Fortinet FCP_FGT_AD-7.4 Practice Test - Questions Answers, Page 2

For a high-latency internet connection, the SSL VPN setting that should be adjusted is:C . SSL VPN dtls-hello-timeout: This setting determines how long the FortiGate will wait for aDTLS hello message from the client. For high-latency connections, increasing this timeout willprevent SSL VPN negotiation failures caused by delays in receiving the DTLS hello message.The other options are not suitable:A . SSL VPN idle-timeout: This setting controls the idle time allowed before a session isterminated, which is not relevant to the initial connection establishment.B . SSL VPN login-timeout: This setting controls the maximum time allowed for a user to log in,but does not affect connection negotiation.D . SSL VPN session-ttl: This setting controls the total time-to-live for an SSL VPN session butdoes not directly address issues caused by high latency.ReferenceFortiOS 7.4.1 Administration Guide - SSL VPN Configuration, page 1415.

When FortiGate performs SSL/SSH full inspection and detects an invalid certificate, there arethree valid actions it can take:Allow & Warning: This action allows the session but generates a warning.Block & Warning: This action blocks the session and generates a warning.Block: This action blocks the session without generating a warning.Actions such as 'Trust & Allow' or just 'Allow' without additional configurations are notapplicable in the context of handling invalid certificates.FortiOS 7.4.1 Administration Guide: Configuring SSL/SSH inspection profile

The Microsoft.Windows.iSCSI.Target.DoS signature is set to 'Monitor' with packet loggingenabled, meaning that while traffic matching this signature will be allowed, it will also belogged for further analysis.The generic Windows filter is set to 'Block,' meaning that all other attacks matching this filterwill be blocked. However, the sensor will not reset connections or log packets unless specified.Therefore, the sensor will allow attackers matching the specific DoS signature while blockingother attacks against Windows.FortiOS 7.4.1 Administration Guide: IPS Configuration

Automation stitches on FortiGate can have one or more triggers, which are conditions or eventsthat activate the automation stitch. The trigger defines when the automation stitch shouldexecute the defined actions. Actions within a stitch can be executed sequentially or in parallel,depending on the configuration.FortiOS 7.4.1 Administration Guide: Automation Stitches

For SSL VPN to function correctly between two FortiGate devices, the following settings arerequired:
B . The server FortiGate requires a CA certificate to verify the client FortiGate certificate: Theserver FortiGate must have a Certificate Authority (CA) certificate installed to authenticate andverify the certificate presented by the client FortiGate device.
C . The client FortiGate requires a client certificate signed by the CA on the server FortiGate:The client FortiGate must have a client certificate that is signed by the same CA that the serverFortiGate uses for verification. This ensures a secure SSL VPN connection between the twodevices.The other options are not directly necessary for establishing SSL VPN:A . The client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN: This isincorrect as SSL VPN does not require a specific tunnel interface type; it typically uses an SSLVPN client profile.
D . The client FortiGate requires a manually added route to remote subnets: While routing maybe necessary, it is not specifically required for the SSL VPN functionality between twoFortiGates.ReferenceFortiOS 7.4.1 Administration Guide - Configuring SSL VPN, page 1203.FortiOS 7.4.1 Administration Guide - SSL VPN Authentication, page 1210