Online Questions – Valid Practice To your FCP_FGT_AD-7.4 Exam (Updated 50 Questions) [Q17-Q37]

NEW QUESTION 17
Refer to the exhibit to view the application control profile.

Users who use Apple FaceTime video conferences are unable to set up meetings.
In this scenario, which statement is true?

Apple FaceTime belongs to the custom monitored filter.

The category of Apple FaceTime is being monitored.

Apple FaceTime belongs to the custom blocked filter.

The category of Apple FaceTime is being blocked.

NEW QUESTION 18
Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 failed to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes can the administrator make to bring phase 1 up? (Choose two.)

On HQ-FortiGate, disable Diffie-Helman group 2.

On Remote-FortiGate, set port2 as Interface.

On both FortiGate devices, set Dead Peer Detection to On Demand.

On HQ-FortiGate, set IKE mode to Main (ID protection).

NEW QUESTION 19
Examine the IPS sensor and DoS policy configuration shown in the exhibit, then answer the question below.

When detecting attacks, which anomaly, signature, or filter will FortiGate evaluate first?

SMTP.Login.Brute.Force

IMAP.Login.brute.Force

ip_src_session

Location: server Protocol: SMTP

NEW QUESTION 20
Refer to the exhibits, which show the firewall policy and an antivirus profile configuration.

Why is the user unable to receive a block replacement message when downloading an infected file for the first time?

The intrusion prevention security profile must be enabled when using flow-based inspection mode.

The option to send files to FortiSandbox for inspection is enabled.

The firewall policy performs a full content inspection on the file.

Flow-based inspection is used, which resets the last packet to the user.

NEW QUESTION 21
A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
All traffic must be routed through the primary tunnel when both tunnels are up. The secondary tunnel must be used only if the primary tunnel goes down. In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover.
Which two key configuration changes must the administrator make on FortiGate to meet the requirements?
(Choose two.)

Enable Dead Peer Detection

Enable Auto-negotiate and AutokeyKeep Alive on the phase 2 configuration of both tunnels.

Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.

Configure a higher distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.

NEW QUESTION 22
Refer to the exhibit.

Which contains a network diagram and routing table output. The Student is unable to access Webserver.
What is the cause of the problem and what is the solution for the problem?

The first packet sent from Student failed the RPF check. This issue can be resolved by adding a static route to 10.0.4.0/24 through wan1.

The first reply packet for Student failed the RPF check. This issue can be resolved by adding a static route to 10.0.4.0/24 through wan1.

The first reply packet for Student failed the RPF check. This issue can be resolved by adding a static route to 203.0.114.24/32 through port3.

The first packet sent from Student failed the RPF check. This issue can be resolved by adding a static route to 203.0.114.24/32 through port3.

NEW QUESTION 23
An administrator has configured central DNAT and virtual IPs.
Which item can be selected in the firewall policy Destination field?

An IP pool

A VIP object

A VIP group

The mapped IP address object of the VIP object

NEW QUESTION 24
Refer to the exhibits.
An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).

What must the administrator do to synchronize the address object?

Change the csf setting on ISFW (downstream) to set configuration-sync local.

Change the csf setting on ISFW (downstream) to set authorization-request-type certificate.

Change the csf setting on both devices to set downstream-access enable.

Change the csf setting on Local-FortiGate (root) to set fabric-object-unification default.

NEW QUESTION 25
Refer to the exhibits.

FGT-1 and FGT-2 are updated with HA configuration commands shown in the exhibit.
What would be the expected outcome in the HA cluster?

FGT-1 will remain the primary because FGT-2 has lower priority.

FGT-2 will take over as the primary because it has the override enable setting and higher priority than FGT-1.

FGT-1 will synchronize the override disable setting with FGT-2.

The HA cluster will become out of sync because the override setting must match on all HA members.

NEW QUESTION 26
Refer to the exhibits.
The exhibits show a firewall policy (Exhibit A) and an antivirus profile (Exhibit B).

Why is the user unable to receive a block replacement message when downloading an infected file for the first time?

The volume of traffic being inspected is too high for this model of FortiGate.

The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.

The firewall policy performs the full content inspection on the file.

The flow-based inspection is used, which resets the last packet to the user.

The flow-based inspection is used, which resets the last packet to the user.
Key to right answer is “unable to receive a block replacement message when downloading an infected file for the first time”.
* “ONLY” If the virus is detected at the “START” of the connection, the IPS engine sends the block replacement message immediately
* When a virus is detected on a TCP session (FIRST TIME), but where “SOME PACKETS” have been already forwarded to the receiver, FortiGate “resets the connection” and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can’t be opened. The IPS engine also caches the URL of the infected file, so that if a “SECOND ATTEMPT” to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.
Two possible scenarios can occur when a virus is detected:
– When a virus is detected on a TCP session where some packets have been already forwarded to the receiver, FG resets the connection and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can’t be opened. The IPS engine also caches the URL of the infected file, so that IF A SECOND ATTEMPT TO TRANSMIT THE FILE IS MADE, THE IPS ENGINE WILL SEND A BLOCK REPLACEMENT MESSAGE to the client instead of scanning the file again.
– If the virus is detected at the start of the connection, the IPS engine sends the block replacement message immediately.
In flow based inspection, when a virus is detected on a TCP session where some packets have been already forwarded to the receiver, FortiGate resets the connection and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can’t be opened. The IPS engine also caches the URL of the infected file, so that if a second attempt to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.

NEW QUESTION 27
A network administrator is configuring an IPsec VPN tunnel for a sales employee travelling abroad.
Which IPsec Wizard template must the administrator apply?

Remote Access

Site to Site

Dial up User

iHub-and-Spoke

NEW QUESTION 28
Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?

Intrusion prevention system engine

Detection engine

Flow engine

Antivirus engine

NEW QUESTION 29
Refer to the exhibit.

FortiGate has two separate firewall policies for Sales and Engineering to access the same web server with the same security profiles.
Which action must the administrator perform to consolidate the two policies into one?

Enable Multiple Interface Policies to select port1 and port2 in the same firewall policy

Create an Interface Group that includes port1 and port2 to create a single firewall policy

Select port1 and port2 subnets in a single firewall policy.

Replace port1 and port2 with the any interface in a single firewall policy.

NEW QUESTION 30
Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.

ADVPN is only supported with IKEv2.

Tunnels are negotiated dynamically between spokes.

Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

NEW QUESTION 31
Refer to the exhibit.

Review the Intrusion Prevention System (IPS) profile signature settings.
Which statement is correct in adding the FTP .Login.Failed signature to the IPS sensor profile?

Traffic matching the signature will be silently dropped and logged.

The signature setting uses a custom rating threshold.

The signature setting includes a group of other signatures.

Traffic matching the signature will be allowed and logged.

NEW QUESTION 32
Refer to the exhibits.
The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) for Facebook.
Users are given access to the Facebook web application. They can play video content hosted on Facebook, but they are unable to leave reactions on videos or other types of posts.

Which part of the policy configuration must you change to resolve the issue?

Force access to Facebook using the HTTP service.

Make the SSL inspection a deep content inspection.

Add Facebook in the URL category in the security policy.

Get the additional application signatures required to add to the security policy.

NEW QUESTION 33
Which two statements are true about collector agent advanced mode? (Choose two.)

Security profiles can be applied only to user groups, nor individual users.

FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.

Advanced mode supports nested or inherited groups.

Advanced mode uses Windows convention-NetBios: DomainUsername.

NEW QUESTION 34
Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?

By default, FortiGate uses WINS servers to resolve names.

By default, the SSL VPN portal requires the installation of a client’s certificate.

By default, split tunneling is enabled.

By default, the admin GUI and SSL VPN portal use the same HTTPS port.

NEW QUESTION 35
Refer to the exhibit.

Examine the intrusion prevention system (IPS) diagnostic command.
Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?

The IPS engine was inspecting high volume of traffic.

The IPS engine was unable to prevent an intrusion attack.

The IPS engine was blocking all traffic.

The IPS engine will continue to run in a normal state.

NEW QUESTION 36
Refer to the exhibit.

An administrator has configured a performance SLA on FortiGate, which failed to generate any traffic.
Why is FortiGate not sending probes to 4.2.2.2 and 4.2.2.1 servers? (Choose two.)