FCP_FGT_AD-7.4 Updated Exam Dumps [2025] Practice Valid Exam Dumps Question
FCP_FGT_AD-7.4 Sample with Accurate & Updated Questions
Fortinet FCP_FGT_AD-7.4 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 36
Refer to the exhibit.
Review the intrusion prevention system (IPS) profile signature settings shown in the exhibit.
What do you conclude when adding the FTP.Login.Failed signature to the IPS sensor profile?
- A. Traffic matching the signature will be silently dropped and logged.
- B. Traffic matching the signature will be allowed and logged.
- C. The signature setting includes a group of other signatures.
- D. The signature setting uses a custom rating threshold.
Answer: B
Explanation:
The exhibit shows that the "FTP.Login.Failed" IPS signature is set with the action "Pass" and packet logging enabled. This means that any traffic matching this signature will be allowed through the FortiGate, and the traffic details will be logged for monitoring and analysis purposes.
Reference:
FortiOS 7.4.1 Administration Guide: IPS Signature Actions
NEW QUESTION # 37
Refer to the exhibit.
The NOC team connects to the FortiGate GUI with the NOC_Access admin profile. They request that their GUI sessions do not disconnect too early during inactivity.
What must the administrator configure to answer this specific request from the NOC team?
- A. Increase the admintimeout value under config system accprofile super_admin.
- B. Enable the parameter Never Timeout in the admin profiles
- C. Increase the admintimeout value under config system global
- D. Increase the offline value of the Override idle Timeout parameter in the NOC_Access admin profile
Answer: C
Explanation:
To adjust the inactivity timeout for GUI sessions, the administrator should increase the admintimeout value in the global settings. This parameter controls how long an administrator's session can remain idle before it times out and disconnects. This is configured globally and affects all administrators, including those with the "NOC_Access" profile.
NEW QUESTION # 38
Which two settings must you configure when FortiGate is being deployed as a root FortiGate in a Security Fabric topology? (Choose two.)
- A. Fabric name
- B. FortiAnalyzer IP address
- C. FortiManager IP address
- D. Pre-authorize downstream FortiGate devices
Answer: A,B
Explanation:
The correct choices for settings to configure when FortiGate is being deployed as a root FortiGate in a Security Fabric topology are:
B. FortiAnalyzer IP address - This setting is required to send logs and reports to the FortiAnalyzer for analysis and storage.
D. Fabric name - This setting is essential to identify the Security Fabric and differentiate it from other fabrics in the network.
NEW QUESTION # 39
Which two statements about incoming and outgoing interfaces in firewall policies are true? (Choose two.)
- A. A zone can be chosen as the outgoing interface.
- B. An incoming interface is mandatory in a firewall policy, but an outgoing interface is optional.
- C. Multiple interfaces can be selected as incoming and outgoing interfaces.
- D. Only the "any" interface can be chosen as an incoming interface.
Answer: A,C
Explanation:
C. Multiple interfaces can be selected as incoming and outgoing interfaces.
This statement is correct. You can specify multiple interfaces as both incoming and outgoing interfaces in a firewall policy.
D. A zone can be chosen as the outgoing interface.
This statement is correct as well. In FortiGate firewalls, you can choose a zone as the outgoing interface in a firewall policy, providing a convenient way to apply policies to multiple physical or logical interfaces grouped under the same zone.
So, the correct choices are C and D.
NEW QUESTION # 40
Which two statements are true about the FGCP protocol? (Choose two.)
- A. Elects the primary FortiGate device
- B. Runs only over the heartbeat links
- C. Not used when FortiGate is in Transparent mode
- D. Is used to discover FortiGate devices in different HA groups
Answer: A,B
Explanation:
C: Runs only over the heartbeat links: FGCP utilizes heartbeat links for exchanging heartbeat packets to monitor the health of the cluster. While heartbeat links play a crucial role, other interfaces can also be used for synchronization and communication within the cluster.
D: Elects the primary FortiGate device: FGCP is responsible for the election of the primary FortiGate device in a high availability (HA) cluster. The primary FortiGate manages the traffic while the secondary FortiGate stays in standby mode.
NEW QUESTION # 41
Which two settings are required for SSL VPN to function between two FortiGate devices? (Choose two.)
- A. The server FortiGate requires a CA certificate to verify the client FortiGate certificate.
- B. The client FortiGate requires a manually added route to remote subnets.
- C. The client FortiGate requires a client certificate signed by the CA on the server FortiGate.
- D. The client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN.
Answer: A,C
Explanation:
For SSL VPN to function correctly between two FortiGate devices, the following settings are required:
* B. The server FortiGate requires a CA certificate to verify the client FortiGate certificate: The server FortiGate must have a Certificate Authority (CA) certificate installed to authenticate and verify the certificate presented by the client FortiGate device.
* C. The client FortiGate requires a client certificate signed by the CA on the server FortiGate: The client FortiGate must have a client certificate that is signed by the same CA that the server FortiGate uses for verification. This ensures a secure SSL VPN connection between the two devices.
The other options are not directly necessary for establishing SSL VPN:
* A. The client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN: This is incorrect as SSL VPN does not require a specific tunnel interface type; it typically uses an SSL VPN client profile.
* D. The client FortiGate requires a manually added route to remote subnets: While routing may be necessary, it is not specifically required for the SSL VPN functionality between two FortiGates.
References
* FortiOS 7.4.1 Administration Guide - Configuring SSL VPN, page 1203.
* FortiOS 7.4.1 Administration Guide - SSL VPN Authentication, page 1210.
NEW QUESTION # 42
Refer to the exhibit.
The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile.
An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category.
What are two solutions for satisfying the requirement? (Choose two.)
- A. Configure a web override rating for download, com and select Malicious Websites as the subcategory.
- B. Configure a separate firewall policy with action Deny and an FQDN address object for *. download, com as destination address.
- C. Set the Freeware and Software Downloads category Action to Warning
- D. Configure a static URL filter entry for download, com with Type and Action set to Wildcard and Block, respectively.
Answer: B,D
Explanation:
To block access specifically to download.com while allowing other sites in the "Freeware and Software Downloads" category, you can create a separate firewall policy with a deny action specifically for the FQDN
*.download.com. This approach allows blocking this particular site without affecting the other sites in the same category. Alternatively, configuring a static URL filter entry with the type set to Wildcard and action set to Block will also achieve the desired effect by directly blocking the specific URL without impacting other sites in the category.
References:
* FortiOS 7.4.1 Administration Guide: URL filter configuration
NEW QUESTION # 43
An administrator wants to monitor their network for any probing attempts aimed to exploit existing vulnerabilities in their servers.
Which two items must they configure on their FortiGate to accomplish this? (Choose two.)
- A. An application control profile, and set all application signatures to monitor
- B. An IPS sensor to monitor all signatures applicable to the server
- C. A web application firewall profile to check protocol constraints
- D. A DoS policy, and log all UDP and TCP scan attempts
Answer: B,D
Explanation:
B. Configure a DoS policy and log all UDP and TCP scan attempts.
A Denial of Service (DoS) policy can help monitor and mitigate scan attempts. By logging UDP and TCP scan attempts, the administrator can identify potential probing activities.
C. Configure an IPS sensor to monitor all signatures applicable to the server.
An Intrusion Prevention System (IPS) sensor is crucial for monitoring and preventing various types of attacks, including those targeting server vulnerabilities. Monitoring all relevant IPS signatures enhances the detection capabilities.
So, the correct choices are indeed B and C.
NEW QUESTION # 44
Refer to the exhibit to view the application control profile.
Users who use Apple FaceTime video conferences are unable to set up meetings.
In this scenario, which statement is true?
- A. Apple FaceTime belongs to the custom monitored filter.
- B. The category of Apple FaceTime is being monitored.
- C. Apple FaceTime belongs to the custom blocked filter.
- D. The category of Apple FaceTime is being blocked.
Answer: C
Explanation:
Apple FaceTime belongs to the custom blocked filter.
FaceTime categorized (filtered) under "Excessive-Bandwidth" and custom filter override set to block this.
Also we know that users can't use FaceTime.
Apple FaceTime falls under (VoIP Catagory), (Excessive-Bandwidth Behavior) and (Vendor as Apple).
A. Correct, but that comes 2nd.
B. Correct, but that comes 2nd, as custom Filter Overrides the precedence of Category.
C. Correct, and that comes 1st.
D. Wrong, VoIP Category is monitored
So correct answer is (C).
NEW QUESTION # 45
Refer to the exhibit.
The global settings on a FortiGate device must be changed to align with company security policies.
What does the Administrator account need to access the FortiGate global settings?
- A. Enable two-factor authentication
- B. Change password
- C. Change Administrator profile
- D. Enable restrict access to trusted hosts
Answer: C
Explanation:
Change Administrator profile
By default, there is a special profile named super_admin, which is used by the account named admin.
You can't change it. It provides full access to everything, making the admin account similar to a root superuser account.The prof_admin is another default profile. It also provides full access, but unlike super_admin, it applies only to its virtual domain-not the global settings of FortiGate. Also, you can change its permissions.
NEW QUESTION # 46
Refer to the exhibit to view the firewall policy.
Why would the firewall policy not block a well-known virus, for example eicar?
- A. The action on the firewall policy is not set to deny.
- B. The firewall policy does not apply deep content inspection.
- C. Web filter is not enabled on the firewall policy to complement the antivirus profile.
- D. The firewall policy is not configured in proxy-based inspection mode.
Answer: D
Explanation:
The firewall policy shown in the exhibit is configured in flow-based inspection mode. In flow-based inspection, certain security features, such as deep content inspection, might not be as effective as in proxy- based mode. Proxy-based inspection is necessary for thorough content inspection, which includes identifying and blocking well-known viruses like EICAR.
References:
* FortiOS 7.4.1 Administration Guide: Inspection Modes
NEW QUESTION # 47
Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?
- A. Intrusion prevention system engine
- B. Detection engine
- C. Flow engine
- D. Antivirus engine
Answer: A
Explanation:
B. Intrusion prevention system engine.
The Intrusion Prevention System (IPS) engine on FortiGate handles application control traffic, along with other functions such as detecting and preventing network attacks based on predefined signatures and behavioral analysis.
Application control can be configured in proxy-based and flow-based firewall policies. However, because application control uses the IPS engine, which uses flow-based inspection, inspection is always flow- based.
It uses an IPS engine to analyze network traffic and detect application traffic, even if the application is using standard or non-standard protocols and ports.
NEW QUESTION # 48
What are two features of FortiGate FSSO agentless polling mode? (Choose two.)
- A. FortiGate does not support workstation check.
- B. FortiGate uses the AD server as the collector agent.
- C. FortiGate uses the SMB protocol to read the event viewer logs from the DCs.
- D. FortiGate directs the collector agent to use a remote LDAP server.
Answer: A,C
Explanation:
FortiGate uses the SMB protocol to read the event viewer logs from the DCs.
In agentless polling mode, FortiGate directly connects to the Domain Controllers (DCs) using the SMB protocol to read event logs and detect user login events.
FortiGate does not support workstation check.
In agentless polling mode, FortiGate does not perform workstation checks. It relies on polling the event logs from the Domain Controllers to identify user logins.
NEW QUESTION # 49
Refer to the exhibits.
The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.
The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IPaddress
10.0.1.254/24.
Which IP address will be used to source NAT (SNAT) the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?
- A. 10.200.1.99
- B. 10.200.1.49
- C. 10.200.1.1
- D. 10.200.1.149
Answer: B
Explanation:
The traffic from the user on Local-Client (10.0.1.10) pinging the IP address of Remote-FortiGate (10.200.3.1) will match the firewall policy with the service "PING traffic". According to the firewall policy:
* Policy ID 6 is set for PING traffic and uses the NAT IP pool "SNAT-Remote1", which is defined as
10.200.1.99.
NEW QUESTION # 50
Refer to the exhibits, which show a diagram of a FortiGate device connected to the network. VIP object configuration, and the firewall policy configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IP address
10.0.1.254/24.
If the host 10.200.3.1 sends a TCP SYN packet on port 8080 to 10.200.1.10, what will the source address, destination address, and destination port of the packet be at the time FortiGate forwards the packet to the destination?
- A. 10.0.1.254, 10.0.1.10, and 80, respectively
- B. 10.200.3.1, 10.0.1.10, and 80, respectively
- C. 10.200.3.1, 10.0.1.10, and 8080, respectively
- D. 10.0.1.254, 10.200.1.10, and 8080, respectively
Answer: B
Explanation:
The source address remains 10.200.3.1 because FortiGate does not modify the source address by default unless NAT is applied (which is disabled in the policy).
The destination address is translated to 10.0.1.10 by the VIP (Virtual IP) object, as this is the internal server address mapped to the external IP 10.200.1.10.
The destination port is translated from 8080 to 80 as per the port forwarding rule configured in the VIP object.
NEW QUESTION # 51
Which three statements about SD-WAN zones are true? (Choose three.)
- A. You can define up to three SD-WAN zones per FortiGate device
- B. An SD-WAN zone must contains at least two members
- C. An SD-WAN zone is a logical grouping of members
- D. You can use an SD-WAN zone in static route definitions
- E. An SD-WAN zone can contain physical and logical interfaces
Answer: C,D,E
Explanation:
An SD-WAN zone can contain physical and logical interfaces
SD-WAN zones can include both physical and logical interfaces, allowing flexible configuration for different network types.
You can use an SD-WAN zone in static route definitions
SD-WAN zones can be referenced in static routes, enabling dynamic path selection based on SD-WAN rules.
An SD-WAN zone is a logical grouping of members
An SD-WAN zone is a logical grouping of interfaces (members), used to simplify the management and application of SD-WAN rules.
NEW QUESTION # 52
Which two statements are true about the RPF check? (Choose two.)
- A. The RPF check is run on the first reply packet of any new session.
- B. The RPF check is run on the first sent packet of any new session.
- C. The RPF check is run on the first sent and reply packet of any new session.
- D. RPF is a mechanism that protects FortiGuard and your network from IP spoofing attacks.
Answer: B,D
Explanation:
RPF protect against IP spoofin attacks. The source IP address is checked against the routing table for a return path. RPF is only carried out on: The first packet in the session, not on reply.
NEW QUESTION # 53
Which of the following are valid actions for FortiGuard category based filter in a web filter profile ui proxy-based inspection mode? (Choose two.)
- A. Warning
- B. Allow
- C. Exempt
- D. Learn
Answer: A,B
Explanation:
A. Warning
C. Allow
In a FortiGuard category-based filter in a web filter profile using proxy-based inspection mode, "Warning" can be used to display a warning message to users attempting to access blocked content, and "Allow" permits access to URLs that match the selected categories.
Exempt is not FortiGuard category action.
In the context of FortiGate's web filter profile under proxy-based inspection mode, the valid actions for FortiGuard category-based filter include:
A. Warning
C. Allow
So, both warning and allow are valid actions for FortiGuard category-based filtering in this scenario.
Proxy: Allow, Block, Monitor, Warning, and Authenticate.
NEW QUESTION # 54
Refer to the exhibit.
Which two statements are true about the routing entries in this database table? (Choose two.)
- A. The port2 interface is marked as inactive.
- B. Both default routes have different administrative distances.
- C. All of the entries in the routing database table are installed in the FortiGate routing table.
- D. The default route on porc2 is marked as the standby route.
Answer: B,D
Explanation:
The routing table in the exhibit shows two default routes (0.0.0.0/0) with different administrative distances:
* The default route through port2 has an administrative distance of 20.
* The default route through port1 has an administrative distance of 10.
Administrative distance determines the priority of the route; a lower value is preferred. Here, the route through port1 with an administrative distance of 10 is the preferred route. The route through port2 with an administrative distance of 20 acts as a standby or backup route. If the primary route (port1) fails or is unavailable, traffic will then be routed through port2.
Regarding the statement that the port2 interface is marked as inactive, there is no indication in the routing table that port2 is inactive. Similarly, all the routes displayed are not necessarily installed in the FortiGate routing table, as the table could include both active and backup routes.
References:
* FortiOS 7.4.1 Administration Guide: Default route configuration
* FortiOS 7.4.1 Administration Guide: Routing table explanation
NEW QUESTION # 55
Refer to the exhibit.
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 failed to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes can the administrator make to bring phase 1 up? (Choose two.)
- A. On Remote-FortiGate, set port2 as Interface.
- B. On both FortiGate devices, set Dead Peer Detection to On Demand.
- C. On HQ-FortiGate, set IKE mode to Main (ID protection).
- D. On HQ-FortiGate, disable Diffie-Helman group 2.
Answer: B,C
Explanation:
To bring Phase 1 up, the following changes can be made:
A . On HQ-FortiGate, disable Diffie-Helman group 2: This is incorrect because Diffie-Hellman group 2 is already selected on both devices. Disabling it would not help.
B . On Remote-FortiGate, set port2 as Interface: This is incorrect as both sides should be consistent in their interface settings for the IPsec tunnel, and the interface is correctly set to port1 on both FortiGates in the IPsec configuration.
C . On both FortiGate devices, set Dead Peer Detection to On Demand: This is a valid option. Setting Dead Peer Detection (DPD) to "On Demand" helps maintain the IPsec connection by checking if the peer is still available, which can help in some cases where the connection fails due to timeouts.
D . On HQ-FortiGate, set IKE mode to Main (ID protection): This is also a valid option because the Remote-FortiGate is already set to Main mode (ID protection). Ensuring that both ends use the same mode is crucial for successful phase 1 negotiation.
Thus, the correct answers are:
C . On both FortiGate devices, set Dead Peer Detection to On Demand.
D . On HQ-FortiGate, set IKE mode to Main (ID protection).
NEW QUESTION # 56
FortiGate is operating in NAT mode and is configured with two virtual LAN (VLAN) subinterfaces added to the same physical interface.
In this scenario, what are two requirements for the VLAN ID? (Choose two.)
- A. The two VLAN subinterfaces must have different VLAN IDs.
- B. The two VLAN subinterfaces can have the same VLAN ID, only if they belong to different VDOMs.
- C. The two VLAN subinterfaces can have the same VLAN ID, only if they have IP addresses in the same subnet.
- D. The two VLAN subinterfaces can have the same VLAN ID, only if they have IP addresses in different subnets.
Answer: A,B
Explanation:
B: The two VLAN subinterfaces can have the same VLAN ID, only if they belong to different VDOMs.
C: The two VLAN subinterfaces must have different VLAN IDs.
https://community.fortinet.com/t5/FortiGate/Technical-Note-How-to-use-emac-vlan-to-share-the-same-VL AN/ta-p/192843?externalID=FD43883 Each interface (physical or VLAN) can belong to only one VDOM.
Meaning that sub-interfaces (VLANs) from the same physical interface can have the same VLAN ID as long as they are not assign to the same VDOM.
VLAN
https://community.fortinet.com/t5/FortiGate/Technical-Tip-rules-about-VLAN-configuration-and-VDOM- interface/ta-p/197640
* VLANs can be created on any physical or aggregate (802.3ad) interfaces
- The same VLAN number cannot be configured twice on the same physical interface
- The same VLAN number can be used on different physical interfaces
- The usable VLAN ID range is from 1 to 4094
* VDOM interface assignment
- Two VDOMs cannot share the same interface or VLAN
- A VLAN sub-interface can belong to a different VDOM than the physical interface it is attached to.
NEW QUESTION # 57
There are multiple dial-up IPsec VPNs configured in aggressive mode on the HQ FortiGate. The requirement is to connect dial-up users to their respective department VPN tunnels.
Which phase 1 setting you can configure to match the user to the tunnel?
- A. Peer ID
- B. IKE Mode Config
- C. Local Gateway
- D. Dead Peer Detection
Answer: A
Explanation:
When using multiple dial-up IPsec VPNs in aggressive mode, the Peer ID setting in Phase 1 can be used to distinguish between different VPN tunnels. Each dial-up user or department can be assigned a unique Peer ID, allowing the FortiGate to match the incoming VPN request to the correct tunnel based on the Peer ID value.
NEW QUESTION # 58
What is the common feature shared between IPv4 and SD-WAN ECMP algorithms?
- A. Both use the same physical interface load balancing settings.
- B. Both can be enabled at the same time.
- C. Both control ECMP algorithms.
- D. Both support volume algorithms.
Answer: C
Explanation:
The correct answer is: C. Both control ECMP algorithms.
In the context of SD-WAN (Software-Defined Wide Area Network), ECMP (Equal-Cost Multi-Path) algorithms are used to determine the path packets should take through the network. Both IPv4 and SD- WAN ECMP algorithms control how traffic is load-balanced across multiple paths to a destination. While IPv4 ECMP operates at the network layer (Layer 3) of the OSI model, SD-WAN ECMP operates at a higher level, typically involving application-aware routing and more advanced traffic steering capabilities.
NEW QUESTION # 59
What devices form the core of the security fabric?
- A. Two FortiGate devices and one FortiManager device
- B. Two FortiGate devices and one FortiAnalyzer device
- C. One FortiGate device and one FortiManager device
- D. One FortiGate device and one FortiAnalyzer device
Answer: B
Explanation:
C: Two FortiGate devices and one FortiAnalyzer device.
These devices form the core of the Fortinet Security Fabric, providing firewall functionality, centralized management, logging, and reporting capabilities.
In certain scenarios, especially when emphasizing visibility and analysis, having multiple FortiGate devices and a FortiAnalyzer device can indeed form a core configuration within the Fortinet Security Fabric. FortiAnalyzer is used for centralized logging, reporting, and analysis of data from multiple FortiGate devices, enhancing the overall security posture.
NEW QUESTION # 60
......
Pass Fortinet FCP_FGT_AD-7.4 Premium Files Test Engine pdf - Free Dumps Collection: https://www.trainingquiz.com/FCP_FGT_AD-7.4-practice-quiz.html
FCP_FGT_AD-7.4 Exam Info and Free Practice Test | TrainingQuiz: https://drive.google.com/open?id=1Vr_Obxz2e3SDYXdQMIciYjZ_2nkWjomt
