FCP_FGT_AD-7.4 Practice Questions Preview

Question 1

Single choice

Refer to the exhibits, which show the firewall policy and the security profile for Facebook.

Users are given access to the Facebook web application.

They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.

Which part of the configuration must you change to resolve the issue?

A
Make the SSL inspection a deep content inspection
B
Add Facebook to the URL category in the security policy
C
Disable HTTP redirect to HTTPS on the web browser
D
Get the additional application signatures required to add to the security policy

Question 2

Single choice

Refer to exhibit.

An administrator configured the web filtering profile shown in the exhibit to block access to all social networking sites except Twitter. However, when users try to accesstwitter.com, they are redirected to a FortiGuard web filtering block page.

Based on the exhibit, which configuration change can the administrator make to allow Twitter while blocking all other social networking sites?

A
On the Static URL Filter configuration set Type to Simple
B
On the FortiGuard Category Based Filter configuration set Action to Warning for Social Networking
C
On the Static URL Filter configuration set Action to Monitor
D
On the Static URL Filter configuration set Action to Exempt

Question 3

Multiple choice

Refer to the exhibit, which shows the IPS sensor configuration.

If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

A
The sensor will gather a packet log for all matched traffic.
B
The sensor will reset all connections that match these signatures.
C
The sensor will allow attackers matching the Microsoft.Windows.iSCSl.Target.DoS signature.
D
The sensor will block all attacks aimed at Windows servers.

Question 4

Single choice

A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser
does not report errors.

What is the reason for the certificate warning errors?

A
The option invalid SSL certificates is set to allow on the SSL/SSH inspection profile
B
The browser does not trust the certificate used by FortiGate for SSL inspection
C
The certificate used by FortiGate for SSL inspection does not contain the required certificate extensions.
D
The matching firewall policy is set to proxy inspection mode

Question 5

Single choice

Which method allows management access to the FortiGate CLI without network connectivity?

A
SSH console
B
CLI console widget
C
Serial console
D
Telnet console

Question 6

Multiple choice

Which three statements about SD-WAN zones are true? (Choose three.)

A
An SD-WAN zone can contain physical and logical interfaces
B
You can use an SD-WAN zone in static route definitions
C
You can define up to three SD-WAN zones per FortiGate device
D
An SD-WAN zone must contains at least two members
E
An SD-WAN zone is a logical grouping of members

Question 7

Single choice

How can you disable RPF checking?

A
Disable src-check on the interface level settings
B
Unset fail-alert-interfaces on the interface level settings.
C
Disable fail-detect on the interface level settings.
D
Disable strict-src-check under system settings.

Question 8

Multiple choice

Refer to the exhibits.

The exhibits show a diagram of a FortiGate device connected to the network, as well as the firewall policy and IP pool configuration on the FortiGate device.

Two PCs, PC1 and PC2, are connected behind FortiGate and can access the internet successfully.
However, when the administrator adds a third PC to the network (PC3), the PC cannot connect to the internet.

Based on the information shown in the exhibit, which two configuration options can the administrator use to fix the connectivity issue for PC3? (Choose two.)

A
In the firewall policy configuration, add 10. o. l. 3 as an address object in the source field.
B
In the IP pool configuration, set endig to 192.2.0.12.
C
Configure another firewall policy that matches only the address of PC3 as source, and then place the policy on top of the list.
D
In the IP pool configuration, set cype to overload.

Question 9

Single choice

Refer to the exhibit.

In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output shown in the exhibit.

What should the administrator do next, to troubleshoot the problem?

A
Execute a debug flow.
B
Capture the traffic using an external sniffer connected to part1.
C
Execute another sniffer on FortiGate, this time with the filter "hose 10.o.1.10".
D
Run a sniffer on the web server.

Question 10

Multiple choice

FortiGate is operating in NAT mode and has two physical interfaces connected to the LAN and DMZ networks respectively.

Which two statements are true about the requirements of connected physical interfaces on FortiGate? (Choose two.)

A
Both interfaces must have the interface role assigned
B
Both interfaces must have directly connected routes on the routing table
C
Both interfaces must have DHCP enabled
D
Both interfaces must have IP addresses assigned

Question 11

Single choice

Which statement is a characteristic of automation stitches?

A
They can be run only on devices in the Security Fabric.
B
They can be created only on downstream devices in the fabric.
C
They can have one or more triggers.
D
They can run multiple actions at the same time.

Question 12

Multiple choice

What are two features of the NGFW profile-based mode? (Choose two.)

A
NGFW profile-based mode can only be applied globally and not on individual VDOMs.
B
NGFW profile-based mode must require the use of central source NAT policy
C
NGFW profile-based mode policies support both flow inspection and proxy inspection.
D
NGFW profile-based mode supports applying applications and web filtering profiles in a firewall policy.

Question 13

Single choice

A network administrator is configuring an IPsec VPN tunnel for a sales employee travelling abroad.

Which IPsec Wizard template must the administrator apply?

A
Remote Access
B
Site to Site
C
Dial up User
D
iHub-and-Spoke

Question 14

Multiple choice

Which two statements are true regarding FortiGate HA configuration synchronization? (Choose two.)

A
Checksums of devices are compared against each other to ensure configurations are the same.
B
Incremental configuration synchronization can occur only from changes made on the primary FortiGate device.
C
Incremental configuration synchronization can occur from changes made on any FortiGate device within the HA cluster
D
Checksums of devices will be different from each other because some configuration items are not synced to other HA members.