcast domain , meaning only interfaces with the same forward-domain ID can exchange traffic. This setting is commonly used toseparate different VLANs or network segments within the transparent VDOM while still allowing FortiGate to apply security policies.

• Question 10:

  Refer to the exhibits.

  

  The Administrators section of a root FortiGate device and the Security Fabric Settings section of a downstream FortiGate device are shown.

  When prompted to sign in with Security Fabric in the downstream FortiGate device, a user enters the AdminSSO credentials.

  What is the next status for the user?

  A. The user is prompted to create an SSO administrator account for AdminSSO.
  B. The user receives an authentication failure message.
  C. The user accesses the downstream FortiGate with super_admin_readonly privileges.
  D. The user accesses the downstream FortiGate with super_admin privileges.
  C. The user accesses the downstream FortiGate with super_admin_readonly privileges.

  ---

  Explanation

  From the Root FortiGate - System Administrator Configuration exhibit:

  The AdminSSO account has the super_admin_readonly role.

  From the Downstream FortiGate - Security Fabric Settings exhibit:

  The Security Fabric role is set to Join Existing Fabric , meaning it will authenticate with the root FortiGate.

  SAML Single Sign-On (SSO) is enabled , and the default admin profile is set to super_admin_readonly .

  When the AdminSSO user logs into the downstream FortiGate using SSO , the authentication request is sent to the root FortiGate, where AdminSSO has super_admin_readonly permissions. Since the downstream FortiGate inherits this

  permission through the Security Fabric configuration, the user will be granted super_admin_readonly access.