Home / Fortinet / FCP_FGT_AD-7.4

Fortinet FCP_FGT_AD-7.4 Practice Test - Questions Answers, Page 5

Question list

List of questions

Question 41

(0)

Which three methods are used by the collector agent for AD polling? (Choose three.)

Question 42

(0)

Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true? (Choose two.)

Question 43

(0)

What are two features of collector agent advanced mode? (Choose two.)

Question 44

(0)

An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings. What is true about the DNS connection to a FortiGuard server?

Question 45

(0)

Refer to the exhibits, which show the firewall policy and an antivirus profile configuration. Why is the user unable to receive a block replacement message when downloading an infected file for t

Question 46

(0)

Refer to the exhibits. FGT-1 and FGT-2 are updated with HA configuration commands shown in the exhibit. What would be the expected outcome in the HA cluster?

Question 47

(0)

Refer to the exhibits. The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration. An administrator created a Deny policy with default setting

Question 48

(0)

What are three key routing principles in SD-WAN? (Choose three.)

Question 49

(0)

Refer to the exhibits, which show a diagram of a FortiGate device connected to the network. VIP object configuration, and the firewall policy configuration. The WAN (port1) interface has the

Question 50

(0)

Which two attributes are required on a certificate so it can be used as a CA certificate on SSL inspection? (Choose two.)

Related questions

Refer to the exhibits. FGT-1 and FGT-2 are updated with HA configuration commands shown in the exhibit. What would be the expected outcome in the HA cluster?

Which three methods are used by the collector agent for AD polling? (Choose three.)

Refer to the exhibits. The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration. An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2. The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver. Which two configuration changes can the administrator make to the policy to deny Webserver access for Remote-User2? (Choose two.)

Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true? (Choose two.)

An administrator configured a FortiGate to act as a collector for agentless polling mode. What must the administrator add to the FortiGate device to retrieve AD user group information?

Which three strategies are valid SD-WAN rule strategies for member selection? (Choose three.)

Refer to the exhibit, which shows a partial configuration from the remote authentication server. Why does the FortiGate administrator need this configuration?

A network administrator is configuring an IPsec VPN tunnel for a sales employee travelling abroad. Which IPsec Wizard template must the administrator apply?

A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes. All traffic must be routed through the primary tunnel when both tunnels are up. The secondary tunnel must be used only if the primary tunnel goes down. In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover. Which two key configuration changes must the administrator make on FortiGate to meet the requirements? (Choose two.)

Which method allows management access to the FortiGate CLI without network connectivity?

Question 41

Which three methods are used by the collector agent for AD polling? (Choose three.)

WinSecLog

WMI

NetAPI

FSSO REST API

FortiGate polling

Show Answer Comment (0)

Question 42

Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true? (Choose two.)

If SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance-mode.

If SD-WAN is disabled, you can configure the parameter v4-ecmp-mode to volume-based.

If SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP

If SD-WAN is disabled, you configure the load balancing algorithm in config system settings.

Show Answer Comment (0)

Question 43

What are two features of collector agent advanced mode? (Choose two.)

In advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.

Advanced mode supports nested or inherited groups.

In advanced mode, security profiles can be applied only to user groups, not individual users.

Advanced mode uses the Windows convention ---NetBios: Domain\Username.

Show Answer Comment (0)

Question 44

An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings.

What is true about the DNS connection to a FortiGuard server?

It uses UDP 8888.

It uses DNS over HTTPS.

It uses DNS over TLS.

It uses UDP 53.

Show Answer Comment (0)

Question 45

Refer to the exhibits, which show the firewall policy and an antivirus profile configuration.

Why is the user unable to receive a block replacement message when downloading an infected file for the first time?

The intrusion prevention security profile must be enabled when using flow-based inspection mode.

The option to send files to FortiSandbox for inspection is enabled.

The firewall policy performs a full content inspection on the file.

Flow-based inspection is used, which resets the last packet to the user.

Show Answer Comment (0)

Question 46

Refer to the exhibits.

FGT-1 and FGT-2 are updated with HA configuration commands shown in the exhibit.

What would be the expected outcome in the HA cluster?

FGT-1 will remain the primary because FGT-2 has lower priority.

FGT-2 will take over as the primary because it has the override enable setting and higher priority than FGT-1.

FGT-1 will synchronize the override disable setting with FGT-2.

The HA cluster will become out of sync because the override setting must match on all HA members.

Show Answer Comment (0)

Question 47

Refer to the exhibits.

The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration.

An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2.

The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver.

Which two configuration changes can the administrator make to the policy to deny Webserver access for Remote-User2? (Choose two.)

Enable match-vip in the Deny policy.

Set the Destination address as Webserver in the Deny policy.

Disable match-vip in the Deny policy.

Set the Destination address as Deny_IP in the Allow_access policy.

Show Answer Comment (0)

Question 48

What are three key routing principles in SD-WAN? (Choose three.)

By default. SD-WAN members are skipped if they do not have a valid route to the destination

By default. SD-WAN rules are skipped if only one route to the destination is available

By default. SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member

SD-WAN rules have precedence over any other type of routes

Regular policy routes have precedence over SD-WAN rules

Show Answer Comment (0)

Question 49

Refer to the exhibits, which show a diagram of a FortiGate device connected to the network. VIP object configuration, and the firewall policy configuration.

The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IP address 10.0.1.254/24.

If the host 10.200.3.1 sends a TCP SYN packet on port 8080 to 10.200.1.10, what will the source address, destination address, and destination port of the packet be at the time FortiGate forwards the packet to the destination?

10.0.1.254, 10.200.1.10, and 8080, respectively

10.0.1.254, 10.0.1.10, and 80, respectively

10.200.3.1, 10.0.1.10, and 80, respectively

10.200.3.1, 10.0.1.10, and 8080, respectively

Show Answer Comment (0)