Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Fortinet
Fortinet Network Security Expert
FCP_FGT_AD-7.4
FCP - FortiGate 7.4 Administrator Questions and Answers

Pass the Fortinet Network Security Expert FCP_FGT_AD-7.4 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam FCP_FGT_AD-7.4 Premium Access

View all detail and faqs for the FCP_FGT_AD-7.4 exam

Go to Exam

690 Students Passed

87% Average Score

98% Same Questions

Viewing page 3 out of 3 pages

Viewing questions 21-30 out of questions

Questions # 21:

Refer to the exhibits.

Question # 21

The exhibits show the application sensor configuration and theExcessive-BandwidthandApplefilter details.

Based on the configuration, what will happen to Apple FaceTime if there are only a few calls originating or incoming?

Options:

Apple FaceTime will be allowed, based on the Video/Audio category configuration.

Apple FaceTime will be allowed, based on the Apple filter configuration.

Apple FaceTime will be allowed only if the Apple filter in Application and Filter Overrides is set to Allow.

Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.

Answer

Explanation

Based on the application sensor configuration and the filter details:

D. Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration:The "Excessive-Bandwidth" filter is set to block, which includes "FaceTime" under its application signature. As a result, FaceTime will be blocked regardless of the "Apple" filter configuration because the "Excessive-Bandwidth" filter takes precedence due to its block action setting.

The other options are not correct:

A. Apple FaceTime will be allowed, based on the Video/Audio category configuration:The Video/Audio category is not relevant because FaceTime is specifically included in the Excessive-Bandwidth filter, which blocks it.

B. Apple FaceTime will be allowed, based on the Apple filter configuration:Although the Apple filter is set to monitor, the block action of the Excessive-Bandwidth filter will override this.

C. Apple FaceTime will be allowed only if the Apple filter in Application and Filter Overrides is set to Allow:The allow setting for the Apple filter is irrelevant in this context, as the block action in the Excessive-Bandwidth filter will prevail.

References

FortiOS 7.4.1 Administration Guide -Application Control and Filtering, page 978.

FortiOS 7.4.1 Administration Guide -Application Sensor Configuration, page 982.

Questions # 22:

Refer to the exhibit which contains a RADIUS server configuration.

Question # 22

An administrator added a configuration for a new RADIUS server. While configuring, the administrator selected theInclude in every user groupoption.

What is the impact of using theInclude in every user groupoption in a RADIUS configuration?

Options:

This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group

This option places all users into even/ RADIUS user group, including groups that are used for the LDAP server on FortiGate

This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case is FortiAuthenticator

This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group

Answer

Explanation

By selecting the "Include in every user group" option in the RADIUS configuration, FortiGate automatically includes this RADIUS server as an authentication source for all user groups. This means any user group configured on the FortiGate will authenticate using this RADIUS server, allowing users to authenticate against the server for any group they belong to.

Questions # 23:

What are two features of collector agent advanced mode? (Choose two.)

Options:

In advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.

Advanced mode supports nested or inherited groups.

In advanced mode, security profiles can be applied only to user groups, not individual users.

Advanced mode uses the Windows convention —NetBios: Domain\Username.

Answer

A, B

Explanation

Advanced mode allows for configuration as an LDAP client and supports group filtering directly on the FortiGate, as well as nested or inherited groups.

Questions # 24:

Refer to the exhibit.

Question # 24

The exhibit shows a diagram of a FortiGate device connected to the network, the firewall policy and VIP configuration on the FortiGate device, and the routing table on the ISP router.

When the administrator tries to access the web server public address (203.0.113.2) from the internet, the connection times out. At the same time the administrator runs a sniffer on FortiGate to capture incoming web traffic to the server and does not see any output.

Based on the information shown in the exhibit, what configuration change must the administrator make to fix the connectivity issue?

Options:

Configure a loopback interface with address 203.0.113.2/32.

In the VIP configuration, enable arp-reply.

In the firewall policy configuration, enable match-vip.

Enable port forwarding on the server to map the external service port to the internal service port.

Answer

Explanation

In this scenario, the FortiGate device is using a Virtual IP (VIP) to map the public IP address (203.0.113.2) to the internal IP address of the web server (172.16.1.10). The fact that the administrator does not see any sniffer output for incoming traffic suggests that the FortiGate is not responding to ARP requests for the public IP address (203.0.113.2).

Enabling arp-reply in the VIP configuration allows the FortiGate to respond to ARP requests for the public IP, thereby allowing traffic to reach the FortiGate, which will then forward it to the web server based on the VIP mapping.

Questions # 25:

Refer to the exhibit showing a debug flow output.

Question # 25

What two conclusions can you make from the debug flow output? (Choose two.)

Options:

The debug flow is for ICMP traffic.

A firewall policy allowed the connection.

A new traffic session was created.

The default route is required to receive a reply.

Answer

A, C

Explanation

The debug flow is for ICMP traffic.

The output shows "proto=1," which indicates that the protocol is ICMP (Internet Control Message Protocol).

A new traffic session was created.

The message "allocate a new session-00003dd5" confirms that a new session was created for this traffic.

Questions # 26:

Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true? (Choose two.)

Options:

If SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance-mode.

If SD-WAN is disabled, you can configure the parameter v4-ecmp-mode to volume-based.

If SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP

If SD-WAN is disabled, you configure the load balancing algorithm in config system settings.

Answer

A, D

Explanation

When SD-WAN is enabled on FortiGate, the load balancing algorithm for Equal-Cost Multi-Path (ECMP) is configured using theload-balance-modeparameter under SD-WAN settings. However, if SD-WAN is disabled, the ECMP load balancing algorithm can be configured underconfig system settings. This flexibility allows FortiGate to control traffic routing behavior based on the network configuration and requirements.

References:

FortiOS 7.4.1 Administration Guide: ECMP Configuration

Viewing page 3 out of 3 pages

Viewing questions 21-30 out of questions