Refer to the exhibit, which shows the FortiGuard Distribution Network of a FortiGate device.FortiGuard Distribution Network on FortiGate An administrator is trying to find the web filter database signature on FortiGate to resolve issues with websites not being filtered correctly in a flow-mode web filter profile.Why is the web filter database version not visible on the GUI, such as with IPS definitions?

The web filter database is not hosted on FortiGate: FortiGate queries FortiGuard or FortiManager for web filter ratings on demand.

The web filter database is stored locally, but the administrator must run over CLI diagnose autoupdate versions.

The web filter database is stored locally on FortiGate, but it is hidden behind the GUI. It requires enabling debug mode to make it visible.

The web filter database is not hosted on FortiGate: FortiGate queries FortiGuard or FortiManager for web filter ratings on demand.

The web filter database is only accessible after manual syncing with a valid FDS server using diagnose test update info.

Refer to the exhibit, which shows an ADVPN network An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2.What two options must the administrator configure in BGP? (Choose two.)

set ebgp-enforce-multrhop enable

set ibgp-enforce-multihop advpn

set attribute-unchanged next-hop

What action can be taken on a FortiGate to block traffic using IPS protocol decoders, focusing on network transmission patterns and application signatures?

Use application control to limit non-URL-based software handling.

Use the DNS filter to block application signatures and protocol decoders.

Use application control to limit non-URL-based software handling.

Enable application detection-based SD-WAN rules.

Configure a web filter profile in flow mode.

An administrator is designing an ADVPN network for a large enterprise with spokes that have varying numbers of internet links. They want to avoid a high number of routes and peer connections at the hub.Which method should be used to simplify routing and peer management?

Use a dynamic routing protocol using loopback interfaces to streamline peers and routes.

Deploy a full-mesh VPN topology to eliminate hub dependency.

Implement static routing over IPsec interfaces for each spoke.

Use a dynamic routing protocol using loopback interfaces to streamline peers and routes.

Establish a traditional hub-and-spoke VPN topology with policy routes.

Refer to the exhibit, which shows the ADVPN IPsec interface representing the VPN IPsec phase 1 from Hub A to Spoke 1 and Spoke 2, and from Hub to Spoke 3 and Spoke 4. An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2.What must the administrator configure in the phase 1 VPN IPsec configuration of the ADVPN tunnels?

set auto-discovery-crossover enable and set enforce-multihop enable

set auto-discovery-sender enable and set network-id x

set auto-discovery-forwarder enable and set remote-as x

set auto-discovery-crossover enable and set enforce-multihop enable

set auto-discovery-receiver enable and set npu-offload enable

A FortiGate device with UTM profiles is reaching the resource limits, and the administrator expects the traffic in the enterprise network to increase.The administrator has received an additional FortiGate of the same model.Which two protocols should the administrator use to integrate the additional FortiGate device into this enterprise network? (Choose two.)

FGSP with external load balancers

FGCP in active-active mode and with switches

FGSP with external load balancers

FGCP in active-active mode and with switches

FGCP in active-passive mode and with VDOM disabled

Refer to the exhibit. The routing tables of FortiGate_A and FortiGate_B are shown. FortiGate_A and FortiGate_B are in the same autonomous system.The administrator wants to dynamically add only route 172.16.1.248/30 on FortiGate_A.What must the administrator configure?

A BGP route map out for 172.16.1.248/30 on FortiGate_B

The prefix 172.16.1.248/30 in the BGP Networks section on FortiGate_B

A BGP route map out for 172.16.1.248/30 on FortiGate_B

Enable Redistribute Connected in the BGP section on FortiGate_B.

A BGP route map in for 172.16.1.248/30 on FortiGate_A

Refer to the exhibit, which shows a network diagram showing the addition of site 2 with an overlapping network segment to the existing VPN IPsec connection between the hub and site 1. Which IPsec phase 2 configuration must an administrator make on the FortiGate hub to enable equal-cost multi-path (ECMP) routing when multiple remote sites connect with overlapping subnets?

Set route-overlap to either use-new or use-old

Refer to the exhibits. The configuration of a user's Windows PC, which has a default MTU of 1500 bytes, along with FortiGate interfaces set to an MTU of 1000 bytes, and the results of PC1 pinging server 172.16.0.254 are shown.Why is the user in Windows PC1 unable to ping server 172.16.0.254 and is seeing the message: Packet needs to be fragmented but DF set?

FortiGate honors the do not fragment bit and the packets are dropped. The user has to adjust the ping MTU to 972 to succeed.

Option ip.flags.mf must be set to enable on FortiGate. The user has to adjust the ping MTU to 1000 to succeed.

Fragmented packets must be encrypted. To connect any application successfully, the user must install the Fortinet_CA certificate in the Microsoft Management Console.

FortiGate honors the do not fragment bit and the packets are dropped. The user has to adjust the ping MTU to 972 to succeed.

The user must trigger different traffic because path MTU discovery techniques do not recognize ICMP payloads.

Refer to the exhibit, which shows the VDOM section of a FortiGate device. An administrator discovers that webfilter stopped working in Core1 and Core2 after a maintenance window.Which two reasons could explain why webfilter stopped working? (Choose two.)

The root VDOM does not have a VDOM link to connect with the Corel and Core2 VDOMs.

The root VDOM does not have access to any valid public FDN.

The root VDOM does not have access to FortiManager in a closed network.

The root VDOM does not have a VDOM link to connect with the Corel and Core2 VDOMs.

The Core1 and Core2 VDOMs must also be enabled as Management VDOMs to receive FortiGuard updates

The root VDOM does not have access to any valid public FDN.

Refer to the exhibit. An administrator is deploying a hub and spokes network and using OSPF as dynamic protocol.Which configuration is mandatory for neighbor adjacency?

Set network-type point-to-multipoint in the hub interface

Set bfd enable in the router configuration

Set network-type point-to-multipoint in the hub interface

Set rfc1583-compatible enable in the router configuration

Set virtual-link enable in the hub interface

Refer to the exhibit, which shows the packet capture output of a three-way handshake between FortiGate and FortiManager Cloud. What two conclusions can you draw from the exhibit? (Choose two.)

The wildcard for the domain *.fortinet-ca2.support.fortinet.com must be supported by FortiManager Cloud.

FortiGate will receive a certificate that supports multiple domains because FortiManager operates in a cloud computing environment.

FortiGate is connecting to the same IP server and will receive an independent certificate for its connection between FortiGate and FortiManager Cloud.

If the TLS handshake contains 17 cipher suites it means the TLS version must be 1.0 on this three-way handshake.

The wildcard for the domain *.fortinet-ca2.support.fortinet.com must be supported by FortiManager Cloud.

Refer to the exhibit, which shows a LAN interface connected from FortiGate to two FortiSwitch devices. What two conclusions can you draw from the corresponding LAN interface? (Choose two.)

The LAN interface must use a 802.3ad type interface.

This connection is using a FortiLInk to manage VLANs on FortiGate.

You must enable STP or RSTP on FortiGate and FortiSwitch to avoid layer 2 loopbacks.

The LAN interface must use a 802.3ad type interface.

This connection is using a FortiLInk to manage VLANs on FortiGate.

FortiGate is using an SD-WAN-type interface to connect to a FortiSwitch device with MCLAG.

Refer to the exhibit, which shows the HA status of an active-passive cluster. An administrator wants FortiGate_B to handle the Core2 VDOM traffic.Which modification must the administrator apply to achieve this?

The administrator must change the priority from 128 to 200 for FortiGate_B.

The administrator must disable override on FortiGate_A.

The administrator must change the priority from 100 to 160 for FortiGate_B.

The administrator must change the load balancing method on FortiGate_B.

The administrator must change the priority from 128 to 200 for FortiGate_B.

Fortinet FCSS_EFW_AD-7.4 Practice Test 2 - Free Online Exam Prep & Questions

Refer to the exhibit, which shows a corporate network and a new remote office network.

Fortinet FCSS_EFW_AD-7.4 image Question 41 63883969988847048168308

An administrator must integrate the new remote office network with the corporate enterprise network.

What must the administrator do to allow routing between the two networks?

Become a Premium Member for full access

Unlock Premium Member

Fortinet FCSS_EFW_AD-7.4 Practice Test 2

Question

Fortinet FCSS_EFW_AD-7.4 Practice Tests

Practice Tests