Free FCP-FGT-AD-7-4 sample questions

Correct answer: set session-pickup enable

The `set session-pickup enable` command is critical for ensuring stateful failover in an FGCP cluster. When enabled, the primary unit synchronizes its session table with the secondary unit. In the event of a failover, the new primary unit can use this synchronized information to take over existing sessions without requiring them to be re-established, which is essential for applications like financial data feeds.

Correct answers: Enable `Port Forwarding` in the VIP object.; Set `External service port` to 80 and `Map to IPv4 port` to 8080.

Translating the destination port requires enabling Port Forwarding on the VIP; this exposes the External service port (CLI extport) and Map to IPv4 port (CLI mappedport) fields, which must be set to 80 and 8080. Without port forwarding, the FortiGate translates only the IP and forwards to port 80. ARP reply is enabled by default and static NAT is already the default VIP type. Source: FortiOS 7.4 Administration Guide, Static virtual IPs.

Translating the destination port requires enabling Port Forwarding on the VIP; this exposes the External service port (CLI extport) and Map to IPv4 port (CLI mappedport) fields, which must be set to 80 and 8080. Without port forwarding, the FortiGate translates only the IP and forwards to port 80. ARP reply is enabled by default and static NAT is already the default VIP type. Source: FortiOS 7.4 Administration Guide, Static virtual IPs.

Correct answer: Create two separate firewall policies: Policy 1 with `IT_Staff` as the source and a lenient web filter, placed above Policy 2 with `Clinical_Staff` as the source and a restrictive web filter.

FortiGate evaluates firewall policies from top to bottom and applies the first match. With both AD groups mapped to FSSO user groups on the FortiGate, a policy for IT_Staff with a lenient web filter placed above a policy for Clinical_Staff with a restrictive web filter ensures IT users match their rule first, wherever they log on, while clinical staff match the restrictive rule. This is the standard way to apply different security profiles to different user groups. Source: FortiOS 7.4 Administration Guide, Firewall policy / FSSO.

Correct answer: False

This statement is false. For full SSL inspection (deep inspection) to work without causing certificate errors, the FortiGate's certificate authority (CA) certificate (e.g., `Fortinet_CA_SSL`) must be trusted by the end-user's client browser. This requires installing the CA certificate into the trusted root certificate store of each client machine or browser.

Correct answer: A policy-based route is configured that overrides the static route.

For a destination such as 10.50.20.5, the routing table lookup would select the 10.50.0.0/16 static route because of longest prefix match; administrative distance and priority are only compared between routes to the same prefix. However, FortiGate checks policy-based routes before the routing table (FIB). If a policy route matches the traffic and its action is to forward it to 192.168.1.254, that decision overrides the routing table. Check with 'diagnose firewall proute list' or the Policy Routes list. Source: FortiOS 7.4 Administration Guide, 'Routing concepts' (Route look-up).

Correct answers: A Performance SLA that measures latency on both WAN links.; An SD-WAN rule matching the business-critical applications with a strategy of `Best Quality` based on the latency SLA.; The implicit SD-WAN rule configured with a load-balancing algorithm of `Volume`.

A Performance SLA (Service Level Agreement) is required to actively monitor the quality of the WAN links. To make decisions based on latency, an SLA must be configured to probe the links and measure this specific metric.

An SD-WAN rule is needed to identify the specific traffic (Salesforce, O365) and apply a routing strategy. The `Best Quality` strategy, tied to the latency-measuring Performance SLA, will ensure this traffic is sent over the link that currently has the lowest latency.

The implicit rule, which is the last rule in the list, catches all traffic not matched by previous rules. To meet the requirement for all other traffic, this rule must be configured with a volume-based load-balancing algorithm.

Correct answer: To provide a direct link to internal web resources through the SSL VPN web portal.

In SSL VPN web mode, bookmarks are shortcuts displayed on the portal page that allow users to easily access internal resources like web servers, RDP, or SSH without needing to know the internal IP address or URL. The FortiGate proxies the connection on behalf of the user.

Correct answer: Preshared Key, Encryption Algorithm, and Authentication Algorithm

For a Phase 1 IKE negotiation to succeed, both VPN peers must be configured with an identical set of proposals. This includes the preshared key (or certificate), the encryption algorithm (e.g., AES256), the authentication algorithm (e.g., SHA256), and the Diffie-Hellman group. A mismatch in any of these will cause the Phase 1 negotiation to fail.

Correct answer: Admin Profiles

Admin Profiles provide granular, role-based access control (RBAC) for FortiGate administrators. By creating a custom admin profile, you can specify read, write, or no access for each functional area of the configuration, such as Firewall, Router, System, and Security Profiles. This is the correct method for limiting an administrator's permissions to specific tasks.

Correct answer: The IP Pool has been exhausted because `One-to-One` NAT maps each internal IP to a unique external IP.

`One-to-One` NAT creates a direct mapping between an internal source IP and an external IP from the pool. This means the number of concurrent users who can access the internet is limited to the number of available IPs in the pool. During peak times, the company has more internal users than available public IPs, leading to NAT exhaustion. The solution would be to change the IP Pool type to `Overload`.