FCSS_EFW_AD-7.4 FCSS - Enterprise Firewall 7.4 Administrator Exam Free Dumps - Free Latest Dumps for IT Certification Exams

FCSS_EFW_AD-7.4 FCSS – Enterprise Firewall 7.4 Administrator Exam Free Dumps

dumps2024-12-26T11:10:20+08:00

dumps Fortinet FCSS - Enterprise Firewall 7.4 Administrator FCSS_EFW_AD-7.4 exam, FCSS_EFW_AD-7.4 exam dumps

FCSS_EFW_AD-7.4 exam is the new core one for FCSS in Network Security certification, which validates your ability to design, administer, monitor, and troubleshoot Fortinet network security solutions. Fortinet FCSS_EFW_AD-7.4 exam information is a first step for you to study. There are 36 multiple-choice questions in real Fortinet FCSS_EFW_AD-7.4 exam, and you have 70 minutes to answer all the questions. The available language is English. The pass or fail score report will be available from your Pearson VUE account. We provide the latest FCSS – Enterprise Firewall 7.4 Administrator FCSS_EFW_AD-7.4 exam dumps, which can make sure you pass easily. Free FCSS – Enterprise Firewall 7.4 Administrator FCSS_EFW_AD-7.4 exam dumps are available below.

Page 1 of 7

1. An administrator must ensure that users cannot access sites containing malware and spyware, while also protecting them from phishing attempts.

What is the most resource-efficient method to block access to these sites?

Enable antivirus profiles to scan all web traffic and block downloads from these malicious sites.

Configure FortiGuard Web Filtering and block the categories malware, spyware, and phishing to prevent access to such sites.

Create a custom IPS policy to monitor and block all outbound traffic related to malware, spyware, and phishing sites.

Set up a DNS filter and block domains related to these categories to stop users from reaching malicious content.

2. What global configuration setting changes the behavior for content-inspected traffic while FortiGate is in system conserve mode?

av-failopen

mem-failopen

utm-failopen

ips-failopen

3. Examine the following traffic log; then answer the question below.

date-20xx-02-01 time=19:52:01 devname=masterdevice_id="xxxxxxx" log_id=0100020007 type=event subtype=system pri critical vd=root service=kemel status=failure msg="NAT port is exhausted."

What does the log mean?

There is not enough available memory in the system to create a new entry in the NAT port table.

The limit for the maximum number of simultaneous sessions sharing the same NAT port has been reached.

FortiGate does not have any available NAT port for a new connection.

The limit for the maximum number of entries in the NAT port table has been reached.

4. Refer to the exhibit, which contains partial output from an IKE real-time debug.

The administrator does not have access to the remote gateway.

Based on the debug output, which configuration change can the administrator make to the local gateway to resolve the phase 1 negotiation error?

In the phase 1 network configuration, set the IKE version to 2.

In the phase 1 proposal configuration, add AES128-SHA128 to the list of encryption algorithms.

In the phase 1 proposal configuration, add AESCBC-SHA2 to the list of encryption algorithms.

In the phase 1 proposal configuration, add AES256-SHA256 to the list of encryption algorithms.

5. Refer to the exhibit, which shows a partial web filter profile configuration.

Which action will FortiGate take if a user attempts to access www.dropbox.com, which is categorized as File Sharing and Storage?

FortiGate will block the connection, based on the FortiGuard category based filter configuration.

FortiGate will block the connection as an invalid UR

FortiGate will exempt the connection, based on the Web Content Filter configuration.

FortiGate will allow the connection, based onthe URL Filter configuration.

6. Refer to the exhibit, which shows partial outputs from two routing debug commands.

Why is the port2 default route not in the second command output?

The port2 interface is disabled in the FortiGate configuration.

The port1 default route has a lower distance than the default route using port2.

The port1 default route has a higher priority value than the default route using port2.

The port1 default route has a lower priority value than the default route using port2.

7. How does FortiManager handle FortiGuard requests from FortiGate devices, when it is configured as a local FDS?

FortiManager can download and maintain local copies of FortiGuard databases.

FortiManager supports only FortiGuard push to managed devices.

FortiManager will respond to update requests only if they originate from a managed device.

FortiManager does not support rating requests.

8. An administrator has configured a dial-up IPsec VPN with one phase 2, extended authentication (XAuth) and IKE mode configuration.

The administrator has also enabled the IKE real time debug:

diagnose debug application ike-1

diagnose debug enable

In which order is each step and phase displayed in the debug output each time a new dial-up user is connecting to the VPN?

Phase1; IKE mode configuration; XAuth; phase 2.

Phase1; XAuth; IKE mode configuration; phase2.

Phase1; XAuth; phase 2; IKE mode configuration.

Phase1; IKE mode configuration; phase 2; XAuth.

9. View the exhibit, which contains the partial output of a diagnose command, and then answer the question below.

Based on the output, which of the following statements is correct?

Anti-replay is enabled.

DPD is disabled.

Quick mode selectors are disabled.

Remote gateway IP is 10.200.5.1.

10. Which statement about the designated router (DR) and backup designated router (BDR) in an OSPF multi-access network is true?

Only the DR receives link state information from non-DR routers.

Non-DR and non-BDR routers form full adjacencies to DR only.

Non-DR and non-BDR routers send link state updates and acknowledgements to 224.0.0.6.

FortiGate first checks the OSPF ID to elect a D

Page 2 of 7

11. Which two statements about application layer test commands are true? (Choose two.)

They are used to filter real-time debugs.

They display real-time application debugs.

Some of them can be used to restart an application.

Some of them display statistics and configuration information about a feature or process.

12. Refer to the exhibit, which shows the output of a diagnose command.

What can you conclude from the output shown in the exhibit? (Choose two.)

This is a pinhole session created to allow traffic for a protocol that requires additional sessions to operate through FortiGate.

This is an expected session created by the IPS engine.

Traffic in the original direction (coming from the IP address 10.171.121.38) will be routed to the next-hop IP address 10.200.1.1.

Traffic in the original direction (coming from the IP address 10.171.121.38) will be routed to the next-hop IP address 10.0.1.10.

13. When investigating FortiGuard connectivity issues, which action is a valid troubleshooting step?

Configure a virtual IP to forward port 443 to the FortiGate external I

Verify management VDOM internet access.

Use the FortiGuard real-time debug command to verify rating requests.

Verify that DNS requests are being proxied, if auto-update tunneling is enabled.

14. In which two states is a given session categorized as ephemeral? (Choose two.)

A TCP session waiting to complete the three-way handshake.

A TCP session waiting for FIN AC

A UDP session with packets sent and received.

A UDP session with only one packet received.

15. Refer to the exhibit, which contains the partial output of an IKE real-time debug.

Why did the tunnel not come up?

The pre-shared keys do not match

The remote gateway phase 1 configuration does not match the local gateway phase 1 configuration.

The remote gateway phase 2 configuration does not match the local gateway phase 2 configuration.

The remote gateway is using aggressive mode and the local gateway is configured to use main mode.

16. Which statement about administrative domains (ADOMs) on FortiManager is true?

The number of configurable ADOMs is based on the FortiManager FortiCare service contract.

The ADOM feature can be enabled by any administrative user.

FortiGate devices with multiple VDOMs must be assigned to the same ADOM on FortiManager.

ADOMs allow grouping of managed devices based on management criteria and administrative access.

17. Refer to the exhibits.

The exhibits show a network diagram, the output from the command config system ha, and a firewall policy.

What source MAC address does the web server detect when a user accesses it?

The virtual MAC address of FortiGate

The physical MAC address of FortiGate

The virtual MAC address of FortiGate

The physical MAC address of FortiGate

18. Which two statements about the Security Fabric are true? (Choose two.)

Only the root FortiGate collects network information and forwards it to FortiAnalyzer.

Branch FortiGate devices must be configured first.

FortiGate uses FortiTelemetry protocol to communicate with FortiAnalyzer.

All FortiGate devices in the Security Fabric must have bidirectional FortiTelemetry connectivity.

19. Examine the output from the 'diagnose debug authd fsso list' command; then answer the question below.

# diagnose debug authd fsso list--FSSO logons-IP: 192.168.3.1 User: STUDENT Groups:TRAININGAD/USERS Workstation: INTERNAL2. TRAINING. LAB The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.

What should the administrator check?

The IP address recorded in the logon event for the user STUDEN

The DNS name resolution for the workstation name INTERNAL2. TRAININ

The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2. TRAININ

The reserve DNS lookup forthe IP address 192.168.3.1.

20. Four FortiGate devices configured for OSPF connected to the same broadcast domain. The first unit is elected as the designated router.

The second unit is elected as the backup designated router.

Under normal operation, how many OSPF full adjacencies are formed to each of the other two units?

Page 3 of 7

21. An administrator has enabled HA session synchronization in a HA cluster with two members.

Which flag is added to a primary unit’s session to indicate that it has been synchronized to the secondary unit?

redir.

dirty.

synced

nds.

22. Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)

Installing configuration changes to managed devices.

Importing interface mappings from managed devices.

Adding devices to FortiManager.

Previewing pending configuration changes for managed devices.

23. Refer to the exhibit, which contains a session table entry.

Which statement about FortiGate inspection of this session is true?

FortiGate applied proxy-based inspection.

FortiGate applied flow-based NGFW policy-based inspection.

FortiGate applied flow-based inspection.

FortiGate forwarded this session without any inspection.

24. An LDAP user cannot authenticate against a FortiGate device.

Examine the real time debug output shown in the exhibit when the user attempted the authentication; then answer the question below.

Based on the output in the exhibit, what can cause this authentication problem?

The FortiGate has been configured with the wrong password for the LDAP administrator.

User student is using a wrong password.

User student is not found in the LDAP server.

The FortiGate has been configured with the wrong authentication schema.

25. Refer to the exhibit, which contains the output of a web filtering diagnose command.

Which statement explains why the cache statistics are all zeros?

The FortiGate web filter cache is disabled in the FortiGate configuration.

FortiGate is using flow-based inspection which does not use the cache.

The administrator has reallocated the cache memory to a separate process.

There are no users making web requests.

26. Refer to the exhibit, which contains partial output from an IKE real-time debug.

Based on the debug output, which phase 1 setting is enabled in the configuration of this VPN?

auto-discovery-receiver

auto-discovery-forwarder

auto-discovery-shortcut

auto-discovery-sender

27. An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer. If the administrator knows that there is no NAT device located between both FortiGates,

What command should the administrator execute?

diagnose sniffer packet any ‘udp port 500’

diagnose sniffer packet any ‘udp port 4500’

diagnose sniffer packet any ‘esp’

diagnose sniffer packet any ‘udp port 500 or udp port 4500’

28. What are two impacts on applications if adjusting the TCP Maximum Segment Size (MSS) on FortiGate? (Choose two.)

The MSS configuration is prone to errors since it requires a thorough understanding of the network path.

The packet count increases adding unnecessary TCP headers when the MSS value is increased.

The overall data throughput is decreased when there is a decrease in MSS value.

The network efficiency improves when there is a decrease in MSS value.

29. Which of the following statements is true regarding a FortiGate configured as an explicit web proxy?

FortiGate limits the number of simultaneous sessions per explicit web proxy user. This limit CANNOT be modified by the administrator.

FortiGate limits the total number of simultaneous explicit web proxy users.

FortiGate limits the number of simultaneous sessions per explicit web proxy user. The limit CAN be modified by the administrator.

FortiGate limits the number of workstations that authenticate using the same web proxy user credentials. This limit CANNOT be modified by the administrator.

30. Which statement about memory conserve mode is true?

A FortiGate exits conserve mode when the configured memory use threshold reaches yellow.

A FortiGate Starts dropping all the new and old sessions when the configured memory use threshold reaches extreme.

A FortiGate starts dropping new sessions when the configured memory use threshold reaches red

A FortiGate enters conserve mode when the configured memory use threshold reaches red

Page 4 of 7

31. Examine the partial output from the IKE real time debug shown in the exhibit; then answer the question below.

Why didn’t the tunnel come up?

IKE mode configuration is not enabled in the remote IPsec gateway.

The remote gateway’s Phase-2 configuration does not match the local gateway’s phase-2 configuration.

The remote gateway’s Phase-1 configuration does not match the local gateway’s phase-1 configuration.

One IPsec gateway is using main mode, while the other IPsec gateway is using aggressive mode.

32. When investigating FortiGuard connectivity issues, which of the following is a valid troubleshooting step?

Verify management VDOM's internet access.

Verify DNS requests are being proxied if auto-update tunneling is enabled.

Use the FortiGuard real-time debug command to verify rating requests.

Configure a virtual IP to forward port 443 to FortiGate's external I

33. Refer to the exhibit, which shows the output of a diagnose command

What can you conclude from the RTT value?

Its value is incremented with each packet lost.

Its initial value is statically set to 10.

It determines which FortiGuard server is used for license validation.

Its value represents the time it takes to receive a response after a rating request is sent to a particular server.

34. Examine the following routing table and BGP configuration; then answer the question below.

The BGP connection is up, but the local peer is NOT advertising the prefix 192.168.1.0/24.

Which configuration change will make the local peer advertise this prefix?

Enable the redistribution of connected routers into BG

Enable the redistribution of static routers into BG

Disable the setting network-import-check.

Enable the setting ebgp-multipath.

35. What configuration changes can reduce the memory utilization in a FortiGate? (Choose two.)

Reduce the session time to live.

Increase the TCP session timers.

Increase the FortiGuard cache time to live.

Reduce the maximum file size to inspect.

36. Refer to the exhibit, which shows the output of a web filtering diagnose command.

Which configuration change would result in non-zero results in the cache statistics section?

set server-type rating under config system central-management

set webfilter-cache enable under config system fortiguard

set webfilter-force-off disable under config system fortiguard

set ngfw-mode policy-based under config system settings

37. Refer to the exhibit, which contains a partial routing table.

Assuming all the appropriate firewall policies are configured, which two pings will FortiGate route? (Choose two.)

Source IP address 10.1.0.24, Destination IP address 10.72.3.20.

Source IP address 10.72.3.52, Destination IP address 10.1.0.254.

Source IP address 10.72.3.27, Destination IP address 10.1.0.52.

Source IP address 10.73.9.10, Destination IP address 10.72.3.15.

38. Which three conditions are required for two FortiGate devices to form an OSP adjacency? (Choose three.)

OSPF costs match

OSPF peer IDs match

Hello and dead intervals match

OSPF IP MTUs match

IP addresses are in the same subnet

39. Refer to the exhibit, which shows partial outputs from two routing debug commands.

Which change must an administrator make on FortiGate to route web traffic from internal users to the internet, using ECMP?

Set the priority of the static default route using port1 to 10.

Set the priority of the static default route using port2 to 1.

Set preserve-session-route to enable.

Set snat-route-change to enable.

40. Examine the partial output from two web filter debug commands; then answer the question below:

Based on the above outputs, which is the FortiGuard web filter category for the web site www.fgt99.com?

Finance and banking

General organization.

Business.

Information technology.

Page 5 of 7

41. Which configuration can be used to reduce the number of BGP sessions in an IBGP network?

Neighbor range

Route reflector

Next-hop-self

Neighbor group

42. Examine the output from the ‘diagnose vpn tunnel list’ command shown in the exhibit; then answer the question below.

Which command can be used to sniffer the ESP traffic for the VPN DialUP_0?

diagnose sniffer packet any ‘port 500’

diagnose sniffer packet any ‘esp’

diagnose sniffer packet any ‘host 10.0.10.10’

diagnose sniffer packet any ‘port 4500’

43. Refer to the exhibit, which shows the output of a debug command.

Which two statements about the output are true? (Choose two.)

In the network connected to port 4, two OSPF routers are down.

Based on the network type of port 4, OSPF hello packets will be sent to 224.0.0.5.

Based on the network type of port 4, OSPF hello packets will be sent to 224.0.0.6.

There are a total of 5 OSPF routers attached to the Port4 network segment.

44. View the exhibit, which contains the output of a diagnose command, and then answer the question below.

What statements are correct regarding the output? (Choose two.)

This is an expected session created by a session helper

Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.0.1.10

Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.200.1.1.

This is an expected session created by an application control profile.

45. Refer to the exhibit, which contains the partial output of the get vpn ipsec tunnel details command.

Based on the output, which two statements are correct? (Choose two.)

Phase 2 authentication is set to sha1 on both sides.

Hub2Spoke1 is configured on interface wan2.

Anti-replay is disabled.

Hub2Spoke1 is a policy-based VP

46. Examine the output from the BGP real time debug shown in the exhibit, then the answer the question below.

Which statements are true regarding the output in the exhibit? (Choose two.)

BGP peers have successfully inter changed Open and Keep alive messages.

Local BGP peer received a prefix for a default route.

The state of the remote BGP peer is Open Confirm.

The state of the remote BGP peer will go to Connect after it confirms the received prefixes.

47. Which of the following troubleshooting steps is applicable when investigating antivirus and IPS update issues on FortiGate?

Use the alternate service port 8888.

Validate DNS resolution for update.fortiguard.net.

Verify outbound ICMP connectivity.

Use the diagnose debug rating command to check active servers.

48. Which layer of the FortiOS architecture does an application process or daemon run on?

User space

Configuration layer

Kernel

Hardware

49. View the exhibit, which contains the output of a real-time debug, and then answer the question below.

Which one of the following statements describes why the update is failing?

The update should be using port 53 or port 8888, instead of port 443.

FortiGate is unable to resolve the required FQDN (service.fortiguard.net) for AV and IPS updates.

FortiGate is unable to establish a TCP connection with FD

The administrator should use the execute update-wf command instead.

50. Which of the following tasks are part of the manual registration process for adding a FortiGate to a FortiManager for central management? (Choose three.)

Wait for the rating databases to download on FortiManager.

In the FortiManager, add the unregistered FortiGate.

Import the policy package from the managed FortiGate.

Start the rating services on FortiManager.

Add the FortiManager IP address to the FortiGate's central management configuration.

Page 6 of 7

51. Examine the output of the 'diagnose debug rating' command shown in the exhibit; then answer the question below.

Which statement are true regarding the output in the exhibit? (Choose two.)

The TZ value represents the delta between each FortiGuard server's time zone and the FortiGate's time zone.

FortiGate will send the FortiGuard queries to the server with highest weight.

There are three FortiGuard servers that are not responding to the queries sent by the FortiGate.

A server's round trip delay (RTT) is not used to calculate its weight.

52. Examine the output of the ‘get router info bgp summary’ command shown in the exhibit; then answer the question below.

Which statement can explain why the state of the remote BGP peer 10.200.3.1 is Connect?

The local peer is receiving the BGP keepalives from the remote peer but it has not received any BGP prefix yet.

The TCP session for the BGP connection to 10.200.3.1 is down.

The local peer has received the BGP prefixed from the remote peer.

The local peer is receiving the BGP keepalives from the remote peer but it has not received the OpenConfirm yet.

53. View the exhibit, which contains the output of a real-time debug, and then answer the question below.

Which of the following statements is true regarding this output? (Choose two.)

This web request was inspected using the root web filter profile.

FortiGate found the requested URL in its local cache.

The requested URL belongs to category ID 52.

The web request was allowed by FortiGate

54. View the following FortiGate configuration.

All traffic to the Internet currently egresses from port1.

The exhibit shows partial session information for Internet traffic from a user on the internal network:

If the priority on route ID 1 were changed from 5 to 20, what would happen to traffic matching that user’s session?

The session would remain the session table, and its traffic would still egress from port 1.

The session would remain the session table, but its traffic would now egress from both port 1and port2

The session would remain the session table, and its traffic would start to egress from port2.

The session would be deleted, so the client would need to start a new session.

55. Refer to the exhibit, which contains the output of the diagnose vpn tunnel list.

Which command will capture ESP traffic for the VPN named DialUp_0?

diagnose sniffer packet any 'port 4500'

diagnose sniffer packet any 'esp and host 10.200.3.2'

diagnose sniffer packet any 'host 10.0.10.10'

diagnose sniffer packet any 'ip proto 50'

56. Examine the following partial output from a sniffer command; then answer the question below.

What is the meaning of the packets dropped counter at the end of the sniffer?

Number of packets that didn’t match the sniffer filter.

Number of total packets dropped by the FortiGate.

Number of packets that matched the sniffer filter and were dropped by the FortiGate.

Number of packets that matched the sniffer filter but could not be captured by the sniffer.

57. Which of the following statements are correct regarding application layer test commands? (Choose two.)

They are used to filter real-time debugs.

They display real-time application debugs.

Some of them display statistics and configuration information about a feature or process.

Some of them can be used to restart an application.

58. Examine the output of the ‘get router info bgp summary’ command shown in the exhibit; then answer the question below.

Which statements are true regarding the output in the exhibit? (Choose two.)

BGP state of the peer 10.125.0.60 is Established.

BGP peer 10.200.3.1 has never been down since the BGP counters were cleared.

Local BGP peer has not received an OpenConfirm from 10.200.3.1.

The local BGP peer has received a total of 3 BGP prefixes.

59. Which two statements about an auxiliary session are true? (Choose two.)

With the auxiliary session setting enabled, ECMP traffic is accelerated to the NP6 processor.

With the auxiliary session setting disabled, for each traffic path, FortiGate will use the same auxiliary session.

With the auxiliary session disabled, only auxiliary sessions will be offloaded.

With the auxiliary session setting enabled, two sessions will be created in case of routing change.

60. What is an OSPF area border router?

A router with interfaces in multiple OSPF areas.

A router with all its interfaces in the backbone area.

A router that is redistributing connected subnets into the OSPF network.

A router that is redistributing non-OSPF routes into the OSPF network.

Page 7 of 7

61. What is the diagnose test application ipsmenitor 5 command used for?

To enable IPS bypass mode

To disable the IPS engine

To restart all IPS engines and monitors

To provide information regarding IPS sessions

62. Examine the output of the ‘get router info ospf interface’ command shown in the exhibit; then answer the question below.

Which statements are true regarding the above output? (Choose two.)

The port4 interface is connected to the OSPF backbone area.

The local FortiGate has been elected as the OSPF backup designated router.

There are at least 5 OSPF routers connected to the port4 network.

Two OSPF routers are down in the port4 network.

63. A corporate network allows internet Access to FSSO users only. The FSSO user student does not have internet access after successfully logged into the Windows AD network.

The output of the ‘diagnose debug authd fsso list’ command does not show student as an active FSSO user. Other FSSO users can access the Internet without problems.

What should the administrator check? (Choose two.)

The user student must not be listed in the CA’s ignore user list.

The user student must belong to one or more of the monitored user groups.

The student workstation’s IP subnet must be listed in the CA’s trusted list.

At least one of the student’s user groups must be allowed by a FortiGate firewall policy.

FCSS_EFW_AD-7.4 FCSS – Enterprise Firewall 7.4 Administrator Exam Free Dumps

FCSS_EFW_AD-7.4 FCSS – Enterprise Firewall 7.4 Administrator Exam Free Dumps

Share this post

Related Posts