Free FCP_FGT_AD-7.4: FCP - FortiGate 7.4 Administrator Exam Questions and Answers

An administrator suspects that a process is consuming excessive CPU on FortiGate. Which CLI command lists the running processes sorted by CPU usage and refreshes the display at regular intervals?

• AA. diagnose hardware sysinfo memory
• BB. get system status
• CC. diagnose sys top
• DD. diagnose sys session stat

Refer to the exhibit. The port2 interface of FortiGate has the IP address 10.0.1.1/24. A client at 198.51.100.7 sends a TCP packet from source port 51000 to 203.0.113.10 on port 8443. Exhibit: config firewall vip edit "Web-VIP" set extip 203.0.113.10 set extintf "port1" set portforward enable set mappedip "10.0.1.20" set extport 8443 set mappedport 443 next end config firewall policy edit 5 set name "To-Web" set srcintf "port1" set dstintf "port2" set action accept set srcaddr "all" set dstaddr "Web-VIP" set schedule "always" set service "ALL" set nat enable next end What source address and destination address and port does the web server at 10.0.1.20 see?

• AA. Source 198.51.100.7, destination 10.0.1.20 port 8443
• BB. Source 10.0.1.1, destination 10.0.1.20 port 8443
• CC. Source 198.51.100.7, destination 10.0.1.20 port 443
• DD. Source 10.0.1.1, destination 10.0.1.20 port 443

Which two statements about how FortiGate evaluates firewall policies are true? (Choose two.)

Select 2 answers.

• AA. Moving a policy to a different position in the list does not change its policy ID
• BB. FortiGate applies the most specific matching policy regardless of its position in the list
• CC. FortiGate evaluates policies in ascending order of policy ID regardless of their position in the list
• DD. FortiGate evaluates policies from top to bottom and applies the first policy that matches the traffic

Refer to the exhibit. FortiGate has the following static routes, and all three gateways are reachable. Exhibit: config router static edit 1 set dst 0.0.0.0 0.0.0.0 set gateway 192.0.2.1 set device "port1" set distance 10 set priority 5 next edit 2 set dst 0.0.0.0 0.0.0.0 set gateway 198.51.100.1 set device "port2" set distance 10 set priority 10 next edit 3 set dst 0.0.0.0 0.0.0.0 set gateway 203.0.113.1 set device "port3" set distance 20 set priority 1 next end Which statement describes how FortiGate routes a packet destined for 8.8.8.8?

• AA. FortiGate uses port3 only, because its priority value is the lowest of the three routes
• BB. FortiGate uses port2 only, and the route on port3 is installed in the routing table after port2 fails
• CC. FortiGate load balances over port1 and port2 with ECMP, and the route on port3 is a backup in the routing table
• DD. FortiGate uses port1 only, and the route on port3 stays in the routing database but not in the routing table

A company runs a hub-and-spoke IPsec VPN with one hub FortiGate and 30 branch FortiGate devices. Each spoke has a single tunnel to the hub, and BGP over the tunnels exchanges the branch subnets. The administrator wants spokes to build direct spoke-to-spoke tunnels on demand, without configuring a tunnel between every pair of spokes. Which configuration meets this requirement?

• AA. Enable auto-discovery-sender on the hub phase 1 interface and auto-discovery-receiver on each spoke phase 1 interface
• BB. Add a static route on each spoke for every other spoke subnet, using the tunnel to the hub as the outgoing interface
• CC. Enable mode-cfg on the hub phase 1 interface and define a client address range for the spokes to use
• DD. Enable auto-discovery-receiver on the hub phase 1 interface and auto-discovery-sender on each spoke phase 1 interface

Refer to the exhibit. The exhibit shows the firewall policy list, in the order displayed, for traffic from port2 (LAN) to port1 (WAN). Exhibit: ID 3 | Source: Sales_Net | Destination: all | Service: HTTP | Action: ACCEPT | NAT: enabled ID 5 | Source: all | Destination: all | Service: ALL | Action: ACCEPT | Web filter: Block_Social | NAT: enabled ID 2 | Source: Sales_Net | Destination: all | Service: HTTPS | Action: ACCEPT | Security profiles: none | NAT: enabled Implicit deny A user at 10.1.10.25, which belongs to Sales_Net, opens an HTTPS website. Which policy processes the session?

• AA. Implicit deny
• BB. ID 2
• CC. ID 3
• DD. ID 5

Refer to the exhibit. An administrator integrated FortiGate with the FSSO collector agent. A firewall policy allows only the FSSO group CORP\ENGINEERING to reach the internet, and the user jsmith reports that access is blocked. Exhibit: FGT # diagnose debug authd fsso list ----FSSO logons---- IP: 10.0.1.45 User: jsmith Groups: CORP/SALES Workstation: PC-045.corp.example.com MemberOf: CORP/SALES Total number of logons listed: 1, filtered: 0 ----end of FSSO logons---- What explains why the traffic is not allowed?

• AA. The reported logon for jsmith is not a member of a group accepted as a source by the policy
• BB. The workstation IP address must be added to the policy as a source address together with the FSSO group
• CC. FortiGate requires jsmith to also authenticate through the captive portal before an FSSO logon is accepted
• DD. The FSSO connector is down, so no logon information reaches FortiGate

Refer to the exhibit. An administrator is investigating slow web browsing and failed scans on a FortiGate. Exhibit: FGT # diagnose hardware sysinfo conserve memory conserve mode: on total RAM: 3959 MB memory used: 3551 MB 89.7% of total RAM memory used threshold extreme: 95% memory used threshold red: 88% memory used threshold green: 82% The administrator frees memory by removing unused sessions, and memory use falls to 85%. What is the state of the FortiGate at this point?

• AA. Memory conserve mode remains on until memory use drops below 82 percent
• BB. Memory conserve mode turns off because memory use is below 88 percent
• CC. Memory conserve mode turns off because memory use is below 95 percent
• DD. Memory conserve mode remains on until the administrator reboots the device

A FortiGate with IPS sensors applied to several policies occasionally enters memory conserve mode, and IPS inspection then drops new sessions. The administrator wants traffic to pass uninspected by IPS instead of being dropped when this occurs. Which configuration achieves this?

• AA. Set the IPS sensor action for all signatures to monitor
• BB. Set av-failopen to pass in the system global settings
• CC. Reduce the IPS engine count in the IPS global settings to one
• DD. Set fail-open to enable in the IPS global settings

Two FortiGate units form an active-passive FGCP cluster with override disabled. FGT-A has priority 200 and is the primary. FGT-B has priority 100 and is the subordinate. All heartbeat and monitored links are up, and both units have been running for several weeks. The administrator changes the priority of FGT-B to 250. What is the expected result?

• AA. FGT-A remains the primary and the new priority is used only during the next election
• BB. FGT-B becomes the primary immediately and FGT-A becomes the subordinate
• CC. FGT-B becomes the primary after the five-minute age difference timer expires
• DD. Both units operate as primary until the administrator reboots one of them