Free FCP-FGT-AD-7-4 sample questions

Correct answer: Create two separate firewall policies: Policy 1 with `IT_Staff` as the source and a lenient web filter, placed above Policy 2 with `Clinical_Staff` as the source and a restrictive web filter.

FortiGate evaluates firewall policies from top to bottom and applies the first match. With both AD groups mapped to FSSO user groups on the FortiGate, a policy for IT_Staff with a lenient web filter placed above a policy for Clinical_Staff with a restrictive web filter ensures IT users match their rule first, wherever they log on, while clinical staff match the restrictive rule. This is the standard way to apply different security profiles to different user groups. Source: FortiOS 7.4 Administration Guide, Firewall policy / FSSO.

Correct answer: False

This statement is false. For full SSL inspection (deep inspection) to work without causing certificate errors, the FortiGate's certificate authority (CA) certificate (e.g., `Fortinet_CA_SSL`) must be trusted by the end-user's client browser. This requires installing the CA certificate into the trusted root certificate store of each client machine or browser.

Correct answer: A policy-based route is configured that overrides the static route.

For a destination such as 10.50.20.5, the routing table lookup would select the 10.50.0.0/16 static route because of longest prefix match; administrative distance and priority are only compared between routes to the same prefix. However, FortiGate checks policy-based routes before the routing table (FIB). If a policy route matches the traffic and its action is to forward it to 192.168.1.254, that decision overrides the routing table. Check with 'diagnose firewall proute list' or the Policy Routes list. Source: FortiOS 7.4 Administration Guide, 'Routing concepts' (Route look-up).

Correct answers: The implicit SD-WAN rule configured with a load-balancing algorithm of `Volume`.; A Performance SLA that measures latency on both WAN links.; An SD-WAN rule matching the business-critical applications with a strategy of `Best Quality` based on the latency SLA.

The implicit rule, which is the last rule in the list, catches all traffic not matched by previous rules. To meet the requirement for all other traffic, this rule must be configured with a volume-based load-balancing algorithm.

A Performance SLA (Service Level Agreement) is required to actively monitor the quality of the WAN links. To make decisions based on latency, an SLA must be configured to probe the links and measure this specific metric.

An SD-WAN rule is needed to identify the specific traffic (Salesforce, O365) and apply a routing strategy. The `Best Quality` strategy, tied to the latency-measuring Performance SLA, will ensure this traffic is sent over the link that currently has the lowest latency.

Correct answer: To provide a direct link to internal web resources through the SSL VPN web portal.

In SSL VPN web mode, bookmarks are shortcuts displayed on the portal page that allow users to easily access internal resources like web servers, RDP, or SSH without needing to know the internal IP address or URL. The FortiGate proxies the connection on behalf of the user.

Correct answer: Preshared Key, Encryption Algorithm, and Authentication Algorithm

For a Phase 1 IKE negotiation to succeed, both VPN peers must be configured with an identical set of proposals. This includes the preshared key (or certificate), the encryption algorithm (e.g., AES256), the authentication algorithm (e.g., SHA256), and the Diffie-Hellman group. A mismatch in any of these will cause the Phase 1 negotiation to fail.

Correct answer: Admin Profiles

Admin Profiles provide granular, role-based access control (RBAC) for FortiGate administrators. By creating a custom admin profile, you can specify read, write, or no access for each functional area of the configuration, such as Firewall, Router, System, and Security Profiles. This is the correct method for limiting an administrator's permissions to specific tasks.

Correct answer: The IP Pool has been exhausted because `One-to-One` NAT maps each internal IP to a unique external IP.

`One-to-One` NAT creates a direct mapping between an internal source IP and an external IP from the pool. This means the number of concurrent users who can access the internet is limited to the number of available IPs in the pool. During peak times, the company has more internal users than available public IPs, leading to NAT exhaustion. The solution would be to change the IP Pool type to `Overload`.

Correct answer: Proxy-based, because it buffers the entire file before scanning, allowing for a more thorough inspection and detection of complex malware.

Proxy-based inspection provides higher security effectiveness. It buffers the complete file or web page before delivering it to the end user, which allows the antivirus engine to perform a more comprehensive scan. This method can identify threats that flow-based inspection might miss, making it the preferred choice when security is the top priority over minimal latency.

Correct answers: It is evaluated before the static and dynamic routing tables.; It makes routing decisions based on criteria other than just the destination IP address, such as source IP or protocol.

FortiGate looks up policy routes first and consults the FIB (kernel routing table) only when no policy route matches. Source: FortiOS 7.4 Administration Guide, Routing concepts > Route look-up.

Policy routes can match on incoming interface, source and destination address, protocol, port and ToS, not only on the destination address as the routing table does. Source: FortiOS 7.4 Administration Guide, Policy routes.