[Jan 10, 2025] FCP_FGT_AD-7.4 Exam Brain Dumps – Study Notes and Theory [Q14-Q34]

4/5 - (1 vote)

[Jan 10, 2025] FCP_FGT_AD-7.4 Exam Brain Dumps – Study Notes and Theory

Pass Fortinet FCP_FGT_AD-7.4 Test Practice Test Questions Exam Dumps

Fortinet FCP_FGT_AD-7.4 Exam Syllabus Topics:

Topic	Details
Topic 1	Content Inspection: This section covers how to inspect encrypted traffic, configure inspection modes, apply web filtering, manage applications, set antivirus modes, and implement IPS for security.
Topic 2	Firewall Policies and Authentication: This topic covers how to set firewall policies, configure SNAT DNAT, implement authentication methods, and deploy FSSO.
Topic 3	Deployment and System Configuration: This section covers how to set up initial configurations, implement Fortinet Security Fabric, and configure an FGCP HA cluster; diagnose resources and connectivity.
Topic 4	Routing: This section covers how to set up packet routing with static routes and configure SD-WAN for efficient traffic load balancing.
Topic 5	VPN: In this section, the focus is on how to configure SSL VPNs for secure network access and implement meshed or redundant IPsec VPNs.

QUESTION 14
An administrator manages a FortiGate model that supports NTurbo.
How does NTurbo enhance performance for flow-based inspection?

NTurbo offloads traffic to the content processor.

NTurbo creates two inspection sessions on the FortiGate device.

NTurbo buffers the whole file and then sends it to the antivirus engine.

NTurbo creates a special data path to redirect traffic between the IPS engine its ingress and egress interfaces.

QUESTION 15
Refer to the exhibits.
Exhibit A shows system performance output.

Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds.

Based on the system performance output, which two results are correct? (Choose two.)

FortiGate will start sending all files to FortiSandbox for inspection.

FortiGate has entered conserve mode.

Administrators cannot change the configuration.

Administrators can access FortiGate only through the console port.

QUESTION 16
Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)

FortiSIEM

FortiCloud

FortiCache

FortiSandbox

FortiAnalyzer

QUESTION 17
Refer to the exhibit, which contains a session diagnostic output.

Which statement is true about the session diagnostic output?

The session is in TCP ESTABLISHED state.

The session is a bidirectional UDP connection.

The session is a UDP unidirectional state.

The session is a bidirectional TCP connection.

QUESTION 18
Refer to the exhibits.

The exhibits show the application sensor configuration and the Excessive-Bandwidth and Apple filter details.
Based on the configuration, what will happen to Apple FaceTime if there are only a few calls originating or incoming?

Apple FaceTime will be allowed, based on the Video/Audio category configuration.

Apple FaceTime will be allowed, based on the Apple filter configuration.

Apple FaceTime will be allowed only if the Apple filter in Application and Filter Overrides is set to Allow.

Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.

QUESTION 19
Which statement is correct regarding the use of application control for inspecting web applications?

Application control can identify child and parent applications, and perform different actions on them.

Application control signatures are organized in a nonhierarchical structure.

Application control does not require SSL inspection to identify web applications.

Application control does not display a replacement message for a blocked web application.

QUESTION 20
Which three statements about security associations (SA) in IPsec are correct? (Choose three.)

Phase 2 SAs are used for encrypting and decrypting the data exchanged through the tunnel.

An SA never expires.

A phase 1 SA is bidirectional, while a phase 2 SA is directional.

Phase 2 SA expiration can be time-based, volume-based, or both.

Both the phase 1 SA and phase 2 SA are bidirectional.

QUESTION 21
Refer to the exhibit.

The exhibit contains a network diagram, central SNAT policy, and IP pool configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
A firewall policy is configured to allow to destinations from LAN (port3) to WAN (port1).
Central NAT is enabled, so NAT settings from matching Central SNAT policies will be applied.
Which IP address will be used to source NAT the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?

10.200.1.149

10.200.1.1

10.200.1.49

10.200.1.99

QUESTION 22
Refer to the exhibit, which shows an SD-WAN zone configuration on the FortiGate GUI.

Based on the exhibit, which statement is true?

The underlay zone contains port1 and

The d-wan zone contains no member.

The d-wan zone cannot be deleted.

The virtual-wan-link zone contains no member.

QUESTION 23
Refer to the exhibit.

Which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules?

All traffic from a source IP to a destination IP is sent to the same interface.

Traffic is sent to the link with the lowest latency.

Traffic is distributed based on the number of sessions through each interface.

All traffic from a source IP is sent to the same interface

QUESTION 24
Which three criteria can FortiGate use to look for a matching firewall policy to process traffic?
(Choose three.)

Services defined in the firewall policy

Highest to lowest priority defined in the firewall policy

Destination defined as Internet Services in the firewall policy

Lowest to highest policy ID number

Source defined as Internet Services in the firewall policy

QUESTION 25
An administrator has configured the following settings:

What are the two results of this configuration? (Choose two.)

Device detection on all interfaces is enforced for 30 minutes

Denied users are blocked for 30 minutes

A session for denied traffic is created

The number of logs generated by denied traffic is reduced

QUESTION 26
FortiGate is operating in NAT mode and has two physical interfaces connected to the LAN and DMZ networks respectively.
Which two statements are true about the requirements of connected physical interfaces on FortiGate? (Choose two.)

Both interfaces must have DHCP enabled

Both interfaces must have IP addresses assigned

Both interfaces must have the interface role assigned

Both interfaces must have directly connected routes on the routing table

QUESTION 27
Refer to the exhibit.

Examine the intrusion prevention system (IPS) diagnostic command.
Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?

The IPS engine was inspecting high volume of traffic.

The IPS engine was unable to prevent an intrusion attack.

The IPS engine was blocking all traffic.

The IPS engine will continue to run in a normal state.

QUESTION 28
Refer to the exhibits.

The exhibits show a diagram of a FortiGate device connected to the network, as well as the firewall policy and IP pool configuration on the FortiGate device.
Two PCs, PC1 and PC2, are connected behind FortiGate and can access the internet successfully. However, when the administrator adds a third PC to the network (PC3), the PC cannot connect to the internet.
Based on the information shown in the exhibit, which two configuration options can the administrator use to fix the connectivity issue for PC3? (Choose two.)

In the firewall policy configuration, add 10. o. l. 3 as an address object in the source field.

In the IP pool configuration, set endig to 192.2.0.12.

Configure another firewall policy that matches only the address of PC3 as source, and then place the policy on top of the list.

In the IP pool configuration, set cype to overload.

QUESTION 29
Refer to the exhibit.

The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile.
An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category.
What are two solutions for satisfying the requirement? (Choose two.)

Configure a separate firewall policy with action Deny and an FQDN address object for *. download, com as destination address.

Set the Freeware and Software Downloads category Action to Warning

Configure a web override rating for download, com and select Malicious Websites as the subcategory.

Configure a static URL filter entry for download, com with Type and Action set to Wildcard and Block, respectively.

QUESTION 30
Examine this FortiGate configuration:

Examine the output of the following debug command:

Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?

It is allowed, but with no inspection

It is allowed and inspected as long as the inspection is flow based

It is dropped.

It is allowed and inspected, as long as the only inspection required is antivirus.

QUESTION 31
Refer to the exhibit.

The exhibit contains a network diagram, central SNAT policy, and IP pool configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
A firewall policy is configured to allow to destinations from LAN (port3) to WAN (port1).
Central NAT is enabled, so NAT settings from matching Central SNAT policies will be applied.
Which IP address will be used to source NAT the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?

10.200.1.149

10.200.1.1

10.200.1.49

10.200.1.99

QUESTION 32
Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)

Firewall policy

Policy rule

Security policy

SSL inspection and authentication policy

QUESTION 33
Refer to the exhibits.

The exhibits show a diagram of a FortiGate device connected to the network, and the firewall policies configuration VIP configuration and IP pool configuration on the FortiGate device The WAN (port1) interface has the IP address 10.200. l. 1/24 The LAN (port3) interface has the IP address
10.0.1.254/24
The first firewall policy has NAT enabled using the IP pool The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT (SNAT) the internet traffic coming from a workstation with the IP address 10.0.1.10?

10.200.1.1

10.200.1.10

10.0.1.254

10.200.1.100

QUESTION 34
An administrator does not want to report the login events of service accounts to FortiGate.
What setting on the collector agent is required to achieve this?

Add the support of NTLM authentication

Add user accounts to the FortiGate group filter

Add user accounts to Active Directory (AD)

Add user accounts to the Ignore User List