Use FCP_FGT_AD-7.6 Dumps to Obtain Fortinet Certification

1. Which two statements are true about the RPF check? (Choose two.)

2. Which two statements about advanced AD access mode for the FSSO collector, agent are true? (Choose two.)

A. FortiGate can act as an LDAP client to configure the group filters.

B. It uses the Windows convention for naming; that is, DomainUsername.

C. It supports monitoring of nested groups.

D. It is only supported if DC agents are deployed.

3. Which type of logs on FortiGate record information about traffic directly to and from the FortiGate management IP addresses?

A. Local traffic logs

B. Forward traffic logs

C. System event logs

D. Security logs

4. Which two IP pool types are useful for carrier-grade NAT deployments? (Choose two.)

A. Port block allocation

B. Fixed port range

C. One-to-one

D. Overload

5. Which security fabric feature causes an event trigger to monitor the network when a threat is detected?

6. When configuring a firewall virtual wire pair policy, which following statement is true?

7. An administrator has configured two-factor authentication to strengthen SSL VPN access.

Which additional best practice can an administrator implement?

8. Refer to the exhibit.





Examine the intrusion prevention system (IPS) diagnostic command shown in the exhibit.

If option 5 is used with the IPS diagnostic command and the outcome is a decrease in the CPU usage, what is the correct conclusion?

9. If the Services field is configured in a Virtual IP (VIP), which of the following statements is true when central NAT is used?

10. Which three methods are used by the collector agent for AD polling? (Choose three.)

A. WMI

B. Novell API

C. WinSecLog

D. NetAPI

E. FortiGate polling

11. An administrator must enable a DHCP server on one of the directly connected networks on FortiGate. However, the administrator is unable to complete the process on the GUI to enable the service on the interface.

In this scenario, what prevents the administrator from enabling DHCP service?

12. When configuring a FortiGate in a multi-WAN setup, why would an administrator enable session preservation on an interface?

13. Examine the IPS sensor and DoS policy configuration shown in the exhibit, then answer the question below.





When detecting attacks, which anomaly, signature, or filter will FortiGate evaluate first?

14. Refer to the exhibit.





What would be the impact of these settings on the Server certificate SNI check configuration on FortiGate?

15. An administrator configured a FortiGate to act as a collector for agentless polling mode.

What must the administrator add to the FortiGate device to retrieve AD user group information?

16. Which two statements about antivirus scanning in a firewall policy set to proxy-based inspection mode, are true? (Choose two.)

17. Which three statements explain a flow-based antivirus profile? (Choose three.)

A. Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.

B. If a virus is detected, the last packet is delivered to the client.

C. The IPS engine handles the process as a standalone.

D. FortiGate buffers the whole file but transmits to the client at the same time.

E. Flow-based inspection optimizes performance compared to proxy-based inspection.

18. Which two statements correctly describe the differences between IPsec main mode and IPsec aggressive mode? (Choose two.)

A. The first packet of aggressive mode contains the peer ID, while the first packet of main mode does not.

B. Main mode cannot be used for dialup VPNs, while aggressive mode can.

C. Aggressive mode supports XAuth, while main mode does not.

D. Six packets are usually exchanged during main mode, while only three packets are exchanged during aggressive mode.

19. An administrator configured the antivirus profile in a firewall policy set to flow-based inspection mode. While testing the configuration, the administrator noticed that eicar.com test files can be downloaded using HTTPS protocol only.

What is causing this issue?

20. An administrator is configuring an IPsec VPN between site A and site B. The Remote Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.168.1.0/24 and the remote quick mode selector is 192.168.2.0/24.

Which subnet must the administrator configure for the local quick mode selector for site B?

A. 192.168.2.0/24

B. 192.168.0.0/8

C. 192.168.1.0/24

D. 192.168.3.0/24

21. A network administrator is configuring a new IPsec VPN tunnel on FortiGate. The remote peer IP address is dynamic. In addition, the remote peer does not support a dynamic DNS update service.

Which type of remote gateway should the administrator configure on FortiGate for the new IPsec VPN tunnel to work?

22. Which three statements about SD-WAN performance SLAs are true? (Choose three.)

23. Refer to the exhibit, which shows the IPS sensor configuration.





If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

24. A FortiGate firewall policy is configured with active authentication however, the user cannot authenticate when accessing a website.

Which protocol must FortiGate allow even though the user cannot authenticate?

25. Refer to the exhibits.





Based on the current HA status, an administrator updates the override and priority parameters on HQ-NGFW-1 and HQ-NGFW-2 as shown in the exhibit.

What would be the expected outcome in the HA cluster?

26. Which two protocols are used to enable administrator access of a FortiGate device? (Choose two.)

A. SSH

B. HTTPS

C. FTM

D. FortiTelemetry

27. FortiGate is integrated with FortiAnalyzer and FortiManager.

When a firewall policy is created, which attribute is added to the policy to improve functionality and to support recording logs to FortiAnalyzer or FortiManager?

28. Refer to the exhibit:





Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)

29. Which two statements describe characteristics of automation stitches? (Choose two.)

30. An administrator wants to block https://www.example.com/videos and allow all other URLs on the website.

What are two configuration changes that the administrator can make to satisfy the requirement? (Choose two.)

31. Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)

32. A new administrator is configuring FSSO authentication on FortiGate using DC Agent Mode.

Which step is NOT part of the expected process?

33. When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?

34. Refer to the exhibit, which shows a partial configuration from the remote authentication server.





Why does the FortiGate administrator need this configuration?

35. An employee needs to connect to the office through a high-latency internet connection.

Which SSL VPN setting should the administrator adjust to prevent SSL VPN negotiation failure?

A. SSL VPN idle-timeout

B. SSL VPN login-timeout

C. SSL VPN dtls-hello-timeout

D. SSL VPN session-ttl

36. Which three strategies are valid SD-WAN rule strategies for member selection? (Choose three.)

37. There are multiple dial-up IPsec VPNs configured in aggressive mode on the HQ FortiGate. The requirement is to connect dial-up users to their respective department VPN tunnels.

Which phase 1 setting you can configure to match the user to the tunnel?

38. An administrator notices that some users are unable to establish SSL VPN connections, while others can connect without any issues.

What should the administrator check first?

39. An administrator needs to create a tunnel mode SSL-VPN to access an internal web server from the Internet. The web server is connected to port1. The Internet is connected to port2. Both interfaces belong to the VDOM named Corporation.

What interface must be used as the source for the firewall policy that will allow this traffic?

40. Which two settings must you configure when FortiGate is being deployed as a root FortiGate in a Security Fabric topology? (Choose two.)

41. FortiGuard categories can be overridden and defined in different categories. To create a web rating override for the example.com home page, the override must be configured using a specific syntax.

Which two syntaxes are correct to configure a web rating override for the home page? (Choose two.)

A. www.example.com

B. www.example.com/index.html

C. www.example.com:443

D. example.com

42. Refer to the web filter raw logs.





Based on the raw logs shown in the exhibit, which statement is correct?

43. Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two.)

44. Which method allows management access to the FortiGate CLI without network connectivity?

45. Refer to the exhibit.





Which statement about the configuration settings is true?

46. Which two statements about IPsec authentication on FortiGate are correct? (Choose two.)

A. For a stronger authentication, you can also enable extended authentication (XAuth) to request the remote peer to provide a username and password.

B. FortiGate supports pre-shared key and signature as authentication methods.

C. Enabling XAuth results in a faster authentication because fewer packets are exchanged.

D. A certificate is not required on the remote peer when you set the signature as the authentication

method.

47. Refer to the exhibits.

Exhibit A shows system performance output.





Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds.





Based on the system performance output, which two results are correct? (Choose two.)

48. Refer to exhibit.

An administrator configured the web filtering profile shown in the exhibit to block access to all social networking sites except Twitter. However, when users try to access twitter.com, they are redirected to a FortiGuard web filtering block page.





Based on the exhibit, which configuration change can the administrator make to allow Twitter while blocking all other social networking sites?

49. An administrator wants to analyze and manage digital certificates to prevent browser warnings when users connect to the SSL VPN portal.

Which two statements describe how to correctly do this? (Choose two.)

50. Which statement about the deployment of the Security Fabric in a multi-VDOM environment is true?

51. Which Security rating scorecard helps identify configuration weakness and best practice violations in your network?

A. Fabric Coverage

B. Automated Response

C. Security Posture

D. Optimization

52. Refer to the exhibit.





The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile.

An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category.

What are two solutions for satisfying the requirement? (Choose two.)

53. Refer to the exhibit.





Based on the ZTNA tag, the security posture of the remote endpoint has changed.

What will happen to endpoint active ZTNA sessions?

54. A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors.

What is the reason for the certificate warning errors?

55. Which two statements describe how the RPF check is used? (Choose two.)

56. Which three methods can you use to deliver the token code to a user who is configured to use two-factor authentication? (Choose three.)

57. The HTTP inspection process in web filtering follows a specific order when multiple features are enabled in the web filter profile.

What order must FortiGate use when the web filter profile has features enabled, such as safe search?

58. Refer to the exhibit.





An administrator is running a sniffer command as shown in the exhibit.

Which three pieces of information are included in the sniffer output? (Choose three.)

59. Refer to the exhibits.













The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration.

An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2.

The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver.

Which two configuration changes can the administrator make to the policy to deny Webserver access for Remote-User2? (Choose two.)

60. Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)

A. FortiSIEM

B. FortiCloud

C. FortiCache

D. FortiSandbox

E. FortiAnalyzer

61. You have configured an application control profile, set peer-to-peer traffic to Block under the Categories tab, and applied it to the firewall policy. However, your peer-to-peer traffic on known ports is passing through the FortiGate without being blocked.

What FortiGate settings should you check to resolve this issue?

62. What are two benefits of flow-based inspection compared to proxy-based inspection? (Choose two.)

A. FortiGate uses fewer resources.

B. FortiGate performs a more exhaustive inspection on traffic.

C. FortiGate adds less latency to traffic.

D. FortiGate allocates two sessions per connection.

63. An administrator is configuring an Ipsec between site A and site B. The Remotes Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.16.1.0/24 and the remote quick mode selector is 192.16.2.0/24.

How must the administrator configure the local quick mode selector for site B?

A. 192.16.3.0/24

B. 192.16.2.0/24

C. 192.16.1.0/24

D. 192.16.0.0/8

64. Which two statements are true about an HA cluster? (Choose two.)

65. Refer to the exhibit to view the authentication rule configuration.





In this scenario, which statement is true?

A. Session-based authentication is enabled

B. Policy-based authentication is enabled

C. IP-based authentication is enabled

D. Route-based authentication is enabled

66. Refer to the exhibit, which shows an SD-WAN zone configuration on the FortiGate GUI.





Based on the exhibit, which statement is true?

67. To complete the final step of a Security Fabric configuration, an administrator must authorize all the devices on which device?

68. What is eXtended Authentication (XAuth)?

69. Which statement about firewall policy NAT is true?

70. Refer to the exhibit.





The exhibit shows a FortiGate configuration.

How does FortiGate handle web proxy traffic coming from the IP address 10.2.1.200, that requires authorization?

71. When configuring a firewall virtual wire pair policy, which following statement is true?

72. In which two ways can RPF checking be disabled? (Choose two.)

73. Which two inspection modes can you use to configure a firewall policy on a profile-based next-generation firewall (NGFW)? (Choose two.)

A. Proxy-based inspection

B. Certificate inspection

C. Flow-based inspection

D. Full Content inspection

74. Refer to the exhibit.





The predefined deep-inspection and custom-deep-inspection profiles exclude some web categories from SSL inspection, as shown in the exhibit.

For which two reasons are these web categories exempted? (Choose two.)

75. Refer to the exhibits.









The exhibits contain a network diagram, and virtual IP, IP pool, and firewall policies configuration information.

The WAN (port1) interface has the IP address 10.200.1.1/24.

The LAN (port3) interface has the IP address 10.0.1.254/24.

The first firewall policy has NAT enabled using IP pool.

The second firewall policy is configured with a VIP as the destination address.

Which IP address will be used to source NAT (SNAT) the internet traffic coming from a workstation with the IP address 10.0.1.10?

76. FortiGate is operating in NAT mode and has two physical interfaces connected to the LAN and DMZ networks respectively.

Which two statements are true about the requirements of connected physical interfaces on FortiGate? (Choose two.)

77. An administrator wanted to configure an IPS sensor to block traffic that triggers a signature set

number of times during a specific time period.

How can the administrator achieve the objective?

78. Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

79. Which three settings and protocols can be used to provide secure and restrictive administrative access to FortiGate? (Choose three.)

A. SSH

B. FortiTelemetry

C. Trusted host

D. HTTPS

E. Trusted authentication

80. View the exhibit.





Both VDOMs are operating in NAT/route mode. The subnet 10.0.1.0/24 is connected to VDOM1. The subnet 10.0.2.0/24 is connected to VDOM2. There is an inter-VDOM link between VDOM1 and VDOM2. Also, necessary firewall policies are configured in VDOM1 and VDOM2.

Which two static routes are required in the FortiGate configuration, to route traffic between both subnets through an inter-VDOM link? (Choose two.)

81. In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy.

Instead of separate policies.

Which three statements are true about consolidated IPv4 and IPv6 policy configuration? (Choose three.)

82. Refer to the exhibit.





























The exhibit shows proxy policies and proxy addresses, the authentication rule and authentication scheme, users, and firewall address.

An explicit web proxy is configured for subnet range 10.0.1.0/24 with three explicit web proxy policies. The authentication rule is configured to authenticate HTTP requests for subnet range 10.0.1.0/24 with a form-based authentication scheme for the FortiGate local user database. Users will be prompted for authentication.

How will FortiGate process the traffic when the HTTP request comes from a machine with the source IP 10.0.1.10 to the destination http:// www.fortinet.com? (Choose three.)

83. What are two features of FortiGate FSSO agentless polling mode? (Choose two.)

84. An administrator needs to inspect all web traffic (including Internet web traffic) coming from users connecting to the SSL-VPN.

How can this be achieved?

85. A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.

All traffic must be routed through the primary tunnel when both tunnels are up. The secondary tunnel must be used only if the primary tunnel goes down. In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover.

Which two key configuration changes must the administrator make on FortiGate to meet the requirements? (Choose two.)

86. Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

A. NetAPI polling can increase bandwidth usage in large networks.

B. The NetSessionEnum function is used to track user logouts.

C. The collector agent must search security event logs.

D. The collector agent uses a Windows API to query DCs for user logins.

87. Refer to the exhibit.





A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 failed to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.

Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes can the administrator make to bring phase 1 up? (Choose two.)