FCP_FGT_AD-7.6 practice questions 21–30

1. Question 21 · 94 in bank

   A network administrator is reviewing firewall policies in both Interface Pair View and By Sequence View. The policies appear in a different order in each view. Why is the policy order different in these two views?

   • APolicies in Interface Pair View are prioritized by security levels, while By Sequence View strictly follows the administrator’s manual ordering.
   • BBy Sequence View groups policies based on rule priority, while Interface Pair View always follows the order of traffic logs.
   • CThe firewall dynamically reorders policies in Interface Pair View based on recent traffic patterns, but By Sequence View remains static.
   • DInterface Pair View sorts policies based on matching interfaces, while By Sequence View shows the actual processing order of rules.

   Show answer

   Answer: D

   Next question

2. Question 22 · 94 in bank

   An administrator notices that some users are unable to establish SSL VPN connections, while others can connect without any issues. What should the administrator check first?

   • AEnsure that the affected users are using the correct port number.
   • BEnsure that user traffic is hitting the firewall policy.
   • CEnsure that forced tunneling is enabled to reroute all traffic through the SSL VPN
   • DEnsure that the HTTPS service is enabled on SSL VPN tunnel interface

   Show answer

   Answer: A

   Next question

3. Question 23 · 94 in bank

   Refer to the exhibit.

   

   An administrator has created a new firewall address to use as the destination for a static route. Why is the administrator not able to select the new address in the Destination field of the new static route?

   • AIn the new static route, the administrator must select Named Address.
   • BIn the new firewall address, the FQDN address must first beresolved.
   • CIn the new static route, the administrator must first set the interface to port2.
   • DIn the new firewall address, Routing configuration must be enabled.

   Show answer

   Answer: D

   Next question

4. Question 24 · 94 in bank

   A new administrator is configuring FSSO authentication on FortiGate using DC Agent Mode. Which step is NOT part of the expected process?

   • AThe DC agent sends login event data directly to FortiGate.
   • BThe user logs into the windows domain.
   • CThe collector agent forwards login event data to FortiGate.
   • DFortiGate determines user identity based on the IP address in the FSSO list.

   Show answer

   Answer: A

   Next question

5. Question 25 · 94 in bank

   When configuring a FortiGate in a multi-WAN setup, why would an administrator enable session preservation on an interface?

   • ATo allow the FortiGate to dynamically change interfaces for all active sessions when a WAN link fails
   • BTo make sure all sessions without source NAT enabled always use the primary WAN link
   • CTo improve security by forcing users to authenticate again when the WAN link changes
   • DTo ensure that existing SSL VPN connections remain on the same interface even if route changes occur

   Show answer

   Answer: D

   Next question

6. Question 26 · 94 in bank

   Select 2

   FortiGate is operating in NAT mode and has two physical interfaces connected to the LAN and DMZ networks respectively. Which two statements about the requirements of connected physical interfaces on FortiGate are true? (Choose two.)

   • ABoth interfaces must have the interface role assigned.
   • BBoth interfaces must have directly connected routes on the routing table.
   • CBoth interfaces must have DHCP enabled and interfaces set to LAN and DMZ roles assigned.
   • DBoth interfaces must have IP addresses assigned.

   Show answer

   Answer: BD

   Next question

7. Question 27 · 94 in bank

   Select 2

   You are analyzing connectivity problems caused by intermediate devices blocking traffic in SSL VPN environment. In which two ways can you effectively resolve the problem? (Choose two.)

   • AYou can turn off IKE fragmentation to fix large certificate negotiation problems.
   • BYou should use IPsec to solve issues with fragment drops and large certificate exchanges.
   • CYou can use SSL VPN tunnel mode to prevent problems with blocked ESP and UDP ports (500 or 4500).
   • DYou can configure a hub-and-spoke topology with SSL VPN tunnels to bypass blocked UDP ports.

   Show answer

   Answer: CD

   Next question

8. Question 28 · 94 in bank

   Refer to the exhibit.

   

   FortiGate has two separate firewall policies for Sales and Engineering to access the same web server with the same security profiles. Which action must the administrator perform to consolidate the two policies into one?

   • ACreate an Aggregate interface that includes port1 and port2 to create a single firewall policy.
   • BSelect port1 and port2 subnets in a single firewall policy.
   • CReplace port1 and port2 with the any interface in a single firewall policy.
   • DEnable Multiple Interface Policies to select port1 and port2 in the same firewall policy.

   Show answer

   Answer: D

   Next question

9. Question 29 · 94 in bank

   You have configured an application control profile, set peer-to-peer traffic to Block under the Categories tab, and applied it to the firewall policy. However, your peer-to-peer traffic on known ports is passing through the FortiGate without being blocked. What FortiGate settings should you check to resolve this issue?

   • AFortiGuard category ratings
   • BApplication and Filter Overrides
   • CNetwork Protocol Enforcement
   • DReplacement Messages for UDP-based Applications

   Show answer

   Answer: C

   Next question

10. Question 30 · 94 in bank

    Select 2

    Which two statements are correct when FortiGate enters conserve mode? (Choose two.)

    • AFortiGate continues to run critical security actions, such as quarantine.
    • BFortiGate refuses to accept configuration changes.
    • CFortiGate halts complete system operation and requires a reboot to regain available resources.
    • DFortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled.

    Show answer

    Answer: BD

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCP_FGT_AD-7.6 practice, question 21. 94 questions available.