Free FCP_FCT_AD-7.4: FCP - FortiClient EMS 7.4 Administrator Exam Questions and Answers

An administrator configured an IPsec VPN tunnel with Auto Connect in the endpoint profile assigned to corporate laptops. The tunnel now also establishes when the laptops are inside the office, which wastes gateway capacity. Users must still connect automatically when they are outside the corporate network. What should the administrator configure in the endpoint profile?

• AA. An on-fabric detection rule for the office network, with the VPN tunnel set to connect only when off-fabric
• BB. A compliance verification rule for the office subnet, with the VPN tunnel set to connect at OS start
• CC. A ZTNA destination for the office subnet, with the VPN tunnel set to remain always up
• DD. A web filter exemption for the office subnet, with the VPN tunnel set to connect at user logon

An administrator finds that a Windows laptop managed by FortiClient EMS is compromised. The laptop must be isolated from the network but remain registered in EMS for investigation. Which EMS action should the administrator use?

• AA. Run an on-demand antivirus scan from the Endpoints list
• BB. Quarantine the endpoint from the Endpoints list
• CC. Deregister the endpoint from the Endpoints list
• DD. Disable the endpoint profile assigned to the endpoint

An administrator has finished installing FortiClient EMS and must now activate the license. Which two methods are available? (Choose two.)

Select 2 answers.

• AA. Upload a license file downloaded from the Fortinet support portal
• BB. Sign in with a FortiCloud account that holds the FortiClient EMS entitlement
• CC. Import the license from FortiAnalyzer through the Security Fabric
• DD. Enter the license key on the FortiGate that is connected to EMS

Refer to the exhibit. Exhibit: FortiClient EMS > Server Settings Listen on IP: All Use FQDN: Disabled Custom hostname: (blank) Default hostname: ems01.corp.local Remote HTTPS access: Enabled The EMS server is published to the internet through a FortiGate virtual IP that forwards TCP 8013 to ems01. Remote users install a FortiClient installer created on EMS, but the endpoints never register. Internal endpoints register without problems. Which change on EMS corrects the problem?

• AA. Change Listen on IP from All to the public address used by the virtual IP, then restart the EMS service
• BB. Enable Use FQDN and set Custom hostname to a name that resolves publicly to the virtual IP, then create a new installer
• CC. Disable Remote HTTPS access so that remote endpoints fall back to the telemetry connection on TCP 8013
• DD. Change the default hostname to ems01 without the domain suffix, then redeploy the existing installer

An administrator has two endpoint policies on FortiClient EMS, listed in this order: Standard-Corp, assigned to the domain group All-Employees, and Sales-Restricted, assigned to the domain group Sales. Every Sales user is also a member of All-Employees. Sales laptops are receiving the Standard-Corp profile. What should the administrator do so that Sales laptops receive the Sales-Restricted profile?

• AA. Assign the Sales-Restricted profile to the Default policy and leave the order of the other policies unchanged
• BB. Replace the profile on the Standard-Corp policy with the Sales-Restricted profile
• CC. Move the Sales-Restricted policy above the Standard-Corp policy in the policy list
• DD. Disable the Default policy so that the Sales group is evaluated against its own policy first

An administrator wants to confirm from an endpoint that FortiClient can reach the EMS telemetry service. Which default TCP port should the administrator test on the EMS server?

• AA. 514
• BB. 1433
• CC. 8013
• DD. 10443

A managed service provider wants one FortiClient EMS server to manage endpoints for several customers, with separate endpoints, policies and administrators for each customer. Which EMS feature provides this?

• AA. Endpoint profile inheritance
• BB. Zero trust tagging rule sets
• CC. Multitenancy
• DD. Telemetry gateway lists

An endpoint profile blocks the Social.Media application category in the Application Firewall. The sales team must still be able to use LinkedIn, and all other applications in that category must remain blocked. What should the administrator configure in the profile?

• AA. The Social.Media category action changed to Monitor
• BB. The Application Firewall disabled in the sales team profile
• CC. An application override for LinkedIn with the Allow action
• DD. A web filter exemption for linkedin.com with the Allow action

An administrator adds FortiClient EMS as a Fabric connector on a FortiGate by entering the EMS IP address. The FortiGate accepts the EMS server certificate, but the connector status stays at "Not connected". On FortiClient EMS, the Fabric Devices page lists the FortiGate with a status of "Waiting for authorization". What should the administrator do to complete the integration?

• AA. Import the FortiGate CA certificate into the trusted certificate store on the EMS server
• BB. Enable the ZTNA gateway list option in the endpoint profile assigned to the endpoints
• CC. Create a ZTNA tagging rule set that references the address group configured on the FortiGate
• DD. Authorize the FortiGate connection request in the Fabric Devices list on EMS

An organization runs FortiAnalyzer in its Security Fabric. The administrator wants FortiClient endpoints that are managed by FortiClient EMS to send their logs directly to FortiAnalyzer. Where should the administrator configure this?

• AA. In the log settings of the FortiGate that forwards telemetry for the endpoints
• BB. In the ZTNA destinations list of the endpoint profile assigned to the endpoints
• CC. In the server settings of FortiClient EMS under the Fabric Devices page
• DD. In the System Settings of the endpoint profile assigned to the endpoints