Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Fortinet
Fortinet Network Security Expert
FCP_FGT_AD-7.6
FortiGate 7.6 Administrator FCP_FGT_AD-7.6 Questions and Answers

Pass the Fortinet Network Security Expert FCP_FGT_AD-7.6 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam FCP_FGT_AD-7.6 Premium Access

View all detail and faqs for the FCP_FGT_AD-7.6 exam

Go to Exam

662 Students Passed

91% Average Score

96% Same Questions

Viewing page 3 out of 3 pages

Viewing questions 21-30 out of questions

Questions # 21:

Question # 21

Refer to the exhibits.

You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.

Which two factors can you observe from these configurations? (Choose two.)

Options:

YouTube search is allowed based on the Google Application and Filter override settings.

YouTube access is blocked based on Excessive-Bandwidth Application and Filter override settings.

Facebook access is allowed but you cannot play Facebook videos based on Video/Audio category filter settings.

Facebook access is blocked based on the category filter settings.

Answer

B, D

Questions # 22:

Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true? (Choose two.)

Options:

If SD-WAN is disabled, you can configure the parameter v4-ecmp-mode to volume-based.

If SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP.

If SD-WAN is disabled, you configure the load balancing algorithm in config system settings.

If SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance-mode.

Answer

A, D

Explanation

When SD-WAN is disabled, FortiGate supports volume-based ECMP mode via the v4-ecmp-mode parameter.

When SD-WAN is enabled, the load balancing algorithm is controlled by the load-balance-mode parameter within the SD-WAN configuration.

Questions # 23:

Question # 23

Refer to the exhibits.

An administrator configured the Web Filter Profile to block access to all social networking sites except Facebook. However, when users try to access Facebook.com, they are redirected to a FortiGuard web filtering block page.

Based on the exhibits, which configuration change must the administrator make to allow Facebook while blocking all other social networking sites?

Options:

Change the Feature set of Web Filter Profile as Proxy-based.

Set the Action as Exempt for www.facebook.com

in the Static URL Filter.

Change the type as Simple in the Static URL Filter section.

Set the Social Networking action as warning in the FortiGuard Category Based Filter.

Answer

Questions # 24:

You have created a web filter profile named restrict_media-profile with a daily category usage quota.

When you are adding the profile to the firewall policy, the restrict_media-profile is not listed in the available web profile drop down.

What could be the reason?

Options:

The firewall policy is in no-inspection mode instead of deep-inspection.

The inspection mode in the firewall policy is not matching with web filter profile feature set.

The web filter profile is already referenced in another firewall policy.

The naming convention used in the web filter profile is restricting it in the firewall policy.

Answer

Explanation

Web filter profiles with category usage quotas require the firewall policy to be in proxy-based (deep) inspection mode; if the inspection mode does not match this requirement, the profile will not appear in the drop-down list.

Questions # 25:

Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

Options:

The collector agent uses a Windows API to query DCs for user logins.

NetAPI polling can increase bandwidth usage in large networks.

The NetSessionEnum function is used to track user logouts.

The collector agent must search Windows application event logs.

Answer

Explanation

NetAPI polling mode involves frequent queries to domain controllers, which can cause increased bandwidth usage, especially in large networks with many login events.

Questions # 26:

What are three key routing principles in SD-WAN? (Choose three.)

Options:

By default. SD-WAN rules are skipped if the included SD-WAN members do not have a valid route to the destination.

SD-WAN rules have precedence over any other type of routes.

Regular policy routes have precedence over SD-WAN rules.

By default. SD-WAN rules are skipped if only one route to the destination is available.

By default. SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.

Answer

A, B, E

Explanation

SD-WAN rules are skipped if none of the SD-WAN members have a valid route to the destination.

SD-WAN rules take precedence over other route types.

SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member by default.

Questions # 27:

Refer to the exhibits.

Question # 27

The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration.

An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2.

The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver.

Which additional configuration can the administrator add to a deny firewall policy, beyond the default behavior, to block Remote-User2 from accessing the Webserver?

Options:

Disable match-vip in the Allow_access policy

Configure a One-to-One IP Pool object in a new policy.

Set the Destination address as Webserver in the Deny policy.

Set the Destination address as Deny_IP in the Allow_access policy.

Answer

Explanation

To block Remote-User2's access to the Webserver, the deny policy must explicitly specify the Webserver as the destination address; otherwise, it denies traffic to all destinations, which is not the desired behavior.

Questions # 28:

Refer to the exhibits.

Question # 28

An administrator has observed the performance status outputs on an HA cluster for 55 seconds.

Which FortiGate is the primary?

Options:

HQ-NGFW-2 with the parameter memory-failover-threshold setting

HQ-NGFW-2 with the parameter priority setting

HQ-NGFW-1 with the parameter memory-failover-flip-timeout setting

HQ-NGFW-1 with the parameter override setting

Answer

Explanation

The HA configuration shows that override is disabled (set override disable), but despite this, HQ-NGFW-1 has the higher priority (200) and is acting as the primary, as indicated by its higher resource usage and uptime. Override allows the device with higher priority to take over as primary, so HQ-NGFW-1 is the primary device.

Questions # 29:

Refer to the exhibits.

Question # 29

Based on the current HA status, an administrator updates the override and priority parameters on HQ-NGFW-1 and HQ-NGFW-2 as shown in the exhibit.

What would be the expected outcome in the HA cluster?

Options:

HQ-NGFW-1 will synchronize the override disable setting with HQ-NGFW-2.

HQ-NGFW-2 will take over as the primary because it has the override enable setting and higher priority than HQ-NGFW-1.

HQ-NGFW-1 will remain the primary because HQ-NGFW-2 has lower priority.

The HA cluster will become out of sync because the override setting must match on all HA members.

Answer

Explanation

With override enabled on HQ-NGFW-2 and its higher priority (110 vs. 90), HQ-NGFW-2 will become the primary device, preempting HQ-NGFW-1 despite the current primary status.

Questions # 30:

You have configured the FortiGate device for FSSO. A user is successful in log-in to windows, but their access to the internet is denied.

What should the administrator check first?

Options:

Whether the user is assigned to the correct AD group.

The FortiGate firewall policy settings for SSL decryption.

The FortiGate FSSO active users list for user’s IP address.

The windows event viewer for failed login attempts.

Answer

Explanation

Checking the active users list verifies if FortiGate correctly associates the user with their IP address, ensuring proper policy enforcement for internet access.

Viewing page 3 out of 3 pages

Viewing questions 21-30 out of questions