FCSS_EFW_AD-7.
4 (57 Questions)
Number: 000-000
Passing Score: 800
Time Limit: 120 min
File Version: 1.0
Vendor: Fortinet
Exam Code: FCSS_EFW_AD-7.4
Exam Name: FCSS - Enterprise Firewall 7.4 Administrator
Innovior ITTech
Q&A
FCSS - Enterprise Firewall 7.4 Administrator
FCSS_EFW_AD-7.4
(57 Questions)
http://www.facebook.com/InnoviorITTech
We Offer Free Update Service
For One Year.
QUESTION 1
A company that acquired multiple branches across different countries needs to install new FortiGate devices
on each of those branches. However, the IT staff lacks sufficient knowledge to implement the initial
configuration on the FortiGate devices. Which three approaches can the company take to successfully deploy
advanced initial configurations on remote branches? (Choose three.)
A. Use metadata variables to dynamically assign values according to each FortiGate device.
B. Use provisioning templates and install configuration settings at the device layer.
C. Use the Global ADOM to deploy global object configurations to each FortiGate device.
D. Apply Jinja in the FortiManager scripts for large-scale and advanced deployments.
E. Add FortiGate devices on FortiManager as model devices, and use ZTP or LTP to connect to FortiGate
devices.
Correct Answer: ABE
Section: (none)
Explanation
Explanation/Reference:
QUESTION 2
An administrator is checking an enterprise network and sees a suspicious packet with the MAC address
e0:23:ff:fc:00:86.
What two conclusions can the administrator draw? (Choose two.)
A. The suspicious packet is related to a cluster that has VDOMs enabled.
B. The network includes FortiGate devices configured with the FGSP protocol.
C. The suspicious packet is related to a cluster with a group-id value lower than 255.
D. The suspicious packet corresponds to port 7 on a FortiGate device.
Correct Answer: AD
Section: (none)
Explanation
Explanation/Reference:
QUESTION 3
A company's guest internet policy, operating in proxy mode, blocks access to Artificial Intelligence Technology
sites using FortiGuard. However, a guest user accessed a page in this category using port 8443. Which
configuration changes are required for FortiGate to analyze HTTPS traffic on nonstandard ports like 8443
when full SSL inspection is active in the guest policy?
A. Add a URL wildcard domain to the website CA certificate and use it in the SSL/SSH Inspection Profile.
B. In the Protocol Port Mapping section of the SSL/SSH Inspection Profile, enter 443, 8443 to analyze both
standard (443) and non-standard (8443) HTTPS ports.
C. To analyze nonstandard ports in web filter profiles, use TLSv1.3 in the SSL/SSH Inspection Profile.
D. Administrators can block traffic on nonstandard ports by enabling the SNI check in the SSL/SSH Inspection
Profile.
Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
QUESTION 4
An administrator needs to install an IPS profile without triggering false positives that can impact applications
and cause problems with the user's normal traffic flow. Which action can the administrator take to prevent false
positives on IPS analysis?
A. Use the IPS profile extension to select an operating system, protocol, and application for all the network
internal services and users to prevent false positives.
B. Enable Scan Outgoing Connections to avoid clicking suspicious links or attachments that can deliver botnet
malware and create false positives.
C. Use an IPS profile with action monitor, however, the administrator must be aware that this can compromise
network integrity.
D. Install missing or expired SSL/TLS certificates on the client PC to prevent expected false positives.
Correct Answer: C
Section: (none)
Explanation
Explanation/Reference:
QUESTION 5
Refer to the exhibit, which shows a hub and spokes deployment.
An administrator is deploying several spokes, including the BGP configuration for the spokes to connect to the
hub.
Which two commands allow the administrator to minimize the configuration? (Choose two.)
A. neighbor-group
B. route-reflector-client
C. neighbor-range
D. ibgp-enforce-multihop
Correct Answer: AC
Section: (none)
Explanation
Explanation/Reference:
QUESTION 6
Why does the ISDB block layers 3 and 4 of the OSI model when applying content filtering? (Choose two.)
A. FortiGate has a predefined list of all IPs and ports for specific applications downloaded from FortiGuard.
B. The ISDB blocks the IP addresses and ports of an application predefined by FortiGuard.
C. The ISDB works in proxy mode, allowing the analysis of packets in layers 3 and 4 of the OSI model.
D. The ISDB limits access by URL and domain.
Correct Answer: AB
Section: (none)
Explanation
Explanation/Reference:
QUESTION 7
Refer to the exhibits.
The Administrators section of a root FortiGate device and the Security Fabric Settings section of a downstream
FortiGate device are shown. When prompted to sign in with Security Fabric in the downstream FortiGate
device, a user enters the AdminSSO credentials.
What is the next status for the user?
A. The user is prompted to create an SSO administrator account for AdminSSO.
B. The user receives an authentication failure message.
C. The user accesses the downstream FortiGate with super_admin_readonly privileges.
D. The user accesses the downstream FortiGate with super_admin privileges.
Correct Answer: C
Section: (none)
Explanation
Explanation/Reference:
QUESTION 8
A user reports that their computer was infected with malware after accessing a secured HTTPS website.
However, when the administrator checks the FortiGate logs, they do not see that the website was detected as
insecure despite having an SSL certificate and correct profiles applied on the policy. How can an administrator
ensure that FortiGate can analyze encrypted HTTPS traffic on a website?
A. The administrator must enable reputable websites to allow only SSL/TLS websites rated by FortiGuard web
filter.
B. The administrator must enable URL extraction from SNI on the SSL certificate inspection to ensure the TLS
three-way handshake is correctly analyzed by FortiGate.
C. The administrator must enable DNS over TLS to protect against fake Server Name Indication (SNI) that
cannot be analyzed in common DNS requests on HTTPS websites.
D. The administrator must enable full SSL inspection in the SSL/SSH Inspection Profile to decrypt packets
and ensure they are analyzed as expected.
Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
QUESTION 9
Refer to the exhibit, which shows an ADVPN network.
The client behind Spoke-1 generates traffic to the device located behind Spoke-2. What is the first message
that the hub sends to Spoke-1 to bring up the dynamic tunnel?
A. Shortcut query
B. Shortcut offer
C. Shortcut reply
D. Shortcut forward
Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
QUESTION 10
What is the initial step performed by FortiGate when handling the first packets of a session?
A. Installation of the session key in the network processor (NP)
B. Data encryption and decryption
C. Security inspections such as ACL, HPE, and IP integrity header checking
D. Offloading the packets directly to the content processor (CP)
Correct Answer: C
Section: (none)
Explanation
Explanation/Reference:
QUESTION 11
An administrator applied a block-all IPS profile for client and server targets to secure the server, but the
database team reported the application stopped working immediately after. How can an administrator apply
IPS in a way that ensures it does not disrupt existing applications in the network?
A. Use an IPS profile with all signatures in monitor mode and verify patterns before blocking.
B. Limit the IPS profile to server targets only to avoid blocking connections from the server to clients.
C. Select flow mode in the IPS profile to accurately analyze application patterns.
D. Set the IPS profile signature action to default to discard all possible false positives.
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 12
An administrator is extensively using VXLAN on FortiGate. Which specialized acceleration hardware does
FortiGate need to improve its performance?
A. NP7
B. SP5
C. 9
D. NTurbo
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
QUESTION 13
Refer to the exhibit, which shows a partial enterprise network.
