Pass the Fortinet Certified Professional Network Security FCP_FWF_AD-7.4 Questions and answers with ExamsMirror

When you need different access levels for various users and device types but want to keep the SSID structure simple, dynamic VLAN assignment is the best practice.

With dynamic VLANs, all clients connect to the same SSID. The RADIUS server (via 802.1X authentication or MAC authentication) assigns each user or device to a specific VLAN based on attributes (like user group, device type, etc.).

This design:

Reduces SSID sprawl.

Allows flexible, scalable, and policy-driven access.

Simplifies management and enhances security.

The other options are either less scalable (multiple SSIDs) or do not provide the required dynamic access control (user groups or NAC alone without VLAN assignment).

FortiAP and Rogue AP Detection:

Background Scanning:

FortiAPs can perform background scanning for rogue APs while actively servicing clients (broadcasting SSIDs). This means they periodically switch from client service to scan the air for unauthorized APs.

This enables detection of threats without a dedicated radio, using periodic scans on service radios.

Manual Suppression:

Suppression of rogue APs (for example, sending de-auth frames to clients of a rogue) must be triggered manually by an administrator from the FortiGate/FortiAP interface.

Automatic Suppression:

FortiAPs do NOT offer automatic suppression of rogue APs by default. Suppression is an explicit administrative action.

Dedicated Monitoring Radios:

Some APs (higher-end models) may have dedicated radios, but this is not the case for all FortiAPs; background scanning is the standard.

Option Breakdown:

A. FortiAP offers automatic suppression of rogue APs when broadcasting SSIDs

Incorrect. Suppression is manual.

B. FortiAP scans rogue APs in the background while broadcasting SSIDs

Correct. Background scanning is supported.

C. FortiAP detects rogue APs on dedicated monitoring radios

Incorrect for most deployments. Dedicated monitoring radios are available only in some models.

D. FortiAP suppresses detected rogue APs manually

Correct. Manual suppression is available via the management interface.

Analysis of the Exhibits and Scenario:

The DHCP server configuration is correct for dynamic assignment within a specified IP range for the interface “WLAN01”.

The RADIUS configuration for user1 includes:

Tunnel-Type (should be set to VLAN, but value is missing)

Tunnel-Medium-Type (set to IEEE-802, which is correct for Ethernet/WiFi)

Tunnel-Private-Group-Id (set to “infrastructure” as a string)

The problem described: Dynamic VLAN assignment is not working for user1.

How Dynamic VLAN Assignment Works in 802.1X/EAP (with FortiGate/FortiAP):

When a user authenticates, the RADIUS server returns attributes specifying the VLAN that should be assigned.

The critical attributes are:

Tunnel-Type (must be set to value “VLAN”, which is integer 13)

Tunnel-Medium-Type (must be “IEEE-802”, integer 6)

Tunnel-Private-Group-Id (can be the VLAN name or VLAN ID, depending on your configuration)

Problem in the Exhibit:

The Tunnel-Type value is missing!

It must be set to 13 (for VLAN).

The Tunnel-Medium-Type and Tunnel-Private-Group-Id are correctly set.

Corrective Action:

Update user1’s RADIUS attributes so that Tunnel-Type is set to the correct value for VLAN (integer 13).

Without this, FortiGate/FortiAP will not know to interpret the returned VLAN name or ID for dynamic assignment.

Review of Options:

Disable the DHCP server on ONBOARD to allow VLAN assignment.

Irrelevant; DHCP server presence does not affect dynamic VLAN assignment.

Add user1 in one of the VLAN names

This is not how dynamic VLAN assignment works. The RADIUS response must include the correct VLAN assignment.

Update user1 RADIUS attributes to include a VLAN ID attribute ID

Correct. You must set Tunnel-Type (13) and possibly provide the VLAN ID in Tunnel-Private-Group-Id.

Create a new VLAN name infrastructure' with a VLAN ID associated with it

Not the root cause; you must first ensure the correct attributes are present in the RADIUS response.

Summary:

The missing “Tunnel-Type” attribute value is the reason dynamic VLAN assignment is not working. The correct configuration requires setting Tunnel-Type = 13 (VLAN) for user1 in the RADIUS server.

When a FortiAP is directly cabled to a FortiGate interface, it sends out a broadcast CAPWAP discovery packet.

The FortiGate listens for these on its interfaces and then discovers/provisions the FortiAP automatically.

Wireless Intrusion Detection System (WIDS) in Fortinet’s Secure Wireless LAN (SWLAN) platform monitors for threats to the wireless environment and detects a range of attacks and misconfigurations.

The main threats detected by WIDS include:

Rogue access points: These are unauthorized APs plugged into the network, posing a security risk. WIDS scans and identifies any AP that is not part of the authorized network, flagging them as potential rogues.

Unauthorized wireless connections: WIDS can detect clients that connect to unauthorized or suspicious wireless networks, as well as unauthorized wireless devices attempting to connect to the network.

Analysis of Options:

A. Brute-force dictionary attacks:

WIDS does not specifically detect brute-force dictionary attacks against authentication. It focuses more on network topology threats and unauthorized devices.

B. Unauthorized wireless connection:

Correct. WIDS can detect unauthorized wireless connections, such as clients connecting to networks/APs that are not trusted.

C. Rogue access points:

Correct. Detecting rogue APs is a primary function of WIDS.

D. WPA2 authentication vulnerabilities:

WIDS does not specifically scan for cryptographic protocol vulnerabilities. It detects behavioral/network threats.

Channel utilization directly measures how much airtime is consumed by wireless transmissions (including data, management, and interference).

Monitoring channel utilization helps optimize the network by:

Identifying congestion or over-utilized channels.

Allowing channel re-planning and SSID optimization.

The other options (AP firmware, event logs, user count) are helpful, but only channel utilization gives actionable insight for radio resource optimization.

FortiPresence analytics is a platform for presence analytics—monitoring WiFi user presence, dwell time, and visitor trends in physical spaces.

A: It collects and reports details about on-site guest users, such as visit duration and repeat visits.

C: It enables comparison of current user presence and activity data with historical trends, supporting operational and marketing analysis.

B (reporting potential threats) is not a function of presence analytics.

D (predicting future guest counts) is not a core function; FortiPresence reports on actual and historical data, not predictive analytics.

WPA3 introduces improvements over WPA2, most notably replacing the PSK (Pre-Shared Key) handshake with the Simultaneous Authentication of Equals (SAE) handshake.

The SAE handshake is resistant to key reinstallation attacks (KRACK) that affected WPA2.

WPA3 also improves security in open networks but does not force enterprise-only mode or universally block all legacy protocols, and 128-bit key size alone isn’t unique to WPA3.

When a client moves out of range, the connection drops.

The normal behavior is for the client to disconnect and then seek out and connect to another AP with a stronger signal.

The AP does not force disconnection or send alerts; the client handles roaming.

Clients do not increase their own radio power substantially in response to poor signals due to hardware limits.