FCP_FGT_AD-7.4 practice questions 11–20

1. Question 11 · 89 in bank

   Refer to the exhibit, which shows an SD-WAN zone configuration on the FortiGate GUI.

   

   Based on the exhibit, which statement is true?

   • AThe underlay zone contains port1 and port2.
   • BThe d-wan zone contains no member.
   • CThe d-wan zone cannot be deleted.
   • DThe virtual-wan-link zone contains no member.

   Show answer

   Answer: B

   Explanation

   B is correct. Page 351 of user guide. The D-WAN zone must have been manually created and therefore can be deleted. The default zone that CAN'T be deleted is the virtual-wan-link and is automatically created and is where 'FortiGate places any new member if you don't assign them to a user-defined zone'.

   Source: Adapted from community discussion — Beatledrew

   Next question

2. Question 12 · 89 in bank

   Select 3

   Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)

   • AThe host field in the HTTP header.
   • BThe server name indication (SNI) extension in the client hello message.
   • CThe subject alternative name (SAN) field in the server certificate.
   • DThe subject field in the server certificate.
   • EThe serial number in the server certificate.

   Show answer

   Answer: BCD

   Explanation

   B,C,D - Related to Training Fortigate Administrator - Certificate Operations: When using SSL certificate inspection, FortiGate is not decrypting the traffic. During the exchange of hello messages at the beginning of an SSL handshake, FortiGate parses the server name indication (SNI) from client Hello, which is an extension of the TLS protocol. The SNI tells FortiGate the hostname of the SSL server, which is validated against the DNS name before receipt of the server certificate. If there is no SNI exchanged, then FortiGate identifies the server by the value in the server by the value in the Subject field or SAN (Subject Alternative Name) field in the server certificate.

   Source: Adapted from community discussion — miguelmagr

   Next question

3. Question 13 · 89 in bank

   Select 2

   Which two statements describe how the RPF check is used? (Choose two.)

   • AThe RPF check is run on the first sent packet of any new session.
   • BThe RPF check is run on the first reply packet of any new session.
   • CThe RPF check is run on the first sent and reply packet of any new session.
   • DThe RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks.

   Show answer

   Answer: AD

   Next question

4. Question 14 · 89 in bank

   Select 3

   Which three strategies are valid SD-WAN rule strategies for member selection? (Choose three.)

   • AManual with load balancing
   • BLowest Cost (SLA) with load balancing
   • CBest Quality with load balancing
   • DLowest Quality (SLA) with load balancing
   • ELowest Cost (SLA) without load balancing

   Show answer

   Answer: ABE

   Explanation

   ABE, When you select Best Quality the "Load Balancing" toggle disappears from the UI. When you select Lowest Cost (SLA) you can choose to enable or disable load balancing.

   Source: Adapted from community discussion — fa7474b

   References

   • Fortinet documentation
   • Fortinet documentation

   Next question

5. Question 15 · 89 in bank

   Select 2

   Which two features of IPsec IKEv1 authentication are supported by FortiGate? (Choose two.)

   • APre-shared key and certificate signature as authentication methods
   • BExtended authentication (XAuth) to request the remote peer to provide a username and password
   • CExtended authentication (XAuth) for faster authentication because fewer packets are exchanged
   • DNo certificate is required on the remote peer when you set the certificate signature as the authentication method

   Show answer

   Answer: AB

   Next question

6. Question 16 · 89 in bank

   Select 2

   Which two statements are true regarding FortiGate HA configuration synchronization? (Choose two.)

   • AChecksums of devices are compared against each other to ensure configurations are the same.
   • BIncremental configuration synchronization can occur only from changes made on the primary FortiGate device.
   • CIncremental configuration synchronization can occur from changes made on any FortiGate device within the HA cluster.
   • DChecksums of devices will be different from each other because some configuration items are not synced to other HA members.

   Show answer

   Answer: AC

   Explanation

   AC: FortiGate 7.4 Administrator Study Guide pg.421 "After the initial synchronization is complete, whenever a change is made to the configuration of an HA cluster device (primary or secondary), incremental synchronization sends the same configuration change to all other cluster devices over the HA heartbeat link"

   Source: Adapted from community discussion — bob511

   Next question

7. Question 17 · 89 in bank

   Select 2

   What are two features of the NGFW profile-based mode? (Choose two.)

   • ANGFW profile-based mode can only be applied globally and not on individual VDOMs.
   • BNGFW profile-based mode must require the use of central source NAT policy.
   • CNGFW profile-based mode policies support both flow inspection and proxy inspection.
   • DNGFW profile-based mode supports applying applications and web filtering profiles in a firewall policy.

   Show answer

   Answer: CD

   Next question

8. Question 18 · 89 in bank

   Refer to the exhibit to view the firewall policy.

   

   Why would the firewall policy not block a well-known virus, for example eicar?

   • AThe action on the firewall policy is not set to deny.
   • BThe firewall policy is not configured in proxy-based inspection mode.
   • CWeb filter is not enabled on the firewall policy to complement the antivirus profile.
   • DThe firewall policy does not apply deep content inspection.

   Show answer

   Answer: D

   Explanation

   D would be the most accurate response. While Flow-Based inspection mode is limited, it still can scan viruses if they are not overly complex. SSL certificate inspection only inspects the certificate of the encrypted traffic, ensuring it is valid and not self-signed or expired. It does not decrypt the actual content of the SSL/TLS traffic, meaning that any malicious content inside encrypted HTTPS traffic will pass through without being inspected. So here, we can assume the EICAR file was accessed via HTTPS.

   Source: Adapted from community discussion — Beatledrew

   Next question

9. Question 19 · 89 in bank

   Which inspection mode does FortiGate use for application profiles if it is configured as a profile-based next-generation firewall (NGFW)?

   • AFull content inspection
   • BProxy-based inspection
   • CCertificate inspection
   • DFlow-based inspection

   Show answer

   Answer: D

   Explanation

   Page 250 of the Study Guide. More information. "You can configure application control in proxy-based and flow-based firewall policies. However, because application control uses the IPS engine, which uses flow-based inspection, the INSPECTION is always flow-based."

   Source: Adapted from community discussion — Beatledrew

   Next question

10. Question 20 · 89 in bank

    Select 2

    Refer to the exhibit showing a FortiGuard connection debug output.

    

    Based on the output, which two facts does the administrator know about the FortiGuard connection? (Choose two.)

    • AOne server was contacted to retrieve the contract information.
    • BThere is at least one server that lost packets consecutively.
    • CA local FortiManager is one of the servers FortiGate communicates with.
    • DFortiGate is using default FortiGuard communication settings.

    Show answer

    Answer: AD

    Explanation

    A and D are correct because in the output we can see num. of servers : 1, it refers to servers use to retreive contract info, and D because in the output we can see that the procolo used is HTTPS on standard port 443 and anycast is enabled

    Source: Adapted from community discussion — fab1ccb

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCP_FGT_AD-7.4 practice, question 11. 89 questions available.