Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true? (Choose two.)

If SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance-mode.

If SD-WAN is disabled, you configure the load balancing algorithm in config system settings.

If SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance-mode.

If SD-WAN is disabled, you can configure the parameter v4-ecmp-mode to volume-based.

If SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP

If SD-WAN is disabled, you configure the load balancing algorithm in config system settings.

What are two features of collector agent advanced mode? (Choose two.)

In advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.

Advanced mode uses the Windows convention ---NetBios: Domain\Username.

In advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.

Advanced mode supports nested or inherited groups.

In advanced mode, security profiles can be applied only to user groups, not individual users.

Advanced mode uses the Windows convention ---NetBios: Domain\Username.

Refer to the exhibits, which show the firewall policy and an antivirus profile configuration. Why is the user unable to receive a block replacement message when downloading an infected file for the first time?

Flow-based inspection is used, which resets the last packet to the user.

The intrusion prevention security profile must be enabled when using flow-based inspection mode.

The option to send files to FortiSandbox for inspection is enabled.

The firewall policy performs a full content inspection on the file.

Flow-based inspection is used, which resets the last packet to the user.

Refer to the exhibits. FGT-1 and FGT-2 are updated with HA configuration commands shown in the exhibit.What would be the expected outcome in the HA cluster?

FGT-2 will take over as the primary because it has the override enable setting and higher priority than FGT-1.

FGT-1 will remain the primary because FGT-2 has lower priority.

FGT-2 will take over as the primary because it has the override enable setting and higher priority than FGT-1.

FGT-1 will synchronize the override disable setting with FGT-2.

The HA cluster will become out of sync because the override setting must match on all HA members.

Refer to the exhibits. The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration.An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2.The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver.Which two configuration changes can the administrator make to the policy to deny Webserver access for Remote-User2? (Choose two.)

Enable match-vip in the Deny policy.

Set the Destination address as Webserver in the Deny policy.

Enable match-vip in the Deny policy.

Set the Destination address as Webserver in the Deny policy.

Disable match-vip in the Deny policy.

Set the Destination address as Deny_IP in the Allow_access policy.

What are three key routing principles in SD-WAN? (Choose three.)

By default. SD-WAN members are skipped if they do not have a valid route to the destination

By default. SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member

SD-WAN rules have precedence over any other type of routes

By default. SD-WAN members are skipped if they do not have a valid route to the destination

By default. SD-WAN rules are skipped if only one route to the destination is available

By default. SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member

SD-WAN rules have precedence over any other type of routes

Regular policy routes have precedence over SD-WAN rules

Refer to the exhibits, which show a diagram of a FortiGate device connected to the network. VIP object configuration, and the firewall policy configuration. The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IP address 10.0.1.254/24.If the host 10.200.3.1 sends a TCP SYN packet on port 8080 to 10.200.1.10, what will the source address, destination address, and destination port of the packet be at the time FortiGate forwards the packet to the destination?

10.200.3.1, 10.0.1.10, and 80, respectively

10.0.1.254, 10.200.1.10, and 8080, respectively

10.0.1.254, 10.0.1.10, and 80, respectively

10.200.3.1, 10.0.1.10, and 80, respectively

10.200.3.1, 10.0.1.10, and 8080, respectively

Which two attributes are required on a certificate so it can be used as a CA certificate on SSL inspection? (Choose two.)

The CA extension must be set to TRUE

The Authority Key Identifier must be of type SSL

The CA extension must be set to TRUE

The Authority Key Identifier must be of type SSL

The keyUsage extension must be set to

Refer to the exhibit showing a debug flow output. What two conclusions can you make from the debug flow output? (Choose two.)

The debug flow is for ICMP traffic.

A new traffic session was created.

The debug flow is for ICMP traffic.

A firewall policy allowed the connection.

A new traffic session was created.

The default route is required to receive a reply.

Which two statements are correct when FortiGate enters conserve mode? (Choose two.)

FortiGate continues to run critical security actions, such as quarantine.

FortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled

FortiGate halts complete system operation and requires a reboot to regain available resources

FortiGate refuses to accept configuration changes

FortiGate continues to run critical security actions, such as quarantine.

FortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled

Refer to the exhibit. The administrator configured SD-WAN rules and set the FortiGate traffic log page to display SD-WAN-specific columns: SD-WAN Quality and SD-WAN Rule Name.FortiGate allows the traffic according to policy ID 1. This is the policy that allows SD-WAN traffic.Despite these settings the traffic logs do not show the name of the SD-WAN rule used to steer those traffic flows.What can be the reason?

FortiGate load balanced the traffic according to the implicit SD-WAN rule.

There is no application control profile applied to the firewall policy.

Destination in the SD-WAN rules are configured per application but the feature visibility is not enabled.

SD-WAN rule names do not appear immediately. The administrator needs to refresh the page.

An administrator has configured the following settings: What are the two results of this configuration? (Choose two.)

A session for denied traffic is created.

The number of logs generated by denied traffic is reduced.

Denied users are blocked for 30 minutes.

A session for denied traffic is created.

The number of logs generated by denied traffic is reduced.

Device detection on all interfaces is enforced for 30 minutes.

Which two statements explain antivirus scanning modes? (Choose two.)

In flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client.

In proxy-based inspection mode antivirus scanning buffers the whole file for scanning, before sending it to the client

In flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client.

In flow-based inspection mode files bigger than the buffer size are scanned

In proxy-based inspection mode files bigger than the buffer size are scanned

In proxy-based inspection mode antivirus scanning buffers the whole file for scanning, before sending it to the client

Refer to the exhibits, which show the firewall policy and the security profile for Facebook. Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.Which part of the configuration must you change to resolve the issue?

Get the additional application signatures required to add to the security policy

Make the SSL inspection a deep content inspection

Add Facebook to the URL category in the security policy

Disable HTTP redirect to HTTPS on the web browser

Get the additional application signatures required to add to the security policy

Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?

Internet Service Database (ISDB) engine

Intrusion prevention system engine

A FortiGate administrator is required to reduce the attack surface on the SSL VPN portal.Which SSL timer can you use to mitigate a denial of service (DoS) attack?

SSL VPN http-request-header-timeout

Refer to the exhibit. The exhibit shows a diagram of a FortiGate device connected to the network, the firewall policy and VIP configuration on the FortiGate device, and the routing table on the ISP router.When the administrator tries to access the web server public address (203.0.113.2) from the internet, the connection times out. At the same time the administrator runs a sniffer on FortiGate to capture incoming web traffic to the server and does not see any output.Based on the information shown in the exhibit, what configuration change must the administrator make to fix the connectivity issue?

In the VIP configuration, enable arp-reply.

Configure a loopback interface with address 203.0.113.2/32.

In the VIP configuration, enable arp-reply.

In the firewall policy configuration, enable match-vip.

Enable port forwarding on the server to map the external service port to the internal service port.

Which three statements explain a flow-based antivirus profile? (Choose three.)

Flow-based inspection optimizes performance compared to proxy-based inspection

FortiGate buffers the whole file but transmits to the client at the same time.

The IPS engine handles the process as a standalone.

Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection

Flow-based inspection optimizes performance compared to proxy-based inspection

FortiGate buffers the whole file but transmits to the client at the same time.

If a virus is detected, the last packet is delivered to the client.

The IPS engine handles the process as a standalone.

Refer to exhibit. An administrator configured the web filtering profile shown in the exhibit to block access to all social networking sites except Twitter. However, when users try to access twitter.com, they are redirected to a FortiGuard web filtering block page.Based on the exhibit, which configuration change can the administrator make to allow Twitter while blocking all other social networking sites?

On the Static URL Filter configuration set Action to Exempt

On the Static URL Filter configuration set Type to Simple

On the FortiGuard Category Based Filter configuration set Action to Warning for Social Networking

On the Static URL Filter configuration set Action to Monitor

On the Static URL Filter configuration set Action to Exempt

Which three statements about SD-WAN zones are true? (Choose three.)

An SD-WAN zone can contain physical and logical interfaces

You can use an SD-WAN zone in static route definitions

An SD-WAN zone is a logical grouping of members

An SD-WAN zone can contain physical and logical interfaces

You can use an SD-WAN zone in static route definitions

You can define up to three SD-WAN zones per FortiGate device

An SD-WAN zone must contains at least two members

An SD-WAN zone is a logical grouping of members

An administrator has configured a strict RPF check on FortiGate.How does strict RPF check work?

Strict RPF checks the best route back to the source using the incoming interface.

Strict RPF allows packets back to sources with all active routes.

Strict RPF checks only for the existence of at least one active route back to the source using the incoming interface.

Strict RPF check is run on the first sent and reply packet of any new session.

A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors.What is the reason for the certificate warning errors?

The browser does not trust the certificate used by FortiGate for SSL inspection

The option invalid SSL certificates is set to allow on the SSL/SSH inspection profile

The browser does not trust the certificate used by FortiGate for SSL inspection

The certificate used by FortiGate for SSL inspection does not contain the required certificate extensions.

The matching firewall policy is set to proxy inspection mode

Refer to the exhibit. The NOC team connects to the FortiGate GUI with the NOC_Access admin profile. They request that their GUI sessions do not disconnect too early during inactivity.What must the administrator configure to answer this specific request from the NOC team?

Increase the admintimeout value under config system global

Enable the parameter Never Timeout in the admin profiles

Increase the admintimeout value under config system accprofile super_admin.

Increase the admintimeout value under config system global

Increase the offline value of the Override idle Timeout parameter in the NOC_Access admin profile

A network administrator enabled antivirus and selected an SSL inspection profile on a firewall policy.When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the and does not block the file allowing it to be downloaded.The administrator confirms that the traffic matches the configured firewall policy.What are two reasons for the failed virus detection by FortiGate? (Choose two.)

The selected SSL inspection profile has certificate inspection enabled

The website is exempted from SSL inspection

The selected SSL inspection profile has certificate inspection enabled

The browser does not trust the FortiGate self-siqned CA certificate

The EICAR test file exceeds the protocol options oversize limit

The website is exempted from SSL inspection

Refer to the exhibit. Examine the intrusion prevention system (IPS) diagnostic command shown in the exhibit.If option 5 is used with the IPS diagnostic command and the outcome is a decrease in the CPU usage, what is the correct conclusion?

The IPS engine is blocking all traffic.

The IPS engine is inspecting a high volume of traffic.

The IPS engine is unable to prevent an intrusion attack.

The IPS engine will continue to run in a normal state.

How can you disable RPF checking?

Disable src-check on the interface level settings

Unset fail-alert-interfaces on the interface level settings.

Disable fail-detect on the interface level settings.

Disable strict-src-check under system settings.

FortiGate is operating in NAT mode and has two physical interfaces connected to the LAN and DMZ networks respectively.Which two statements are true about the requirements of connected physical interfaces on FortiGate? (Choose two.)

Both interfaces must have directly connected routes on the routing table

Both interfaces must have IP addresses assigned

Both interfaces must have the interface role assigned

Both interfaces must have directly connected routes on the routing table

Both interfaces must have DHCP enabled

Both interfaces must have IP addresses assigned

Refer to the exhibit. Based on the routing database shown in the exhibit which two conclusions can you make about the routes? (Choose two.)

The port1 and port2 default routes are active in the routing table

The port3 default route has the highest distance

There will be eight routes active in the routing table

The port1 and port2 default routes are active in the routing table

The port3 default route has the highest distance

The port3 default route has the lowest metric

What are two features of FortiGate FSSO agentless polling mode? (Choose two.)

FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

FortiGate does not support workstation check.

FortiGate directs the collector agent to use a remote LDAP server.

FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

FortiGate does not support workstation check.

FortiGate uses the AD server as the collector agent.

Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

The NetSessionEnum function is used to track user logouts.

NetAPI polling can increase bandwidth usage in large networks.

The collector agent must search Windows application event logs.

The collector agent uses a Windows API to query DCs for user logins.

Fortinet FCP_FGT_AD-7.4 Practice Test 2 - Free Online Exam Prep & Questions

Which three methods are used by the collector agent for AD polling? (Choose three.)

A.

WinSecLog

B.

WMI

C.

NetAPI

D.

FSSO REST API

E.

FortiGate polling

Fortinet FCP_FGT_AD-7.4 Practice Test 2

Question

Fortinet FCP_FGT_AD-7.4 Practice Tests

Practice Tests