(Mar-2025) FCP_FGT_AD-7.4 Exam Dumps Contains FREE Real Quesions from the Actual Exam
Free Test Engine Verified By FCP in Network Security Certified Experts
Fortinet FCP_FGT_AD-7.4 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 24
Refer to the exhibit.
The exhibit contains a network diagram, firewall policies, and a firewall address object configuration. An administrator created a Deny policy with default settings to deny Webserver access for Remote-user2.
Remote-user2 is still able to access Webserver.
Which two changes can the administrator make to deny Webserver access for Remote-User2? (Choose two.)
- A. Set the Destination address as Web_server in the Deny policy.
- B. Enable match-vip in the Deny policy.
- C. Set the Destination address as Deny_IP in the Allow-access policy.
- D. Disable match-vip in the Deny policy.
Answer: A,B
Explanation:
By default does not match vip in deny policy for destination all. So 2 options we have:
1. Enable match vip in the Deny policy.
2. Add destination as webserver in deny policy. It should set match-vip enable, nor disable it...
Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Firewall-does-not-block-incoming- WAN-to-LAN /ta-p/189641
NEW QUESTION # 25
Refer to the exhibits, which show the firewall policy and an antivirus profile configuration.
Why is the user unable to receive a block replacement message when downloading an infected file for the first time?
- A. The firewall policy performs a full content inspection on the file.
- B. Flow-based inspection is used, which resets the last packet to the user.
- C. The intrusion prevention security profile must be enabled when using flow-based inspection mode.
- D. The option to send files to FortiSandbox for inspection is enabled.
Answer: B
Explanation:
In flow-based inspection mode, FortiGate sends a reset (RST) packet to the client instead of providing a replacement message, which causes the block message not to be displayed.
NEW QUESTION # 26
What are two features of the NGFW profile-based mode? (Choose two.)
- A. NGFW profile-based mode can only be applied globally and not on individual VDOMs.
- B. NGFW profile-based mode policies support both flow inspection and proxy inspection.
- C. NGFW profile-based mode supports applying applications and web filtering profiles in a firewall policy.
- D. NGFW profile-based mode must require the use of central source NAT policy
Answer: B,C
Explanation:
NGFW (Next Generation Firewall) profile-based mode in FortiGate allows policies to use both flow-based and proxy-based inspection modes, providing flexibility depending on security and performance requirements. Additionally, profile-based mode supports applying applications and web filtering profiles directly in a firewall policy, allowing granular control over the traffic.
Reference:
FortiOS 7.4.1 Administration Guide: NGFW Mode Configuration
NEW QUESTION # 27
FortiGuard categories can be overridden and defined in different categories. To create a web rating override for the example.com home page the override must be configured using a specific syntax.
Which two syntaxes are correct to configure a web rating override for the home page? (Choose two.)
- A. www.example.com:443
- B. www.example.com/index.hrml
- C. www.example.com
- D. example.com
Answer: C,D
Explanation:
www.example.com
This syntax targets the main domain, which is a common way to configure a web rating override for the home page of a website.
example.com
This syntax also correctly targets the main domain without specifying a subdomain (like "www"), which is valid for configuring a web rating override for the entire site, including the home page.
NEW QUESTION # 28
A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors.
What is the reason for the certificate warning errors?
- A. The option invalid SSL certificates is set to allow on the SSL/SSH inspection profile
- B. The browser does not trust the certificate used by FortiGate for SSL inspection
- C. The certificate used by FortiGate for SSL inspection does not contain the required certificate extensions.
- D. The matching firewall policy is set to proxy inspection mode
Answer: B
Explanation:
When full SSL inspection is enabled, FortiGate intercepts HTTPS traffic, decrypts it for inspection, and re-encrypts it using its own SSL certificate before forwarding it to the browser. If the browser does not trust the SSL certificate being used by FortiGate for re-encryption, it will display certificate warning errors. To resolve this, the certificate used by FortiGate for SSL inspection must be installed and trusted in the browser's certificate store.
NEW QUESTION # 29
Refer to the exhibits.
The exhibits show the firewall policies and the objects used in the firewall policies.
The administrator is using the Policy Lookup feature and has entered the search criteria shown in the exhibit.
Which policy will be highlighted, based on the input criteria?
- A. Policy with ID 1.
- B. Policy with ID 5.
- C. Policies with ID 2 and 3.
- D. Policy with ID 4.
Answer: B
Explanation:
Policy with ID 5.
It's coming from port 3 - hits Facebook-Web (Application) from the screenshot it show that it allows http and https traffic (80, 443).
There are 3 rules related to port3
and two rules source LOCAL_CLIENT
this would leave us with Rule 1 & 5
Rule one Service is = ULL_UDP
Rule five = Internet Services
Destination port we are looking for is 443 (usually this is TCP)
So it had to be PID5
We are looking for a policy that will allow or deny traffic from the source interface Port3 and source IP address 10.1.1.10 (LOCAL_CLIENT) to facebook.com TCP port 443 (HTTPS). There are only two policies that will match this traffic, policy ID 2 and 5. In FortiGate, firewall policies are evaluated from top to bottom. This means that the first policy that matches the traffic is applied, and subsequent policies are not evaluated. Based on the Policy Lookup criteria, Policy ID 5 will be highlighted.
NEW QUESTION # 30
Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)
- A. SSL inspection and authentication policy
- B. Firewall policy
- C. Policy rule
- D. Security policy
Answer: A,D
Explanation:
NGFW policy based mode, you must configure a few policies to allow traffic:
SSL inspection & Authentication, Security policy.
Security policies work with SSL Inspection & Authentication policies to inspect traffic. To allow traffic from a specific user or user group, both Security and SSL Inspection & Authentication policies must be configured.
If you are using Policy Based Mode, SSL Inspection & Authentication (consolidated) and Security Policy are required to allow traffic.
NEW QUESTION # 31
Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)
- A. The serial number in the server certificate.
- B. The host field in the HTTP header.
- C. The subject alternative name (SAN) field in the server certificate.
- D. The subject field in the server certificate.
- E. The server name indication (SNI) extension in the client hello message.
Answer: C,D,E
Explanation:
When SSL certificate inspection is enabled on a FortiGate device, the system uses the following three pieces of information to identify the hostname of the SSL server:
Server Name Indication (SNI) extension in the client hello message (B): The SNI is an extension in the client hello message of the SSL/TLS protocol. It indicates the hostname the client is attempting to connect to. This allows FortiGate to identify the server's hostname during the SSL handshake.
Subject Alternative Name (SAN) field in the server certificate (C): The SAN field in the server certificate lists additional hostnames or IP addresses that the certificate is valid for. FortiGate inspects this field to confirm the identity of the server.
Subject field in the server certificate (D): The Subject field contains the primary hostname or domain name for which the certificate was issued. FortiGate uses this information to match and validate the server's identity during SSL certificate inspection.
The other options are not used in SSL certificate inspection for hostname identification:
Host field in the HTTP header (A): This is part of the HTTP request, not the SSL handshake, and is not used for SSL certificate inspection.
Serial number in the server certificate (E): The serial number is used for certificate management and revocation, not for hostname identification.
Reference
FortiOS 7.4.1 Administration Guide - SSL/SSH Inspection, page 1802.
FortiOS 7.4.1 Administration Guide - Configuring SSL/SSH Inspection Profile, page 1799.
NEW QUESTION # 32
Examine the exhibit, which shows a firewall policy configured with multiple security profiles.
Which two security profiles are handled by the IPS engine? (Choose two.)
- A. AntiVirus
- B. Application Control
- C. Web Filter
- D. IPS
Answer: B,D
Explanation:
When the FortiGate is set for proxy inspection mode, the IPS engine will handle the Application Control and IPS security profiles.
The security profiles that will be handled by the IPS engine when the FortiGate is set for proxy inspection mode are Application Control and IPS. In this mode, the FortiGate acts as an intermediary between the client and the server, intercepting and inspecting traffic to enforce security policies. The IPS engine is responsible for analyzing network traffic and identifying any malicious or suspicious activity based on predefined rules and signatures.
NEW QUESTION # 33
An administrator must disable RPF check to investigate an issue.
Which method is best suited to disable RPF without affecting features like antivirus and intrusion prevention system?
- A. Disable the RPF check at the FortiGate interface level for the reply check.
- B. Enable asymmetric routing, so the RPF check will be bypassed.
- C. Disable the RPF check at the FortiGate interface level for the source check.
- D. Enable asymmetric routing at the interface level.
Answer: C
Explanation:
"B" is the answer be careful question are very tricky. RPF methods in NSE guide says: Two ways to disable RFP.
1 Enable asymetric routing, which disables RPF checking system wide (but not at interface level is through the CLI command config system settings)
2 Disable RPF checkking at the interface level (the only way at the interface level in the CLI command).
A incorrect. If you enable asymetric routing, RPF not will be bypass because is disable.
B Correct. You have to disable the RPF check an the interface level, for the source.
C Is incorrect is for the source D is incorrect: Asymetric routing is not enable at interface level.
RPF checking can be disabled in the ways. If you enable asymmetric routing, it will disable RPF checking system wide. However this reduces the security of you network greatly. Features such us ANTIVIRUS, and IPS become non-effective.
So, if you need to disable RPF checking, you can do so at the interface level using the command:
config system interface
edit
set src-check [enable | disable]
end
NEW QUESTION # 34
Refer to the exhibit.
FortiGate has two separate firewall policies for Sales and Engineering to access the same web server with the same security profiles.
Which action must the administrator perform to consolidate the two policies into one?
- A. Select port1and port2 subnets in a single firewall policy.
- B. Replace port1and port2with the any interface in a single firewall policy.
- C. Enable Multiple Interface Policies to select port1and port2 in the same firewall policy
- D. Create an Interface Group that includes port1 and port2 to create a single firewall policy
Answer: C
NEW QUESTION # 35
Refer to the exhibits.
Exhibit A.
Exhibit B.
An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).
What must the administrator do to synchronize the address object?
- A. Change the csf setting on Local-FortiGate (root) to set configuration-sync local.
- B. Change the csf setting on ISFW (downstream) to set fabric-object-unification default.
- C. Change the csf setting on ISFW (downstream) to set configuration-sync local.
- D. Change the csf setting on Local-FortiGate (root) to set fabric-object-unification default.
Answer: D
Explanation:
Change the csf setting on Local-FortiGate (root) to set fabric-object-unification default.
The CLI command set fabric-object-unification is only available on the root FortiGate. When set to local, global objects will not be synchronized to downstream devices in the Security Fabric. The default value is default.
Option A will not synchronise global fabric objects downstream.
NEW QUESTION # 36
What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?
- A. FortiGate automatically negotiates different local and remote addresses with the remote peer.
- B. FortiGate automatically brings up the IPsec tunnel and keeps it up, regardless of activity on the IPsec tunnel.
- C. FortiGate automatically negotiates different encryption and authentication algorithms with the remote peer.
- D. FortiGate automatically negotiates a new security association after the existing security association expires.
Answer: B
Explanation:
When IPsec SAs expire, FortiGate needs to negotiate new SAs to continue sending and receiving traffic over the IPsec tunnel. Technically, FortiGate deletes the expired SAs from the respective phase 2 selectors, and installs new ones. If IPsec SA renegotiation takes too much time, then FortiGate might drop interesting traffic because of the absence of active SAs. To prevent this, you can enable Auto- negotiate. When you do this, FortiGate not only negotiates new SAs before the current SAs expire, but it also starts using the new SAs right away. The latter prevents traffic disruption by IPsec SA renegotiation.
Enable auto-negotiate by default enabling auto-keep-alive too which brings up tunnel automatically.
Answer B is little bit tricky, auto-negotiate will negotiate new SA "before" existing SA expired not "after" existing SA expired.
NEW QUESTION # 37
Which type of logs on FortiGate record information about traffic directly to and from the FortiGate management IP addresses?
- A. Security logs
- B. Local traffic logs
- C. Forward traffic logs
- D. System event logs
Answer: B
Explanation:
The type of logs on FortiGate that records information about traffic directly to and from the FortiGate nmanagement IP addresses is:
A. Local traffic logs
Local traffic logs include information about traffic that is directed to and from the FortiGate unit itself, including traffic to and from the FortiGate management IP addresses. These logs provide details about communication involving the FortiGate device.
So, the correct choice is A.
NEW QUESTION # 38
An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings.
What is true about the DNS connection to a FortiGuard server?
- A. It uses DNS over TLS.
- B. It uses DNS over HTTPS.
- C. It uses UDP 8888.
- D. It uses UDP 53.
Answer: D
Explanation:
By default, DNS queries to FortiGuard servers use UDP port 53.
NEW QUESTION # 39
Refer to the exhibit:
Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)
- A. There will be eight routes active in the routing table.
- B. The port3 default route has the lowest metric.
- C. The port3 default route has the highest distance.
- D. The port1 and port2 default routes are active in the routing table.
Answer: C,D
Explanation:
*> mean active routes
first square bracked mean administrative distance
second bracket square mean priority (valid only on static routes) metric applies only in multiroutes with same administrative distance.
NEW QUESTION # 40
Refer to the exhibits.
The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration.
An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2.
The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver.
Which two configuration changes can the administrator make to the policy to deny Webserver access for Remote-User2? (Choose two.)
- A. Enable match-vip in the Deny policy.
- B. Set the Destination address as Webserver in the Deny policy.
- C. Disable match-vip in the Deny policy.
- D. Set the Destination address as Deny_IP in the Allow_access policy.
Answer: A,B
NEW QUESTION # 41
Which two features of IPsec IKEv1 authentication are supported by FortiGate? (Choose two.)
- A. No certificate is required on the remote peer when you set the certificate signature as the authentication method
- B. Pre-shared key and certificate signature as authentication methods
- C. Extended authentication (XAuth)to request the remote peer to provide a username and password
- D. Extended authentication (XAuth) for faster authentication because fewer packets are exchanged
Answer: B,C
NEW QUESTION # 42
......
Use Real Fortinet Achieve the FCP_FGT_AD-7.4 Dumps - 100% Exam Passing Guarantee: https://www.braindumpspass.com/Fortinet/FCP_FGT_AD-7.4-practice-exam-dumps.html
Verified FCP_FGT_AD-7.4 Q&As - Pass Guarantee FCP_FGT_AD-7.4 Exam Dumps: https://drive.google.com/open?id=1cA0FK4BMaelt_T7WeLj71v-SUS1He2JG
