FCP_FGT_AD-7.4 practice questions 81–89

1. Question 81 · 89 in bank

   Select 2

   Refer to the exhibit.

   

   Based on the routing database shown in the exhibit which two conclusions can you make about the routes? (Choose two.)

   • AThere will be eight routes active in the routing table
   • BThe port1 and port2 default routes are active in the routing table
   • CThe port3 default route has the highest distance
   • DThe port3 default route has the lowest metric

   Show answer

   Answer: BC

   Next question

2. Question 82 · 89 in bank

   Select 2

   What are two features of FortiGate FSSO agentless polling mode? (Choose two.)

   • AFortiGate directs the collector agent to use a remote LDAP server.
   • BFortiGate uses the SMB protocol to read the event viewer logs from the DCs.
   • CFortiGate does not support workstation check.
   • DFortiGate uses the AD server as the collector agent.

   Show answer

   Answer: BC

   Next question

3. Question 83 · 89 in bank

   Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

   • AThe NetSessionEnum function is used to track user logouts.
   • BNetAPI polling can increase bandwidth usage in large networks.
   • CThe collector agent must search Windows application event logs.
   • DThe collector agent uses a Windows API to query DCs for user logins.

   Show answer

   Answer: A

   Explanation

   A. Because "NetAPI: polls temporary sessions created on the DC when a user logs in or LOGS OUT and calls the NetSessionEnum function on Windows."

   Source: Adapted from community discussion — herlock_sholmes_2810

   Next question

4. Question 84 · 89 in bank

   Refer to the exhibits.

   

   

   

   An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW). What must the administrator do to synchronize the address object?

   • AChange the csf setting on Local-FortiGate (root) to set fabric-object-unification default.
   • BChange the csf setting on both devices to set downstream-access enable.
   • CChange the csf setting on ISFW (downstream) to set authorization-request-type certificate.
   • DChange the csf setting on ISFW (downstream) to set configuration-sync local.

   Show answer

   Answer: A

   Explanation

   Correct: A. Change the csf setting on Local-FortiGate (root) to set fabric-object-unification default. FortiGate Security 7.2 Study Guide (p.434): "The CLI command set fabric-object-unification is only available on the root FortiGate. When set to local, global objects will not be synchronized to downstream devices in the Security Fabric. The default value is default"

   Source: Adapted from community discussion — s4mu3l007

   References

   • Fortinet documentation
   • Fortinet documentation

   Next question

5. Question 85 · 89 in bank

   Refer to the exhibits.

   

   

   The SSL VPN connection fails when a user attempts to connect to it. What should the user do to successfully connect to the SSL VPN?

   • AChange the SSL VPN portal to the tunnel.
   • BChange the idle timeout.
   • CChange the server IP address.
   • DChange the SSL VPN port on the client.

   Show answer

   Answer: D

   Next question

6. Question 86 · 89 in bank

   Refer to the exhibits.

   

   

   

   

   The exhibits show a diagram of a FortiGate device connected to the network, and the firewall policies configuration, VIP configuration, and IP pool configuration on the FortiGate device. The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IP address 10.0.1.254/24. The first firewall policy has NAT enabled using the IP pool. The second firewall policy is configured with a VIP as the destination address. Which IP address will be used to source NAT (SNAT) the internet traffic coming from a workstation with the IP address 10.0.1.10?

   • A10.200.1.100
   • B10.200.1.10
   • C10.200.1.1
   • D10.0.1.254

   Show answer

   Answer: A

   Next question

7. Question 87 · 89 in bank

   Select 2

   Refer to the exhibit.

   

   A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up. Based on the phase 2 configuration shown in the exhibit, which two configuration changes will bring phase 2 up? (Choose two.)

   • AOn Remote-FortiGate, set Seconds to 43200.
   • BOn HQ-FortiGate, enable Diffie-Hellman Group 2.
   • COn HQ-FortiGate, set Encryption to AES256.
   • DOn Remote-FortiGate, set Remote Address to 10.0.1.0/255.255.255.0.

   Show answer

   Answer: CD

   Next question

8. Question 88 · 89 in bank

   Select 2

   Refer to the exhibits.

   

   

   

   

   The exhibits show a diagram of a FortiGate device connected to the network, VIP configuration, firewall policy, and the sniffer CLI output on the FortiGate device. The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IP address 10.0.1.254/24. The webserver host (10.0.1.10) must use its VIP external IP address as the source NAT (SNAT) when it pings remote server (10.200.3.1). Which two statements are valid to achieve this goal? (Choose two.)

   • ACreate a new firewall policy before Internet_Access for the webserver and apply the IP pool.
   • BDisable port forwarding on the VIP object.
   • CEnable NAT on the Allow_access firewall policy.
   • DDisable NAT on the Internet_Access firewall policy.

   Show answer

   Answer: AB

   Next question

9. Question 89 · 89 in bank

   Select 2

   Refer to the exhibit.

   

   The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile. An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category. What are two solutions for satisfying the requirement? (Choose two.)

   • AConfigure a separate firewall policy with action Deny and an FQDN address object for *.download.com as destination address.
   • BSet the Freeware and Software Downloads category Action to Warning.
   • CConfigure a web override rating for download.com and select Malicious Websites as the subcategory.
   • DConfigure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.

   Show answer

   Answer: CD

   Explanation

   Correct answer: Use C and D for a more direct and efficient solution. A. Incorrect: A separate firewall policy for *.download.com would work but is less efficient for this specific case. B. Incorrect: Setting the category to "Warning" does not block download.com. C. Correct: A web rating override reclassifies download.com as "Malicious Websites," blocking it without affecting the rest of the category. D. Correct: A static URL filter blocks download.com specifically while keeping other sites in the same category accessible.

   Source: Adapted from community discussion — rigonet

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCP_FGT_AD-7.4 practice, question 81. 89 questions available.