FCP_FGT_AD-7.6 practice questions 31–40

1. Question 31 · 94 in bank

   When configuring firewall policies which of the following is true regarding the policy ID?

   • AIt is mandatory to provide a policy ID while creating a firewall policy regardless of GUI or CLI.
   • BA firewall policy ID identifies the order of policy execution in firewall policies.
   • CYou can create a policy in CLI with policy ID 0.
   • DA policy ID cannot be edited once a policy is created.

   Show answer

   Answer: D

   Next question

2. Question 32 · 94 in bank

   A remote user reports slow SSL VPN performance and frequent disconnections. The user is located in an area with poor internet connectivity. What setting should the administrator adjust to improve the user's experience?

   • AEnable split tunneling to reduce VPN traffic.
   • BChange the SSL VPN port to a non-standard port.
   • CIncrease the session timeout for inactive sessions.
   • DConfigure the DTLS timeout to accommodate high-latency connections.

   Show answer

   Answer: D

   Next question

3. Question 33 · 94 in bank

   Select 2

   An administrator wants to analyze and manage digital certificates to prevent browser warnings when users connect to the SSL VPN portal. Which two statements describe how to correctly do this? (Choose two.)

   • AThe administrator can rely on the default FortiGate self-signed certificate to prevent all security warnings in the browser.
   • BThe administrator must disable HTTPS administrative access entirely to avoid certificate warnings.
   • CThe administrator can use a publicly trusted certificate from a known certificate authority (CA) to stop browser warnings.
   • DThe administrator can import the FortiGate self-signed certificate into each user’s browser as a trusted certificate.

   Show answer

   Answer: CD

   Next question

4. Question 34 · 94 in bank

   An administrator suspects that the Collector Agent is not forwarding login events to FortiGate. What is the most effective troubleshooting step?

   • AVerify if DC agent is enabled on the FortiGate.
   • BRestart the domain controller to refresh authentication services.
   • CVerify if FortiGate is set to use LDAP authentication instead of FSSO.
   • DCheck if TCP port 8000 is open between the collector agent and FortiGate.

   Show answer

   Answer: D

   Next question

5. Question 35 · 94 in bank

   Select 2

   Refer to the exhibit.

   

   A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up. Based on the phase 2 configuration shown in the exhibit, which two configuration changes will bring phase 2 up? (Choose two.)

   • AOn BR1-FGT, set Seconds to 43200.
   • BOn HQ-NGFW, enable Diffie-Hellman Group 2.
   • COn BR1-FGT, set Remote Address to 10.0.11.0/255.255.255.0
   • DOn HQ-NGFW. set Encryption to AES256

   Show answer

   Answer: CD

   Next question

6. Question 36 · 94 in bank

   Refer to the exhibits.

   

   An administrator has observed the performance status outputs on an HA cluster for 55 seconds. Which FortiGate is the primary?

   • AHQ-NGFW-2 with the parameter memory-failover-threshold setting
   • BHQ-NGFW-2 with the parameter priority setting
   • CHQ-NGFW-1 with the parameter memory-failover-flip-timeout setting
   • DHQ-NGFW-1 with the parameter override setting

   Show answer

   Answer: A

   Next question

7. Question 37 · 94 in bank

   Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

   • AThe collector agent uses a Windows API to query DCs for user logins.
   • BNetAPI polling can increase bandwidth usage in large networks.
   • CThe NetSessionEnum function is used to track user logouts.
   • DThe collector agent must search Windows application event logs.

   Show answer

   Answer: C

   Next question

8. Question 38 · 94 in bank

   You have configured the FortiGate device for FSSO. A user is successful in log-in to windows, but their access to the internet is denied. What should the administrator check first?

   • AWhether the user is assigned to the correct AD group.
   • BThe FortiGate firewall policy settings for SSL decryption.
   • CThe FortiGate FSSO active users list for user’s IP address.
   • DThe windows event viewer for failed login attempts.

   Show answer

   Answer: C

   Next question

9. Question 39 · 94 in bank

   Select 3

   What are three key routing principles in SD-WAN? (Choose three.)

   • ABy default, SD-WAN rules are skipped if the included SD-WAN members do not have a valid route to the destination.
   • BSD-WAN rules have precedence over any other type of routes.
   • CRegular policy routes have precedence over SD-WAN rules.
   • DBy default. SD-WAN rules are skipped if only one route to the destination is available.
   • EBy default, SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.

   Show answer

   Answer: ACE

   Next question

10. Question 40 · 94 in bank

    Refer to the exhibits.

    

    The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects. The WAN (port2) interface has the IP address 100.65.0.101/24. The LAN (port4) interface has the IP address 10.0.11.254/24. Which IP address will be used to source NAT (SNAT) the traffic, if the user on HQ-PC-1 (10.0.11.50) pings the IP address of BR-FGT (100.65.1.111)

    • A100.65.0.101
    • B100.65.0.49
    • C100.65.0.99
    • D100.65.0.149

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCP_FGT_AD-7.6 practice, question 31. 94 questions available.