Free FCSS-EFW-AD-7-4 sample questions

Correct answer: Use a single policy package with a common web filter profile, and use per-device mapping for the URL filter object.

The most efficient method is to use a single policy package for consistency and apply per-device mapping for the specific objects that need to be unique, such as the URL filter entry. This avoids the massive overhead of managing 50 separate policy packages and leverages FortiManager's dynamic object capabilities.

Correct answers: Configure two FortiGate devices as a standard HA cluster (Active-Passive) for the hub.; Deploy a second, independent FortiGate as a secondary hub and configure spokes to connect to both.

To achieve hub redundancy in an ADVPN setup, you can either use a standard FortiGate HA cluster for the hub role, which provides device-level failover, or deploy two independent hubs and configure spokes to establish tunnels to both. The latter provides greater resiliency, including against ISP or site failure at the primary hub location.

Correct answer: False

This statement is false. While session pickup synchronizes TCP sessions, it does not synchronize connectionless sessions like UDP and ICMP by default. These sessions will be dropped and must be re-established after a failover. For some specific protocols like SIP, session helpers can assist, but it is not a universal guarantee for all session types.

Correct answer: Add the FQDNs of the healthcare services to the 'Exempt from SSL Inspection' list within the specific SSL/SSH Inspection profile.

The correct and most direct method is to add the fully qualified domain names (FQDNs) of the problematic services to the exemption list within the SSL/SSH Inspection profile itself. This allows the firewall policy to remain simple while giving granular control over which destinations are bypassed by the deep inspection engine.

Correct answer: It will only use Route 1 because it has the lower priority value.

In FortiOS, when two static routes have the same destination and administrative distance, the route with the lower priority value is considered superior and will be installed as the active route in the routing table. The higher priority route will only be used if the lower priority route becomes inactive.

Correct answer: Assign a specific NP7 processor to the 'Guest-WiFi' VDOM using the `vdom-npu-affinity` command.

On FortiGate models with multiple NP7 processors, you can dedicate specific processors to particular VDOMs. By using the `config global` and `config system npu` CLI commands to set `vdom-npu-affinity`, the administrator can bind the 'Guest-WiFi' VDOM to a specific NP7, ensuring its traffic is prioritized for hardware acceleration by that processor.

Correct answer: The administrator's profile is missing the 'Script Management' permission in their assigned access profile.

In FortiManager, permissions are granular. Even with Super_User rights within an ADOM, the administrator's overall access profile must explicitly grant permissions for 'Script Management'. Without this specific permission, the administrator cannot create, edit, or run scripts, resulting in a 'permission denied' error.

Correct answer: The `auto-negotiate` setting is disabled in the Phase 2 configuration.

When `auto-negotiate` is disabled, the FortiGate will not attempt to bring the tunnel up automatically after it goes down (for example, due to lifetime expiration). It will wait for interesting traffic to trigger the negotiation. Since the disconnection happens overnight when traffic is low, the tunnel remains down. Enabling `auto-negotiate` ensures the FortiGate proactively re-establishes the tunnel.

Correct answer: In FortiAnalyzer, create an event handler to mark these specific events as acknowledged upon arrival.

The best approach is to use a FortiAnalyzer event handler. An event handler can be configured to automatically process incoming logs that match specific criteria (like the IPS signature ID). It can then perform an action, such as marking the event as acknowledged or changing its severity, which effectively hides it from the default alert views without deleting the log data. This preserves visibility for forensic purposes while cleaning up the active monitoring console.

Correct answers: Configure an Inter-VDOM link (NPV/NPU VDOM link).; Physically connect two interfaces of the FortiGate with an Ethernet cable, assigning one to each VDOM.

Traffic between VDOMs on the same device can be routed either virtually using an inter-VDOM link (a software or hardware-accelerated connection) or physically by connecting two ports with a cable and assigning each port to a different VDOM. The inter-VDOM link is the more common and efficient method.