Fortinet FCP_FGT_AD-7.4 Practice Test - Questions Answers, Page 8

The selected SSL inspection profile has certificate inspection enabled

If the SSL inspection profile is set to certificate inspection instead of full SSL inspection, FortiGate will only inspect the certificate of the HTTPS connection but will not decrypt and inspect the actual traffic content, leading to a failure in virus detection.

The website is exempted from SSL inspection

If the website hosting the EICAR test file is exempt from SSL inspection, FortiGate will not decrypt the traffic, meaning it cannot inspect the file content for viruses, resulting in the file being downloaded without detection.

Option 5 in the IPS diagnostic command toggles the bypass status. If this option is used and results in a decrease in CPU usage, it means the IPS engine is no longer processing traffic, effectively blocking or bypassing the traffic. In this case, IPS is not inspecting the traffic anymore, leading to a decrease in CPU usage, which indicates that the traffic might be blocked instead of inspected.

To disable RPF (Reverse Path Forwarding) checking on a FortiGate interface, you need to disable the src-check option in the interface settings. This action disables the RPF check, allowing traffic to bypass the verification that it is arriving on the correct interface based on the routing table.

For site B, the local quick mode selector should match the remote quick mode selector of site A, and vice versa. Since site A's remote quick mode selector is 192.168.2.0/24 (which is the subnet of site B), site B's local quick mode selector must be 192.168.1.0/24, which is the subnet of site A.

Both interfaces must have directly connected routes on the routing table

In NAT mode, each interface must have a corresponding entry in the routing table, typically as a directly connected route, to route traffic between them effectively.

Both interfaces must have IP addresses assigned

In NAT mode, each interface must have an IP address to participate in routing and NAT operations. The IP addresses allow the FortiGate to forward traffic between different network segments.

IPsec security associations

IPsec security associations (SAs) are synchronized between HA members to ensure seamless failover and continuity of VPN tunnels.

DHCP leases

DHCP lease information is synchronized between HA members to maintain consistent IP address assignments and prevent disruptions when failover occurs.

The port1 and port2 default routes are active in the routing table

The routes with 0.0.0.0/0 for both port1 and port2 are marked with an asterisk * and > symbol, which indicates that these routes are active and selected in the routing table.

The port3 default route has the highest distance

The route via port3 has a distance of [20/0], which is higher than the distances for the routes via port1 [10/0] and port2 [30/0]. This indicates that the port3 default route has the highest distance.

FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

In agentless polling mode, FortiGate directly connects to the Domain Controllers (DCs) using the SMB protocol to read event logs and detect user login events.

FortiGate does not support workstation check.

In agentless polling mode, FortiGate does not perform workstation checks. It relies on polling the event logs from the Domain Controllers to identify user logins.

In NetAPI polling mode, the FSSO (Fortinet Single Sign-On) collector agent uses the NetAPI (Windows API) to query the Domain Controllers (DCs) for user login sessions. This method allows the collector agent to retrieve information about active user sessions without directly scanning event logs.