Free FCP-FML-AD-7-4 sample questions

Correct answer: The IBE encryption profile has not been applied to the matching outbound recipient policy.

FortiMail applies IBE encryption through policies. For outbound mail, an outbound recipient policy must be matched, and that policy must have a content profile that specifies the IBE encryption action. If the content profile with the IBE action is not linked to the outbound policy, encryption will not be triggered, even if the IBE service is active.

Correct answers: Deploy a second FortiMail unit in an active-passive HA cluster.; Ensure the FortiMail model supports and is configured for fail-to-wire or fail-open on its network interfaces.

Deploying an active-passive HA cluster is the primary method for providing redundancy. If the active unit fails, the passive unit takes over all processing, ensuring continuous email inspection and delivery.

Fail-to-wire (also known as fail-open or bypass mode) is a hardware feature on certain FortiMail models. If the appliance loses power or fails critically, the ports create a direct physical connection, allowing traffic to pass through uninspected but without interrupting the mail flow. This is a crucial last-resort mechanism for maintaining connectivity.

Correct answer: True

In gateway mode, the FortiMail unit acts as an inbound and outbound mail relay. To ensure that all incoming email for the protected domain is first processed by FortiMail, the public Mail Exchanger (MX) DNS records must be updated to point to the FortiMail appliance. This directs all external mail servers to deliver email to FortiMail instead of directly to the organization's mail server.

Correct answer: Add the partner's domain to the bounce validation exemption list.

FortiMail provides a specific exemption list for bounce address tag validation. By adding the trusted partner's domain to this list, their DSNs will be accepted without a valid BATV tag, resolving the issue without disabling the feature globally or creating overly permissive IP whitelists.

Correct answer: memberOf

In Microsoft Active Directory, the 'memberOf' attribute is a multi-valued attribute on a user object that lists the distinguished names of the groups to which the user belongs. FortiMail uses this attribute to determine group membership for policy matching.

Correct answer: Create a user alias with a wildcard, mapping '*' to '[email protected]'.

In FortiMail's server mode, a wildcard user alias (`*`) can be created to act as a catch-all. When recipient verification fails to find a specific user, it checks for a matching alias. The wildcard alias will match any non-existent user in the domain and redirect the email to the specified destination, in this case, '[email protected]'.

Correct answers: The sending mail server is not compliant with RFC standards for retrying email delivery.; The greylisting feature is enabled in the session profile applied to the matching IP policy.; If the sending server retries delivery after the initial greylist period, the email will be accepted.

Greylisting works by temporarily rejecting an email from an unknown combination of IP/sender/recipient. A compliant Mail Transfer Agent (MTA) will attempt to redeliver the email after a short period. If the sending server does not retry, the message will remain deferred and eventually time out.

Greylisting is a feature configured within a session profile. That profile must then be applied to a policy (either IP-based or recipient-based) that matches the incoming email session for the greylisting action to be triggered.

Once the initial greylist period has passed, FortiMail will recognize the retried attempt from the same IP/sender/recipient tuple and accept the connection, delivering the email. The tuple is then whitelisted for a configurable period.

Correct answer: In a public DNS server as a TXT record for the domain.

The DKIM standard specifies that the public key must be published in the public DNS system as a TXT record. The record is located at a specific subdomain indicated by the selector in the DKIM signature header. Receiving servers query this DNS record to retrieve the public key and verify the signature's authenticity.

Correct answer: Administrator Access Profiles

Administrator access profiles are used to create custom, role-based access control (RBAC) policies. An administrator can create a profile for each team, granting read/write or read-only access to specific areas of the GUI and CLI. These profiles are then assigned to the respective administrator accounts.