Free FCSS_EFW_AD-7.4: FCSS - Enterprise Firewall 7.4 Administrator Exam Questions and Answers

Refer to the exhibit, which shows the VDOM section of a FortiGate device. An administrator discovers that webfilter stopped working in Core1 and Core2 after a maintenance window. Which two reasons could explain why webfilter stopped working? (Choose two.)

Select 2 answers.

• AA. The root VDOM does not have access to FortiManager in a closed network.
• BB. The root VDOM does not have a VDOM link to connect with the Core1 and Core2 VDOMs.
• CC. The Core1 and Core2 VDOMs must also be enabled as Management VDOMs to receive FortiGuard updates
• DD. The root VDOM does not have access to any valid public FDN.

An administrator needs to install an IPS profile without triggering false positives that can impact applications and cause problems with the user's normal traffic flow. Which action can the administrator take to prevent false positives on IPS analysis?

• AA. Use the IPS profile extension to select an operating system, protocol, and application for all the network internal services and users to prevent false positives.
• BB. Enable Scan Outgoing Connections to avoid clickingsuspicious links or attachments that can deliver botnet malware and create false positives.
• CC. Use an IPS profile with action monitor, however, the administrator must be aware that this can compromise network integrity.
• DD. Install missingor expired SSUTLS certificates on the client PC to prevent expected false positives.

Refer to the exhibit, which shows a command output. FortiGate_A and FortiGate_B are members of an FGSP cluster in an enterprise network. While testing the cluster using the ping command, the administrator monitors packet loss and found that the session output on FortiGate_B is as shown in the exhibit. What could be the cause of this output on FortiGate_B?

• AA. The session synchronization is encrypted.
• BB. session-pickup-connectionless is set to disable on FortiGate_B.
• CC. FortiGate_B is configured in passive mode.
• DD. FortiGate_A and FortiGate_B have the same standalone-group-id value.

Which two statements about IKEv2 are true if an administrator decides to implement IKEv2 in the VPN topology? (Choose two.)

Select 2 answers.

• AA. It includes stronger Diffie-Hellman (DH) groups, such as Elliptic Curve (ECP) groups.
• BB. It supports interoperability with devices using IKEv1.
• CC. It exchanges a minimum of two messages to establish a secure tunnel.
• DD. It supports the extensible authentication protocol (EAP).

A company that acquired multiple branches across different countries needs to install new FortiGate devices on each of those branches. However, the IT staff lacks sufficient knowledge to implement the initial configuration on the FortiGate devices. Which three approaches can the company take to successfully deploy advanced initial configurations on remote branches? (Choose three.)

Select 3 answers.

• AA. Use metadata variables to dynamically assign values according to each FortiGate device.
• BB. Use provisioning templates and install configuration settings at the device layer.
• CC. Use the Global ADOM to deploy global object configurations to each FortiGate device.
• DD. Apply Jinja in the FortiManager scripts for large-scale and advanced deployments.
• EE. Add FortiGate devices on FortiManager as model devices, and use ZTP or LTP to connect to FortiGate devices.

Refer to the exhibit, which shows a revision history window in the FortiManager device layer. The IT team is trying to identify the administrator responsible for the most recent update in the FortiGate device database. Which conclusion can you draw about this scenario?

• AA. This retrieved process was automatically triggered by a Remote FortiGate Directly (via CLI) script.
• BB. The user script_manager is an API user from the Fortinet Developer Network (FDN) retrieving a configuration.
• CC. To identify the user who created the event, check it on the Configuration and Installation widget on FortiGate within the FortiManager device layer.
• DD. Find the user in the FortiManager system logs and use the type=script command to find the administrator user in the user field.

Refer to the exhibit, which shows a corporate network and a new remote office network. An administrator must integrate the new remote office network with the corporate enterprise network. What must the administrator do to allow routing between the two networks?

• AA. The administrator must implement BGP to inject the new remote office network into the corporate FortiGate device
• BB. The administrator must configure a static route to the subnet 192.168.l.0/24 on the corporate FortiGate device.
• CC. The administrator must configure virtual links on both FortiGate devices.
• DD. The administrator must implement OSPF over IPsec on both FortiGate devices.

An administrator is extensively using VXLAN on FortiGate. Which specialized acceleration hardware does FortiGate need to improve its performance?

• AA. NP7
• BB. SP5
• CC. 9
• DD. NTurbo

An administrator is designing an ADVPN network for a large enterprise with spokes that have varying numbers of internet links. They want to avoid a high number of routes and peer connections at the hub. Which method should be used to simplify routing and peer management?

• AA. Deploy a full-mesh VPN topology to eliminate hub dependency.
• BB. Implement static routing over IPsec interfaces for each spoke.
• CC. Use a dynamic routing protocol using loopback interfaces to streamline peers and routes.
• DD. Establish a traditional hub-and-spoke VPN topology with policy routes.

An administrator applied a block-all IPS profile for client and server targets to secure the server, but the database team reported the application stopped working immediately after. How can an administrator apply IPS in a way that ensures it does not disrupt existing applications in the network?

• AA. Use an IPS profile with all signatures in monitor mode and verify patterns before blocking.
• BB. Limit the IPS profile to server targets only to avoid blocking connections from the server to clients.
• CC. Select flow mode in the IPS profile to accurately analyze application patterns.
• DD. Set the IPS profile signature action to default to discard all possible false positives.