FCP_FGT_AD-7.4 Exam Info and Free Practice Test Professional Quiz Study Materials [Q53-Q73]

5/5 - (2 votes)

FCP_FGT_AD-7.4 Exam Info and Free Practice Test Professional Quiz Study Materials

Accurate Hot Selling FCP_FGT_AD-7.4 Exam Dumps 2025 Newly Released

Q53. Refer to the exhibit, which contains a session list output.

Based on the information shown in the exhibit, which statement is true?

Port block allocation IP pool is used in the firewall policy

Destination NAT is disabled in the firewall policy

Overload NAT IP pool is used in the firewall policy

One-to-one NAT IP pool is used in the firewall policy

Q54. Which two statements are true when FortiGate is in transparent mode? (Choose two.)

By default, all interfaces are part of the same broadcast domain.

The existing network IP schema must be changed when installing a transparent mode FortiGate in the network.

Static routes are required to allow traffic to the next hop.

FortiGate forwards frames without changing the MAC address.

Q55. Refer to the exhibits, which show the firewall policy and an antivirus profile configuration.

Why is the user unable to receive a block replacement message when downloading an infected file for the first time?

The intrusion prevention security profile must be enabled when using flow-based inspection mode.

The option to send files to FortiSandbox for inspection is enabled.

The firewall policy performs a full content inspection on the file.

Flow-based inspection is used, which resets the last packet to the user.

Q56. Refer to the exhibits.

The exhibits show the application sensor configuration and the Excessive-Bandwidth and Apple filter details.
Based on the configuration, what will happen to Apple FaceTime if there are only a few calls originating or incoming?

Apple FaceTime will be allowed, based on the Video/Audio category configuration.

Apple FaceTime will be allowed, based on the Apple filter configuration.

Apple FaceTime will be allowed only if the Apple filter in Application and Filter Overrides is set to Allow.

Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.

Q57. Refer to the exhibit.

Why did FortiGate drop the packet?

11 matched an explicitly configured firewall policy with the action DENY

It failed the RPF check.

The next-hop IP address is unreachable.

It matched the default implicit firewall policy

Q58. Which timeout setting can be responsible for deleting SSL VPN associated sessions?

SSL VPN idle-timeout

SSL VPN http-request-body-timeout

SSL VPN login-timeout

SSL VPN dtls-hello-timeout

Q59. Refer to the exhibit.

A user located behind the FortiGate device is trying to go to http://www.addictinggames.com (Addicting.Games). The exhibit shows the application detains and application control profile.
Based on this configuration, which statement is true?

Addicting.Games will be blocked, based on the Filter Overrides configuration.

Addicting.Games will be allowed only if the Filter Overrides action is set to Learn.

Addicting.Games will be allowed, based on the Categories configuration.

Addicting.Games will be allowed, based on the Application Overrides configuration.

Q60. Which statement is a characteristic of automation stitches?

They can be run only on devices in the Security Fabric.

They can be created only on downstream devices in the fabric.

They can have one or more triggers.

They can run multiple actions at the same time.

Q61. Which two VDOMs are the default VDOMs created when FortiGate is set up in split VDOM mode?
(Choose two.)

FG-traffic

Mgmt

FG-Mgmt

Root

Q62. Which three methods are used by the collector agent for AD polling? (Choose three.)

WinSecLog

WMI

NetAPI

FSSO REST API

FortiGate polling

Q63. An administrator manages a FortiGate model that supports NTurbo.
How does NTurbo enhance performance for flow-based inspection?

NTurbo offloads traffic to the content processor.

NTurbo creates two inspection sessions on the FortiGate device.

NTurbo buffers the whole file and then sends it to the antivirus engine.

NTurbo creates a special data path to redirect traffic between the IPS engine its ingress and egress interfaces.

Q64. Which two statements are correct regarding FortiGate FSSO agentless polling mode? (Choose two.)

FortiGate uses the AD server as the collector agent

FortiGate uses the SMB protocol to read the event viewer logs from the DCs

FortiGate points the collector agent to use a remote LDAP server

FortiGate queries AD by using the LDAP to retrieve user group information

Q65. Refer to the exhibit, which shows a partial configuration from the remote authentication server.

Why does the FortiGate administrator need this configuration?

To authenticate only the Training user group.

To set up a RADIUS server Secret

To authenticate and match the Training OU on the RADIUS server.

To authenticate Any FortiGate user groups.

Q66. Which two attributes are required on a certificate so it can be used as a CA certificate on SSL inspection?
(Choose two.)

The issuer must be a public CA

The CA extension must be set to TRUE

The Authority Key Identifier must be of type SSL

The keyUsage extension must be set to

Q67. Which statements are true regarding firewall policy NAT using the outgoing interface IP address with fixed port disabled? (Choose two.)

This is known as many-to-one NAT.

Source IP is translated to the outgoing interface IP.

Connections are tracked using source port and source MAC address.

Port address translation is not used.

Q68. Which two statements are true about the RPF check? (Choose two.)

The RPF check is run on the first sent packet of any new session.

The RPF check is run on the first reply packet of any new session.

The RPF check is run on the first sent and reply packet of any new session.

RPF is a mechanism that protects FortiGuard and your network from IP spoofing attacks.

Q69. A team manager has decided that, while some members of the team need access to a particular website, the majority of the team does not.
Which configuration option is the most effective way to support this request?

Implement web filter quotas for the specified website

Implement a DNS filter for the specified website.

Implement a web filter category override for the specified website

Implement web filter authentication for the specified website.

Q70. Which additional load balancing method is supported in equal cost multipath (ECMP) load balancing when SD-WAN is enabled?

Volume based

Source-destination IP based

Source IP based

Weight based

Q71. Which two statements about advanced AD access mode for the FSSO collector, agent are true?
(Choose two.)

FortiGate can act as an LDAP client to configure the group filters.

It uses the Windows convention for naming; that is, DomainUsername.

It supports monitoring of nested groups.

It is only supported if DC agents are deployed.

Q72. Refer to the exhibits.

An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).
What must the administrator do to synchronize the address object?

Change the csf setting on Local-FortiGate (root) to sec fabric-object-unification default.

Change the csf setting on both devices to sec downscream-access enable.

Change the csf setting on ISFW (downstream) to sec auchorizacion-requesc-cype certificace.

Change the csf setting on ISFW (downstream) to sec configuration-sync local.

Q73. Refer to the exhibits.

The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration.
An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2.
The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver.
Which two configuration changes can the administrator make to the policy to deny Webserver access for Remote-User2? (Choose two.)

Enable match-vip in the Deny policy.

Set the Destination address as Webserver in the Deny policy.

Disable match-vip in the Deny policy.

Set the Destination address as Deny_IP in the Allow_access policy.

Fortinet FCP_FGT_AD-7.4 Exam Syllabus Topics:

Topic	Details
Topic 1	Content Inspection: This section covers how to inspect encrypted traffic, configure inspection modes, apply web filtering, manage applications, set antivirus modes, and implement IPS for security.
Topic 2	Deployment and System Configuration: This section covers how to set up initial configurations, implement Fortinet Security Fabric, and configure an FGCP HA cluster; diagnose resources and connectivity.
Topic 3	VPN: In this section, the focus is on how to configure SSL VPNs for secure network access and implement meshed or redundant IPsec VPNs.
Topic 4	Firewall Policies and Authentication: This topic covers how to set firewall policies, configure SNAT DNAT, implement authentication methods, and deploy FSSO.
Topic 5	Routing: This section covers how to set up packet routing with static routes and configure SD-WAN for efficient traffic load balancing.