Fortinet
FCP_FGT_AD-7.4
FCP - FortiGate 7.4 Administrator
QUESTION & ANSWERS
QUESTION: 1
If the Issuer and Subject values are the same in a digital certificate, to which type of entity was the
certificate issued?
Option A : A subordinate CA
Option B : A root CA
Option C : A user
Option D : A CRL
Correct Answer: B
Explanation/Reference:
If the Issuer and Subject values are the same in a digital certificate, it typically indicates that the certificate is a self-signed
certificate. Therefore, the correct answer is:
B. A root CA (Certificate Authority)
A self-signed certificate is one where the entity that issued the certificate is also the entity identified by the certificate. In the
context of a Certificate Authority (CA), this is often referred to as a root CA certificate. Root CA certificates are at the top of the
certificate hierarchy and are used to sign other certificates, creating a chain of trust in a Public Key Infrastructure (PKI).
Download From Here: https://www.dumpscertify.com/product/FCP_FGT_AD-7.4exam
QUESTION: 2
You have enabled logging on your FortiGate device for Event logs and all Security logs, and you have set up
logging to use the FortiGate local disk.What is the default behavior when the local disk is full?
Option A : Logs are overwritten and the only warning is issued when log disk usage reaches the threshold
of 95%.
Option B : No new log is recorded until you manually clear logs from the local disk.
Option C : Logs are overwritten and the first warning is issued when log disk usage reaches the threshold
of 75%.
Option D : No new log is recorded after the warning is issued when log disk usage reaches the threshold
of 95%.
Correct Answer: C
Explanation/Reference:
C is Correct First warnig 75%, second 90% and final Warning 95%
Only 75% of the disk is available to store logs, this is distributed in the existing vdoms.
Diagnose sys logdisk usage -- CLI command to verify this.
QUESTION: 3
An administrator needs to configure VPN user access for multiple sites using the same soft FortiToken. Each
site has a FortiGate VPN gateway.What must an administrator do to achieve this objective?
Option A : The administrator can register the same FortiToken on more than one FortiGate.
Option B : The administrator must use a FortiAuthenticator device.
Option C : The administrator can use a third-party radius OTP server.
Option D : The administrator must use the user self-registration server.
Correct Answer: B
Explanation/Reference:
B is correct due to the FortiToken, a different OTP cannot use FortiToken. So we have to choose the fortiAuthenticator.
To achieve VPN user access for multiple sites using the same soft FortiToken, the administrator can use a FortiAuthenticator
device. FortiAuthenticator is designed to provide centralized authentication services for Fortinet devices, including VPN
authentication. It allows for the centralized management of user identities, authentication methods, and FortiTokens. By using
FortiAuthenticator, the administrator can register the same FortiToken for users across multiple FortiGate devices, providing a
seamless and centralized user access experience.
Download From Here: https://www.dumpscertify.com/product/FCP_FGT_AD-7.4-exam
QUESTION: 4
Refer to the exhibits.Exhibit A shows a topology for a FortiGate HA cluster that performs proxy-based
inspection on traffic. Exhibit B shows the HA configuration and the partial output of the get system ha status
command.
Based on the exhibits, which two statements about the traffic passing through the cluster are true? (Choose
two.)
Option A : For non-load balanced connections, packets forwarded by the cluster to the server contain the
virtual MAC address of port2 as source.
Option B : The traffic sourced from the client and destined to the server is sent to FGT-1.
Option C : The cluster can load balance ICMP connections to the secondary.
Option D : For load balanced connections, the primary encapsulates TCP SYN packets before forwarding
them to the secondary.
Correct Answer: A,D
Explanation/Reference:
A: Non load balance: traffic enters port1 and go out port2 from FGT1. FGT2 is in primary mode
D: In proxy inspection mode, SYN packet goes to FGT1 port1. It is then forwarded to FGT2. the source MAC address of the
packet is changed to the physical MAC address of port1 on the primary and the destination MAC address to the physical MAC
address of port1 on the secondary. This is also known as MAC address rewrite. In addition, the primary encapsulates the packet
in an Ethernet frame type 0x8891. The encapsulation is done only for the first packet of a load balanced session
A. For non-load balanced connections, packets forwarded by the cluster to the server contain the virtual MAC address of port2
as source.
D. For load balanced connections, the primary encapsulates TCP SYN packets before forwarding them to the secondary.
Incorrect:
B. The traffic sourced from the client and destined to the server is sent to FGT-1. (not primary)
C. The cluster can load balance ICMP connections to the secondary. (not enabled)
"To forward traffic correctly, a FortiGate HA solution uses virtual MAC addresses."
"The primary forwards the SYN packet to the selected secondary. (...) This is also known as MAC address rewrite. In addition,
the primary encapsulates the packet in an Ethernet frame type 0x8891. The encapsulation is done only for the first packet of a
load balanced session. The encapsulated packet includes the original packet plus session information that the secondary
requires to process the traffic."
Download From Here: https://www.dumpscertify.com/product/FCP_FGT_AD-7.4-exam
QUESTION: 5
Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)
Option A : FortiGuard update servers
Option B : System time
Option C : Operating mode
Option D : NGFW mode
Correct Answer: C,D
Explanation/Reference:
C: "Operating mode is per-VDOM setting. You can combine transparent mode VDOM's with NAT mode VDOMs on the same
physical Fortigate".
D: "Inspection-mode selection has moved from VDOM to firewall policy, and the default inspection-mode is flow, so NGFW Mode
can be changed from Profile-base (Default) to Policy-base directly in System > Settings from the VDOM".
A and B are incorrect: "The firmware on your Fortigate and some settings, such as system time, apply to the entire device-they
are not specific to each VDOM.
"NGFW mode is a per-VDOM setting."
"Operation mode is a per-VDOM setting. You can combine transparent mode VDOMs with NAT mode VDOMs on the same
physical FortiGate."
QUESTION: 6
In an explicit proxy setup, where is the authentication method and database configured?
Option A : Proxy Policy
Option B : Authentication Rule
Option C : Firewall Policy
Option D : Authentication scheme
Correct Answer: D
Explanation/Reference:
In an explicit proxy setup, the authentication method and database can indeed be configured in the "Authentication Scheme."
The Authentication Scheme defines the method and parameters used for user authentication when accessing the internet
through the explicit proxy.
So, the correct answer is:
D. Authentication Scheme
QUESTION: 7
Refer to the exhibit.
In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The
administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit.
What should the administrator do next to troubleshoot the problem?
Option A : Run a sniffer on the web server.
Option B : Capture the traffic using an external sniffer connected to port1.
Option C : Execute another sniffer in the FortiGate, this time with the filter “host 10.0.1.10”
Option D : Execute a debug flow.
Correct Answer: D
Explanation/Reference:
Because sniffer shows the ingressing and egressing packets, but we cannot see dropped packets by fortigate in a
sniffer. Debugging can show the packets are not entering for any reasons caused by fortigate. So, if a packed is
reached to fortigate and dropped , debug will show us.
Download From Here: https://www.dumpscertify.com/product/FCP_FGT_AD-7.4-exam
QUESTION: 8
Refer to the exhibit to view the authentication rule configuration.
In this scenario, which statement is true?
Option A : Session-based authentication is enabled
Option B : Policy-based authentication is enabled
Option C : IP-based authentication is enabled
Option D : Route-based authentication is enabled
Correct Answer: A
Explanation/Reference:
The correct statement is:
A. Session-based authentication is enabled
The configuration specifies the use of web authentication cookies (set web-auth-cookie enable), which is a form of sessionbased authentication.
NTLM authentication = session-based
QUESTION: 9
Refer to the exhibit.
The exhibit shows proxy policies and proxy addresses, the authentication rule and authentication scheme,
users, and firewall address.
An explicit web proxy is configured for subnet range 10.0.1.0/24 with three explicit web proxy policies.
The authentication rule is configured to authenticate HTTP requests for subnet range 10.0.1.0/24 with a
form-based authentication scheme for the FortiGate local user database. Users will be prompted for
authentication.
How will FortiGate process the traffic when the HTTP request comes from a machine with the source IP
10.0.1.10 to the destination http:// www.fortinet.com? (Choose three.)
Option A : If a Mozilla Firefox browser is used with User-B credentials, the HTTP request will be allowed.
Option B : If a Google Chrome browser is used with User-B credentials, the HTTP request will be allowed.
Option C : If a Mozilla Firefox browser is used with User-A credentials, the HTTP request will be allowed.
Option D : If a Microsoft Internet Explorer browser is used with User-B credentials, the HTTP request will be
allowed.
Option E : If a Mozilla Firefox browser is used with User-C credentials, the HTTP request will be denied.
Correct Answer: B,C,D
Explanation/Reference:
- Browser CAT2 & Local subnet & User B --> deny
- Browser CAT1 & Local subnet & User all --> accept
Above exhibits only users from Chrome and IE are allowed.
Chrome and IE use the same system proxy setting. Proxy rule is accept for all users with these two browsers.
C: hit the 3rd rule.
QUESTION: 10
Which of the following statements correctly describes FortiGates route lookup behavior when searching for a
suitable gateway? (Choose two)
Option A : Lookup is done on the first packet from the session originator
Option B : Lookup is done on the last packet sent from the responder
Option C : Lookup is done on every packet, regardless of direction
Option D : Lookup is done on the first reply packet from the responder
Correct Answer: A,D
Explanation/Reference:
FortiGate performs route lookup based on the trust packet. The trust packet is the first packet of the session that is sent by the
session originator. This is the packet that initiates the communication. The route lookup is also done on the trust reply packet,
which is the first reply packet received from the responder.
In summary, FortiGate looks at the initial packet from the session originator and the first reply packet from the responder when
performing route lookup to determine the suitable gateway.
QUESTION: 11
Which three criteria can FortiGate use to look for a matching firewall policy to process traffic? (Choose three.)
Option A : Services defined in the firewall policy
Option B : Highest to lowest priority defined in the firewall policy
Option C : Destination defined as Internet Services in the firewall policy
Option D : Lowest to highest policy ID number
Option E : E. Source defined as Internet Services in the firewall policy
Correct Answer: A,C,E
Explanation/Reference:
E. Source defined as Internet Services in the firewall policy
"When a packet arrives, how does FortiGate find a matching policy? Each policy has match criteria, which you can define using
the following objects:
• Incoming Interface
• Outgoing Interface
• Source: IP address, user, internet services
• Destination: IP address or internet services
• Service: IP protocol and port number
• Schedule: Specific times to apply policy"
Download From Here: https://www.dumpscertify.com/product/FCP_FGT_AD-7.4-exam
QUESTION: 12
Which statements are true regarding firewall policy NAT using the outgoing interface IP address with fixed
port disabled? (Choose two.)
Option A : This is known as many-to-one NAT.
Option B : Source IP is translated to the outgoing interface IP.
Option C : Connections are tracked using source port and source MAC address.
Option D : Port address translation is not used.
Correct Answer: A,B
Explanation/Reference:
Because the fixed port is disabled (default). If it is enable, then the answer would be C&D.
Fixed port disable means that source port translation can be used.
A. This is known as many-to-one NAT.
This statement is correct. When the source IP is translated to the outgoing interface IP address, it typically involves mapping
multiple private IP addresses to a single public IP address. This is commonly referred to as many-to-one NAT.
B. Source IP is translated to the outgoing interface IP.
This statement is also correct. In the context of the provided information, the source IP of outgoing traffic is translated to the IP
address of the outgoing interface.
So, both statements A and B are true regarding firewall policy NAT using the outgoing interface IP address with fixed port
disabled.
QUESTION: 13
Refer to the exhibits.The exhibits show a firewall policy (Exhibit A) and an antivirus profile (Exhibit B).
Why is the user unable to receive a block replacement message when downloading an infected file for the
first time?
Option A : The volume of traffic being inspected is too high for this model of FortiGate.
Option B : The intrusion prevention security profile needs to be enabled when using flow-based inspection
mode.
Option C : The firewall policy performs the full content inspection on the file.
Option D : The flow-based inspection is used, which resets the last packet to the user.
Correct Answer: D
Explanation/Reference:
Key to right answer is "unable to receive a block replacement message when downloading an infected file for the first time".
• "ONLY" If the virus is detected at the "START" of the connection, the IPS engine sends the block replacement message
immediately
• When a virus is detected on a TCP session (FIRST TIME), but where "SOME PACKETS" have been already forwarded to the
receiver, FortiGate "resets the connection" and does not send the last piece of the file. Although the receiver got most of the
file content, the file has been truncated and therefore, can’t be opened. The IPS engine also caches the URL of the infected file,
so that if a "SECOND ATTEMPT" to transmit the file is made, the IPS engine will then send a block replacement message to the
client instead of scanning the file again.
Two possible scenarios can occur when a virus is detected:
- When a virus is detected on a TCP session where some packets have been already forwarded to the receiver, FG resets the
connection and does not send the last piece of the file. Although the receiver got most of the file content, the file has been
truncated and therefore, can't be opened. The IPS engine also caches the URL of the infected file, so that IF A SECOND
ATTEMPT TO TRANSMIT THE FILE IS MADE, THE IPS ENGINE WILL SEND A BLOCK REPLACEMENT MESSAGE to the client instead
of scanning the file again.
- If the virus is detected at the start of the connection, the IPS engine sends the block replacement message immediately.
In flow based inspection, when a virus is detected on a TCP session where some packets have been already forwarded to the
receiver, FortiGate resets the connection and does not send the last piece of the file. Although the receiver got most of the file
content, the file has been truncated and therefore, can’t be opened. The IPS engine also caches the URL of the infected file, so
that if a second attempt to transmit the file is made, the IPS engine will then send a block replacement message to the client
instead of scanning the file again.
QUESTION: 14
Refer to the exhibit.
Which statement about this firewall policy list is true?
Option A : The Implicit group can include more than one deny firewall policy.
Option B : The firewall policies are listed by ID sequence view.
Option C : The firewall policies are listed by ingress and egress interfaces pairing view.
Option D : LAN to WAN. WAN to LAN. and Implicit are sequence grouping view lists.
Correct Answer: C
Explanation/Reference:
The firewall policy list in the exhibit is arranged in the "Interface Pair View," where policies are grouped by their incoming
(ingress) and outgoing (egress) interface pairs. Each section (LAN to WAN, WAN to LAN, etc.) groups policies based on these
interface pairings. This view helps administrators quickly identify which policies apply to specific traffic flows between network
interfaces. Options A and D are incorrect because the Implicit group typically does not include more than one deny policy, and
there is no "sequence grouping view" in FortiGate. Option B is incorrect as the list is not displayed strictly by ID sequence.
References: FortiOS 7.4.1 Administration Guide: Firewall Policy Views
QUESTION: 15
A network administrator enabled antivirus and selected an SSL inspection profile on a firewall policy. When
downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When
downloading the same file through HTTPS, FortiGate does not detect the virus and does not block the file,
allowing it to be downloaded.The administrator confirms that the traffic matches the configured firewall
policy.What are two reasons for the failed virus detection by FortiGate? (Choose two.)
Option A : The website is exempted from SSL inspection.
Option B : The EICAR test file exceeds the protocol options oversize limit.
Option C : The selected SSL inspection profile has certificate inspection enabled.
Option D : The browser does not trust the FortiGate self-signed CA certificate.
Correct Answer: A,C
Explanation/Reference:
Two possible explanations for FortiGate's failure to detect the virus are:
A. The website is exempted from SSL inspection: If the website hosting the EICAR test file is exempt from SSL inspection,
FortiGate will not be able to inspect the encrypted traffic, leading to the virus going undetected.
C. The selected SSL inspection profile has certificate inspection enabled: If the SSL inspection profile used by FortiGate has
certificate inspection enabled, it may cause issues with SSL/TLS connections, potentially leading to the failure to detect the
virus in HTTPS traffic.
Deep inspection need to be enabled.
We're not talking about certificate trust warnings. The file was not decrypted, thus the antivur engine could not recognize the
payload as a virus.
While offering some level of security, certificate inspection does not permit the inspection of encrypted data. Deep-Inspection
is required in stead of Certificate-based to ensure content inspection.
QUESTION: 16
Which of the following are purposes of NAT traversal in IPsec? (Choose two.)
Option A : To detect intermediary NAT devices in the tunnel path.
Option B : To dynamically change phase 1 negotiation mode aggressive mode.
Option C : To encapsulation ESP packets in UDP packets using port 4500.
Option D : To force a new DH exchange with each phase 2 rekey
Correct Answer: A,C
Explanation/Reference:
When NAT-T is enabled on both ends, peers can detect any NAT device along the path. If NAT is found, then the following
occurs:
- Both phase 2 and remaining phase 1 packets change to UDP port 4500.
- Both ends encapsulate ESP within UDP port 4500.
Reference:
https://kb.fortinet.com/kb/documentLink.do?externalID=FD48755
QUESTION: 17
Which statement about the IP authentication header (AH) used by IPsec is true?
Option A : AH does not provide any data integrity or encryption.
Option B : AH does not support perfect forward secrecy.
Option C : AH provides data integrity but no encryption.
Option D : AH provides strong data integrity but weak encryption.
Correct Answer: C
Explanation/Reference:
C. AH provides data integrity but no encryption.
Then, I acknowledge the correction. The correct statement about the IP Authentication Header (AH) used by IPsec is that AH
provides data integrity and authentication but does not provide encryption.
"IPsec is a suite of protocols that is used for authenticating and encrypting traffic between two peers. The threemost used
protocols in the suite are the following:
- Internet Key Exchange (IKE), which does the handshake, tunnel maintenance, and disconnection.
- Encapsulation Security Payload (ESP), which ensures data integrity and encryption.
- Authentication Header (AH), which offers only data integrity - not encryption."
QUESTION: 18
Refer to the exhibits.The exhibits show the firewall policies and the objects used in the firewall policies.The
administrator is using the Policy Lookup feature and has entered the search criteria shown in the exhibit.
Which policy will be highlighted, based on the input criteria?
Option A : Policy with ID 4.
Option B : Policy with ID 5.
Option C : Policies with ID 2 and 3.
Option D : Policy with ID 1.
Correct Answer: B
Explanation/Reference:
It's coming from port 3 - hits Facebook-Web (Application) from the screenshot it show that it allows http and https traffic (80,
443).
There are 3 rules related to port3
and two rules source LOCAL_CLIENT
this would leave us with Rule 1 & 5
Rule one Service is = ULL_UDP
Rule five = Internet Services
Destination port we are looking for is 443 (usually this is TCP)
So it had to be PID5
We are looking for a policy that will allow or deny traffic from the source interface Port3 and source IP address 10.1.1.10
(LOCAL_CLIENT) to facebook.com TCP port 443 (HTTPS). There are only two policies that will match this traffic, policy ID 2 and
5. In FortiGate, firewall policies are evaluated from top to bottom. This means that the first policy that matches the traffic is
applied, and subsequent policies are not evaluated. Based on the Policy Lookup criteria, Policy ID 5 will be highlighted.
QUESTION: 19
Which two VDOMs are the default VDOMs created when FortiGate is set up in split VDOM mode? (Choose
two.)
Option A : FG-traffic
Option B : Mgmt
Option C : FG-Mgmt
Option D : Root
Correct Answer: A,D
Explanation/Reference:
Root VDOM is created by default when VDOMs are enabled.
configure on Fortigate:
- captive portal authentication required
- Authentication failed message for Sales users
- Authentication success for HR users
- second policy used by HR users
QUESTION: 20
What devices form the core of the security fabric?
Option A : Two FortiGate devices and one FortiManager device
Option B : One FortiGate device and one FortiManager device
Option C : Two FortiGate devices and one FortiAnalyzer device
Option D : One FortiGate device and one FortiAnalyzer device
Correct Answer: C
Explanation/Reference:
In certain scenarios, especially when emphasizing visibility and analysis, having multiple FortiGate devices and a FortiAnalyzer
device can indeed form a core configuration within the Fortinet Security Fabric. FortiAnalyzer is used for centralized logging,
reporting, and analysis of data from multiple FortiGate devices, enhancing the overall security posture.
QUESTION: 21
Which statement about traffic flow in an active-active HA cluster is true?
Option A : The SYN packet from the client always arrives at the primary device first.
Option B : The secondary device responds to the primary device with a SYN/ACK, and then the primary
device forwards the SYN/ACK to the client.
Option C : All FortiGate devices are assigned the same virtual MAC addresses for the HA heartbeat
interfaces to redistribute to the sessions.
Option D : The ACK from the client is received on the physical MAC address of the primary device.
Correct Answer: A
Explanation/Reference:
The correct statement about traffic flow in an active-active High Availability (HA) cluster is:
A. The SYN packet from the client always arrives at the primary device first.
In an active-active HA cluster, the primary device typically handles the initial SYN packet from the client. The primary device
then determines how to distribute the traffic among the cluster members.
The other statements are not accurate:
B is incorrect because the secondary device does not respond to the primary device with a SYN/ACK. The response is usually
handled by the primary device.
C is incorrect because in an active-active HA cluster, each FortiGate device has its own unique virtual MAC addresses for the
HA heartbeat interfaces.
D is incorrect because the ACK from the client is generally processed by the same device that received the initial SYN packet,
which is typically the primary device.
So, the correct choice is A.
QUESTION: 22
Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)
Option A : FortiSIEM
Option B : FortiCloud
Option C : FortiCache
Option D : FortiSandbox
Option E : FortiAnalyzer
Correct Answer: A,B,E
Explanation/Reference:
The three remote log storage options you can configure on FortiGate are:
A. FortiSIEM
FortiSIEM is a comprehensive security information and event management (SIEM) solution that allows for centralized log
storage and analysis.
B. FortiCloud
FortiCloud provides cloud-based services, including log storage, for Fortinet devices, allowing for remote log storage and
management.
E. FortiAnalyzer
FortiAnalyzer is a dedicated log and analysis appliance that provides centralized log storage, reporting, and analysis
capabilities for Fortinet devices.
So, the correct choices are A, B, and E.
Fortisandbox is not a logging solution.
QUESTION: 23
Refer to the FortiGuard connection debug output.
Based on the output shown in the exhibit, which two statements are correct? (Choose two.)
Option A : There is at least one server that lost packets consecutively.
Option B : One server was contacted to retrieve the contract information.
Option C : A local FortiManager is one of the servers FortiGate communicates with.
Option D : FortiGate is using default FortiGuard communication settings.
Correct Answer: B,D
Explanation/Reference:
B is correct, one server has the flag DI which means it was contacted to retrieve contract information.
A: no server has packets dropped
C: No local(ip) fortimanager can be seen
D: ..... Anycast is enabled by default(as it says on the study guide) so its not using default settings. still, it uses HTTPS(TCP) and
port 443 under tcp so we can consider this a default setting.
"by default, FortiGate is configured to enforce the use of HTTPS port 443 to perform live filtering with FortiGuard or
FortiManager"
We did check ourFortiGate and its configured the same.
Anycast is Enabled by default, but A and C are definitely incorrect.
QUESTION: 24
Which CLI command allows administrators to troubleshoot Layer 2 issues, such as an IP address conflict?
Option A : get system status
Option B : diagnose sys top
Option C : get system performance status
Option D : get system arp
Correct Answer: D
Explanation/Reference:
To troubleshoot Layer 2 issues, such as an IP address conflict, the appropriate CLI command is:
D. get system arp
Explanation:
D. get system arp
The get system arp command displays the Address Resolution Protocol (ARP) table. This table maps IP addresses to MAC
addresses and is essential for diagnosing Layer 2 issues like IP address conflicts. By examining the ARP table, administrators
can identify if multiple devices are claiming the same IP address, which indicates an IP address conflict.
Why Other Options Are Incorrect:
A. get system status
This command provides general information about the system's status, such as version, uptime, and hardware details. It does
not provide specific details about ARP or Layer 2 issues.
B. diagnose sys top
This command shows system performance metrics and resource usage, such as CPU and memory usage. It is useful for
performance troubleshooting but does not provide Layer 2 troubleshooting information.
C. get system performance status
This command provides performance statistics, similar to diagnose sys top, but it does not offer insights into Layer 2 issues or
the ARP table.
Thus, D. get system arp is the correct command to use for troubleshooting Layer 2 issues like IP address conflicts.
"If you suspect that there is an IP address conflict, or that an IP has been assigned to the wrong device, you may need to look
at the ARP table. The get system arp command is used for that purpose."