FCP — FortiGate 7.4 Administrator practice questions

1. Question 1 of 25

   Select 2

   Refer to the exhibit.

   

   Which two statements are true about the routing entries in this database table? (Choose two.)

   • AAll of the entries in the routing database table are installed in the FortiGate routing table.
   • BThe port2 interface is marked as inactive.
   • CBoth default routes have different administrative distances.
   • DThe default route on port2 is marked as the standby route.

   Show answer

   Correct answer: C, D

   How others answered

   • CD100%

   Explanation

   Correct Answers: C. Both default routes have different administrative distances. D. The default route on port2 is marked as the standby route. A. Incorrect: Not all routes are installed; only those marked with *. B. Incorrect: Port2 is active but not the primary route. C. Correct: Port1 has an administrative distance of 10, Port2 has 20. D. Correct: Port2's route is a backup due to its higher administrative distance.

   Adapted from community discussion by rigonet · 2024-12-14 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

   1. R

      rigonet

      2024-12-14

      Selected C, D4 upvotes

      Correct Answers: C. Both default routes have different administrative distances. D. The default route on port2 is marked as the standby route. A. Incorrect: Not all routes are installed; only those marked with *. B. Incorrect: Port2 is active but not the primary route. C. Correct: Port1 has an administrative distance of 10, Port2 has 20. D. Correct: Port2's route is a backup due to its higher administrative distance.

   2. S

      sxcap

      2024-11-29

      Selected C, D3 upvotes

      Administrative distance are different 20/0 and 10/0 there is an ECMP route and the port2 link is UP, so is not inactive, it keeps in standby

   3. M

      montonearm

      2025-01-13

      Selected C, D2 upvotes

      Le due affermazioni corrette sono: C. Both default routes have different administrative distances. (Confermato: 10 per port1 e 20 per port2). D. The default route on port2 is marked as the standby route. (Confermato: La rotta su port2 è considerata standby poiché ha una distanza amministrativa maggiore rispetto a port1).

   4. R

      renauyd

      2024-11-25

      1 upvote

      Administrative distance is the first number after the destination 0.0.0.0/0, which is 20 and 10. "[20/0] 20 indicates an administrative distance of 20 out of a range of 0 to 255. 0 is an additional metric associated with this route, such as in OSPF."

2. Question 2 of 25

   Refer to the exhibits.

   

   

   The exhibits show the application sensor configuration and the Excessive-Bandwidth and Apple filter details. Based on the configuration, what will happen to Apple FaceTime if there are only a few calls originating or incoming?

   • AApple FaceTime will be allowed, based on the Video/Audio category configuration.
   • BApple FaceTime will be allowed, based on the Apple filter configuration.
   • CApple FaceTime will be allowed only if the Apple filter in Application and Filter Overrides is set to Allow.
   • DApple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.

   Show answer

   Correct answer: D

   How others answered

   • D85%
   • B15%

   Explanation

   Pagina 257 Scanning Order: After the IPS engine examines the traffic stream for a signature match, FortiGate scans packets for matches, in this order, for the application control profile: 1. Application and filter overrides: If you have configured any application overrides or filter overrides, the application control profile considers those first. It looks for a matching override starting at the top of the list, like firewall policies. 2. Categories: Finally, the application control profile applies the action that you’ve configured for applications in your selected categories.

   Adapted from community discussion by IBB90704 · 2024-09-05 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

   1. K

      Knocks

      2024-09-16

      Selected D9 upvotes

      The first rule that matches is block Excessive-Bandwidth, and FaceTime is within that filter.

   2. B

      Beatledrew

      2024-09-12

      7 upvotes

      D. Just because it says that there are only a few calls, the filter override is a CATEGORY of EXCESSIVE BANDWIDTH. It matches. This question comes directly from page 259 of the study guide.

   3. I

      IBB90704

      2024-09-05

      Selected D4 upvotes

      Pagina 257 Scanning Order: After the IPS engine examines the traffic stream for a signature match, FortiGate scans packets for matches, in this order, for the application control profile: 1. Application and filter overrides: If you have configured any application overrides or filter overrides, the application control profile considers those first. It looks for a matching override starting at the top of the list, like firewall policies. 2. Categories: Finally, the application control profile applies the action that you’ve configured for applications in your selected categories.

   4. R

      rigonet

      2024-12-14

      Selected D2 upvotes

      Correct Answer: D. Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration. A. Incorrect: Video/Audio category is set to "Block," so FaceTime would not be allowed. B. Incorrect: The Apple filter set to "Monitor" does not override the higher-priority "Excessive-Bandwidth" block. C. Incorrect: Even if Apple filter were "Allow," the "Excessive-Bandwidth" block still takes precedence. D. Correct: FaceTime is categorized under "Excessive-Bandwidth," and this override has the highest priority, explicitly blocking it. Conclusion: FaceTime is blocked because the "Excessive-Bandwidth" filter takes priority.

3. Question 3 of 25

   An employee needs to connect to the office through a high-latency internet connection. Which SSL VPN setting should the administrator adjust to prevent SSL VPN negotiation failure?

   • ASSL VPN idle-timeout
   • BSSL VPN login-timeout
   • CSSL VPN dtls-hello-timeout
   • DSSL VPN session-ttl

   Show answer

   Correct answer: C

   How others answered

   • C58%
   • B43%

   Only 58% agreed on this answer — treat it as contested rather than settled.

   Explanation

   It is C, In a Fortinet SSL VPN, the "dtls-hello-timeout" setting defines the maximum time a FortiGate will wait for an initial "Hello" message from a client during the DTLS (Datagram Transport Layer Security) handshake process, essentially setting a time limit for establishing a secure connection before considering the attempt failed due to network latency or issues with the client device; this is crucial for preventing prolonged connection attempts and improving overall VPN connection stability. The SSL VPN login-timeout in FortiGate controls the amount of time that the SSL VPN waits before disconnecting

   Adapted from community discussion by Cantero75 · 2024-11-01 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

   1. C

      Cantero75

      2024-11-01

      6 upvotes

      It is C, In a Fortinet SSL VPN, the "dtls-hello-timeout" setting defines the maximum time a FortiGate will wait for an initial "Hello" message from a client during the DTLS (Datagram Transport Layer Security) handshake process, essentially setting a time limit for establishing a secure connection before considering the attempt failed due to network latency or issues with the client device; this is crucial for preventing prolonged connection attempts and improving overall VPN connection stability. The SSL VPN login-timeout in FortiGate controls the amount of time that the SSL VPN waits before disconnecting

   2. H

      hecjoseroag

      2024-12-11

      Selected C3 upvotes

      I think that the most correct answer would be C but I have the doubt because there are portals where they indicate that it is a configuration that must have both the dtls and login timed out would be perhaps B and C. I leave a part of the manual where they indicate scenario to use the DTLS "Many factors can contribute to slow throughput.This recommendation tries to improve throughput by using the FortiOS Datagram Transport Layer Security (DTLS) tunnel option, available in FortiOS 5.4 and above. DTLS allows SSL VPN to encrypt traffic using TLS and uses UDP as the transport layer instead of TCP. This avoids retransmission problems that can occur with TCP-in-TCP."

   3. T

      Thespis

      2024-12-16

      Selected C3 upvotes

      Both B and C are correct. A new SSL VPN driver was added to FortiClient 5.6.0 and later to resolve SSL VPN connection issues. If the FortiOS version is compatible, upgrade to use one of these versions. Latency or poor network connectivity can cause login timeout on FortiGate. In v5.6.0 and later, use the following commands to allow a user to increase the SSL VPN login timeout setting. config vpn ssl settings set login-timeout 180 (default is 30) set dtls-hello-timeout 60 (default is 10) end

   4. B

      bob511

      2024-09-02

      5 upvotes

      C is also a correct answer .... FortiGate 7.4 Administrator Study Guide pg.287

4. Question 4 of 25

   Select 3

   When FortiGate performs SSL/SSH full inspection, you can decide how it should react when it detects an invalid certificate. Which three actions are valid actions that FortiGate can perform when it detects an invalid certificate? (Choose three.)

   • AAllow & Warning
   • BTrust & Allow
   • CAllow
   • DBlock & Warning
   • EBlock

   Show answer

   Correct answer: B, C, E

   How others answered

   • BCE75%
   • ABE22%

   Explanation

   Pagina 186 When a certificate fails for any of the reasons above, you can configure any of the following actions: • Keep untrusted & Allow: FortiGate allows the website and lets the browser decide the action to take. FortiGate takes the certificate as untrusted. • Block: FortiGate blocks the content of the site. • Trust & Allow: FortiGate allows the website and takes the certificate as trusted.

   Adapted from community discussion by IBB90704 · 2024-09-05 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Fortinet documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

   1. I

      IBB90704

      2024-09-05

      Selected B, C, E13 upvotes

      Pagina 186 When a certificate fails for any of the reasons above, you can configure any of the following actions: • Keep untrusted & Allow: FortiGate allows the website and lets the browser decide the action to take. FortiGate takes the certificate as untrusted. • Block: FortiGate blocks the content of the site. • Trust & Allow: FortiGate allows the website and takes the certificate as trusted.

   2. 0

      066c9f3

      2024-10-29

      Selected B, C, E4 upvotes

      I'd go with BCE because on FortiGate it says "Keep untrusted & Allow", "Block", "Trust & Allow". With "Keep untrusted & Allow", Fortigate allows it and does NOT display a warning but let's the browser decide. I'd associate the Fortigate setting "Keep untrusted & allow" with "Allow" from the question (Option C). Anything else doesn't make sense. Since there's no warning displayed in any allow situation, A doesn't make sense and since Block & Warning doesn't exist, it has to be B for this. The other two (Trust & Allow, Block) are the exact same words as written in the question, so it can only be B, C, E.

   3. 6

      6f7d62a

      2024-10-12

      Selected B, C, E5 upvotes

      In the administration guide you can confirm that there are only the options to allow or block, after enabling deep inspection, the options to trust or not trust the certificate are added.

   4. M

      marcovinicius4

      2024-10-28

      Selected B, C, E4 upvotes

      In "SSL/SSH Inspection" > Create New I can set in "Common Options" Invalid SSL certificates: Allow | Bloc | Custom - Expired certificates: Keep Untrusted & Allow | Block | Trust & Allow - Revoke certificates: Keep Untrusted & Allow | Block | Trust & Allow - Validation time-out certificates: Keep Untrusted & Allow | Block | Trust & Allow - Validation failed certificates: Keep Untrusted & Allow | Block | Trust & Allow

5. Question 5 of 25

   Select 2

   Refer to the exhibit, which shows the IPS sensor configuration.

   

   If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

   • AThe sensor will gather a packet log for all matched traffic.
   • BThe sensor will reset all connections that match these signatures.
   • CThe sensor will allow attackers matching the Microsoft.Windows.iSCSI.Target.DoS signature.
   • DThe sensor will block all attacks aimed at Windows servers.

   Show answer

   Correct answer: C, D

   How others answered

   • CD46%
   • AC44%

   Only 46% agreed on this answer — treat it as contested rather than settled.

   Explanation

   How can A be a correct answer when the packet logging is enabled only for the iSCSI attack and disabled for the Windows attacks?

   Adapted from community discussion by 0d6e481 · 2024-10-08 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

   1. 0

      0d6e481

      2024-10-08

      Selected C, D12 upvotes

      How can A be a correct answer when the packet logging is enabled only for the iSCSI attack and disabled for the Windows attacks?

   2. S

      sxcap

      2024-12-04

      Selected C, D3 upvotes

      A is incorrect because there is no log enabled to blocked packets B is incorrect because iSCI packets are allowed C is correct because iSCI packets are allowed D is correct because all other windows server attacks will be blocked

   3. C

      Charly0710

      2024-11-07

      3 upvotes

      A and C. D cannot be for the following reason: "When the IPS engine compares traffic with the signatures in each filter, order matters. The rules are similar to firewall policy matching; the engine evaluates the filters and signatures at the top of the list first, and applies the first match. The engine skips subsequent filters". Pag 243 Fortinate Administrator Study Guide

   4. C

      CharlieS8

      2024-10-16

      3 upvotes

      If you will research about the signature. it actually targets the server. So D is not true because the way the filter works is from top to bottom. thus, allowing the Signature above to pass through without blocking it. So, if B and D is incorrect the only remaining answer is A and C

6. Question 6 of 25

   Which statement is a characteristic of automation stitches?

   • AThey can be run only on devices in the Security Fabric.
   • BThey can be created only on downstream devices in the fabric.
   • CThey can have one or more triggers.
   • DThey can run multiple actions at the same time.

   Show answer

   Correct answer: D

   How others answered

   • D85%
   • C15%

   Explanation

   According to the illustration on page 396 of the the study guide, it says automatic stitches consist of 'a trigger' and 'one or more configurable actions'.

   Adapted from community discussion by Billyon · 2024-09-08 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Fortinet documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

   1. B

      Billyon

      2024-09-08

      Selected D14 upvotes

      According to the illustration on page 396 of the the study guide, it says automatic stitches consist of 'a trigger' and 'one or more configurable actions'.

   2. H

      hecjoseroag

      2024-12-11

      Selected D5 upvotes

      The answer is D in FortiOS 7.4.5 Administration Guide page 3349 "The stitch Action execution can be set to either Sequential or Parallel. In sequential execution, actions will execute one after another with a delay (if specified). If one action fails, then the action chain stops. This is the default setting. In parallel execution, all actions will execute immediately when the stitch is triggered"

   3. B

      bdosres

      2024-11-12

      4 upvotes

      C. They can have one or more triggers. Explanation: • Automation stitches on Fortinet devices allow you to automate actions based on specific events (triggers). A stitch can be configured with one or multiple triggers to respond to specific conditions, such as detecting suspicious traffic. • A stitch can also perform actions, but not simultaneously — they execute sequentially. • Stitches are not limited to devices within the Security Fabric, nor are they restricted to downstream devices. Therefore, the correct option is C because the main characteristic of stitches is that they can have multiple triggers to initiate the defined actions.

   4. 3

      3101a6a

      2024-10-20

      Selected D3 upvotes

      "Administrator-defined automated workflows (called stitches) cause FortiOS to automatically respond to an event in a preprogrammed way. Because this workflow is part of the Security Fabric, you can set up automation stitches for any device in the Security Fabric. However, the Security Fabric is not required to use stitches. Each automation stitch pairs a trigger and one or more actions. FortiOS has several predefined stitches, triggers and actions. However, you can create custom automation based on the available options."

7. Question 7 of 25

   What is the primary FortiGate election process when the HA override setting is disabled?

   • AConnected monitored ports > Priority > System uptime > FortiGate serial number
   • BConnected monitored ports > System uptime > Priority > FortiGate serial number
   • CConnected monitored ports > Priority > HA uptime > FortiGate serial number
   • DConnected monitored ports > HA uptime > Priority > FortiGate serial number

   Show answer

   Correct answer: D

   How others answered

   • D96%

   Explanation

   1. The cluster compares the number of monitored interfaces that have a status of up. The member with the most available monitored interfaces becomes the primary. 2. The cluster compares the HA uptime of each member. The member with the highest HA uptime, by at least five minutes, becomes the primary. 3. The member with the highest priority becomes the primary. 4. The member with the highest serial number becomes the primary.

   Adapted from community discussion by Knocks · 2024-09-16 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Fortinet documentation
   • community.fortinet.com documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

   1. T

      terminatoritsec

      2024-08-28

      Selected D7 upvotes

      D is Correct. Fortigate Administratror Study Guide page 414.

   2. H

      hecjoseroag

      2024-12-11

      Selected D3 upvotes

      Override enable: Connected monitored ports - Priority - HA Uptime - SN Override disabled: Connected monitored ports - HA Uptime - Priority - SN (page 2897 FortiOS Administrator Guide)

   3. K

      Knocks

      2024-09-16

      Selected D2 upvotes

      1. The cluster compares the number of monitored interfaces that have a status of up. The member with the most available monitored interfaces becomes the primary. 2. The cluster compares the HA uptime of each member. The member with the highest HA uptime, by at least five minutes, becomes the primary. 3. The member with the highest priority becomes the primary. 4. The member with the highest serial number becomes the primary.

   4. N

      NetworkWeaver

      2024-09-27

      2 upvotes

      D is the correct answer When override is disabled (MUPS): The device that has a higher number of operationally UP Monitored interfaces (M). The device that has the highest HA Uptime. not the unit uptime (U). The device which has the highest Priority (P) Device which has the highest Serial Number (S). When override is enabled (MPUS): The device that has a higher number of operationally UP Monitored interfaces (M). The device that has the highest Priority (P). A device that has the highest HA Uptime. not the unit uptime (U) The device that has the highest Serial Number (S).

8. Question 8 of 25

   Select 2

   Which two settings are required for SSL VPN to function between two FortiGate devices? (Choose two.)

   • AThe client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN.
   • BThe server FortiGate requires a CA certificate to verify the client FortiGate certificate.
   • CThe client FortiGate requires a client certificate signed by the CA on the server FortiGate.
   • DThe client FortiGate requires a manually added route to remote subnets.

   Show answer

   Correct answer: A, B

   How others answered

   • AB94%

   Explanation

   If fortigate is used as an SSL VPN client, it needs a ssl virtual tunnel interface to connect to the SSL VPN server. This is the client virtual interface that the vpn server will assign the temporary IP address to during the lifetime of an ssl connection. The SSL VPN server also needs a correct CA certificate to authenticate/trust client's certificate. (page 2527 FortiOS Administrator Guide)

   Adapted from community discussion by hecjoseroag · 2024-12-11 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

   1. H

      hecjoseroag

      2024-12-11

      Selected A, B4 upvotes

      If fortigate is used as an SSL VPN client, it needs a ssl virtual tunnel interface to connect to the SSL VPN server. This is the client virtual interface that the vpn server will assign the temporary IP address to during the lifetime of an ssl connection. The SSL VPN server also needs a correct CA certificate to authenticate/trust client's certificate. (page 2527 FortiOS Administrator Guide)

   2. K

      knoor

      2024-09-05

      3 upvotes

      According to Based on FCP - FortiGate 7.4 Administrator Self-Paced course: A and B are correct

   3. S

      sxcap

      2024-12-04

      Selected A, B2 upvotes

      Client FortiGate need an SSLVPN type interface Server FortiGate need a CA to check client FortiGate certificate

   4. J

      JRKhan

      2024-11-14

      Selected A, B1 upvote

      If fortigate is used as an SSL VPN client, it needs a ssl virtual tunnel interface to connect to the SSL VPN server. This is the client virtual interface that the vpn server will assign the temporary IP address to during the lifetime of an ssl connection. The SSL VPN server also needs a correct CA certificate to authenticate/trust client's certificate.

9. Question 9 of 25

   Refer to the exhibit.

   

   Which statement about this firewall policy list is true?

   • AThe Implicit group can include more than one deny firewall policy.
   • BThe firewall policies are listed by ID sequence view.
   • CThe firewall policies are listed by ingress and egress interfaces pairing view.
   • DLAN to WAN, WAN to LAN, and Implicit are sequence grouping view lists.

   Show answer

   Correct answer: D

   How others answered

   • D71%
   • C29%

   Only 71% agreed on this answer — treat it as contested rather than settled.

   Explanation

   I'd go with D, because the policies cannot be in interface pair view, since the policy ID 1 has multiple interfaces, so it cannot be C.

   Adapted from community discussion by Knocks · 2024-09-16 · 21 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

   1. K

      Knocks

      2024-09-16

      Selected D21 upvotes

      I'd go with D, because the policies cannot be in interface pair view, since the policy ID 1 has multiple interfaces, so it cannot be C.

   2. Y

      youla5

      2024-09-27

      4 upvotes

      Guys it is D, I Think With Interfaces pairing we need to have the following format LAN --> WAN

   3. B

      Bilale

      2024-12-24

      Selected D2 upvotes

      C. The firewall policies are listed by ingress and egress interfaces pairing view = NOK This can be correct if we have on destination by rule When we have 2 destination interface the view is by group sequence / sequence Refer to NSE4 study guide | Policy List - Interface Pair view and by Sequence

   4. H

      hecjoseroag

      2024-12-11

      Selected D2 upvotes

      I would say it is D because when you configure more than one interface the interface per view option disappears and only leaves by sequence and in this case it is not by sequence either.

10. Question 10 of 25

    Select 3

    Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)

    • AThe host field in the HTTP header.
    • BThe server name indication (SNI) extension in the client hello message.
    • CThe subject alternative name (SAN) field in the server certificate.
    • DThe subject field in the server certificate.
    • EThe serial number in the server certificate.

    Show answer

    Correct answer: B, C, D

    How others answered

    • BCD100%

    Explanation

    B,C,D - Related to Training Fortigate Administrator - Certificate Operations: When using SSL certificate inspection, FortiGate is not decrypting the traffic. During the exchange of hello messages at the beginning of an SSL handshake, FortiGate parses the server name indication (SNI) from client Hello, which is an extension of the TLS protocol. The SNI tells FortiGate the hostname of the SSL server, which is validated against the DNS name before receipt of the server certificate. If there is no SNI exchanged, then FortiGate identifies the server by the value in the server by the value in the Subject field or SAN (Subject Alternative Name) field in the server certificate.

    Adapted from community discussion by miguelmagr · 2024-09-25 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

    1. M

       miguelmagr

       2024-09-25

       3 upvotes

       B,C,D - Related to Training Fortigate Administrator - Certificate Operations: When using SSL certificate inspection, FortiGate is not decrypting the traffic. During the exchange of hello messages at the beginning of an SSL handshake, FortiGate parses the server name indication (SNI) from client Hello, which is an extension of the TLS protocol. The SNI tells FortiGate the hostname of the SSL server, which is validated against the DNS name before receipt of the server certificate. If there is no SNI exchanged, then FortiGate identifies the server by the value in the server by the value in the Subject field or SAN (Subject Alternative Name) field in the server certificate.

    2. R

       rigonet

       2024-12-14

       Selected B, C, D2 upvotes

       Correct Answers: B. The server name indication (SNI) extension in the client hello message. C. The subject alternative name (SAN) field in the server certificate. D. The subject field in the server certificate. Key Points: B: SNI identifies the hostname in the TLS handshake. C: SAN field specifies the hostname in the certificate. D: Subject field may also contain the hostname. A and E: Not relevant for hostname identification.

    3. S

       sxcap

       2024-11-29

       Selected B, C, D2 upvotes

       SNI Subject in the certificate Subject alternative name in the certificate

    4. T

       tharindas

       2025-03-18

       Selected B, C, D1 upvote

       Refer the FCP FGT Administrator 7.4 Study Guide Page No: 166 Chapter: Certificate Operation

11. Question 11 of 25

    Select 3

    Which three strategies are valid SD-WAN rule strategies for member selection? (Choose three.)

    • AManual with load balancing
    • BLowest Cost (SLA) with load balancing
    • CBest Quality with load balancing
    • DLowest Quality (SLA) with load balancing
    • ELowest Cost (SLA) without load balancing

    Show answer

    Correct answer: A, B, E

    How others answered

    • ABE75%
    • ABC23%

    Explanation

    ABE, When you select Best Quality the "Load Balancing" toggle disappears from the UI. When you select Lowest Cost (SLA) you can choose to enable or disable load balancing.

    Adapted from community discussion by fa7474b · 2024-10-09 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Fortinet documentation
    • Fortinet documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

    1. F

       fa7474b

       2024-10-09

       Selected A, B, E14 upvotes

       ABE, When you select Best Quality the "Load Balancing" toggle disappears from the UI. When you select Lowest Cost (SLA) you can choose to enable or disable load balancing.

    2. Q

       Qwerty379

       2024-09-02

       Selected A, B, E8 upvotes

       It's AB for sure, but there is no load balancing in Best quality, so, it's so tricky, I think E should be also correct. ABE.

    3. W

       wenhui28

       2024-09-09

       5 upvotes

       Answer should be ABE pg357, load balancing only for Manual & Lowest cost (SLA), not Best Quality.

    4. W

       wsdeffwd

       2024-09-06

       4 upvotes

       Page 357 - The choices are: Manual with LB, Manual w/o LB, Lowest Cost w/ LB, Lowest Cost w/o LB, Best Quality w/o LB So its ABE

12. Question 12 of 25

    Select 2

    Which two statements are true regarding FortiGate HA configuration synchronization? (Choose two.)

    • AChecksums of devices are compared against each other to ensure configurations are the same.
    • BIncremental configuration synchronization can occur only from changes made on the primary FortiGate device.
    • CIncremental configuration synchronization can occur from changes made on any FortiGate device within the HA cluster.
    • DChecksums of devices will be different from each other because some configuration items are not synced to other HA members.

    Show answer

    Correct answer: A, C

    How others answered

    • AC71%
    • AB18%

    Only 71% agreed on this answer — treat it as contested rather than settled.

    Explanation

    AC: FortiGate 7.4 Administrator Study Guide pg.421 "After the initial synchronization is complete, whenever a change is made to the configuration of an HA cluster device (primary or secondary), incremental synchronization sends the same configuration change to all other cluster devices over the HA heartbeat link"

    Adapted from community discussion by bob511 · 2024-09-02 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

    1. B

       bob511

       2024-09-02

       8 upvotes

       AC: FortiGate 7.4 Administrator Study Guide pg.421 "After the initial synchronization is complete, whenever a change is made to the configuration of an HA cluster device (primary or secondary), incremental synchronization sends the same configuration change to all other cluster devices over the HA heartbeat link"

    2. T

       TheVaro

       2025-02-18

       Selected A, C1 upvote

       After the initial synchronization is complete, whenever a change is made to the configuration of an HA cluster device (primary or secondary), incremental synchronization sends the same configuration change to all other cluster devices over the HA heartbeat link. An HA synchronization process running on each cluster device receives the configuration change and applies it to the cluster device. For example, if you create a firewall address object, the primary doesn’t resend its complete configuration—it sends only the new object.

    3. S

       sxcap

       2024-12-04

       Selected A, C2 upvotes

       checksums must be the same if any change occurs, incremental sync must happen to ensure checksums keep the same

    4. M

       miguelmagr

       2024-10-01

       Selected A, C1 upvote

       Checksum must be equal on both fortigate. Incremental Configuration Synchronization happens when the primary configuration is changed and changes are synchronized to the secondary. Secondary configuration is changed and changes are synchronized to the primary.

13. Question 13 of 25

    An administrator must enable a DHCP server on one of the directly connected networks on FortiGate. However, the administrator is unable to complete the process on the GUI to enable the service on the interface. In this scenario, what prevents the administrator from enabling DHCP service?

    • AThe role of the interface prevents setting a DHCP server.
    • BThe DHCP server setting is available only on the CLI.
    • CAnother interface is configured as the only DHCP server on FortiGate.
    • DThe FortiGate model does not support the DHCP server.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    The 'DHCP server' option cannot be enabled/used on DMZ interfaces. For the interfaces with DMZ role, DHCP server and Security mode are not available (by design). If a DHCP server is required on that physical interface, change its role from DMZ to LAN, WAN, or Undefined.

    Adapted from community discussion by hecjoseroag · 2024-12-11 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • community.fortinet.com documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

    1. K

       Knocks

       2024-09-16

       Selected A4 upvotes

       if you set the interface role to wan, it will hide useless settings on a wan link (such as DHCP server)

    2. B

       Beatledrew

       2024-09-17

       1 upvote

       In this scenario, the issue preventing the administrator from enabling DHCP service on the FortiGate interface is most likely that the interface is configured as part of a zone or is set to use DHCP relay. Here's a breakdown of potential causes: 1. Interface in a Zone: If the interface is part of a zone, you cannot configure individual settings, such as DHCP, directly on the interface. FortiGate restricts interface-specific configurations like DHCP when the interface is assigned to a zone. 2. DHCP Relay Configured: If the interface is already configured to act as a DHCP relay (forwarding DHCP requests to an external DHCP server), FortiGate will not allow you to enable the DHCP server on that interface. Page 8 of Study Guide

    3. H

       hecjoseroag

       2024-12-11

       Selected A2 upvotes

       The 'DHCP server' option cannot be enabled/used on DMZ interfaces. For the interfaces with DMZ role, DHCP server and Security mode are not available (by design). If a DHCP server is required on that physical interface, change its role from DMZ to LAN, WAN, or Undefined.

    4. F

       fab1ccb

       2024-09-14

       Selected A2 upvotes

       The role that prevent an interface to act like DHCP relay is assigned to DMZ interface. https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-FortiGate-as-DHCP-server/ta-p/197856

14. Question 14 of 25

    Refer to the exhibit.

    

    Which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules?

    • AAll traffic from a source IP to a destination IP is sent to the same interface.
    • BTraffic is sent to the link with the lowest latency.
    • CTraffic is distributed based on the number of sessions through each interface.
    • DAll traffic from a source IP is sent to the same interface

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/216765/implicit-rule Traffic is divided equally between the interfaces. Sessions that start at the same source IP address and go to the same destination IP address use the same path.

    Adapted from community discussion by lenriquereyes · 2024-09-20 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Fortinet documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

    1. R

       rigonet

       2024-12-14

       Selected A3 upvotes

       Correct Answer: A. All traffic from a source IP to a destination IP is sent to the same interface. Explanation of each option: A. Correct: Default behavior is source-destination IP-based hashing for consistency. B. Incorrect: Latency-based routing requires a matching SD-WAN rule. C. Incorrect: Session-based distribution is not default behavior. D. Incorrect: Routing considers both source and destination IPs, not just source IP.

    2. S

       sxcap

       2024-11-29

       Selected A3 upvotes

       if no sdwan rules are matched, traffic is routed by the implicit rule, which in this case, says that traffic is routed by source - destination, it does mean that all traffic from the same source and destination IP's is routed by the same initial interface

    3. T

       TIGERZ44

       2024-08-31

       1 upvote

       If you log into a firewall, you'll see the following options: "Source IP" is the default setting. Source IP: Traffic is divided equally between members. Sessions that start at the same source address use the same route. Sessions: The traffic is distributed based on the number of sessions that are connected through the member. Spillover: The highest priority member is used until bandwidth exceeds ingress and egress thresholds. Additional traffic is sent through the next SD-WAN member. Source-Destination IP: Traffic is divided equally. Sessions that start at the same source IP address and go to the same destination IP address use the same route. Volume: The workload is distributed based on the number of packets that are going through the member.

    4. L

       lenriquereyes

       2024-09-20

       Selected A2 upvotes

       https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/216765/implicit-rule Traffic is divided equally between the interfaces. Sessions that start at the same source IP address and go to the same destination IP address use the same path.

15. Question 15 of 25

    Refer to the exhibit.

    

    Review the intrusion prevention system (IPS) profile signature settings shown in the exhibit. What do you conclude when adding the FTP.Login.Failed signature to the IPS sensor profile?

    • ATraffic matching the signature will be allowed and logged.
    • BThe signature setting uses a custom rating threshold.
    • CThe signature setting includes a group of other signatures.
    • DTraffic matching the signature will be silently dropped and logged.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    D is correct. The action is set to Block at the top of the configuration setting. If it was set to default then the default action underneath for each signature will apply.

    Adapted from community discussion by JRKhan · 2024-11-15 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

    1. J

       JRKhan

       2024-11-15

       Selected D3 upvotes

       D is correct. The action is set to Block at the top of the configuration setting. If it was set to default then the default action underneath for each signature will apply.

    2. K

       Knocks

       2024-09-16

       3 upvotes

       Nope, the action in the signature list is block (top of the screenshot). It would be A if the action was default or allow, but the action of all the signatures that will be added to this list is going to be block.

    3. M

       miguelmagr

       2024-09-27

       Selected D1 upvote

       I got confused with the IPS Signature Action "Pass". I see Rate-based setting is set to "Default". After many loging fail I guess that action is going to be logged as an action "blocked" when exceed the amount of retries. Am I wrong?

    4. T

       truserud

       2025-02-18

       Selected D1 upvote

       See page 245 in the Study guide. Action set to block, is the action the IPS Filter will take for the IPS signatures added in the list. "Select Block to silently drop traffic matching any of the signatures included in the entry".

16. Question 16 of 25

    An administrator manages a FortiGate model that supports NTurbo. How does NTurbo enhance performance for flow-based inspection?

    • ANTurbo offloads traffic to the content processor.
    • BNTurbo creates two inspection sessions on the FortiGate device.
    • CNTurbo buffers the whole file and then sends it to the antivirus engine.
    • DNTurbo creates a special data path to redirect traffic between the IPS engine its ingress and egress interfaces.

    Show answer

    Correct answer: D

    How others answered

    • D85%
    • A15%

    Explanation

    "NTurbo creates a special data path to redirect traffic from the ingress interface to the IPS engine, and from the IPS engine to the egress interface." Reference: FortiGate 7.4 Administrator Study Guide, page 201 (Inspection Modes Use Cases)

    Adapted from community discussion by herlock_sholmes_2810 · 2024-09-22 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Fortinet documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

    1. H

       herlock_sholmes_2810

       2024-09-22

       Selected D2 upvotes

       "NTurbo creates a special data path to redirect traffic from the ingress interface to the IPS engine, and from the IPS engine to the egress interface." Reference: FortiGate 7.4 Administrator Study Guide, page 201 (Inspection Modes Use Cases)

    2. H

       hecjoseroag

       2024-12-11

       Selected D1 upvote

       NTurbo creates a special data path to redirect traffic from the ingress interface to IPS, and from IPS to the egress interface. NTurbo allows firewall operations to be offloaded along this path, and still allows IPS to behave as a stage in the processing pipeline, reducing the workload on the FortiGate CPU and improving overall throughput. Hardware Acceleration https://docs.fortinet.com/document/fortigate/7.0.1/hardware-acceleration/896174/nturbo-offloads-flow-based-processing

    3. 3

       3101a6a

       2024-10-20

       Selected D2 upvotes

       "NTurbo creates a special data path to redirect traffic from the ingress interface to the IPS engine, and from the IPS engine to the egress interface."

    4. F

       Fs4ntos

       2024-10-31

       1 upvote

       B is correct For firewall sessions with flow-based security profiles, NTurbo offloads firewall and NAT sessions from the FortiGate CPU to NP7 or NP6 network processors. NTurbo distributes these sessions to different IPS engine processes spread across multiple CPU cores, ensuring a load-balanced approach for handling IPS signature/pattern matching tasks.

17. Question 17 of 25

    Refer to the exhibit, which shows a partial configuration from the remote authentication server.

    

    Why does the FortiGate administrator need this configuration?

    • ATo authenticate only the Training user group.
    • BTo set up a RADIUS server Secret.
    • CTo authenticate and match the Training OU on the RADIUS server.
    • DTo authenticate Any FortiGate user groups.

    Show answer

    Correct answer: A

    How others answered

    • A86%

    Explanation

    This configuration is specifically used to authenticate users belonging to the "Training" user group, as indicated by the Fortinet-Group-Name attribute.

    Adapted from community discussion by Billyon · 2024-09-08 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

    1. K

       knoor

       2024-09-05

       3 upvotes

       I am not sure why Training "OU" should be the answer, it looks like a LDAP attribute of group name as training so the answer should be A

    2. B

       Billyon

       2024-09-08

       Selected A2 upvotes

       This configuration is specifically used to authenticate users belonging to the "Training" user group, as indicated by the Fortinet-Group-Name attribute.

    3. T

       TIGERZ44

       2024-09-07

       Selected A2 upvotes

       The Attribute is "Fortinet-GROUP-Name" so one would assume this refers to the name of a group and not an OU.

    4. T

       TIGERZ44

       2024-09-07

       2 upvotes

       I agree. The Attribute is "Fortinet-GROUP-Name" so one would assume this refers to the name of a group and not an OU.

18. Question 18 of 25

    A network administrator is configuring an IPsec VPN tunnel for a sales employee travelling abroad. Which IPsec Wizard template must the administrator apply?

    • ARemote Access
    • BSite to Site
    • CDial up User
    • DHub-and-Spoke

    Show answer

    Correct answer: A

    How others answered

    • A92%

    Explanation

    A is correct. When you go to VPN>IPsec Wizard and select the VPN setup, you'll see Remote Access for this type of connection

    Adapted from community discussion by TIGERZ44 · 2024-09-01 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

    1. T

       TIGERZ44

       2024-09-01

       Selected A3 upvotes

       A is correct. When you go to VPN>IPsec Wizard and select the VPN setup, you'll see Remote Access for this type of connection

    2. R

       rigonet

       2024-12-14

       Selected A1 upvote

       Correct Answer: A. Remote Access Explanation of each option: A. Remote Access (Correct): This template is designed for employees or devices accessing the network from remote locations, such as a traveling sales employee. B. Site to Site (Incorrect): Used to connect two fixed networks, not for individual remote users. C. Dial up User (Incorrect): Refers to legacy remote access methods, not modern IPsec VPN setups. D. Hub-and-Spoke (Incorrect): Used to interconnect multiple branch offices to a central hub, not for individual remote users.

    3. K

       krage304

       2024-12-03

       Selected A2 upvotes

       Possible Template types are Site to Site, Hub-and-Spoke, Remote Access or Custom

    4. K

       killer843

       2024-12-10

       1 upvote

       dans les wizard tu as trois type de VPN IPSEC à savoir: -Site to Site -Hub and Spoke -Remote access

19. Question 19 of 25

    Refer to the exhibit.

    

    FortiGate is configured for firewall authentication. When attempting to access an external website, the user is not presented with a login prompt. What is the most likely reason for this situation?

    • AThe Service DNS is required in the firewall policy.
    • BThe user is using an incorrect user name.
    • CThe Remote-users group is not added to the Destination.
    • DNo matching user account exists for this user.

    Show answer

    Correct answer: A

    How others answered

    • A96%

    Explanation

    Just confirmed the answer is A by replicating this config on my Fortigate. If you don't add DNS to the policy you just get a timeout and the browser cannot find the site. Once you add DNS you get a prompt that you must log in to access the internet. I think the confusing part of this question is that it reads as if the user is able to access the internet and is not being prompted. When in fact, they are not getting prompted AND they can't access the internet.

    Adapted from community discussion by fa7474b · 2024-10-09 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

    1. F

       fa7474b

       2024-10-09

       Selected A10 upvotes

       Just confirmed the answer is A by replicating this config on my Fortigate. If you don't add DNS to the policy you just get a timeout and the browser cannot find the site. Once you add DNS you get a prompt that you must log in to access the internet. I think the confusing part of this question is that it reads as if the user is able to access the internet and is not being prompted. When in fact, they are not getting prompted AND they can't access the internet.

    2. T

       TIGERZ44

       2024-09-07

       Selected A2 upvotes

       A firewall policy also checks the service in order to transport the named protocols or group of protocols. No service (with the exception of DNS) is allowed through the firewall policy before successful user authentication. DNS is usually used by HTTP so that people can use domain names for websites, instead of their IP address. DNS is allowed because it is a base protocol and will most likely be required to initially see proper authentication protocol traffic. Hostname resolution is almost always a requirement for any protocol. However, the DNS service must still be defined in the policy as allowed, in order for it to pass. A is the correct answer

    3. H

       herlock_sholmes_2810

       2024-09-17

       Selected A2 upvotes

       A. The Service DNS is required in the firewall policy. "DNS traffic can be allowed if user has not authenticated yet Hostname resolution is often required by the application layer protocol (HTTP/HTTPS/FTP/Telnet) that is used to authenticate DNS service must be explicity listed as a service in the policy" Reference: FortiGate 7.4 Administration Study Guide, page 115 (Firewall Policy - Service)

    4. K

       Knocks

       2024-09-16

       Selected A2 upvotes

       It cannot be B, also because the user is never promped to login.

20. Question 20 of 25

    Select 2

    Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true? (Choose two.)

    • AIf SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance-mode.
    • BIf SD-WAN is disabled, you can configure the parameter v4-ecmp-mode to volume-based.
    • CIf SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP
    • DIf SD-WAN is disabled, you configure the load balancing algorithm in config system settings.

    Show answer

    Correct answer: A, D

    How others answered

    • AD100%

    Explanation

    AD, "When SD-WAN is enabled, FortiOS hides the v4-ecmp-mode setting and replaces it with the loadbalance-mode setting under config system sdwan. That is, when you enable SD-WAN, you control the ECMP algorithm with the load-balance-mode setting." The statement C. If SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP is incorrect because ECMP requires routes to have equal cost, which means that the routes must have the same distance and priority values to be considered for load balancing. In contrast, ECMP specifically balances traffic across multiple paths that have equal cost, hence the term "equal-cost" in ECMP. If the distance or priority values are different, those routes would not be eligible for ECMP. Therefore, A and D are correct, and C is incorrect.

    Adapted from community discussion by bob511 · 2024-09-01 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Fortinet documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

    1. B

       bob511

       2024-09-01

       3 upvotes

       AD, "When SD-WAN is enabled, FortiOS hides the v4-ecmp-mode setting and replaces it with the loadbalance-mode setting under config system sdwan. That is, when you enable SD-WAN, you control the ECMP algorithm with the load-balance-mode setting." The statement C. If SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP is incorrect because ECMP requires routes to have equal cost, which means that the routes must have the same distance and priority values to be considered for load balancing. In contrast, ECMP specifically balances traffic across multiple paths that have equal cost, hence the term "equal-cost" in ECMP. If the distance or priority values are different, those routes would not be eligible for ECMP. Therefore, A and D are correct, and C is incorrect.

    2. X

       x666

       2024-12-16

       Selected A, D3 upvotes

       Took me some digging to find the source: https://docs.fortinet.com/document/fortigate/7.4.6/administration-guide/25967/equal-cost-multi-path

    3. V

       vuhidus

       2024-11-19

       Selected A, D2 upvotes

       A. If SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance-mode. D. If SD-WAN is disabled, you configure the load balancing algorithm in config system settings.

    4. M

       miguelmagr

       2024-10-01

       Selected A, D2 upvotes

       Config system settings if SDWAN is disabled. Use load balance mode if SDWAN is enabled.

21. Question 21 of 25

    Refer to the exhibits.

    

    

    

    FGT-1 and FGT-2 are updated with HA configuration commands shown in the exhibit. What would be the expected outcome in the HA cluster?

    • AFGT-1 will remain the primary because FGT-2 has lower priority.
    • BFGT-2 will take over as the primary because it has the override enable setting and higher priority than FGT-1.
    • CFGT-1 will synchronize the override disable setting with FGT-2.
    • DThe HA cluster will become out of sync because the override setting must match on all HA members.

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    B is correct Explanation: With override enabled, the primary unit with the highest device priority will always become the primary unit. Whenever an event occurs that may affect primary unit selection, the cluster negotiates. For example, when override is enabled a cluster renegotiates when you change the device priority of any cluster unit or when you add a new unit to a cluster. Override and primary unit selection Enabling override changes the order of primary unit selection. As shown below, if override is enabled, primary unit selection considers device priority before age and serial number. This means that if you set the device priority higher on one cluster unit, with override enabled this cluster unit becomes the primary unit even if its age and serial number are lower than other cluster units. https://docs.fortinet.com/document/fortigate/6.0.0/handbook/123439/primary-unit-selection-with-override-enabled

    Adapted from community discussion by hecjoseroag · 2024-12-16 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Fortinet documentation

    View community discussion2

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

    1. H

       hecjoseroag

       2024-12-16

       Selected B3 upvotes

       B is correct Explanation: With override enabled, the primary unit with the highest device priority will always become the primary unit. Whenever an event occurs that may affect primary unit selection, the cluster negotiates. For example, when override is enabled a cluster renegotiates when you change the device priority of any cluster unit or when you add a new unit to a cluster. Override and primary unit selection Enabling override changes the order of primary unit selection. As shown below, if override is enabled, primary unit selection considers device priority before age and serial number. This means that if you set the device priority higher on one cluster unit, with override enabled this cluster unit becomes the primary unit even if its age and serial number are lower than other cluster units. https://docs.fortinet.com/document/fortigate/6.0.0/handbook/123439/primary-unit-selection-with-override-enabled

    2. S

       sxcap

       2024-12-17

       Selected B1 upvote

       Override enable will set the FortiGate2 as primary while is UP

22. Question 22 of 25

    Refer to the exhibits, which show the firewall policy and the security profile for Facebook.

    

    

    Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts. Which part of the configuration must you change to resolve the issue?

    • AMake the SSL inspection a deep content inspection
    • BAdd Facebook to the URL category in the security policy
    • CDisable HTTP redirect to HTTPS on the web browser
    • DGet the additional application signatures required to add to the security policy

    Show answer

    Correct answer: A

    How others answered

    • A75%
    • D25%

    Explanation

    The Facebook_Like.Button is selected. Facebook_Like.Button ID 29210 Summary This indicates an attempt to "Like" a content that is shared on the Facebook servers. Facebook Like is a feature that allows users to display their reaction to contents that are shared on the Facebook servers. Deep inspection is required on this application signature. It is not on Video Play

    Adapted from community discussion by Thespis · 2024-12-16 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

    1. T

       Thespis

       2024-12-16

       Selected A3 upvotes

       The Facebook_Like.Button is selected. Facebook_Like.Button ID 29210 Summary This indicates an attempt to "Like" a content that is shared on the Facebook servers. Facebook Like is a feature that allows users to display their reaction to contents that are shared on the Facebook servers. Deep inspection is required on this application signature. It is not on Video Play

    2. X

       x666

       2024-12-13

       Selected A3 upvotes

       A - Deep inspection is required for some apps, including this one. Refer to the old exam question where it is clearer. https://www.examtopics.com/discussions/fortinet/view/92003-exam-nse4_fgt-70-topic-1-question-44-discussion/

    3. S

       sxcap

       2024-12-17

       Selected A2 upvotes

       There is NO "reaction" app signature for facebook, "like button" is enough to leave reactions but it has a "lock" icon that does mean, "SSL deep inspection is required"

    4. C

       Cispro

       2024-10-29

       Selected A2 upvotes

       It needs to check the contents of the packets, therefore deep inspection in requiered

23. Question 23 of 25

    Select 3

    What are three key routing principles in SD-WAN? (Choose three.)

    • ABy default, SD-WAN members are skipped if they do not have a valid route to the destination
    • BBy default, SD-WAN rules are skipped if only one route to the destination is available
    • CBy default, SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member
    • DSD-WAN rules have precedence over any other type of routes
    • ERegular policy routes have precedence over SD-WAN rules

    Show answer

    Correct answer: A, C, E

    How others answered

    • ACE100%

    Explanation

    SD-WAN rules are matched only if the best route to the destination points to SD-WAN SD-WAN member is selected only if it has a route to the destination https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan-sd-branch-architecture-for-mssps/768108/sd-wan-routing-logic SDWAN rules are 'policy routes', but regular policy routes have precedence over SD-WAN rules. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Explaining-the-SD-WAN-rule-matching-process/ta-p/284325

    Adapted from community discussion by hecjoseroag · 2024-12-10 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Fortinet documentation
    • community.fortinet.com documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

    1. H

       hecjoseroag

       2024-12-10

       Selected A, C, E2 upvotes

       SD-WAN rules are matched only if the best route to the destination points to SD-WAN SD-WAN member is selected only if it has a route to the destination https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan-sd-branch-architecture-for-mssps/768108/sd-wan-routing-logic SDWAN rules are 'policy routes', but regular policy routes have precedence over SD-WAN rules. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Explaining-the-SD-WAN-rule-matching-process/ta-p/284325

    2. S

       sxcap

       2024-12-17

       Selected A, C, E2 upvotes

       FortiGate must check that the preferred member has a valid route to the destination SD-WAN Rules only apply if the traffic goes throught SD-WAN

    3. S

       s4mu3l007

       2024-10-29

       1 upvote

       A. By default, SD-WAN members are skipped if they do not have a valid route to the destination. C. By default, SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member. E. Regular policy routes have precedence over SD-WAN rules

    4. T

       tharindas

       2025-03-18

       1 upvote

       Answers are A,C,E FCP FGT Administrator Study Guide Page No 248-363

24. Question 24 of 25

    An administrator has configured a strict RPF check on FortiGate. How does strict RPF check work?

    • AStrict RPF checks the best route back to the source using the incoming interface.
    • BStrict RPF allows packets back to sources with all active routes.
    • CStrict RPF checks only for the existence of at least one active route back to the source using the incoming interface.
    • DStrict RPF check is run on the first sent and reply packet of any new session.

    Show answer

    Correct answer: A

    How others answered

    • A86%

    Explanation

    A Strict: In this mode, Fortigate also verifies that the matching route is the best route in the routing table. That is, if the route in table contains a matching route for the source address and the incoming interface, but there is a better route for the source address through another interface the the rpf check fails.

    Adapted from community discussion by s4mu3l007 · 2024-10-28 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • community.fortinet.com documentation

    View community discussion3

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

    1. S

       s4mu3l007

       2024-10-28

       2 upvotes

       A Strict: In this mode, Fortigate also verifies that the matching route is the best route in the routing table. That is, if the route in table contains a matching route for the source address and the incoming interface, but there is a better route for the source address through another interface the the rpf check fails.

    2. H

       hecjoseroag

       2024-12-12

       Selected A1 upvote

       'strict' : a routing lookup (with best match) is made for the packet source IP. Packet is dropped if its ingressing interface does not match the interface selected by the routing lookup. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Reverse-Path-Forwarding-RPF-implementation-and-use/ta-p/194382

    3. S

       sxcap

       2024-12-17

       Selected A1 upvote

       if the route is the best, traffic is allowed, if not, traffic is drop

25. Question 25 of 25

    Refer to the exhibits.

    

    

    

    An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW). What must the administrator do to synchronize the address object?

    • AChange the csf setting on Local-FortiGate (root) to set fabric-object-unification default.
    • BChange the csf setting on both devices to set downstream-access enable.
    • CChange the csf setting on ISFW (downstream) to set authorization-request-type certificate.
    • DChange the csf setting on ISFW (downstream) to set configuration-sync local.

    Show answer

    Correct answer: A

    How others answered

    • A91%

    Explanation

    Correct: A. Change the csf setting on Local-FortiGate (root) to set fabric-object-unification default. FortiGate Security 7.2 Study Guide (p.434): "The CLI command set fabric-object-unification is only available on the root FortiGate. When set to local, global objects will not be synchronized to downstream devices in the Security Fabric. The default value is default"

    Adapted from community discussion by s4mu3l007 · 2024-10-28 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Fortinet documentation
    • Fortinet documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FGT_AD-7.4 or CertExamHQ.

    1. S

       s4mu3l007

       2024-10-28

       Selected A2 upvotes

       Correct: A. Change the csf setting on Local-FortiGate (root) to set fabric-object-unification default. FortiGate Security 7.2 Study Guide (p.434): "The CLI command set fabric-object-unification is only available on the root FortiGate. When set to local, global objects will not be synchronized to downstream devices in the Security Fabric. The default value is default"

    2. H

       hecjoseroag

       2024-12-12

       Selected A1 upvote

       Set object synchronization (fabric-object-unification) to default or local on a downstream device. When set to local, the device does not synchronize objects from the root, but will still participate in sending the synchronized object downstream. https://docs.fortinet.com/document/fortigate/6.4.0/new-features/520820/improvements-to-synchronizing-objects-across-the-security-fabric-6-4-4

    3. F

       f3eb371

       2024-12-08

       Selected A1 upvote

       set fabric-object-unification [default/local] default: Global CMDB objects will be synchronized in the Security Fabric. local: Global CMDB objects will not be synchronized to and from this device. https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/880913/synchronizing-objects-across-the-security-fabric?utm_source=chatgpt.com

    4. 0

       066c9f3

       2024-10-29

       Selected A1 upvote

       A is correct. In contrast to the same question in 7.2, the Exhibit B is actually correct here making A a valild answer because the fabric-object-unification is set to local on the exhibit.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCP_FGT_AD-7.4 practice, question 1 of 25