FCP_FGT_AD-7.4 practice questions 31–40

1. Question 31 · 89 in bank

   Refer to the exhibits.

   

   

   

   The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects. The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IPaddress 10.0.1.254/24. Which IP address will be used to source NAT (SNAT) the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?

   • A10.200.1.1
   • B10.200.1.149
   • C10.200.1.99
   • D10.200.1.49

   Show answer

   Answer: C

   Explanation

   Read well the question, is easy to fall in a trick, you would choose B if you don't read that there is a PING policy that matches the rithg answer: C

   Source: Adapted from community discussion — sxcap

   Next question

2. Question 32 · 89 in bank

   Select 2

   Refer to the exhibit.

   

   A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 failed to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match. Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes can the administrator make to bring phase 1 up? (Choose two.)

   • AOn HQ-FortiGate, disable Diffie-Helman group 2.
   • BOn Remote-FortiGate, set port2 as Interface.
   • COn both FortiGate devices, set Dead Peer Detection to On Demand.
   • DOn HQ-FortiGate, set IKE mode to Main (ID protection).

   Show answer

   Answer: BD

   Explanation

   Based on the phase 1 configuration and the diagram shown in the exhibit, the administrator can make the following two configuration changes to bring phase 1 up: B. On Remote-FortiGate, set port2 as Interface: The diagram indicates that port2 is currently not selected under ‘Interface’ for Remote-FortiGate. Aligning this setting with HQ-FortiGate, which has port1 set as Interface, might resolve inconsistencies. D. On HQ-FortiGate, set IKE mode to Main (ID protection): The current setting on HQ-FortiGate is Aggressive for IKE mode, while Remote-FortiGate is set to Main mode. Matching these settings may help in establishing phase 1 of the IPsec tunnel.

   Source: Adapted from community discussion — ShrekAlmighty

   Next question

3. Question 33 · 89 in bank

   A network administrator has configured an SSL/SSH inspection profile defined for full SSL inspection and set with a private CA certificate. The firewall policy that allows the traffic uses this profile for SSL inspection and performs web filtering. When visiting any HTTPS websites, the browser reports certificate warning errors. What is the reason for the certificate warning errors?

   • AThe SSL cipher compliance option is not enabled on the SSL inspection profile. This setting is required when the SSL inspection profile is defined with a private CA certificate.
   • BThe certificate used by FortiGate for SSL inspection does not contain the required certificate extensions.
   • CThe browser does not recognize the certificate in use as signed by a trusted CA.
   • DWith full SSL inspection it is not possible to avoid certificate warning errors at the browser level.

   Show answer

   Answer: C

   Next question

4. Question 34 · 89 in bank

   A network administrator is configuring an IPsec VPN tunnel for a sales employee travelling abroad. Which IPsec Wizard template must the administrator apply?

   • ARemote Access
   • BSite to Site
   • CDial up User
   • DHub-and-Spoke

   Show answer

   Answer: A

   Explanation

   A is correct. When you go to VPN>IPsec Wizard and select the VPN setup, you'll see Remote Access for this type of connection

   Source: Adapted from community discussion — TIGERZ44

   Next question

5. Question 35 · 89 in bank

   Refer to the exhibit.

   

   FortiGate is configured for firewall authentication. When attempting to access an external website, the user is not presented with a login prompt. What is the most likely reason for this situation?

   • AThe Service DNS is required in the firewall policy.
   • BThe user is using an incorrect user name.
   • CThe Remote-users group is not added to the Destination.
   • DNo matching user account exists for this user.

   Show answer

   Answer: A

   Explanation

   Just confirmed the answer is A by replicating this config on my Fortigate. If you don't add DNS to the policy you just get a timeout and the browser cannot find the site. Once you add DNS you get a prompt that you must log in to access the internet. I think the confusing part of this question is that it reads as if the user is able to access the internet and is not being prompted. When in fact, they are not getting prompted AND they can't access the internet.

   Source: Adapted from community discussion — fa7474b

   Next question

6. Question 36 · 89 in bank

   Select 3

   Which three methods are used by the collector agent for AD polling? (Choose three.)

   • AWinSecLog
   • BWMI
   • CNetAPI
   • DFSSO REST API
   • EFortiGate polling

   Show answer

   Answer: ABC

   Explanation

   The collector agent for Active Directory (AD) polling uses the following three methods: A. WinSecLog: This method involves reading the Windows Security Event Log to gather information about user logins and logouts. B. WMI (Windows Management Instrumentation): This method allows the collector agent to query the AD for user login information using WMI queries. C. NetAPI: This method uses the Windows Network API to retrieve user login information from the AD. These methods help the collector agent efficiently gather and monitor user activity within an AD environment.

   Source: Adapted from community discussion — ShrekAlmighty

   Next question

7. Question 37 · 89 in bank

   Select 2

   Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true? (Choose two.)

   • AIf SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance-mode.
   • BIf SD-WAN is disabled, you can configure the parameter v4-ecmp-mode to volume-based.
   • CIf SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP
   • DIf SD-WAN is disabled, you configure the load balancing algorithm in config system settings.

   Show answer

   Answer: AD

   Explanation

   AD, "When SD-WAN is enabled, FortiOS hides the v4-ecmp-mode setting and replaces it with the loadbalance-mode setting under config system sdwan. That is, when you enable SD-WAN, you control the ECMP algorithm with the load-balance-mode setting." The statement C. If SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP is incorrect because ECMP requires routes to have equal cost, which means that the routes must have the same distance and priority values to be considered for load balancing. In contrast, ECMP specifically balances traffic across multiple paths that have equal cost, hence the term "equal-cost" in ECMP. If the distance or priority values are different, those routes would not be eligible for ECMP. Therefore, A and D are correct, and C is incorrect.

   Source: Adapted from community discussion — bob511

   References

   • Fortinet documentation

   Next question

8. Question 38 · 89 in bank

   Select 2

   What are two features of collector agent advanced mode? (Choose two.)

   • AIn advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.
   • BAdvanced mode supports nested or inherited groups.
   • CIn advanced mode, security profiles can be applied only to user groups, not individual users.
   • DAdvanced mode uses the Windows convention —NetBios: Domain\Username.

   Show answer

   Answer: AB

   Next question

9. Question 39 · 89 in bank

   An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings. What is true about the DNS connection to a FortiGuard server?

   • AIt uses UDP 8888.
   • BIt uses DNS over HTTPS.
   • CIt uses DNS over TLS.
   • DIt uses UDP 53.

   Show answer

   Answer: C

   Explanation

   C - pg 24 of study guide. Lesson 1, Slide 21 of training deck When using FortiGuard servers for DNS, FortiOS uses DNS over TLS (DoT) by default to secure the DNS traffic. New FortiGuard DNS servers have been added as primary and secondary servers.

   Source: Adapted from community discussion — TIGERZ44

   Next question

10. Question 40 · 89 in bank

    Refer to the exhibits, which show the firewall policy and an antivirus profile configuration.

    

    Why is the user unable to receive a block replacement message when downloading an infected file for the first time?

    • AThe intrusion prevention security profile must be enabled when using flow-based inspection mode.
    • BThe option to send files to FortiSandbox for inspection is enabled.
    • CThe firewall policy performs a full content inspection on the file.
    • DFlow-based inspection is used, which resets the last packet to the user.

    Show answer

    Answer: D

    Explanation

    D is correct In Flow Based scanning, if a virus is detected, the final packet is dropped making the file unusable tot the end user. FG caches the URL of the file. If the user attempts to download again, rather than scanning the file again, the IPS engine then sends a block message to the user.

    Source: Adapted from community discussion — TIGERZ44

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCP_FGT_AD-7.4 practice, question 31. 89 questions available.