[2025年01月] 問題集簡単概要FCP_FGT_AD-7.4試験問題PassTest [Q38-Q58]

38、Refer to the exhibits.

FGT-1 and FGT-2 are updated with HA configuration commands shown in the exhibit.
What would be the expected outcome in the HA cluster?

FGT-1 will remain the primary because FGT-2 has lower priority.

FGT-2 will take over as the primary because it has the override enable setting and higher priority than FGT-1.

FGT-1 will synchronize the override disable setting with FGT-2.

The HA cluster will become out of sync because the override setting must match on all HA members.

39、Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

NetAPI polling can increase bandwidth usage in large networks.

The NetSessionEnum function is used to track user logouts.

The collector agent must search security event logs.

The collector agent uses a Windows API to query DCs for user logins.

The NetSessionEnum function is used to track user logouts.
Study Guide – FSSO – FSSO with Windows Active Directory – Collector Agent-Based Polling Mode Options.
Collector agent-based polling mode has three methods (or options) for collecting logon info: NetAPI, WinSecLog and WMI.
NetAPI: Polls temporary sessions created on the DC when a user logs on or logs off and calls the NetSessionEnum function on Windows. It’s faster than the WinSec and WMI methods; however, it can miss some logon events if a DC is under heavy system load. This is because sessions can be quickly created and purged form RAM, before the agent has a chance to poll and notify FG.
NetAPI: polls temporary sessions created on the DC when a user logs in or logs out and calls the NetSessionEnum function on Windows. It’s faster than the WinSec and WMI methods; however, it can miss some login events if a DC is under heavy system load. This is because sessions can be quickly created and purged from RAM, before the agent has a chance to poll and notify FortiGate.
Incorrect:
A: NetAPI polling can increase bandwidth usage in large networks. (WinSecLog) C: The collector agent must search security event logs. (WinSecLog) D: The collector agent uses a Windows API to query DCs for user logins. (WMI)
– WinSecLog: polis all the security event logs from the DC. It doesn’t miss any login events that have been recorded by the DC because events are not normally deleted from the logs. There can be some delay in FortiGate receiving events if the network is large and, therefore, writing to the logs is slow. It also requires that the audit success of specific event IDs is recorded in the Windows security logs. For a full list of supported event IDs, visit the Fortinet Knowledge Base (http://kb.fortinet.com).
– NetAPI: polls temporary sessions created on the DC when a user logs in or logs out and calls the NetSessionEnum function on Windows. It’s faster than the WinSec and WMI methods; however, it can miss some login events if a DC is under heavy system load. This is because sessions can be quickly created and purged from RAM, before the agent has a chance to poll and notify FortiGate.

40、Which method allows management access to the FortiGate CLI without network connectivity?

SSH console

CLI console widget

Serial console

Telnet console

41、Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 failed to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes can the administrator make to bring phase 1 up? (Choose two.)

On HQ-FortiGate, disable Diffie-Helman group 2.

On Remote-FortiGate, set port2 as Interface.

On both FortiGate devices, set Dead Peer Detection to On Demand.

On HQ-FortiGate, set IKE mode to Main (ID protection).

42、FortiGate is configured as a policy-based next-generation firewall (NGFW) and is applying web filtering and application control directly on the security policy.
Which two other security profiles can you apply to the security policy? (Choose two.)

Antivirus scanning

File filter

DNS filter

Intrusion prevention

43、Which inspection mode does FortiGate use for application profiles if it is configured as a profile-based next-generation firewall (NGFW)?

Full content inspection

Proxy-based inspection

Certificate inspection

Flow-based inspection

44、An administrator manages a FortiGate model that supports NTurbo.
How does NTurbo enhance performance for flow-based inspection?

NTurbo offloads traffic to the content processor.

NTurbo creates two inspection sessions on the FortiGate device.

NTurbo buffers the whole file and then sends it to the antivirus engine.

NTurbo creates a special data path to redirect traffic between the IPS engine its ingress and egress interfaces.

45、Which two settings are required for SSL VPN to function between two FortiGate devices? (Choose two.)

The client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN.

The server FortiGate requires a CA certificate to verify the client FortiGate certificate.

The client FortiGate requires a client certificate signed bythe CA on the server FortiGate.

The client FortiGate requires a manually added route to remote subnets.

46、Refer to the exhibits.

The SSL VPN connection fails when a user attempts to connect to it.
What should the user do to successfully connect to the SSL VPN?

Change the SSL VPN portal to the tunnel.

Change the idle timeout.

Change the server IP address.

Change the SSL VPN port on the client.

47、Refer to the exhibit.

In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit.
What should the administrator do next to troubleshoot the problem?

Run a sniffer on the web server.

Capture the traffic using an external sniffer connected to port1.

Execute another sniffer in the FortiGate, this time with the filter “host 10.0.1.10”

Execute a debug flow.

48、Refer to the exhibits, which show the firewall policy and the security profile for Facebook.

Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.
Which part of the configuration must you change to resolve the issue?

Make the SSL inspection a deep content inspection

Add Facebook to the URL category in the security policy

Disable HTTP redirect to HTTPS on the web browser

Get the additional application signatures required to add to the security policy

49、Refer to the exhibit.

Which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules?

All traffic from a source IP to a destination IP is sent to the same interface.

Traffic is sent to the link with the lowest latency.

Traffic is distributed based on the number of sessions through each interface.

All traffic from a source IP is sent to the same interface

50、Which statement about firewall policy NAT is true?

DNAT is not supported.

DNAT can automatically apply to multiple firewall policies, based on DNAT rules.

You must configure SNAT for each firewall policy.

SNAT can automatically apply to multiple firewall policies, based on SNAT rules.

51、Refer to the exhibit to view the application control profile.

Based on the configuration, what will happen to Apple FaceTime?

Apple FaceTime will be allowed, based on the Apple filter configuration.

Apple FaceTime will be allowed, based on the Categories configuration.

Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.

Apple FaceTime will be allowed only if the filter in Application and Filter Overrides is set to Learn.

52、If the Services field is configured in a Virtual IP (VIP), which of the following statements is true when central NAT is used?

The Services field removes the requirement of creating multiple VIPs for different services.

The Services field is used when several VIPs need to be bundled into VIP groups.

The Services field does not allow source NAT and destination NAT to be combined in the same policy.

The Services field does not allow multiple sources of traffic, to use multiple services, to connect to a single computer.

53、Which two VDOMs are the default VDOMs created when FortiGate is set up in split VDOM mode?
(Choose two.)

FG-traffic

Mgmt

FG-Mgmt

Root

54、Refer to the exhibit.

In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output shown in the exhibit.
What should the administrator do next, to troubleshoot the problem?

Execute a debug flow.

Capture the traffic using an external sniffer connected to part1.

Execute another sniffer on FortiGate, this time with the filter “hose 10.o.1.10”.

Run a sniffer on the web server.

55、Which statement is a characteristic of automation stitches?

They can be run only on devices in the Security Fabric.

They can be created only on downstream devices in the fabric.

They can have one or more triggers.

They can run multiple actions at the same time.

56、Refer to the exhibit.

FortiGate has two separate firewall policies for Sales and Engineering to access the same web server with the same security profiles.
Which action must the administrator perform to consolidate the two policies into one?

Enable Multiple Interface Policies to select port1 and port2 in the same firewall policy

Create an Interface Group that includes port1 and port2 to create a single firewall policy

Select port1 and port2 subnets in a single firewall policy.

Replace port1 and port2 with the any interface in a single firewall policy.

57、Which type of logs on FortiGate record information about traffic directly to and from the FortiGate management IP addresses?

Local traffic logs

Forward traffic logs

System event logs

Security logs

58、Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?

To remove the NAT operation.

To generate logs

To finish any inspection operations.

To allow for out-of-order packets that could arrive after the FIN/ACK packets.