Free FCP_FML_AD-7.4: FCP - FortiMail 7.4 Administrator Exam Questions and Answers

An administrator configures two FortiMail units as an active-passive HA cluster. Mail clients and MTAs connect to 192.168.10.5 on port1 of the primary unit. After a failover, the secondary unit must accept SMTP connections sent to 192.168.10.5. What must the administrator configure on port1 of both units?

• AA. Enable the HA monitor on port1 and set the operation mode of the secondary unit to config only
• BB. Set port1 as the heartbeat interface and give each unit a unique IP address in 192.168.10.0/24
• CC. Configure 192.168.10.5 as a secondary IP address on port1 of the primary unit only
• DD. Set the virtual IP action to Use and enter 192.168.10.5 as the virtual IP address

A FortiMail device operates in server mode and hosts the mailboxes for example.com. The administrator wants messages addressed to sales@example.com to be delivered to the mailboxes of three local users, without creating a mailbox named sales. What should the administrator configure?

• AA. A mail user group named sales with the three users as members of the group
• BB. An alias named sales with the three user accounts as its members
• CC. An address map entry that rewrites sales@example.com to the three users
• DD. A recipient policy that matches sales@example.com and forwards to the three users

An administrator enables greylisting in the antispam profile used by the inbound policy. The next day, the accounts team reports that order confirmations from a vendor's web application never arrive. The FortiMail logs show a temporary failure for each first connection from the vendor's IP address 203.0.113.40, and no later attempts from that address. What should the administrator do?

• AA. Add 203.0.113.40 to the greylist exempt list
• BB. Enable Bayesian autolearning for the accounts team mailboxes
• CC. Increase the greylist initial expiry period
• DD. Lower the spam score threshold for the inbound policy

Which capability is available on FortiMail in server mode but not in gateway mode?

• AA. Encrypting messages with identity-based encryption (IBE)
• BB. Delivering clean email to an external protected mail server
• CC. Applying antispam profiles to inbound and outbound email
• DD. Hosting mailboxes that users access with IMAP, POP3 or webmail

A company must guarantee that all email delivered by FortiMail to the partner domain partner-logistics.example is sent over an encrypted SMTP connection. If the partner server does not offer STARTTLS, FortiMail must not deliver the message. What should the administrator configure?

• AA. Enable SMTPS on port 465 in the mail server settings and keep the default delivery behavior
• BB. Import the partner's CA certificate as a trusted CA and leave delivery as opportunistic TLS
• CC. Apply an IBE encryption profile through a content action profile for the partner domain
• DD. Create a TLS profile that requires TLS and select it in an access delivery rule matching the partner domain

Refer to the exhibit. Exhibit: Domain: corp.example SMTP server: 10.20.0.25 Use this domain's SMTP server to deliver the mail: Enabled Hide this box from the mail server: Disabled A FortiMail device operates in transparent mode in front of the mail server 10.20.0.25. The mail server logs show every inbound SMTP connection coming from 10.20.0.5, the FortiMail IP address, so the server's own connection-based controls cannot identify the external senders. What must you configure to correct this?

• AA. Add the external sender networks to the trusted hosts in the session profile
• BB. Enable Hide this box from the mail server in the domain settings
• CC. Disable Use this domain's SMTP server to deliver the mail in the domain settings
• DD. Change the operation mode to gateway mode and add 10.20.0.5 as a relay host

An administrator has integrated FortiMail with FortiSandbox. The security team wants messages with attachments that have no existing verdict to be held in the queue until FortiSandbox returns a result, rather than delivered immediately. What should the administrator configure in the antivirus profile?

• AA. Set the FortiSandbox scan mode to Submit Only
• BB. Enable the heuristic scan for attachments with unknown file types
• CC. Set the FortiSandbox scan mode to Submit and Wait for Result
• DD. Enable content disarm and reconstruction for all attachments

An administrator wants internal SMTP clients that send email to external recipients through a FortiMail gateway to authenticate against an LDAP server before FortiMail relays the message. Where should the administrator select the authentication profile?

• AA. In the Authentication and Access settings of the outgoing recipient policy matching the sender
• BB. In the address mapping settings of the outbound session profile
• CC. In the Recipient Address Verification settings of the protected domain
• DD. In an LDAP group profile bound to the access control rule that matches the client network

Which TCP port does FortiMail use by default to accept SMTP connections over implicit TLS (SMTPS)?

• AA. 25
• BB. 465
• CC. 587
• DD. 993

Users have received executable files renamed with a .pdf extension. An administrator must block these attachments regardless of the file name used. What should the administrator configure in the content profile?

• AA. An attachment filter rule with the file name pattern *.pdf
• BB. A content monitor rule that matches the keyword exe in the message body
• CC. An attachment filter rule with the file name pattern *.exe
• DD. An attachment filter rule that uses the file type of the attachment