Free FCP_FGT_AD-7.4: FCP - FortiGate 7.4 Administrator Exam Questions and Answers
47 verified practice questions for FCP_FGT_AD-7.4.
The first 10 questions on this page are free to read, answers included — no account and no card. A plan opens the rest of the bank, the full timed practice test and your weak-topic reporting.
Last updated: September 19, 2026
- Provider
- Fortinet
- Questions in our bank
- 1000+
- Free to read
- First 10, with answers
- Our test mode duration & pass mark
- 130 mins · 70%
- Verified answers
- Reviewed weekly
- Practice format
- Multiple choice
Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.
Question #1
Refer to the exhibit. Why did FortiGate drop the packet?
Please select an optionIncorrectCorrect answer: D
The debug trace output shows that the packet was "Denied by forward policy check (policy 0)." In FortiGate, policy ID 0 corresponds to the default implicit deny policy. This means that if a packet does not match any configured firewall policies, it is denied by the default implicit policy. References: FortiOS 7.4.1 Administration Guide: Firewall Policies
Was this answer correct?Question #2
When FortiGate performs SSL/SSH full inspection, you can decide how it should react when it detects an invalid certificate. Which three actions are valid actions that FortiGate can perform when it detects an invalid certificate? (Choose three.)
Select 3 answers.
Please select an optionIncorrectCorrect answer: A, D, E
When FortiGate performs SSL/SSH full inspection and detects an invalid certificate, there are three valid actions it can take: Allow & Warning: This action allows the session but generates a warning. Block & Warning: This action blocks the session and generates a warning. Block: This action blocks the session without generating a warning. Actions such as "Trust & Allow" or just "Allow" without additional configurations are not applicable in the context of handling invalid certificates. References: FortiOS 7.4.1 Administration Guide: Configuring SSL/SSH inspection profile
Was this answer correct?Question #3
Which two statements describe how the RPF check is used? (Choose two.)
Select 2 answers.
Please select an optionIncorrectCorrect answer: A, D
The Reverse Path Forwarding (RPF) check is run on the first sent packet of any new session to ensure that the packet arrives on a legitimate interface. This check protects the network from IP spoofing attacks by verifying that a return route exists from the receiving interface back to the source IP address. If the route is invalid or not found, the packet is discarded. Options B and C are incorrect because RPF checks are performed on the first sent packet, not the reply packet. References: FortiOS 7.4.1 Administration Guide: Reverse Path Forwarding (RPF) Check
Was this answer correct?Question #4
Which inspection mode does FortiGate use for application profiles if it is configured as a profile-based next- generation firewall (NGFW)?
Please select an optionIncorrectCorrect answer: D
When FortiGate is configured in NGFW profile-based mode, it primarily uses flow-based inspection for application profiles. Flow-based inspection provides faster processing and lower latency by inspecting traffic in real-time without buffering, making it suitable for scenarios where performance is a priority. References: FortiOS 7.4.1 Administration Guide: Inspection Modes
Was this answer correct?Question #5
Refer to the exhibit. The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile. An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category. What are two solutions for satisfying the requirement? (Choose two.)
Select 2 answers.
Please select an optionIncorrectCorrect answer: C, D
To block access specifically to download.com while allowing other sites in the "Freeware and Software Downloads" category, you can create a separate firewall policy with a deny action specifically for the FQDN *.download.com. This approach allows blocking this particular site without affecting the other sites in the same category. Alternatively, configuring a static URL filter entry with the type set to Wildcard and action set to Block will also achieve the desired effect by directly blocking the specific URL without impacting other sites in the category. References: FortiOS 7.4.1 Administration Guide: URL filter configuration
Was this answer correct?Question #6
Which method allows management access to the FortiGate CLI without network connectivity?
Please select an optionIncorrectCorrect answer: C
The serial console method allows management access to the FortiGate CLI without relying on network connectivity. This method involves directly connecting a computer to the FortiGate device using a serial cable (such as a DB-9 to RJ-45 cable or USB to RJ-45 cable) and using terminal emulation software to interact with the FortiGate CLI. This method is essential for situations where network-based access methods (such as SSH or Telnet) are not available or feasible. References: FortiOS 7.4.1 Administration Guide: Console connection
Was this answer correct?Question #7
An administrator configured a FortiGate to act as a collector for agentless polling mode. What must the administrator add to the FortiGate device to retrieve AD user group information?
Please select an optionIncorrectCorrect answer: A
To retrieve AD user group information in agentless polling mode, the administrator must add an LDAP server to the FortiGate device.
Was this answer correct?Question #8
Which three strategies are valid SD-WAN rule strategies for member selection? (Choose three.)
Select 3 answers.
Please select an optionIncorrectCorrect answer: A, B, C
FortiGate's SD-WAN rule strategies for member selection include the following: Manual with load balancing: This strategy allows an administrator to manually configure which SD- WAN member interfaces to use for specific traffic. Lowest Cost (SLA) with load balancing: This strategy prioritizes the link with the lowest cost that meets the SLA requirements. Best Quality with load balancing: This strategy selects the link with the best performance metrics, such as latency, jitter, or packet loss. Options D and E are incorrect because "Lowest Quality" is not a valid strategy, and "Lowest Cost without load balancing" contradicts the requirement for load balancing in the strategy name. References: FortiOS 7.4.1 Administration Guide: SD-WAN Rule Strategies
Was this answer correct?Question #9
Refer to the exhibit. Which two statements are true about the routing entries in this database table? (Choose two.)
Select 2 answers.
Please select an optionIncorrectCorrect answer: C, D
The routing table in the exhibit shows two default routes (0.0.0.0/0) with different administrative distances: The default route through port2 has an administrative distance of 20. The default route through port1 has an administrative distance of 10. Administrative distance determines the priority of the route; a lower value is preferred. Here, the route through port1 with an administrative distance of 10 is the preferred route. The route through port2 with an administrative distance of 20 acts as a standby or backup route. If the primary route (port1) fails or is unavailable, traffic will then be routed through port2. Regarding the statement that the port2 interface is marked as inactive, there is no indication in the routing table that port2 is inactive. Similarly, all the routes displayed are not necessarily installed in the FortiGate routing table, as the table could include both active and backup routes. References: FortiOS 7.4.1 Administration Guide: Default route configuration FortiOS 7.4.1 Administration Guide: Routing table
Was this answer correct?Question #10
Refer to the exhibits. The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration. An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2. The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver. Which two configuration changes can the administrator make to the policy to deny Webserver access for Remote-User2? (Choose two.)
Select 2 answers.
Please select an optionIncorrectCorrect answer: A, B
Traffic to the server arrives through a VIP, so the deny policy must use the VIP object as destination and have match-vip enabled; otherwise FortiGate skips the deny policy for VIP traffic and Remote-User2 still reaches the webserver.
Was this answer correct?
Continue with FCP_FGT_AD-7.4: FCP - FortiGate 7.4 Administrator
Unlock the full question bank
You have read the first 10 questions. A subscription opens every question in FCP_FGT_AD-7.4: FCP - FortiGate 7.4 Administrator, the full timed practice test, and your progress and weak-topic reporting.
Single exam
$19.99for 30 days
Full question bank and practice test for one exam, for 30 days.
Single exam
$49.99for 1 year
One exam for a full year. Nothing renews and nothing to cancel.
Full access
$39.99/mo
Every exam in the catalogue, month to month.
Full access
$199.99/yr
Every exam in the catalogue for a year.
Already subscribed? Sign in to pick up where you left off.
Other Fortinet certifications
- NSE4-5.4: Fortinet Network Security Expert - FortiOS 5.4 (opens in a new tab)
- NSE4_FGT-7.0: Fortinet NSE 4 - FortiOS 7.0 (opens in a new tab)
- NSE5_FMG-7.2: Fortinet NSE 5 - FortiManager 7.2 (opens in a new tab)
- NSE6_FML-6.2: Fortinet NSE 6 - FortiMail 6.2 (opens in a new tab)
- NSE7 Enterprise Firewall - FortiOS 5.4 (opens in a new tab)
- NSE7_EFW-6.2: Fortinet NSE 7 - Enterprise Firewall 6.2 (opens in a new tab)
Reviews
★★★★★
This platform is a lifesaver. The practice questions and explanations are so detailed. It’s the best study tool I’ve ever used.
Hannah Smith
USA
★★★★★
I highly recommend Exam Practice. The feedback after each test helped me improve significantly, and I passed my exams easily.
Oscar Nyström
Sweden
★★★★★
Exam Practice is worth every penny. The mock exams are realistic, and the feedback helped me focus on key areas.
Amit Sharma
India
FAQ
Learn More: https://www.fortinet.com/training-certification
- Q1: What are Fortinet Certification Exams?
- A: Fortinet Certification Exams validate your expertise in using and managing Fortinet’s network security solutions, including FortiGate firewalls, FortiAnalyzer, and other Fortinet security products. These certifications demonstrate your proficiency in deploying, configuring, and troubleshooting Fortinet security technologies to protect networks from cyber threats.
- Q2: Why should I pursue Fortinet Certification?
- A: Fortinet Certification enhances your professional credibility, showcasing your skills and knowledge in network security. This can lead to better job opportunities, higher salaries, and career advancement in cybersecurity and IT infrastructure roles.
- Q3: What are the benefits of Fortinet Certification?
- A: Benefits include recognition as a certified Fortinet professional, improved job performance, access to exclusive resources, continuing education opportunities, and staying current with the latest Fortinet technologies and best practices.
- Q4: Who should take Fortinet Certification Exams?
- A: Network engineers, system administrators, security analysts, and IT professionals involved in designing, implementing, and managing network security solutions using Fortinet products should consider these certifications to validate their expertise and advance their careers.
- Q5: What types of Fortinet Certification Exams are available?
- A: Fortinet offers various certification paths under the Network Security Expert (NSE) program, including:
- Q6: How do I prepare for Fortinet Certification Exams?
- A: Preparation can include official Fortinet training courses, study guides, practice exams, online tutorials, and hands-on experience with Fortinet security products and solutions.
- Q7: Where can I take Fortinet Certification Exams?
- A: Fortinet Certification Exams can be taken at authorized Pearson VUE testing centers worldwide or online, providing flexibility to fit your schedule and location.
- Q8: How do Fortinet Certifications impact my career?
- A: Fortinet Certifications significantly boost your career by demonstrating your expertise to employers, making you a more competitive candidate for advanced roles and promotions in network security and IT infrastructure.
- Q9: Are there any prerequisites for Fortinet Certification Exams?
- A: Some exams may have prerequisites, such as foundational knowledge or prior certifications. Check the specific requirements for each certification path on the Fortinet website.
- Q10: How often do I need to recertify for Fortinet Certifications?
- A: Fortinet Certifications typically require recertification every two years to ensure that certified professionals stay updated with the latest cybersecurity technologies and industry practices.