FCP_FGT_AD-7.4 practice questions 51–60

1. Question 51 · 89 in bank

   Select 3

   Which three CLI commands can you use to troubleshoot Layer 3 issues, if the issue is in neither the physical layer nor the link layer? (Choose three.)

   • Aexecute ping
   • Bexecute traceroute
   • Cdiagnose sys top
   • Dget system arp
   • Ediagnose sniffer packet any

   Show answer

   Answer: ABE

   Explanation

   ABE makes sense but i have a suspicion they are looking for ARP as an answer here because the study guide talks about using D as a way to look for IP address conflicts.

   Source: Adapted from community discussion — fa7474b

   Next question

2. Question 52 · 89 in bank

   An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is outbound traffic but no response from the peer. Which DPD mode on FortiGate meets this requirement?

   • AOn Demand
   • BOn Idle
   • CDisabled
   • DEnabled

   Show answer

   Answer: A

   Explanation

   The requirement is that FortiGate sends DPD probes only when there is outbound traffic but no response from the peer = when FortiGate Demand / On Demand

   Source: Adapted from community discussion — sxcap

   Next question

3. Question 53 · 89 in bank

   Select 2

   Which two statements are correct when FortiGate enters conserve mode? (Choose two.)

   • AFortiGate halts complete system operation and requires a reboot to regain available resources
   • BFortiGate refuses to accept configuration changes
   • CFortiGate continues to run critical security actions, such as quarantine.
   • DFortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled

   Show answer

   Answer: BD

   Explanation

   B & D is correct, refer to FortiGate 7.4 Study Guide p. 460. It does not accept config changes, because it might increase memory usage even further. It explicitly does NOT run any quarantine actions. You can configure IPS fail-open to control how IPS behaves when the IPS socket buffer is full.

   Source: Adapted from community discussion — 066c9f3

   Next question

4. Question 54 · 89 in bank

   Which statement is correct regarding the use of application control for inspecting web applications?

   • AApplication control can identify child and parent applications, and perform different actions on them
   • BApplication control signatures are included in Fortinet Antivirus engine
   • CApplication control does not display a replacement message for a blocked web application
   • DApplication control does not require SSL Inspection to Identify web applications

   Show answer

   Answer: A

   Next question

5. Question 55 · 89 in bank

   Select 3

   What are three key routing principles in SD-WAN? (Choose three.)

   • ABy default, SD-WAN members are skipped if they do not have a valid route to the destination
   • BBy default, SD-WAN rules are skipped if only one route to the destination is available
   • CBy default, SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member
   • DSD-WAN rules have precedence over any other type of routes
   • ERegular policy routes have precedence over SD-WAN rules

   Show answer

   Answer: ACE

   Explanation

   SD-WAN rules are matched only if the best route to the destination points to SD-WAN SD-WAN member is selected only if it has a route to the destination https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan-sd-branch-architecture-for-mssps/768108/sd-wan-routing-logic SDWAN rules are 'policy routes', but regular policy routes have precedence over SD-WAN rules. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Explaining-the-SD-WAN-rule-matching-process/ta-p/284325

   Source: Adapted from community discussion — hecjoseroag

   References

   • Fortinet documentation
   • community.fortinet.com documentation

   Next question

6. Question 56 · 89 in bank

   Select 2

   Refer to the exhibits.

   

   

   

   The exhibits show a diagram of a FortiGate device connected to the network, as well as the firewall policy and IP pool configuration on the FortiGate device. Two PCs, PC1 and PC2, are connected behind FortiGate and can access the internet successfully. However, when the administrator adds a third PC to the network (PC3), the PC cannot connect to the internet. Based on the information shown in the exhibit, which two configuration options can the administrator use to fix the connectivity issue for PC3? (Choose two.)

   • AIn the firewall policy configuration, add 10.0.1.3 as an address object in the source field.
   • BIn the IP pool configuration, set endip to 192.2.0.12.
   • CConfigure another firewall policy that matches only the address of PC3 as source, and then place the policy on top of the list.
   • DIn the IP pool configuration, set type to overload.

   Show answer

   Answer: BD

   Next question

7. Question 57 · 89 in bank

   Refer to the exhibits, which show a diagram of a FortiGate device connected to the network. VIP object configuration, and the firewall policy configuration.

   

   

   

   The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IP address 10.0.1.254/24. If the host 10.200.3.1 sends a TCP SYN packet on port 8080 to 10.200.1.10, what will the source address, destination address, and destination port of the packet be at the time FortiGate forwards the packet to the destination?

   • A10.0.1.254, 10.200.1.10, and 8080, respectively
   • B10.0.1.254, 10.0.1.10, and 80, respectively
   • C10.200.3.1, 10.0.1.10, and 80, respectively
   • D10.200.3.1, 10.0.1.10, and 8080, respectively

   Show answer

   Answer: C

   Explanation

   NAT is disabled on the Allow_access policy, which is the policy of interest here as the traffic is coming IN WAN port1 and going to the server out LAN port3.

   Source: Adapted from community discussion — fa7474b

   Next question

8. Question 58 · 89 in bank

   Select 2

   Which two attributes are required on a certificate so it can be used as a CA certificate on SSL inspection? (Choose two.)

   • AThe issuer must be a public CA
   • BThe CA extension must be set to TRUE
   • CThe Authority Key Identifier must be of type SSL
   • DThe keyUsage extension must be set to keyCertSign

   Show answer

   Answer: BD

   Next question

9. Question 59 · 89 in bank

   Select 2

   Refer to the exhibit showing a debug flow output.

   

   What two conclusions can you make from the debug flow output? (Choose two.)

   • AThe debug flow is for ICMP traffic.
   • BA firewall policy allowed the connection.
   • CA new traffic session was created.
   • DThe default route is required to receive a reply.

   Show answer

   Answer: AC

   Next question

10. Question 60 · 89 in bank

    Select 3

    Which three statements explain a flow-based antivirus profile? (Choose three.)

    • AFlow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.
    • BFlow-based inspection optimizes performance compared to proxy-based inspection.
    • CFortiGate buffers the whole file but transmits to the client at the same time.
    • DIf a virus is detected, the last packet is delivered to the client.
    • EThe IPS engine handles the process as a standalone.

    Show answer

    Answer: ABC

    Explanation

    ABC is correct. B and C are understood to be correct, A is correct because flow-based inspection uses hybrid of two scanning options, default and legacy. Default scanning supports scanning of nested archive files without buffering the whole container file whereas legacy mode buffers the whole container file for scanning purposes (of underlying nested files).

    Source: Adapted from community discussion — JRKhan

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCP_FGT_AD-7.4 practice, question 51. 89 questions available.