Fortinet FCP_FGT_AD-7.6 Practice Exam Questions

Fortinet FCP_FGT_AD-7.6 Sample Question Answers

Question # 1

Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.) 

A. The host field in the HTTP header. 
B. The server name indication (SNI) extension in the client hello message. 
C. The subject alternative name (SAN) field in the server certificate. 
D. The subject field in the server certificate. 
E. The serial number in the server certificate. 

Show Answer

Question # 2

Refer to the exhibit. Which two statements are true about the routing entries in this database table? (Choose two.) 

A. All of the entries in the routing database table are installed in the FortiGate routing table. 
B. The port2 interface is marked as inactive. 
C. Both default routes have different administrative distances. 
D. The default route on port2 is marked as the standby route. 

Show Answer

Question # 3

Refer to the exhibit. Refer to the exhibits. An administrator configured the Web Filter Profile to block access to all social networking sites except Facebook. However, when users try to access Facebook.com, they are redirected to a FortiGuard web filtering block page. Based on the exhibits, which configuration change must the administrator make to allow Facebook while blocking all other social networking sites?

 A. Change the Feature set of Web Filter Profile as Proxy-based.
 B. Set the Action as Exempt for www.facebook.com in the Static URL Filter. 
C. Change the type as Simple in the Static URL Filter section. 
D. Set the Social Networking action as warning in the FortiGuard Category Based Filter. 

Show Answer

Question # 4

You are encountering connectivity problems caused by intermediate devices blocking IPsec traffic. In which two ways can you effectively resolve the problem? (Choose two.) 

A. You should use the protocol IKEv2. 
B. You can use SSL VPN tunnel mode to prevent problems with blocked ESP and UDP ports (500 or 4500). 
C. You can configure a hub-and-spoke topology with SSL VPN tunnels to bypass blocked UDP ports. 
D. You can turn on fragmentation to fix large certificate negotiation problems. 

Show Answer

Question # 5

Refer to the exhibit. Refer to the exhibits. You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits. Which two factors can you observe from these configurations? (Choose two.) :

A. YouTube search is allowed based on the Google Application and Filter override settings. 
B. YouTube access is blocked based on Excessive-Bandwidth Application and Filter override settings. 
C. Facebook access is allowed but you cannot play Facebook videos based on Video/Audio category filter settings. 
D. Facebook access is blocked based on the category filter settings. 

Show Answer

Question # 6

Refer to the exhibit. The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile. An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category. What are two solutions for satisfying the requirement? (Choose two.)

 A. Configure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively. 
B. Configure a web override rating for download.com and select Malicious Websites as the subcategory. 
C. Configure a separate firewall policy with action Deny and an FQDN address object for*.download.com as destination address. 
D. Set the Freeware and Software Downloads category Action to Warning.

Show Answer

Question # 7

Refer to the exhibits. An administrator wants to add HQ-ISFW-2 in the Security Fabric. HQ-ISFW-2 is in the same subnet as HQ-ISFW. After configuring the Security Fabric settings on HQ-ISFW-2, the status stays Pending. What can be the two possible reasons? (Choose two.) 

A. Upstream FortiGate IP must be set to 10.0.11.254. 
B. SAML Single Sign-On must be set to Manual. 
C. HQ-ISFW-2 must be authorized on HQ-ISFW. 
D. Management IP must be set to 10.0.13.254. 

Show Answer

Question # 8

QUESTION 43 Refer to the exhibits. Based on the current HA status, an administrator updates the override and priority parameters on HQ-NGFW-1 and HQ-NGFW-2 as shown in the exhibit. What would be the expected outcome in the HA cluster? 

A. HQ-NGFW-1 will synchronize the override disable setting with HQ-NGFW-2. 
B. HQ-NGFW-2 will take over as the primary because it has the override enable setting and higher priority than HQ-NGFW-1. 
C. HQ-NGFW-1 will remain the primary because HQ-NGFW-2 has lower priority. 
D. The HA cluster will become out of sync because the override setting must match on all HA members.

Show Answer

Question # 9

Refer to the exhibits. The exhibits show the system performance output and default configuration of high memory usage thresholds on a FortiGate device. Based on the system performance output, what are the two possible outcomes? (Choose two.) 

A. FortiGate has entered conserve mode. 
B. Administrators can access FortiGate only through the console port. 
C. Administrators can change the configuration. 
D. FortiGate drops new sessions. 

Show Answer

Question # 10

Refer to the exhibits. The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration. An administrator created a Deny policy with default settings to deny Webserver access for RemoteUser2. The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver. Which additional configuration can the administrator add to a deny firewall policy, beyond the default behavior, to block Remote-User2 from accessing the Webserver? 

A. Disable match-vip in the Allow_access policy 
B. Configure a One-to-One IP Pool object in a new policy.
 C. Set the Destination address as Webserver in the Deny policy.
 D. Set the Destination address as Deny_IP in the Allow_access policy. 

Show Answer