Fortinet FCP - FortiGate 7.4 Administrator - FCP_FGT

QUESTION NO: 1
Refer to the exhibits.

The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration.
An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2.
The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver.
Which two configuration changes can the administrator make to the policy to deny Webserver access for Remote-User2? (Choose two.)

A. Disable match-vip in the Deny policy. B. Set the Destination address as Webserver in the Deny policy. C. Enable match-vip in the Deny policy. D. Set the Destination address as Deny_IP in the Allow_access policy.

Correct Answer: B,C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
Refer to the exhibit.

In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output shown in the exhibit.
What should the administrator do next, to troubleshoot the problem?

A. Execute another sniffer on FortiGate, this time with the filter "hose 10.o.1.10". B. Capture the traffic using an external sniffer connected to part1. C. Run a sniffer on the web server. D. Execute a debug flow.

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
A FortiGate firewall policy is configured with active authentication however, the user cannot authenticate when accessing a website.
Which protocol must FortiGate allow even though the user cannot authenticate?

A. DNS B. ICMP C. DHCP D. LDAP

Correct Answer: A

QUESTION NO: 4
Refer to the exhibit to view the firewall policy.

Why would the firewall policy not block a well-known virus, for example eicar?

A. The firewall policy does not apply deep content inspection. B. The action on the firewall policy is not set to deny. C. The firewall policy is not configured in proxy-based inspection mode. D. Web filter is not enabled on the firewall policy to complement the antivirus profile.

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 5
Which three statements about SD-WAN zones are true? (Choose three.)

A. You can use an SD-WAN zone in static route definitions B. An SD-WAN zone is a logical grouping of members C. You can define up to three SD-WAN zones per FortiGate device D. An SD-WAN zone can contain physical and logical interfaces E. An SD-WAN zone must contains at least two members

Correct Answer: A,B,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 6
Refer to the exhibits, which show the firewall policy and an antivirus profile configuration.

Why is the user unable to receive a block replacement message when downloading an infected file for the first time?

A. The option to send files to FortiSandbox for inspection is enabled. B. The firewall policy performs a full content inspection on the file. C. Flow-based inspection is used, which resets the last packet to the user. D. The intrusion prevention security profile must be enabled when using flow-based inspection mode.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 7
Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)

A. The subject alternative name (SAN) field in the server certificate. B. The server name indication (SNI) extension in the client hello message. C. The host field in the HTTP header. D. The serial number in the server certificate. E. The subject field in the server certificate.

Correct Answer: A,B,E

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
Which three strategies are valid SD-WAN rule strategies for member selection? (Choose three.)

A. Manual with load balancing B. Lowest Cost (SLA) without load balancing C. Best Quality with load balancing D. Lowest Cost (SLA) with load balancing E. Lowest Quality (SLA) with load balancing

Correct Answer: A,B,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 9
Which two statements are correct when FortiGate enters conserve mode? (Choose two.)

A. FortiGate halts complete system operation and requires a reboot to regain available resources B. FortiGate continues to run critical security actions, such as quarantine. C. FortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled D. FortiGate refuses to accept configuration changes

Correct Answer: C,D

QUESTION NO: 10
What are two features of FortiGate FSSO agentless polling mode? (Choose two.)

A. FortiGate directs the collector agent to use a remote LDAP server. B. FortiGate uses the SMB protocol to read the event viewer logs from the DCs. C. FortiGate does not support workstation check. D. FortiGate uses the AD server as the collector agent.

Correct Answer: B,C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

Fortinet FCP - FortiGate 7.4 Administrator - FCP_FGT_AD-7.4 Exam Questions