FCP_FGT_AD-7.6 practice questions 41–50

1. Question 41 · 94 in bank

   Select 2

   Refer to the exhibits.

   

   The exhibits show the system performance output and default configuration of high memory usage thresholds on a FortiGate device. Based on the system performance output, what are the two possible outcomes? (Choose two.)

   • AFortiGate has entered conserve mode.
   • BAdministrators can access FortiGate only through the console port.
   • CAdministrators can change the configuration.
   • DFortiGate drops new sessions.

   Show answer

   Answer: AD

   Next question

2. Question 42 · 94 in bank

   Select 2

   Refer to the exhibits.

   

   An administrator wants to add HQ-ISFW-2 in the Security Fabric. HQ-ISFW-2 is in the same subnet as HQ-ISFW. After configuring the Security Fabric settings on HQ-ISFW-2, the status stays Pending. What can be the two possible reasons? (Choose two.)

   • AUpstream FortiGate IP must be set to 10.0.11.254.
   • BSAML Single Sign-On must be set to Manual.
   • CHQ-ISFW-2 must be authorized on HQ-ISFW.
   • DManagement IP must be set to 10.0.13.254.

   Show answer

   Answer: AC

   Next question

3. Question 43 · 94 in bank

   Refer to the exhibits.

   

   Based on the current HA status, an administrator updates the override and priority parameters on HQ-NGFW-1 and HQ-NGFW-2 as shown in the exhibit. What would be the expected outcome in the HA cluster?

   • AHQ-NGFW-1 will synchronize the override disable setting with HQ-NGFW-2.
   • BHQ-NGFW-2 will take over as the primary because it has the override enable setting and higher priority than HQ-NGFW-1.
   • CHQ-NGFW-1 will remain the primary because HQ-NGFW-2 has lower priority.
   • DThe HA cluster will become out of sync because the override setting must match on all HA members.

   Show answer

   Answer: B

   Next question

4. Question 44 · 94 in bank

   Select 2

   Refer to the exhibit.

   

   The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile. An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category. What are two solutions for satisfying the requirement? (Choose two.)

   • AConfigure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.
   • BConfigure a web override rating for download.com and select Malicious Websites as the subcategory.
   • CConfigure a separate firewall policy with action Deny and an FQDN address object for *.download.com as destination address.
   • DSet the Freeware and Software Downloads category Action to Warning.

   Show answer

   Answer: AB

   Next question

5. Question 45 · 94 in bank

   Refer to the exhibit, which contains a RADIUS server configuration.

   

   An administrator added a configuration for a new RADIUS server. While configuring, the administrator enabled Include in every user group. What is the impact of enabling Include in every user group in a RADIUS configuration?

   • AThis option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.
   • BThis option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.
   • CThis option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.
   • DThis option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.

   Show answer

   Answer: A

   Next question

6. Question 46 · 94 in bank

   Select 3

   Which three strategies are valid SD-WAN rule strategies for member selection? (Choose three.)

   • ALowest Cost (SLA) without load balancing
   • BManual with load balancing
   • CLowest Quality (SLA) with load balancing
   • DLowest Cost (SLA) with load balancing
   • EBest Quality with load balancing

   Show answer

   Answer: ABD

   Next question

7. Question 47 · 94 in bank

   Select 2

   What are two characteristics of HA cluster heartbeat IP addresses in a FortiGate device? (Choose two.)

   • AHeartbeat interfaces have virtual IP addresses that are manually assigned.
   • BHeartbeat IP addresses are used to distinguish between cluster members.
   • CThe heartbeat interface of the primary device in the cluster is always assigned IP address 169.254.0.1.
   • DA change in the heartbeat IP address happens when a FortiGate device joins or leaves the cluster.

   Show answer

   Answer: BD

   Next question

8. Question 48 · 94 in bank

   Refer to the exhibits.

   

   

   

   

   An administrator creates a new address object on the root FortiGate (HQ-NGFW-1) in the Security Fabric. After synchronization, this object is not available on the downstream FortiGate (HQ-ISFW). What must the administrator do to synchronize the address object?

   • AChange the csf setting on HQ-ISFW (downstream) to set configuration-sync local.
   • BChange the csf setting on HQ-ISFW (downstream) to set saml-configuration-sync default.
   • CChange the csf setting on HQ-NGFW-1 (root) to set fabric-object-unification default.
   • DChange the csf setting on both devices to set downstream-access enable.

   Show answer

   Answer: C

   Next question

9. Question 49 · 94 in bank

   Select 2

   Refer to the exhibit showing a debug flow output.

   

   Which two conclusions can you make from the debug flow output? (Choose two.)

   • AThe default gateway is configured on port2.
   • BThe RPF check fails.
   • CThe debug flow is for UDP traffic.
   • DThe matching firewall policy denies the traffic.

   Show answer

   Answer: AD

   Next question

10. Question 50 · 94 in bank

    Refer to the exhibit, which shows a firewall policy to enable active authentication.

    

    When attempting to access an external website using an active authentication method, the user is not presented with a login prompt. What is the most likely reason for this situation?

    • AThe Service DNS is required in the firewall policy.
    • BThe Remote-users group must be set up correctly in the FSSO configuration.
    • CNo matching user account exists for this user.
    • DThe Remote-users group is not added to the Destination.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCP_FGT_AD-7.6 practice, question 41. 94 questions available.