Ask Question
Fortinet FCP_FGT_AD-7.4 Practice Test - Questions Answers, Page 4
List of questions
Question 31
The HTTP inspection process in web filtering follows a specific order when multiple features are enabled in the web filter profile.
Which order must FortiGate use when the web filter profile has features such as safe search enabled?
Question 32
FortiGate is integrated with FortiAnalyzer and FortiManager.
When a firewall policy is created, which attribute is added to the policy to improve functionality and to support recording logs to FortiAnalyzer or FortiManager?
Question 33
An administrator configured a FortiGate to act as a collector for agentless polling mode.
What must the administrator add to the FortiGate device to retrieve AD user group information?
To retrieve AD user group information in agentless polling mode, the administrator must add anLDAP server to the FortiGate device.
Question 34
An administrator manages a FortiGate model that supports NTurbo.
How does NTurbo enhance performance for flow-based inspection?
Question 35
Refer to the exhibit.
FortiGate has two separate firewall policies for Sales and Engineering to access the same web server with the same security profiles.
Which action must the administrator perform to consolidate the two policies into one?
To consolidate the two separate firewall policies for Sales and Engineering departmentsaccessing the same web server, you can create an Interface Group that includes both port1
(Sales) and port2 (Engineering). Once the Interface Group is created, you can use this group as asingle incoming interface in a single firewall policy. This approach reduces the number ofpolicies, making management more efficient.FortiOS 7.4.1 Administration Guide: Firewall Policy Configuration
Question 36
Refer to the exhibit, which shows a partial configuration from the remote authentication server.
Why does the FortiGate administrator need this configuration?
Question 37
Refer to the exhibits.
The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.
The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IPaddress 10.0.1.254/24.
Which IP address will be used to source NAT (SNAT) the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?
Question 38
Refer to the exhibit.
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 failed to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes can the administrator make to bring phase 1 up? (Choose two.)
To bring Phase 1 up, the following changes can be made:A . On HQ-FortiGate, disable Diffie-Helman group 2: This is incorrect because Diffie-Hellmangroup 2 is already selected on both devices. Disabling it would not help.B . On Remote-FortiGate, set port2 as Interface: This is incorrect as both sides should beconsistent in their interface settings for the IPsec tunnel, and the interface is correctly set toport1 on both FortiGates in the IPsec configuration.C . On both FortiGate devices, set Dead Peer Detection to On Demand: This is a valid option.Setting Dead Peer Detection (DPD) to 'On Demand' helps maintain the IPsec connection bychecking if the peer is still available, which can help in some cases where the connection failsdue to timeouts.D . On HQ-FortiGate, set IKE mode to Main (ID protection): This is also a valid option becausethe Remote-FortiGate is already set to Main mode (ID protection). Ensuring that both ends usethe same mode is crucial for successful phase 1 negotiation.Thus, the correct answers are: C . On both FortiGate devices, set Dead Peer Detection to OnDemand. D . On HQ-FortiGate, set IKE mode to Main (ID protection).
Question 39
A network administrator has configured an SSL/SSH inspection profile defined for full SSL inspection and set with a private CA certificate. The firewall policy that allows the traffic uses this profile for SSL inspection and performs web filtering. When visiting any HTTPS websites, the browser reports certificate warning errors.
What is the reason for the certificate warning errors?
Question 40
Refer to the exhibit.
FortiGate is configured for firewall authentication. When attempting to access an external website, the user is not presented with a login prompt.
What is the most likely reason for this situation?
Firewall authentication generally requires the DNS service to be enabled in the firewall policy tocorrectly resolve hostnames during the authentication process. If DNS is not allowed in thefirewall policy, the FortiGate cannot resolve external domains, and as a result, the user may notbe presented with the login prompt when attempting to access an external website.FortiOS 7.4.1 Administration Guide: Firewall Authentication Configuration
Related questions
Export
If you didn't receive an email within 5 minutes, you should submit a support request to [email protected].
|
BASIC - 1 Month
$
10
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
|
PLUS - 2 Months
$
15
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
|
PRO - 6 Months
$
40
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
|
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
Selling illegal goods, money scams etc.
Serious attack on a group.
Harassing an individual (including doxing)
Threatening or glorifying violence or serious harm, including self-harm
Nudity/Sexual content
Sexually explicit or suggestive imagery or writing involving minors
Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans
Reusing content without attribution (link and blockquotes)
Not in English or has very bad formatting, grammar, and spelling
Author's credential is offensive, spam, or impersonation
Ex. Illegal content, incomplete question...
Question