FCP_FGT_AD-7.4 Free Exam Questions & Answers PDF Updated on Mar-2025 [Q35-Q51]

March 13, 2025 admin 0

Categories : FCP_FGT_AD-7.4 , Fortinet

Rate this post

FCP_FGT_AD-7.4 Free Exam Questions and Answers PDF Updated on Mar-2025

Latest FCP_FGT_AD-7.4 Exam Dumps Recently Updated 90 Questions

QUESTION 35
Which of the following statements correctly describes FortiGates route lookup behavior when searching for a suitable gateway? (Choose two)

Lookup is done on the first packet from the session originator

Lookup is done on the last packet sent from the responder

Lookup is done on every packet, regardless of direction

Lookup is done on the first reply packet from the responder

FortiGate performs route lookup based on the trust packet. The trust packet is the first packet of the session that is sent by the session originator.
This is the packet that initiates the communication. The route lookup is also done on the trust reply packet, which is the first reply packet received from the responder.
In summary, FortiGate looks at the initial packet from the session originator and the first reply packet from the responder when performing route lookup to determine the suitable gateway.

QUESTION 36
FortiGate is configured for firewall authentication. When attempting to access an external website, the user is not presented with a login prompt.
What is the most likely reason for this situation?

No matching user account exists for this user.

The user is using a guest account profile.

The user was authenticated using passive authentication.

The user is using a super admin account.

The most likely reason for a user not being presented with a login prompt when attempting to access an external website in a FortiGate firewall authentication scenario is:
C. The user was authenticated using passive authentication.
Passive authentication allows the FortiGate to authenticate users transparently without presenting them with a login prompt. This often involves the use of authentication methods such as Captive Portal or single sign-on (SSO) techniques where users are authenticated based on their network activity without actively entering credentials.
Options A, B, and D are less likely to cause the absence of a login prompt in this context: A is less likely because if there was no matching user account, it would typically result in an authentication prompt.
B is less likely unless the guest account profile specifically has a passive authentication mechanism.
D is less likely because super admin accounts are typically not subject to transparent or passive authentication mechanisms.
So, the most likely reason is C.

QUESTION 37
Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)

Firewall policy

Policy rule

Security policy

SSL inspection and authentication policy

NGFW policy based mode, you must configure a few policies to allow traffic:
SSL inspection & Authentication, Security policy.
Security policies work with SSL Inspection & Authentication policies to inspect traffic. To allow traffic from a specific user or user group, both Security and SSL Inspection & Authentication policies must be configured.
If you are using Policy Based Mode, SSL Inspection & Authentication (consolidated) and Security Policy are required to allow traffic.

QUESTION 38
Which method allows management access to the FortiGate CLI without network connectivity?

SSH console

CLI console widget

Serial console

Telnet console

The serial console method allows management access to the FortiGate CLI without relying on network connectivity. This method involves directly connecting a computer to the FortiGate device using a serial cable (such as a DB-9 to RJ-45 cable or USB to RJ-45 cable) and using terminal emulation software to interact with the FortiGate CLI. This method is essential for situations where network-based access methods (such as SSH or Telnet) are not available or feasible.
References:
* FortiOS 7.4.1 Administration Guide: Console connection

QUESTION 39
Refer to the web filter raw logs.

Based on the raw logs shown in the exhibit, which statement is correct?

Access to the social networking web filter category was explicitly blocked to all users.

The action on firewall policy ID 1 is set to warning.

Social networking web filter category is configured with the action set to authenticate.

The name of the firewall policy is all_users_web.

C is correct. We have two logs, first with action deny and second with passthrough.
A incorrect – second log shows: action=”passthrough”.
B incorrect – Firewall action can be allow or deny.
D incorrect – CLI don’t show policy name, only ID.
Remember … action=”passthrough” mean that authentication has occurred/ At first attempt from the same IP source connection is blocked, but a warning message is displayed. At the second attempt with the same IP source connection passtrough, so considering the first block and the second pass, the user must authenticate to be granted with access.

QUESTION 40
Refer to the exhibits.
Exhibit A.

Exhibit B.

An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).
What must the administrator do to synchronize the address object?

Change the csf setting on Local-FortiGate (root) to set configuration-sync local.

Change the csf setting on ISFW (downstream) to set configuration-sync local.

Change the csf setting on Local-FortiGate (root) to set fabric-object-unification default.

Change the csf setting on ISFW (downstream) to set fabric-object-unification default.

Change the csf setting on Local-FortiGate (root) to set fabric-object-unification default.
The CLI command set fabric-object-unification is only available on the root FortiGate. When set to local, global objects will not be synchronized to downstream devices in the Security Fabric. The default value is default.
Option A will not synchronise global fabric objects downstream.

QUESTION 41
View the exhibit.

Which two behaviors result from this full (deep) SSL configuration? (Choose two.)

The browser bypasses all certificate warnings and allows the connection.

A temporary trusted FortiGate certificate replaces the server certificate, even when the server certificate is untrusted.

A temporary trusted FortiGate certificate replaces the server certificate when the server certificate is trusted.

A temporary untrusted FortiGate certificate replaces the server certificate when the server certificate is untrusted.

C. A temporary trusted FortiGate certificate replaces the server certificate when the server certificate is trusted.
D. A temporary untrusted FortiGate certificate replaces the server certificate when the server certificate is untrusted.
In a full (deep) SSL configuration, a temporary untrusted FortiGate certificate replaces the server certificate when the server certificate is untrusted, and a temporary trusted FortiGate certificate replaces the server certificate when the server certificate is trusted.
The behavior that results from this full (deep) SSL configuration is that a temporary untrusted FortiGate certificate replaces the server certificate when the server certificate is untrusted. Additionally, a temporary trusted FortiGate certificate replaces the server certificate when the server certificate is trusted.

QUESTION 42
Refer to the exhibit, which shows the IPS sensor configuration.

If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

The sensor will gather a packet log for all matched traffic.

The sensor will reset all connections that match these signatures.

The sensor will allow attackers matchingthe Microsoft.Windows.iSCSl.Target.DoS signature.

The sensor will block all attacks aimed at Windows servers.

QUESTION 43
Refer to the exhibit.

Which statement about the configuration settings is true?

When a remote user accesses http://10.200.1.1:443, the SSL-VPN login page opens.

When a remote user accesses https://10.200.1.1:443, the SSL-VPN login page opens.

When a remote user accesses https://10.200.1.1:443, the FortiGate login page opens.

The settings are invalid. The administrator settings and the SSL-VPN settings cannot use the same port.

B. When a remote user accesses https://10.200.1.1:443, the SSL-VPN login page opens.
In this scenario, the remote user is accessing the FortiGate device using HTTPS (port 443), which is typically used for SSL-VPN access. Therefore, when accessing the device at that address and port, the SSL-VPN login page should open for the user to authenticate and establish a VPN connection.

QUESTION 44
An administrator manages a FortiGate model that supports NTurbo.
How does NTurbo enhance performance for flow-based inspection?

NTurbo offloads traffic to the content processor.

NTurbo creates two inspection sessions on the FortiGate device.

NTurbo buffers the whole file and then sends it to the antivirus engine.

NTurbo creates a special data path to redirect traffic between the IPS engine its ingress and egress interfaces.

QUESTION 45
Which CLI command allows administrators to troubleshoot Layer 2 issues, such as an IP address conflict?

get system status

diagnose sys top

get system performance status

get system arp

D. get system arp
The get system arp command allows administrators to view the ARP (Address Resolution Protocol) table on the FortiGate unit. This table maps IP addresses to MAC addresses and can be used to troubleshoot Layer 2 issues, such as an IP address conflict, by checking for duplicate IP addresses or incorrect MAC address mappings.
If you suspect that there is an IP address conflict, or that an IP has been assigned to the wrong device, you may need to look at the ARP table. The get system arp command is used for that purpose.

QUESTION 46
A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
All traffic must be routed through the primary tunnel when both tunnels are up. The secondary tunnel must be used only if the primary tunnel goes down. In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover.
Which two key configuration changes must the administrator make on FortiGate to meet the requirements? (Choose two.)

Configure a higher distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.

Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.

Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.

Enable Dead Peer Detection.

To set up redundant IPsec VPN tunnels on FortiGate and meet the specified requirements, the administrator should make the following key configuration changes:
B: Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
By configuring a lower administrative distance for the static route of the primary tunnel, the FortiGate will prefer this route when both tunnels are up. If the primary tunnel goes down, the higher administrative distance on the static route for the secondary tunnel will cause the FortiGate to use the secondary tunnel.
D: Enable Dead Peer Detection.
Dead Peer Detection (DPD) should be enabled to detect the status of the VPN tunnels. If the FortiGate detects that the primary tunnel is no longer responsive (dead), it can trigger the failover to the secondary tunnel, ensuring a faster tunnel failover.
So, the correct choices are B and D.

QUESTION 47
Which three statements explain a flow-based antivirus profile? (Choose three.)

Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.

If a virus is detected, the last packet is delivered to the client.

The IPS engine handles the process as a standalone.

FortiGate buffers the whole file but transmits to the client at the same time.

Flow-based inspection optimizes performance compared to proxy-based inspection.

A: Flow-based inspection mode uses a hybrid of the scanning modes available in proxy-based inspection.
D: the IPS engine reads the payload of each packet, caches a local copy, and forwards the packet to the receiver at the same time. some operations can be offloaded to SPUs to improve performance (not C).
E: If performance is your top priority, then flow inspection mode is more appropriate. Extra explanation:
A. Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.
Flow-based inspection combines aspects of both proxy-based and flow-based inspection methods to optimize performance and scanning effectiveness.
D. FortiGate buffers the whole file but transmits to the client at the same time.
In flow-based inspection, FortiGate buffers the entire file for scanning before transmitting it to the client.
This allows for comprehensive scanning without delaying the transmission to the client.
E. Flow-based inspection optimizes performance compared to proxy-based inspection.
Flow-based inspection is generally more efficient than proxy-based inspection, especially in high-traffic environments, as it does not require the buffering of entire files before delivery.

QUESTION 48
Refer to the exhibit, which shows a partial configuration from the remote authentication server.

Why does the FortiGate administrator need this configuration?

To authenticate only the Training user group.

To set up a RADIUS server Secret

To authenticate and match the Training OU on the RADIUS server.

To authenticate Any FortiGate user groups.

The configuration shown in the exhibit indicates that the FortiGate is using a Fortinet-specific RADIUS attribute (Fortinet-Group-Name) with the value “Training.” This setup allows the FortiGate to authenticate users against the RADIUS server and match them to the “Training” Organizational Unit (OU). By doing so, only users within this specific group or OU can be authenticated and allowed access through the FortiGate.
References:
* FortiOS 7.4.1 Administration Guide: RADIUS Server Configuration

QUESTION 49
An administrator wants to block https://www.example.com/videos and allow all other URLs on the website.
What are two configuration changes that the administrator can make to satisfy the requirement? (Choose two.)

Configure web override for the URL and select a blocked FortiGuard subcategory

Enable full SSL inspection

Configure a video filter profile to block the URL

Configure a static URL filter entry for the URL and select Block as the action

If the goal is to block the specific URL https://www.example.com/videos and allow all other URLs on the website, the correct configuration changes are:
B. Enable full SSL inspection.
Enabling full SSL inspection allows the FortiGate to inspect and filter HTTPS traffic, including the specific URL https://www.example.com/videos.
D. Configure a static URL filter entry for the URL and select Block as the action.
Create a static URL filter entry for the specific URL https://www.example.com/videos and set the action to Block. This will block access to the specified URL.
Enabling full SSL inspection is necessary to inspect and filter HTTPS traffic effectively, including the specific URL within the encrypted traffic.
So, the correct choices are B and D.

QUESTION 50
An administrator does not want to report the login events of service accounts to FortiGate.
What setting on the collector agent is required to achieve this?

Add the support of NTLM authentication

Add user accounts to the FortiGate group filter

Add user accounts to Active Directory (AD)

Add user accounts to the Ignore User List

D. Add user accounts to the Ignore User List
To achieve this, the administrator should add the service accounts to the Ignore User List on the collector agent. This will prevent the login events of these accounts from being reported to FortiGate.
To prevent the reporting of login events of service accounts to FortiGate using the collector agent, the appropriate setting is:
D. Add user accounts to the Ignore User List.
By adding the service accounts to the Ignore User List, you instruct the collector agent to exclude these accounts from reporting login events to FortiGate. This way, events related to the specified users will not be forwarded or logged.

QUESTION 51
How do you format the FortiGate flash disk?

Load the hardware test (HQIP) image.

Select the format boot device option from the BIOS menu.

Load a debug FortiOS image.

Execute the CLI command execute formatlogdisk.

Select the format boot device option from the BIOS menu.
Selecting the format boot device option from the BIOS menu allows you to format the FortiGate flash disk. This option is typically used when you need to reformat the flash disk to resolve issues or prepare it for a fresh installation of the operating system. However, it’s important to note that formatting the flash disk will erase all data on it, so it should be done carefully.
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD46582
https://kb.fortinet.com/kb/viewContent.do?externalId=10338

Loading …

Fortinet FCP_FGT_AD-7.4 Exam Syllabus Topics:

Topic	Details
Topic 1	Deployment and System Configuration: This section covers how to set up initial configurations, implement Fortinet Security Fabric, and configure an FGCP HA cluster; diagnose resources and connectivity.
Topic 2	Routing: This section covers how to set up packet routing with static routes and configure SD-WAN for efficient traffic load balancing.
Topic 3	VPN: In this section, the focus is on how to configure SSL VPNs for secure network access and implement meshed or redundant IPsec VPNs.
Topic 4	Content Inspection: This section covers how to inspect encrypted traffic, configure inspection modes, apply web filtering, manage applications, set antivirus modes, and implement IPS for security.
Topic 5	Firewall Policies and Authentication: This topic covers how to set firewall policies, configure SNAT DNAT, implement authentication methods, and deploy FSSO.