FCP_FGT_AD-7.4 practice questions 71–80

1. Question 71 · 89 in bank

   An administrator has configured a strict RPF check on FortiGate. How does strict RPF check work?

   • AStrict RPF checks the best route back to the source using the incoming interface.
   • BStrict RPF allows packets back to sources with all active routes.
   • CStrict RPF checks only for the existence of at least one active route back to the source using the incoming interface.
   • DStrict RPF check is run on the first sent and reply packet of any new session.

   Show answer

   Answer: A

   Explanation

   A Strict: In this mode, Fortigate also verifies that the matching route is the best route in the routing table. That is, if the route in table contains a matching route for the source address and the incoming interface, but there is a better route for the source address through another interface the the rpf check fails.

   Source: Adapted from community discussion — s4mu3l007

   References

   • community.fortinet.com documentation

   Next question

2. Question 72 · 89 in bank

   A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors. What is the reason for the certificate warning errors?

   • AThe option invalid SSL certificates is set to allow on the SSL/SSH inspection profile
   • BThe browser does not trust the certificate used by FortiGate for SSL inspection
   • CThe certificate used by FortiGate for SSL inspection does not contain the required certificate extensions.
   • DThe matching firewall policy is set to proxy inspection mode

   Show answer

   Answer: B

   Next question

3. Question 73 · 89 in bank

   Refer to the exhibit.

   

   The NOC team connects to the FortiGate GUI with the NOC_Access admin profile. They request that their GUI sessions do not disconnect too early during inactivity. What must the administrator configure to answer this specific request from the NOC team?

   • AEnable the parameter Never Timeout in the admin profiles
   • BIncrease the admintimeout value under config system accprofile super_admin.
   • CIncrease the admintimeout value under config system global
   • DIncrease the offline value of the Override idle Timeout parameter in the NOC_Access admin profile

   Show answer

   Answer: D

   Explanation

   D would be more correct than C . C changes the timeout for ALL admins, D would change it for just the NOC_Access profiles, and the question says "answer this specific request for NOC team". To me that means it's better to just change their setting in the GUI using option D

   Source: Adapted from community discussion — fa7474b

   Next question

4. Question 74 · 89 in bank

   Select 2

   A network administrator enabled antivirus and selected an SSL inspection profile on a firewall policy. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the and does not block the file allowing it to be downloaded. The administrator confirms that the traffic matches the configured firewall policy. What are two reasons for the failed virus detection by FortiGate? (Choose two.)

   • AThe selected SSL inspection profile has certificate inspection enabled
   • BThe browser does not trust the FortiGate self-signed CA certificate
   • CThe EICAR test file exceeds the protocol options oversize limit
   • DThe website is exempted from SSL inspection

   Show answer

   Answer: AD

   Next question

5. Question 75 · 89 in bank

   Refer to the exhibit.

   

   Examine the intrusion prevention system (IPS) diagnostic command shown in the exhibit. If option 5 is used with the IPS diagnostic command and the outcome is a decrease in the CPU usage, what is the correct conclusion?

   • AThe IPS engine is blocking all traffic.
   • BThe IPS engine is inspecting a high volume of traffic.
   • CThe IPS engine is unable to prevent an intrusion attack.
   • DThe IPS engine will continue to run in a normal state.

   Show answer

   Answer: B

   Explanation

   If there are high-CPU use problems caused by the IPS, you can use the diagnose test application ipsmonitor command with option 5 to isolate where the problem might be. Option 5 enables IPS bypass mode. In this mode, the IPS engine is still running, but it is not inspecting traffic. If the CPU use decreases after that, it usually indicates that the volume of traffic being inspected is too high for that FortiGate model.

   Source: Adapted from community discussion — Net_Asif

   Next question

6. Question 76 · 89 in bank

   How can you disable RPF checking?

   • ADisable src-check on the interface level settings
   • BUnset fail-alert-interfaces on the interface level settings.
   • CDisable fail-detect on the interface level settings.
   • DDisable strict-src-check under system settings.

   Show answer

   Answer: A

   Next question

7. Question 77 · 89 in bank

   An administrator is configuring an IPsec VPN between site A and site В. The Remote Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.168.1.0/24 and the remote quick mode selector is 192.168.2.0/24. Which subnet must the administrator configure for the local quick mode selector for site B?

   • A192.168.3.0/24
   • B192.168.0.0/8
   • C192.168.2.0/24
   • D192.168.1.0/24

   Show answer

   Answer: C

   Next question

8. Question 78 · 89 in bank

   Refer to the exhibit.

   

   In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output shown in the exhibit. What should the administrator do next, to troubleshoot the problem?

   • AExecute a debug flow.
   • BCapture the traffic using an external sniffer connected to port1.
   • CExecute another sniffer on FortiGate, this time with the filter "host 10.0.1.10".
   • DRun a sniffer on the web server.

   Show answer

   Answer: A

   Explanation

   Correct Answer: A. Execute a debug flow A. Execute a debug flow. Correct. Provides detailed packet routing, NAT, and policy analysis to identify the issue. B. Capture the traffic using an external sniffer connected to port1. Incorrect. External sniffers are unnecessary; FortiGate tools are sufficient. C. Execute another sniffer on FortiGate with the filter "host 10.0.1.10". Incorrect. The current sniffer already captures traffic from 10.0.1.10. D. Run a sniffer on the web server. Incorrect. The problem is better diagnosed from FortiGate first before moving to the server.

   Source: Adapted from community discussion — rigonet

   Next question

9. Question 79 · 89 in bank

   Select 2

   FortiGate is operating in NAT mode and has two physical interfaces connected to the LAN and DMZ networks respectively. Which two statements are true about the requirements of connected physical interfaces on FortiGate? (Choose two.)

   • ABoth interfaces must have the interface role assigned
   • BBoth interfaces must have directly connected routes on the routing table
   • CBoth interfaces must have DHCP enabled
   • DBoth interfaces must have IP addresses assigned

   Show answer

   Answer: BD

   Explanation

   Since it looks like you can't escape roles (LAN, WAN, DMZ, etc), they give you the impression they are mandatory. But they are for organizational or management purposes and do not affect functionality or connectivity. That is why A isn't within the best answer and B and D are.

   Source: Adapted from community discussion — Vago_que_hace_nada

   Next question

10. Question 80 · 89 in bank

    Select 2

    Which two pieces of information are synchronized between FortiGate HA members? (Choose two.)

    • AOSPF adjacencies
    • BIPsec security associations
    • CBGP peerings
    • DDHCP leases

    Show answer

    Answer: BD

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCP_FGT_AD-7.4 practice, question 71. 89 questions available.