Latest [Oct 25, 2024] Fortinet FCP_FGT_AD-7.4 Real Exam Dumps PDF
FCP_FGT_AD-7.4 Practice Test Questions Updated 50 Questions
Fortinet FCP_FGT_AD-7.4 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
| Topic 9 |
|
| Topic 10 |
|
| Topic 11 |
|
| Topic 12 |
|
| Topic 13 |
|
NEW QUESTION # 27
Which certificate value can FortiGate use to determine the relationship between the issuer and the certificate?
- A. Subject value
- B. SMMIE Capabilities value
- C. Subject Key Identifier value
- D. Subject Alternative Name value
Answer: C
Explanation:
Subject Key Identifier value.
FortiGate can use the Subject Key Identifier and Authority Key Identifier values to determine the relationship between the issuer of the certificate (identified in the Issuer field) and the certificate.
The Subject Key Identifier (SKI) is a value in a certificate that is used to uniquely identify the public key associated with a particular private key. It allows FortiGate to determine the relationship between the issuer (who signed the certificate) and the certificate itself. This identifier is often used in various cryptographic protocols and is included in the certificate extensions. By comparing the SKI in the certificate to the SKI of the issuing certificate, FortiGate can verify the certificate's authenticity and maintain the chain of trust in the certificate hierarchy.
NEW QUESTION # 28
An administrator must enable a DHCP server on one of the directly connected networks on FortiGate.
However, the administrator is unable to complete the process on the GUI to enable the service on the interface.
In this scenario, what prevents the administrator from enabling DHCP service?
- A. The DHCP server settingis available only on the CLI.
- B. Another interface is configured as the only DHCP server on FortiGate.
- C. The role of the interface prevents settinga DHCP server.
- D. The FortiGate model does not support the DHCP server.
Answer: C
NEW QUESTION # 29
Refer to the exhibit.
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 failed to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes can the administrator make to bring phase 1 up? (Choose two.)
- A. On HQ-FortiGate, disable Diffie-Helman group 2.
- B. On both FortiGate devices, set Dead Peer Detection to On Demand.
- C. On HQ-FortiGate, set IKE mode to Main (ID protection).
- D. On Remote-FortiGate, set port2 as Interface.
Answer: B,C
Explanation:
To bring Phase 1 up, the following changes can be made:
* A. On HQ-FortiGate, disable Diffie-Helman group 2: This is incorrect because Diffie-Hellman group 2 is already selected on both devices. Disabling it would not help.
* B. On Remote-FortiGate, set port2 as Interface: This is incorrect as both sides should be consistent in their interface settings for the IPsec tunnel, and the interface is correctly set to port1 on both FortiGates in the IPsec configuration.
* C. On both FortiGate devices, set Dead Peer Detection to On Demand: This is a valid option.
Setting Dead Peer Detection (DPD) to "On Demand" helps maintain the IPsec connection by checking if the peer is still available, which can help in some cases where the connection fails due to timeouts.
* D. On HQ-FortiGate, set IKE mode to Main (ID protection): This is also a valid option because the Remote-FortiGate is already set to Main mode (ID protection). Ensuring that both ends use the same mode is crucial for successful phase 1 negotiation.
Thus, the correct answers are:C. On both FortiGate devices, set Dead Peer Detection to On Demand.D.
On HQ-FortiGate, set IKE mode to Main (ID protection).
NEW QUESTION # 30
Refer to the exhibit.
The exhibit shows a FortiGate configuration.
How does FortiGate handle web proxy traffic coming from the IP address 10.2.1.200, that requires authorization?
- A. It authenticates the traffic using the authentication scheme SCHEME1.
- B. It authenticates the traffic using the authentication scheme SCHEME2.
- C. It always authorizes the traffic without requiring authentication.
- D. It drops the traffic
Answer: A
Explanation:
It authenticates the traffic using the authentication scheme SCHEME1.
What happens to traffic that requires authorization, but does not match any authentication rule? The active and passive SSO schemes to use for those cases is defined under config authentication setting.
NEW QUESTION # 31
Refer to the exhibit.
Which statement about this firewall policy list is true?
- A. The Implicit group can include more than one deny firewall policy.
- B. LAN to WAN. WAN to LAN. and Implicit are sequence grouping view lists.
- C. The firewall policies are listed by ID sequence view.
- D. The firewall policies are listed by ingress and egress interfaces pairing view.
Answer: D
NEW QUESTION # 32
A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
All traffic must be routed through the primary tunnel when both tunnels are up. The secondary tunnel must be used only if the primary tunnel goes down. In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover.
Which two key configuration changes must the administrator make on FortiGate to meet the requirements?
(Choose two.)
- A. Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
- B. Configure a higher distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.
- C. Enable Auto-negotiate and AutokeyKeep Alive on the phase 2 configuration of both tunnels.
- D. Enable Dead Peer Detection
Answer: A,D
NEW QUESTION # 33
Refer to exhibit.
An administrator configured the web filtering profile shown in the exhibit to block access to all social networking sites except Twitter. However, when users try to access twitter.com, they are redirected to a FortiGuard web filtering block page.
Based on the exhibit, which configuration change can the administrator make to allow Twitter while blocking all other social networking sites?
- A. On the Static URL Filter configuration, set Action to Monitor.
- B. On the FortiGuard Category Based Filter configuration, set Action to Warning for Social Networking.
- C. On the Static URL Filter configuration, set Action to Exempt.
- D. On the Static URL Filter configuration, set Type to Simple.
Answer: C
Explanation:
C: On the Static URL Filter configuration, set Action to Exempt.
Based on the exhibit, the administrator has configured the FortiGuard Category Based Filter to block access to all social networking sites, and has also configured a Static URL Filter to block access to twitter.com. As a result, users are being redirected to a block page when they try to access twitter.com.
To allow users to access twitter.com while blocking all other social networking sites, the administrator can make the following configuration change:
On the Static URL Filter configuration, set Action to Exempt: By setting the Action to Exempt, the administrator can override the block on twitter.com that was specified in the FortiGuard Category Based Filter. This will allow users to access twitter.com, while all other social networking sites will still be blocked.
Note:
Tested this in a lab environment and to make this work as stated in the question the Exempt action is the only way to go, and also *.twimg.com will has to be added to the URL Filter with an Exempt action for this situation to really work!
Allow: Access is permitted. Traffic is passed to remaining operations, including FortiGuard web filter, web content filter, web script filters, and antivirus scanning.
Exempt: Allows traffic from trusted sources to bypass all security inspections.
NEW QUESTION # 34
Refer to the FortiGuard connection debug output.
Based on the output shown in the exhibit, which two statements are correct? (Choose two.)
- A. FortiGate is using default FortiGuard communication settings.
- B. There is at least one server that lost packets consecutively.
- C. One server was contacted to retrieve the contract information.
- D. A local FortiManager is one of the servers FortiGate communicates with.
Answer: A,C
Explanation:
B is correct, one server has the flag DI which means it was contacted to retrieve contract information. A:
no server has packets dropped
C: No local(ip) fortimanager can be seen
D:......Anycast is enabled by default(as it says on the study guide) so its not using default settings. still, it uses HTTPS(TCP) and port 443 under tcp so we can consider this a default setting.
"by default, FortiGate is configured to enforce the use of HTTPS port 443 to perform live filtering with FortiGuard or FortiManager" We did check ourFortiGate and its configured the same.
Anycast is Enabled by default, but A and C are definitely incorrect.
NEW QUESTION # 35
Refer to the exhibit.
Which contains a network diagram and routing table output. The Student is unable to access Webserver.
What is the cause of the problem and what is the solution for the problem?
- A. The first reply packet for Student failed the RPF check. This issue can be resolved by adding a static route to 203.0.114.24/32 through port3.
- B. The first packet sent from Student failed the RPF check. This issue can be resolved by adding a static route to 203.0.114.24/32 through port3.
- C. The first reply packet for Student failed the RPF check. This issue can be resolved by adding a static route to 10.0.4.0/24 through wan1.
- D. The first packet sent from Student failed the RPF check. This issue can be resolved by adding a static route to 10.0.4.0/24 through wan1.
Answer: A
Explanation:
The first reply packet for Student failed the RPF check. This issue can be resolved by adding a static route to 203.0.114.24/32 through port3.
Option C is the correct answer based on the provided information, let's analyze it:
Option C states: "The first reply packet for Student failed the RPF check. This issue can be resolved by adding a static route to 203.0.114.24/32 through port3." The issue is related to the first reply packet from the Student failing the Reverse Path Forwarding (RPF) check and that adding a static route to 203.0.114.24/32 through "port3" will resolve the problem, then you can go ahead with this solution.
In a typical RPF check scenario, it ensures that the incoming packet is arriving on the expected interface based on the routing table. Adding a static route to 203.0.114.24/32 through "port3" may indeed resolve the RPF issue if the routing is misconfigured.
Option C is the correct solution based on your network setup and further analysis, you can proceed with implementing that static route to see if it resolves the issue. Additionally, it's a good practice to monitor the network to ensure that the problem is indeed resolved after making the change.
NEW QUESTION # 36
Which two statements are true about collector agent standard access mode? (Choose two.)
- A. Standard access mode supports nested groups.
- B. Standard mode security profiles apply to organizational units (OU).
- C. Standard mode uses Windows convention-NetBios: Domain\Username.
- D. Standard mode security profiles apply to user groups.
Answer: C,D
Explanation:
A. Standard mode uses Windows convention-NetBios: Domain\Username:
In the standard access mode, the collector agent uses the Windows convention for identifying users, which is in the format of NetBios: Domain\Username.
C. Standard mode security profiles apply to user groups:
In standard access mode, security profiles are applied based on user groups. This means that you can define security policies and profiles that are specific to certain user groups, allowing for more granular control and customization.
These features help in efficiently managing and applying security policies in a network environment using Fortinet's collector agent in standard access mode.
B is incorrect. Standard Mode does not do OU, advanced mode does.
D is incorrect. Standard Mode cannot do nested groups.
NEW QUESTION # 37
Examine the IPS sensor and DoS policy configuration shown in the exhibit, then answer the question below.
When detecting attacks, which anomaly, signature, or filter will FortiGate evaluate first?
- A. IMAP.Login.brute.Force
- B. SMTP.Login.Brute.Force
- C. Location: server Protocol: SMTP
- D. ip_src_session
Answer: A
Explanation:
IMAP.Login.brute.Force
Anomalies can be zero-day or denial of service attack
Are Detected by behaivoral analysis:
Rate Based IPS Signatures.
DoS Policies.
Protocol Constraint Inspections.
DoS policy disabled in this scenario.
NEW QUESTION # 38
To complete the final step of a Security Fabric configuration, an administrator must authorize all the devices on which device?
- A. FortiAnalyzer
- B. FortiManager
- C. Downstream FortiGate
- D. Root FortiGate
Answer: A
Explanation:
The correct answer is C. FortiAnalyzer.
Explanation:
In a Security Fabric configuration, after the devices are added to the Security Fabric, the final step is to authorize these devices. This authorization process is typically done through FortiAnalyzer, which manages and controls the Security Fabric. FortiAnalyzer allows administrators to centrally manage and monitor the Security Fabric, including authorizing devices to participate in the Security Fabric.
All devices must be authorized on the root Fortigate, and then after this step all must be authorized on the FortiAnalyzer.
NEW QUESTION # 39
An administrator has configured the following settings:
config system settings
set ses-denied-traffic enable
end
config system global
set block-session-timer 30
end
What are the two results of this configuration? (Choose two.)
- A. Denied users are blocked for 30 seconds.
- B. Device detection on all interfaces is enforced for 30 seconds.
- C. A session for denied traffic is created.
- D. The number of logs generated by denied traffic is reduced.
Answer: C,D
Explanation:
The timer config any way is by seconds.
ses-denied-traffic Enable/disable including denied session in the session table. block-session-timer Duration in seconds for blocked sessions (1 - 300 sec (5 minutes), default = 30).
C: The number of logs generated by denied traffic is reduced.
D: A session for denied traffic is created.
During the session, if a security profile detects a violation, FortiGate records the attack log immediately.
To reduce the number of log messages generated and improve performance, you can enable a session table entry of dropped traffic. This creates the denied session in the session table and, if the session is denied, all packets of that session are also denied. This ensures that FortiGate does not have to do a policy lookup for each new packet matching the denied session, which reduces CPU usage and log generation. This option is in the CLI, and is called ses-denied-traffic. You can also set the duration for block sessions. This determines how long a session will be kept in the session table by setting block- sessiontimer in the CLI. By default, it is set to 30 seconds.
Reference and download study guide:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-denied-session-to-be-added-int o-the/ta-p/195478
NEW QUESTION # 40
Refer to the exhibit to view the application control profile.
Based on the configuration, what will happen to Apple FaceTime?
- A. Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.
- B. Apple FaceTime will be allowed only if the filter in Application and Filter Overrides is set to Learn.
- C. Apple FaceTime will be allowed, based on the Categories configuration.
- D. Apple FaceTime will be allowed, based on the Apple filter configuration.
Answer: A
Explanation:
Apple facetime will be blocked according to the "Excessive Bandwidth" filter.
Facetime belongs to VoIP category which is monitored here and therefore should be allowed, however, because of the behavior of the facetime "Excessive-Bandwidth", the custom filter Excessive-Bandwidth will block Facetime and the lookup won't continue to the second filter.
The excessive bandwidth filter contains facetime and is referenced by the application sensor with the action to block. There is no reference to a bandwidth threshold at which point the filter is applied so the number of calls is irrelevant.
NEW QUESTION # 41
Which two configuration settings are global settings? (Choose two.)
- A. Firewall policies
- B. User & Device settings
- C. FortiGuard settings
- D. HA settings
Answer: C,D
Explanation:
The two configuration settings that are global settings are:
C. HA settings - High Availability settings are typically configured globally to manage failover and redundancy.
D. FortiGuard settings - FortiGuard settings for security services and updates are also configured globally to ensure consistent protection across the network.
HA configuration overview. The purpose of an HA configuration is to reduce downtime when a zone or instance becomes unavailable. This might happen during a zonal outage, or when an instance runs out of memory. With HA, your data continues to be available to client applications.
FortiGuard > Settings provides a central location for configuring and enabling your FortiManager system's built-in FDS as an FDN override server.
NEW QUESTION # 42
Which statement correctly describes NetAPI polling mode for the FSSO collector agent?
- A. The collector agent uses a Windows API to query DCs for user logins.
- B. NetAPI polling can increase bandwidth usage in large networks.
- C. The collector agent must search security event logs.
- D. The NetSessionEnum function is used to track user logouts.
Answer: D
Explanation:
The NetSessionEnum function is used to track user logouts.
Study Guide - FSSO - FSSO with Windows Active Directory - Collector Agent-Based Polling Mode Options.
Collector agent-based polling mode has three methods (or options) for collecting logon info: NetAPI, WinSecLog and WMI.
NetAPI: Polls temporary sessions created on the DC when a user logs on or logs off and calls the NetSessionEnum function on Windows. It's faster than the WinSec and WMI methods; however, it can miss some logon events if a DC is under heavy system load. This is because sessions can be quickly created and purged form RAM, before the agent has a chance to poll and notify FG.
NetAPI: polls temporary sessions created on the DC when a user logs in or logs out and calls the NetSessionEnum function on Windows. It's faster than the WinSec and WMI methods; however, it can miss some login events if a DC is under heavy system load. This is because sessions can be quickly created and purged from RAM, before the agent has a chance to poll and notify FortiGate.
Incorrect:
A: NetAPI polling can increase bandwidth usage in large networks. (WinSecLog) C: The collector agent must search security event logs. (WinSecLog) D: The collector agent uses a Windows API to query DCs for user logins. (WMI)
- WinSecLog: polis all the security event logs from the DC. It doesn't miss any login events that have been recorded by the DC because events are not normally deleted from the logs. There can be some delay in FortiGate receiving events if the network is large and, therefore, writing to the logs is slow. It also requires that the audit success of specific event IDs is recorded in the Windows security logs. For a full list of supported event IDs, visit the Fortinet Knowledge Base (http://kb.fortinet.com).
- NetAPI: polls temporary sessions created on the DC when a user logs in or logs out and calls the NetSessionEnum function on Windows. It's faster than the WinSec and WMI methods; however, it can miss some login events if a DC is under heavy system load. This is because sessions can be quickly created and purged from RAM, before the agent has a chance to poll and notify FortiGate.
NEW QUESTION # 43
An administrator wants to monitor their network for any probing attempts aimed to exploit existing vulnerabilities in their servers.
Which two items must they configure on their FortiGate to accomplish this? (Choose two.)
- A. An application control profile, and set all application signatures to monitor
- B. A web application firewall profile to check protocol constraints
- C. A DoS policy, and log all UDP and TCP scan attempts
- D. An IPS sensor to monitor all signatures applicable to the server
Answer: C,D
Explanation:
B. Configure a DoS policy and log all UDP and TCP scan attempts.
A Denial of Service (DoS) policy can help monitor and mitigate scan attempts. By logging UDP and TCP scan attempts, the administrator can identify potential probing activities.
C. Configure an IPS sensor to monitor all signatures applicable to the server.
An Intrusion Prevention System (IPS) sensor is crucial for monitoring and preventing various types of attacks, including those targeting server vulnerabilities. Monitoring all relevant IPS signatures enhances the detection capabilities.
So, the correct choices are indeed B and C.
NEW QUESTION # 44
Refer to the exhibits.
The exhibits show the application sensor configuration and theExcessive-BandwidthandApplefilter details.
Based on the configuration, what will happen to Apple FaceTime if there are only a few calls originating or incoming?
- A. Apple FaceTime will be allowed only if the Apple filter in Application and Filter Overrides is set to Allow.
- B. Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.
- C. Apple FaceTime will be allowed, based on the Video/Audio category configuration.
- D. Apple FaceTime will be allowed, based on the Apple filter configuration.
Answer: B
NEW QUESTION # 45
NGFW mode allows policy-based configuration for most inspection rules.
Which security profile's configuration does not change when you enable policy-based inspection?
- A. Web proxy
- B. Web filtering
- C. Application control
- D. Antivirus
Answer: D
Explanation:
Antivirus and IPS is enhanced by the IPS Engine, so that is why B is the right answer.
When you enable policy-based inspection in NGFW (Next-Generation Firewall) mode, the security profile configuration that typically does not change is:
B: Antivirus So, the correct answer is B. Antivirus.
NEW QUESTION # 46
You can configure FortiGate to store logs on syslog servers, FortiCloud, FortiSIEM, FortiAnalyzer, or FortiManager. These logging devices can also be used as a backup solution. Whenever possible, it is preferred to store logs externally.
If storing logs locally does not fit your requirements, you can store logs externally. You can configure FG to store logs on syslog servers, FortiCloud, FortiSIEM, FortiAnalyzer or FortiManager. These logging devices can also be used as a backup solution.
192.Examine this PAC file configuration.
Which of the following statements are true? (Choose two.)
- A. Any web request fortinet.com is allowed to bypass the proxy.
- B. Any web request to the 172.25. 120.0/24 subnet is allowed to bypass the proxy.
- C. All requests not made to Fortinet.com or the 172.25. 120.0/24 subnet, have to go through altproxy.corp.com: 8060.
- D. Browsers can be configured to retrieve this PAC file from the FortiGate.
Answer: A,D
Explanation:
The command direct bypass the proxy and it is a standard for pac files. And browsers can download de pac file from any server/fortigate.
NEW QUESTION # 47
......
Fortinet FCP_FGT_AD-7.4 Dumps - Secret To Pass in First Attempt: https://www.examcost.com/FCP_FGT_AD-7.4-practice-exam.html
FCP_FGT_AD-7.4 Dumps - Grab Out For [NEW-2024] Fortinet Exam: https://drive.google.com/open?id=1DCaZKfZ2gj625Neb4tS02zdrBkK3RynU
