New 2025 Latest Questions FCP_FGT_AD-7.4 Dumps - Use Updated Fortinet Exam
Latest FCP_FGT_AD-7.4 Exam Dumps Fortinet Exam from Training Expert Actual4Dumps
NEW QUESTION # 22
A network administrator enabled antivirus and selected an SSL inspection profile on a firewall policy.
When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the and does not block the file allowing it to be downloaded.
The administrator confirms that the traffic matches the configured firewall policy.
What are two reasons for the failed virus detection by FortiGate? (Choose two.)
- A. The selected SSL inspection profile has certificate inspection enabled
- B. The browser does not trust the FortiGate self-siqned CA certificate
- C. The website is exempted from SSL inspection
- D. The EICAR test file exceeds the protocol options oversize limit
Answer: A,C
Explanation:
The selected SSL inspection profile has certificate inspection enabled
If the SSL inspection profile is set to certificate inspection instead of full SSL inspection, FortiGate will only inspect the certificate of the HTTPS connection but will not decrypt and inspect the actual traffic content, leading to a failure in virus detection.
The website is exempted from SSL inspection
If the website hosting the EICAR test file is exempt from SSL inspection, FortiGate will not decrypt the traffic, meaning it cannot inspect the file content for viruses, resulting in the file being downloaded without detection.
NEW QUESTION # 23
What are two features of FortiGate FSSO agentless polling mode? (Choose two.)
- A. FortiGate uses the AD server as the collector agent.
- B. FortiGate does not support workstation check.
- C. FortiGate uses the SMB protocol to read the event viewer logs from the DCs.
- D. FortiGate directs the collector agent to use a remote LDAP server.
Answer: B,C
Explanation:
FortiGate uses the SMB protocol to read the event viewer logs from the DCs.
In agentless polling mode, FortiGate directly connects to the Domain Controllers (DCs) using the SMB protocol to read event logs and detect user login events.
FortiGate does not support workstation check.
In agentless polling mode, FortiGate does not perform workstation checks. It relies on polling the event logs from the Domain Controllers to identify user logins.
NEW QUESTION # 24
Which two statements describe how the RPF check is used? (Choose two.)
- A. The RPF check is run on the first sent packet of any new session.
- B. The RPF check is run on the first reply packet of any new session.
- C. The RPF check is run on the first sent and reply packet of any new session.
- D. The RPF check is a mechanism that protects FortiGateand the network from IP spoofingattacks.
Answer: A,D
NEW QUESTION # 25
Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)
- A. FortiAnalyzer
- B. FortiCloud
- C. FortiCache
- D. FortiSandbox
- E. FortiSIEM
Answer: A,B,E
Explanation:
B: FortiCloud
C: FortiSIEM
E: FortiAnalyzer
NEW QUESTION # 26
Which three strategies are valid SD-WAN rule strategies for member selection? (Choose three.)
- A. Lowest Quality (SLA) with load balancing
- B. Lowest Cost (SLA) with load balancing
- C. Best Quality with load balancing
- D. Lowest Cost (SLA) without load balancing
- E. Manual with load balancing
Answer: B,C,E
Explanation:
FortiGate's SD-WAN rule strategies for member selection include the following:
* Manual with load balancing: This strategy allows an administrator to manually configure which SD- WAN member interfaces to use for specific traffic.
* Lowest Cost (SLA) with load balancing: This strategy prioritizes the link with the lowest cost that meets the SLA requirements.
* Best Quality with load balancing: This strategy selects the link with the best performance metrics, such as latency, jitter, or packet loss.
Options D and E are incorrect because "Lowest Quality" is not a valid strategy, and "Lowest Cost without load balancing" contradicts the requirement for load balancing in the strategy name.
References:
* FortiOS 7.4.1 Administration Guide: SD-WAN Rule Strategies
NEW QUESTION # 27
An administrator needs to create a tunnel mode SSL-VPN to access an internal web server from the Internet. The web server is connected to port1. The Internet is connected to port2. Both interfaces belong to the VDOM named Corporation.
What interface must be used as the source for the firewall policy that will allow this traffic?
- A. ssl.Corporation
- B. port2
- C. port1
- D. ssl.root
Answer: A
Explanation:
ssl.Corporation
If you are working within a specific VDOM named "Corporation," and the SSL VPN is associated with that VDOM, then the correct choice is:
B. ssl.Corporation
Using the "ssl.Corporation" interface as the source for the firewall policy makes sense in the context of a VDOM-specific SSL VPN.
NEW QUESTION # 28
Refer to the exhibits.
The exhibits contain a network diagram, and virtual IP, IP pool, and firewall policies configuration information.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
The first firewall policy has NAT enabled using IP pool.
The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT (SNAT) the internet traffic coming from a workstation with the IP address 10.0.1.10?
- A. 10.200.1.1
- B. 10.0.1.254
- C. 10.200.1.100
- D. 10.200.1.10
Answer: C
Explanation:
From LAN to WAN, the Source NAT will use the IPPOOL with address configured 10.200.1.100 Destination NAT, from WAN to LAN, will use the VIP The question says SNAT, so the only correct answer here (looking at the IP Pool) is D.
(Step 2): FortiGate uses as NAT IP the external IP address defined in the VIP when performing SNAT on all egress traffic sourced from the mapped address in the VIP, provided the matching firewall policy has NAT enabled.
Note that you can override the behavior described in step 2 by using an IP pool.
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD44529
NEW QUESTION # 29
Refer to the exhibits, which show a diagram of a FortiGate device connected to the network. VIP object configuration, and the firewall policy configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IP address 10.0.1.254/24.
If the host 10.200.3.1 sends a TCP SYN packet on port 8080 to 10.200.1.10, what will the source address, destination address, and destination port of the packet be at the time FortiGate forwards the packet to the destination?
- A. 10.200.3.1, 10.0.1.10, and 8080, respectively
- B. 10.0.1.254, 10.200.1.10, and 8080, respectively
- C. 10.0.1.254, 10.0.1.10, and 80, respectively
- D. 10.200.3.1, 10.0.1.10, and 80, respectively
Answer: D
Explanation:
The source address remains 10.200.3.1 because FortiGate does not modify the source address by default unless NAT is applied (which is disabled in the policy).
The destination address is translated to 10.0.1.10 by the VIP (Virtual IP) object, as this is the internal server address mapped to the external IP 10.200.1.10.
The destination port is translated from 8080 to 80 as per the port forwarding rule configured in the VIP object.
NEW QUESTION # 30
What are three key routing principles in SD-WAN? (Choose three.)
- A. By default. SD-WAN rules are skipped if only one route to the destination is available
- B. Regular policy routes have precedence over SD-WAN rules
- C. SD-WAN rules have precedence over any other type of routes
- D. By default. SD-WAN members are skipped if they do not have a valid route to the destination
- E. By default. SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member
Answer: C,D,E
Explanation:
By default, SD-WAN members are skipped if they do not have a valid route to the destination SD-WAN ensures that only members with valid routes to the destination are considered during routing decisions.
By default, SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member If the best route is not an SD-WAN member, SD-WAN rules are bypassed and standard routing takes over.
SD-WAN rules have precedence over any other type of routes
SD-WAN rules are evaluated first, meaning they take precedence over other routing mechanisms, such as static routes or policy-based routes.
NEW QUESTION # 31
Refer to the exhibits.
The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.
The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IPaddress
10.0.1.254/24.
Which IP address will be used to source NAT (SNAT) the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?
- A. 10.200.1.99
- B. 10.200.1.49
- C. 10.200.1.1
- D. 10.200.1.149
Answer: A
Explanation:
The traffic from the user on Local-Client (10.0.1.10) pinging the IP address of Remote-FortiGate (10.200.3.1) will match the firewall policy with the service "PING traffic". According to the firewall policy:
* Policy ID 6 is set for PING traffic and uses the NAT IP pool "SNAT-Remote1", which is defined as
10.200.1.99.
NEW QUESTION # 32
Refer to the exhibit.
Review the intrusion prevention system (IPS) profile signature settings shown in the exhibit.
What do you conclude when adding theFTP.Login.Failedsignature to the IPS sensor profile?
- A. The signature setting includes a group of other signatures.
- B. Traffic matching the signature will be silently dropped and logged.
- C. Traffic matching the signature will be allowed and logged.
- D. The signature setting uses a custom rating threshold.
Answer: B
NEW QUESTION # 33
What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?
- A. FortiGate automatically negotiates a new security association after the existing security association expires.
- B. FortiGate automatically negotiates different encryption and authentication algorithms with the remote peer.
- C. FortiGate automatically negotiates different local and remote addresses with the remote peer.
- D. FortiGate automatically brings up the IPsec tunnel and keeps it up, regardless of activity on the IPsec tunnel.
Answer: D
Explanation:
When IPsec SAs expire, FortiGate needs to negotiate new SAs to continue sending and receiving traffic over the IPsec tunnel. Technically, FortiGate deletes the expired SAs from the respective phase 2 selectors, and installs new ones. If IPsec SA renegotiation takes too much time, then FortiGate might drop interesting traffic because of the absence of active SAs. To prevent this, you can enable Auto- negotiate. When you do this, FortiGate not only negotiates new SAs before the current SAs expire, but it also starts using the new SAs right away. The latter prevents traffic disruption by IPsec SA renegotiation.
Enable auto-negotiate by default enabling auto-keep-alive too which brings up tunnel automatically.
Answer B is little bit tricky, auto-negotiate will negotiate new SA "before" existing SA expired not "after" existing SA expired.
NEW QUESTION # 34
Refer to the exhibits.
The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.
The WAN (port1) interface has the IP address10.200.1.1/24. The LAN (port3) interface has the IPaddress10.
0.1.254/24.
Which IP address will be used to source NAT (SNAT) the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?
- A. 10.200.1.99
- B. 10.200.1.49
- C. 10.200.1.1
- D. 10.200.1.149
Answer: B
NEW QUESTION # 35
An administrator needs to increase network bandwidth and provide redundancy.
What interface type must the administrator select to bind multiple FortiGate interfaces?
- A. Redundant interface
- B. Aggregate interface
- C. VLAN interface
- D. Software Switch interface
Answer: B
Explanation:
Link aggregation (IEEE 802.3ad) enables you to bind two or more physical interfaces together to form an aggregated (combined) link. This new link has the bandwidth of all the links combined. If a link in the group fails, traffic is transferred automatically to the remaining interfaces with the only noticeable effect being a reduced bandwidth.
To increase network bandwidth and provide redundancy, an administrator can use an Aggregate Interface (also known as Link Aggregation or Port Channel). This interface type allows multiple physical interfaces to be combined into a single logical interface, providing increased bandwidth and fault tolerance. This logical interface appears as a single interface to the rest of the network, and it distributes traffic across the member interfaces.
NEW QUESTION # 36
A network administrator is configuring an IPsec VPN tunnel for a sales employee travelling abroad.
Which IPsec Wizard template must the administrator apply?
- A. Site to Site
- B. iHub-and-Spoke
- C. Dial up User
- D. Remote Access
Answer: D
NEW QUESTION # 37
Refer to the exhibits.
Exhibit A shows system performance output.
Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds.
Based on the system performance output, which two results are correct? (Choose two.)
- A. FortiGate will start sending all files to FortiSandbox for inspection.
- B. FortiGate has entered conserve mode.
- C. Administrators cannot change the configuration.
- D. Administrators can access FortiGate only through the console port.
Answer: B,C
Explanation:
What actions does FortiGate take to preserve memory while in conserve mode?
* FortiGate does not accept configuration changes, because they might increase memory usage.
* FortiGate does not run any quarantine action, including forwarding suspicious files to FortiSandbox.
* You can configure the fail-open setting under config ips global to control how the IPS engine behaves when the IPS socket buffer is full.
Based on the system performance output, it appears that FortiGate has entered conserve mode and administrators cannot change the configuration.
FortiGate has entered conserve mode: When FortiGate enters conserve mode, it reduces its operational capacity in order to conserve resources and improve performance. This may be necessary if the system is experiencing high levels of traffic or if there are issues with resource utilization.
Administrators cannot change the configuration: When the system is in conserve mode, administrators may not be able to change the configuration. This is because the system is prioritizing resource conservation over other activities, and making changes to the configuration may require additional resources that are not available.
It is important to note that FortiGate will not start sending all files to FortiSandbox for inspection, and administrators may still be able to access FortiGate through other means besides the console port. "If memory usage goes above the percentage of total RAM defined as the red threshold, FortiGate enters conserve mode."
"FortiGate does not accept configuration changes, because they might increase memory usage." Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-conserve-mode-is- triggered/ta-p/198580
NEW QUESTION # 38
Refer to the exhibit.
Which two statements are true about the routing entries in this database table? (Choose two.)
- A. The default route on porc2 is marked as the standby route.
- B. All of the entries in the routing database table are installed in the FortiGate routing table.
- C. Both default routes have different administrative distances.
- D. The port2 interface is marked as inactive.
Answer: A,C
Explanation:
The routing table in the exhibit shows two default routes (0.0.0.0/0) with different administrative distances:
* The default route through port2 has an administrative distance of 20.
* The default route through port1 has an administrative distance of 10.
Administrative distance determines the priority of the route; a lower value is preferred. Here, the route through port1 with an administrative distance of 10 is the preferred route. The route through port2 with an administrative distance of 20 acts as a standby or backup route. If the primary route (port1) fails or is unavailable, traffic will then be routed through port2.
Regarding the statement that the port2 interface is marked as inactive, there is no indication in the routing table that port2 is inactive. Similarly, all the routes displayed are not necessarily installed in the FortiGate routing table, as the table could include both active and backup routes.
References:
* FortiOS 7.4.1 Administration Guide: Default route configuration
* FortiOS 7.4.1 Administration Guide: Routing table explanation
NEW QUESTION # 39
Examine the two static routes shown in the exhibit, then answer the following question.
Which of the following is the expected FortiGate behavior regarding these two routes to the same destination?
- A. FortiGate will route twice as much traffic to the port2 route
- B. FortiGate will load balance all traffic across both routes.
- C. FortiGate will only actuate the port1 route in the routing table
- D. FortiGate will use the port1 route as the primary candidate.
Answer: D
Explanation:
B. FortiGate will use the port1 route as the primary candidate.
FortiGate will use the port1 route as the primary candidate. It has better priority.
NEW QUESTION # 40
Refer to the exhibit.
Based on the routing database shown in the exhibit which two conclusions can you make about the routes? (Choose two.)
- A. The port3 default route has the highest distance
- B. There will be eight routes active in the routing table
- C. The port1 and port2 default routes are active in the routing table
- D. The port3 default route has the lowest metric
Answer: A,C
Explanation:
The port1 and port2 default routes are active in the routing table
The routes with 0.0.0.0/0 for both port1 and port2 are marked with an asterisk * and > symbol, which indicates that these routes are active and selected in the routing table.
The port3 default route has the highest distance
The route via port3 has a distance of [20/0], which is higher than the distances for the routes via port1 [10/0] and port2 [30/0]. This indicates that the port3 default route has the highest distance.
NEW QUESTION # 41
FortiGate is integrated with FortiAnalyzer and FortiManager.
When a firewall policy is created, which attribute is added to the policy to improve functionality and to support recording logs to FortiAnalyzer or FortiManager?
- A. Policy ID
- B. Log ID
- C. Universally Unique Identifier
- D. (Sequence ID
Answer: C
NEW QUESTION # 42
An administrator is configuring an IPsec VPN between site A and site B. The Remote Gateway setting in both sites has been configured as Static IP Address.
For site A, the local quick mode selector is 192.168.1.0/24 and the remote quick mode selector is 192.168.2.0/24.
Which subnet must the administrator configure for the local quick mode selector for site B?
- A. 192.168.0.0/8
- B. 192.168.2.0/24
- C. 192.168.3.0/24
- D. 192.168.1.0/24
Answer: D
Explanation:
For site B, the local quick mode selector should match the remote quick mode selector of site A, and vice versa. Since site A's remote quick mode selector is 192.168.2.0/24 (which is the subnet of site B), site B's local quick mode selector must be 192.168.1.0/24, which is the subnet of site A.
NEW QUESTION # 43
......
Fortinet FCP_FGT_AD-7.4 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
Updated Test Engine to Practice FCP_FGT_AD-7.4 Dumps & Practice Exam: https://www.actual4dumps.com/FCP_FGT_AD-7.4-study-material.html
Pass Fortinet FCP_FGT_AD-7.4 PDF Dumps Recently Updated 90 Questions: https://drive.google.com/open?id=1uQSGv-JjBnvZhpZzpL6tDi8azfwdx-6a