File Info
| Exam | FCP-FortiGate 7.4 Administrator |
| Number | FCP_FGT_AD-7.4 |
| File Name | Fortinet.FCP_FGT_AD-7.4.PassLeader.2025-02-21.35q.tqb |
| Size | 137 KB |
| Posted | Feb 21, 2025 |
| Download | Fortinet.FCP_FGT_AD-7.4.PassLeader.2025-02-21.35q.tqb |
How to open VCEX & EXAM Files?
Files with VCEX & EXAM extensions can be opened by ProfExam Simulator.
Coupon: MASTEREXAM
With discount: 20%
Demo Questions
Question 1
Which two statements explain antivirus scanning modes? (Choose two.)
- In flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client.
- In flow-based inspection mode files bigger than the buffer size are scanned.
- In proxy-based inspection mode files bigger than the buffer size are scanned.
- In proxy-based inspection mode antivirus scanning buffers the whole file for scanning, before sending it to the client.
Correct answer: AD
Explanation:
- In flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client. Flow-based inspection allows real-time scanning of files as they are being transmitted, with minimal impact on performance. - In proxy-based inspection mode antivirus scanning buffers the whole file for scanning, before sending it to the client. Proxy-based inspection mode holds the file completely, scans it for threats, and only sends the file to the client if no threats are detected. - In flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client. Flow-based inspection allows real-time scanning of files as they are being transmitted, with minimal impact on performance.
- In proxy-based inspection mode antivirus scanning buffers the whole file for scanning, before sending it to the client. Proxy-based inspection mode holds the file completely, scans it for threats, and only sends the file to the client if no threats are detected.
Question 2
Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?
- Internet Service Database (ISDB) engine.
- Intrusion prevention system engine.
- Antivirus engine.
- Application control engine.
Correct answer: B
Explanation:
Unlike other forms of security profiles, such as web filtering or antivirus, application control is not applied by a proxy. It uses an IPS engine to analyze network traffic and detect application traffic, even if the application is using standard or non-standard protocols and ports. It doesn't operate using built-in protocol states. It matches patterns in the entire byte stream of the packet, and then looks for patterns. Unlike other forms of security profiles, such as web filtering or antivirus, application control is not applied by a proxy. It uses an IPS engine to analyze network traffic and detect application traffic, even if the application is using standard or non-standard protocols and ports. It doesn't operate using built-in protocol states. It matches patterns in the entire byte stream of the packet, and then looks for patterns.
Question 3
A FortiGate administrator is required to reduce the attack surface on the SSL VPN portal. Which SSL timer can you use to mitigate a denial of service (DoS) attack?
- SSL VPN dcls-hello-timeout.
- SSL VPN http-request-header-timeout.
- SSL VPN login-timeout.
- SSL VPN idle-timeout.
Correct answer: B
Explanation:
The SSL VPN http-request-header-timeout timer is used to mitigate denial of service (DoS) attacks by limiting the amount of time the FortiGate waits for the client to send an HTTP request header after a connection is established. This helps reduce the attack surface by preventing potential attacks that exploit prolonged connection times without fully completing requests. The SSL VPN http-request-header-timeout timer is used to mitigate denial of service (DoS) attacks by limiting the amount of time the FortiGate waits for the client to send an HTTP request header after a connection is established. This helps reduce the attack surface by preventing potential attacks that exploit prolonged connection times without fully completing requests.
Question 4
A FortiGate firewall policy is configured with active authentication however, the user cannot authenticate when accessing a website. Which protocol must FortiGate allow even though the user cannot authenticate?
- ICMP
- DNS
- DHCP
- LDAP
Correct answer: B
Explanation:
Even if the user cannot authenticate, DNS traffic must be allowed to ensure that domain name resolution can occur, which is essential for accessing websites. Even if the user cannot authenticate, DNS traffic must be allowed to ensure that domain name resolution can occur, which is essential for accessing websites.
Question 5
There are multiple dial-up IPsec VPNs configured in aggressive mode on the HQ FortiGate. The requirement is to connect dial-up users to their respective department VPN tunnels. Which phase 1 setting you can configure to match the user to the tunnel?
- Peer ID
- Local Gateway
- Dead Peer Detection
- IKE Mode Config
Correct answer: A
Explanation:
When using multiple dial-up IPsec VPNs in aggressive mode, the Peer ID setting in Phase 1 can be used to distinguish between different VPN tunnels. Each dial-up user or department can be assigned a unique Peer ID, allowing the FortiGate to match the incoming VPN request to the correct tunnel based on the Peer ID value. When using multiple dial-up IPsec VPNs in aggressive mode, the Peer ID setting in Phase 1 can be used to distinguish between different VPN tunnels. Each dial-up user or department can be assigned a unique Peer ID, allowing the FortiGate to match the incoming VPN request to the correct tunnel based on the Peer ID value.
Question 6
Which three CLI commands, can you use to troubleshoot Layer 3 issues if the issue is in neither the physical layer nor the link layer? (Choose three.)
- execute ping
- execute traceroute
- diagnose sys top
- get system arp
- diagnose sniffer packet any
Correct answer: ABE
Explanation:
- Option C: diagnose sys top - list of processes with most CPU. - Option D: get system arp - show interface, IP, MAC (physical layer). - Option C: diagnose sys top - list of processes with most CPU.
- Option D: get system arp - show interface, IP, MAC (physical layer).
Question 7
An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is outbound traffic but no response from the peer. Which DPD mode on FortiGate meets this requirement?
- On Demand
- On Idle
- Disabled
- Enabled
Correct answer: A
Explanation:
The On Demand mode for Dead Peer Detection (DPD) on FortiGate sends DPD probes only when there is outbound traffic and no response from the peer. This mode is used to detect if the peer is still available without continuously sending DPD probes, reducing unnecessary traffic. The On Demand mode for Dead Peer Detection (DPD) on FortiGate sends DPD probes only when there is outbound traffic and no response from the peer. This mode is used to detect if the peer is still available without continuously sending DPD probes, reducing unnecessary traffic.
Question 8
Which two statements are correct when FortiGate enters conserve mode? (Choose two.)
- FortiGate halts complete system operation and requires a reboot to regain available resources.
- FortiGate refuses to accept configuration changes.
- FortiGate continues to run critical security actions, such as quarantine.
- FortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled.
Correct answer: BD
Explanation:
It does not accept config changes, because it might increase memory usage even further. It explicitly does NOT run any quarantine actions. You can configure IPS fail-open to control how IPS behaves when the IPS socket buffer is full. It does not accept config changes, because it might increase memory usage even further. It explicitly does NOT run any quarantine actions. You can configure IPS fail-open to control how IPS behaves when the IPS socket buffer is full.
Question 9
Which statement is correct regarding the use of application control for inspecting web applications?
- Application control can identify child and parent applications, and perform different actions on them.
- Application control signatures are included in Fortinet Antivirus engine.
- Application control does not display a replacement message for a blocked web application.
- Application control does not require SSL Inspection to Identity web applications.
Correct answer: A
Explanation:
The FortiGuard application control signature database is organized in a hierarchical structure. This gives you the ability to inspect the traffic with more granularity. You can block Facebook applications while allowing users to collaborate using Facebook chat. The FortiGuard application control signature database is organized in a hierarchical structure. This gives you the ability to inspect the traffic with more granularity. You can block Facebook applications while allowing users to collaborate using Facebook chat.
Question 10
What are three key routing principles in SD-WAN? (Choose three.)
- By default. SD-WAN members are skipped if they do not have a valid route to the destination.
- By default. SD-WAN rules are skipped if only one route to the destination is available.
- By default. SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.
- SD-WAN rules have precedence over any other type of routes.
- Regular policy routes have precedence over SD-WAN rules.
Correct answer: ACE
Explanation:
- Option A: By default, SD-WAN members are skipped if they do not have a valid route to the destination SD-WAN ensures that only members with valid routes to the destination are considered during routing decisions. - Option C: By default, SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member. - Option E: If the best route is not an SD-WAN member, SD-WAN rules are bypassed and standard routing takes over. - Option A: By default, SD-WAN members are skipped if they do not have a valid route to the destination SD-WAN ensures that only members with valid routes to the destination are considered during routing decisions.
- Option C: By default, SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.
- Option E: If the best route is not an SD-WAN member, SD-WAN rules are bypassed and standard routing takes over.
