FCP in Network Security FCP_FGT_AD-7.4練習テストエンジン今すぐ試そう50試験問題 [Q23-Q42]

4/5 - (1 vote)

FCP in Network Security FCP_FGT_AD-7.4練習テストエンジン: 今すぐ試そう50試験問題

試験合格保証付きのFCP in Network Security FCP_FGT_AD-7.4試験問題集

新問題 23
Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)

FortiGuard update servers

System time

Operating mode

NGFW mode

新問題 24
Which two statements are true when FortiGate is in transparent mode? (Choose two.)

By default, all interfaces are part of the same broadcast domain.

The existing network IP schema must be changed when installing a transparent mode FortiGate in the network.

Static routes are required to allow traffic to the next hop.

FortiGate forwards frames without changing the MAC address.

新問題 25
Which two protocol options are available on the CLI but not on the GUI when configuring an SD-WAN Performance SLA? (Choose two.)

udp-echo

DNS

TWAMP

ping

新問題 26
Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM is enabled on all FortiGate devices?

FG-traffic VDOM

Root VDOM

Customer VDOM

Global VDOM

新問題 27
Refer to the exhibits.

FGT-1 and FGT-2 are updated with HA configuration commands shown in the exhibit.
What would be the expected outcome in the HA cluster?

FGT-1 will remain the primary because FGT-2 has lower priority.

FGT-2 will take over as the primary because it has the override enable setting and higher priority than FGT-1.

FGT-1 will synchronize the override disable setting with FGT-2.

The HA cluster will become out of sync because the override setting must match on all HA members.

新問題 28
Which two statements are correct about NGFW Policy-based mode? (Choose two.)

NGFW policy-based mode does not require the use of central source NAT policy

NGFW policy-based mode can only be applied globally and not on individual VDOMs

NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy

NGFW policy-based mode policies support only flow inspection

新問題 29
Refer to the exhibits.

FGT-1 and FGT-2 are updated with HA configuration commands shown in the exhibit.
What would be the expected outcome in the HA cluster?

FGT-1 will remain the primary because FGT-2 has lower priority.

FGT-2 will take over as the primary because it has the override enable setting and higher priority than FGT-1.

FGT-1 will synchronize the override disable setting with FGT-2.

The HA cluster will become out of sync because the override setting must match on all HA members.

新問題 30
In which two ways can RPF checking be disabled? (Choose two.)

Enable anti-replay in firewall policy.

Enable asymmetric routing.

Disable strict-src-check under system settings.

Disable the RPF check at the FortiGate interface level for the source check.

新問題 31
Refer to the exhibits.
An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).

What must the administrator do to synchronize the address object?

Change the csf setting on ISFW (downstream) to set configuration-sync local.

Change the csf setting on ISFW (downstream) to set authorization-request-type certificate.

Change the csf setting on both devices to set downstream-access enable.

Change the csf setting on Local-FortiGate (root) to set fabric-object-unification default.

新問題 32
Refer to the exhibits.

The exhibits contain a network diagram, and virtual IP, IP pool, and firewall policies configuration information.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
The first firewall policy has NAT enabled using IP pool.
The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT (SNAT) the internet traffic coming from a workstation with the IP address 10.0.1.10?

10.200.1.1

10.0.1.254

10.200.1.10

10.200.1.100

新問題 33
Which two statements are true about the Security Fabric rating? (Choose two.)

The Security Fabric rating is a free service that comes bundled with all FortiGate devices.

Many of the security issues can be fixed immediately by clicking Apply where available.

The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.

It provides executive summaries of the four largest areas of security focus.

新問題 34
Which additional load balancing method is supported in equal cost multipath (ECMP) load balancing when SD-WAN is enabled?

Volume based

Source-destination IP based

Source IP based

Weight based

新問題 35
Refer to the exhibit.

The exhibit shows a diagram of a FortiGate device connected to the network and the firewall policy and IP pool configuration on the FortiGate device.
Which two actions does FortiGate take on internet traffic sourced from the subscribers? (Choose two.)

FortiGate allocates port blocks per user, based on the configured range of internal IP addresses.

FortiGate allocates port blocks on a first-come, first-served basis.

FortiGate generates a system event log for every port block allocation made per user.

FortiGate allocates 128 port blocks per user.

新問題 36
A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
All traffic must be routed through the primary tunnel when both tunnels are up. The secondary tunnel must be used only if the primary tunnel goes down. In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover.
Which two key configuration changes must the administrator make on FortiGate to meet the requirements?
(Choose two.)

Enable Dead Peer Detection

Enable Auto-negotiate and AutokeyKeep Alive on the phase 2 configuration of both tunnels.

Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.

Configure a higher distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.

新問題 37
Refer to the exhibit.

Examine the intrusion prevention system (IPS) diagnostic command.
Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?

The IPS engine was inspecting high volume of traffic.

The IPS engine was unable to prevent an intrusion attack.

The IPS engine was blocking all traffic.

The IPS engine will continue to run in a normal state.

新問題 38
An administrator is configuring an IPsec VPN between site A and site B.
The Remote Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.168.1.0/24 and the remote quick mode selector is 192.168.2.0/24.
Which subnet must the administrator configure for the local quick mode selector for site B?

192.168.2.0/24

192.168.0.0/8

192.168.1.0/24

192.168.3.0/24

新問題 39
An administrator has configured outgoing interface any in a firewall policy.
Which statement is true about the policy list view?

Interface Pair view will be disabled.

Search option will be disabled.

Policy lookup will be disabled.

By Sequence view will be disabled.

新問題 40
A network administrator is configuring an IPsec VPN tunnel for a sales employee travelling abroad.
Which IPsec Wizard template must the administrator apply?

Remote Access

Site to Site

Dial up User

iHub-and-Spoke

新問題 41
Which three statements explain a flow-based antivirus profile? (Choose three.)

Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.

If a virus is detected, the last packet is delivered to the client.

The IPS engine handles the process as a standalone.

FortiGate buffers the whole file but transmits to the client at the same time.

Flow-based inspection optimizes performance compared to proxy-based inspection.

新問題 42
Refer to the exhibits.

The exhibits show the application sensor configuration and theExcessive-BandwidthandApplefilter details.
Based on the configuration, what will happen to Apple FaceTime if there are only a few calls originating or incoming?