FCP_FGT_AD-7.4 practice questions 1–10

1. Question 1 · 89 in bank

   Select 2

   Refer to the exhibit.

   

   Which two statements are true about the routing entries in this database table? (Choose two.)

   • AAll of the entries in the routing database table are installed in the FortiGate routing table.
   • BThe port2 interface is marked as inactive.
   • CBoth default routes have different administrative distances.
   • DThe default route on port2 is marked as the standby route.

   Show answer

   Answer: CD

   Explanation

   Correct Answers: C. Both default routes have different administrative distances. D. The default route on port2 is marked as the standby route. A. Incorrect: Not all routes are installed; only those marked with *. B. Incorrect: Port2 is active but not the primary route. C. Correct: Port1 has an administrative distance of 10, Port2 has 20. D. Correct: Port2's route is a backup due to its higher administrative distance.

   Source: Adapted from community discussion — rigonet

   Next question

2. Question 2 · 89 in bank

   Select 2

   A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes. All traffic must be routed through the primary tunnel when both tunnels are up. The secondary tunnel must be used only if the primary tunnel goes down. In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover. Which two key configuration changes must the administrator make on FortiGate to meet the requirements? (Choose two.)

   • AEnable Dead Peer Detection.
   • BEnable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.
   • CConfigure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
   • DConfigure a higher distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.

   Show answer

   Answer: AC

   Explanation

   Conclusion: Enable A (Dead Peer Detection) for failover detection and C (lower distance for the primary tunnel) to prioritize it. Explanation: A. Enable Dead Peer Detection. Correct. Dead Peer Detection (DPD) is essential to quickly detect when a tunnel is down, enabling FortiGate to failover to the secondary tunnel. B. Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels. Incorrect. While helpful for maintaining tunnel stability, this setting is not directly required to detect dead tunnels or configure routing preferences. C. Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel. Correct. A lower distance ensures the primary tunnel is preferred for traffic. The higher distance on the secondary tunnel ensures it is used only during failover. D. Configure a higher distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel. Incorrect. This reverses the desired behavior, making the secondary tunnel primary.

   Source: Adapted from community discussion — rigonet

   Next question

3. Question 3 · 89 in bank

   Refer to the exhibits.

   

   

   The exhibits show the application sensor configuration and the Excessive-Bandwidth and Apple filter details. Based on the configuration, what will happen to Apple FaceTime if there are only a few calls originating or incoming?

   • AApple FaceTime will be allowed, based on the Video/Audio category configuration.
   • BApple FaceTime will be allowed, based on the Apple filter configuration.
   • CApple FaceTime will be allowed only if the Apple filter in Application and Filter Overrides is set to Allow.
   • DApple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.

   Show answer

   Answer: D

   Explanation

   Pagina 257 Scanning Order: After the IPS engine examines the traffic stream for a signature match, FortiGate scans packets for matches, in this order, for the application control profile: 1. Application and filter overrides: If you have configured any application overrides or filter overrides, the application control profile considers those first. It looks for a matching override starting at the top of the list, like firewall policies. 2. Categories: Finally, the application control profile applies the action that you’ve configured for applications in your selected categories.

   Source: Adapted from community discussion — IBB90704

   Next question

4. Question 4 · 89 in bank

   An employee needs to connect to the office through a high-latency internet connection. Which SSL VPN setting should the administrator adjust to prevent SSL VPN negotiation failure?

   • ASSL VPN idle-timeout
   • BSSL VPN login-timeout
   • CSSL VPN dtls-hello-timeout
   • DSSL VPN session-ttl

   Show answer

   Answer: C

   Explanation

   It is C, In a Fortinet SSL VPN, the "dtls-hello-timeout" setting defines the maximum time a FortiGate will wait for an initial "Hello" message from a client during the DTLS (Datagram Transport Layer Security) handshake process, essentially setting a time limit for establishing a secure connection before considering the attempt failed due to network latency or issues with the client device; this is crucial for preventing prolonged connection attempts and improving overall VPN connection stability. The SSL VPN login-timeout in FortiGate controls the amount of time that the SSL VPN waits before disconnecting

   Source: Adapted from community discussion — Cantero75

   Next question

5. Question 5 · 89 in bank

   Select 3

   When FortiGate performs SSL/SSH full inspection, you can decide how it should react when it detects an invalid certificate. Which three actions are valid actions that FortiGate can perform when it detects an invalid certificate? (Choose three.)

   • AAllow & Warning
   • BTrust & Allow
   • CAllow
   • DBlock & Warning
   • EBlock

   Show answer

   Answer: BCE

   Explanation

   Pagina 186 When a certificate fails for any of the reasons above, you can configure any of the following actions: • Keep untrusted & Allow: FortiGate allows the website and lets the browser decide the action to take. FortiGate takes the certificate as untrusted. • Block: FortiGate blocks the content of the site. • Trust & Allow: FortiGate allows the website and takes the certificate as trusted.

   Source: Adapted from community discussion — IBB90704

   References

   • Fortinet documentation

   Next question

6. Question 6 · 89 in bank

   Select 2

   Refer to the exhibit, which shows the IPS sensor configuration.

   

   If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

   • AThe sensor will gather a packet log for all matched traffic.
   • BThe sensor will reset all connections that match these signatures.
   • CThe sensor will allow attackers matching the Microsoft.Windows.iSCSI.Target.DoS signature.
   • DThe sensor will block all attacks aimed at Windows servers.

   Show answer

   Answer: CD

   Explanation

   How can A be a correct answer when the packet logging is enabled only for the iSCSI attack and disabled for the Windows attacks?

   Source: Adapted from community discussion — 0d6e481

   References

   • Microsoft Learn

   Next question

7. Question 7 · 89 in bank

   Which statement is a characteristic of automation stitches?

   • AThey can be run only on devices in the Security Fabric.
   • BThey can be created only on downstream devices in the fabric.
   • CThey can have one or more triggers.
   • DThey can run multiple actions at the same time.

   Show answer

   Answer: D

   Explanation

   According to the illustration on page 396 of the the study guide, it says automatic stitches consist of 'a trigger' and 'one or more configurable actions'.

   Source: Adapted from community discussion — Billyon

   References

   • Fortinet documentation

   Next question

8. Question 8 · 89 in bank

   What is the primary FortiGate election process when the HA override setting is disabled?

   • AConnected monitored ports > Priority > System uptime > FortiGate serial number
   • BConnected monitored ports > System uptime > Priority > FortiGate serial number
   • CConnected monitored ports > Priority > HA uptime > FortiGate serial number
   • DConnected monitored ports > HA uptime > Priority > FortiGate serial number

   Show answer

   Answer: D

   Explanation

   1. The cluster compares the number of monitored interfaces that have a status of up. The member with the most available monitored interfaces becomes the primary. 2. The cluster compares the HA uptime of each member. The member with the highest HA uptime, by at least five minutes, becomes the primary. 3. The member with the highest priority becomes the primary. 4. The member with the highest serial number becomes the primary.

   Source: Adapted from community discussion — Knocks

   References

   • Fortinet documentation
   • community.fortinet.com documentation

   Next question

9. Question 9 · 89 in bank

   Select 2

   Which two settings are required for SSL VPN to function between two FortiGate devices? (Choose two.)

   • AThe client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN.
   • BThe server FortiGate requires a CA certificate to verify the client FortiGate certificate.
   • CThe client FortiGate requires a client certificate signed by the CA on the server FortiGate.
   • DThe client FortiGate requires a manually added route to remote subnets.

   Show answer

   Answer: AB

   Explanation

   If fortigate is used as an SSL VPN client, it needs a ssl virtual tunnel interface to connect to the SSL VPN server. This is the client virtual interface that the vpn server will assign the temporary IP address to during the lifetime of an ssl connection. The SSL VPN server also needs a correct CA certificate to authenticate/trust client's certificate. (page 2527 FortiOS Administrator Guide)

   Source: Adapted from community discussion — hecjoseroag

   Next question

10. Question 10 · 89 in bank

    Refer to the exhibit.

    

    Which statement about this firewall policy list is true?

    • AThe Implicit group can include more than one deny firewall policy.
    • BThe firewall policies are listed by ID sequence view.
    • CThe firewall policies are listed by ingress and egress interfaces pairing view.
    • DLAN to WAN, WAN to LAN, and Implicit are sequence grouping view lists.

    Show answer

    Answer: D

    Explanation

    I'd go with D, because the policies cannot be in interface pair view, since the policy ID 1 has multiple interfaces, so it cannot be C.

    Source: Adapted from community discussion — Knocks

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCP_FGT_AD-7.4 practice, question 1. 89 questions available.