This page was exported from Actual Test Materials [ http://blog.actualtests4sure.com ] Export date:Mon Mar 10 20:30:46 2025 / +0000 GMT ___________________________________________________ Title: Course 2025 FCSS_EFW_AD-7.4 Test Prep Training Practice Exam Download [Q46-Q69] --------------------------------------------------- Course 2025 FCSS_EFW_AD-7.4 Test Prep Training Practice Exam Download FCSS_EFW_AD-7.4 Exam Info and Free Practice Test Professional Quiz Study Materials QUESTION 46Refer to the exhibit, which shows a session table entry.Which statement about FortiGate behavior relating to this session is true?  FortiGate redirected the client to the captive portal to authenticate, so that a correct policy match could be made.  FortiGate forwarded this session without any inspection.  FortiGate is performing security profile inspection using the CPU.  FortiGate applied only IPS inspection to this session. QUESTION 47Which command is used to enable timestamp in a real-time debug?  diagnose debug console timestamp enable  diagnose timestamp enable  diagnose application timestamp enable  diagnose debug application timestamp enable QUESTION 48Refer to the exhibit, which contains partial output from an IKE real-time debug.Which two statements about this debug output are correct? (Choose two.)  The initiator provided remote as its IPsec peer ID.  It shows a phase 2 negotiation.  Perfect Forward Secrecy (PFS) is enabled in the configuration.  The local gateway IP address is 10.0.0.1. QUESTION 49Refer to the exhibit, which contains the partial output of a diagnose command.Based on the output, which two statements are correct? (Choose two.)  The remote gateway has quick mode selectors containing a destination subnet of 10.1.2.0/24.  The remote gateway IP is 10.200.5.1.  DPD is disabled.  Anti-replay is enabled. QUESTION 50In which two states is a given session categorized as ephemeral? (Choose two.)  A TCP session waiting to complete the three-way handshake.  A TCP session waiting for FIN ACK.  A UDP session with packets sent and received.  A UDP session with only one packet received. QUESTION 51Refer to the exhibits, which contain the partial configurations of two VPNs on FortiGate.An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovered that FortiGate is not matching the user-2 VPN for members of the Users-2 group.Which two changes must the administrator make to fix the issue? (Choose two.)  Use different pre-shared keys on both VPNs.  Enable XAuth on both VPNs.  Set up specific peer IDs on both VPNs.  Change to aggressive mode on both VPNs. QUESTION 52View the exhibit, which contains a session entry, and then answer the question below.What statements are correct regarding this session? (Choose two.)  It is an UDP session that has seen traffic flow both ways.  It is a TCP session in SYN_SENT state.  This session terminates or originates in the FortiGate device.  This is a TCP session that was blocked by firewall policy ID 0. QUESTION 53Refer to the exhibit, which shows the output of get system ha status. NGFW-1 and NGFW-2 have been up for a week.Which two statements about the output are true? (Choose two.)  If FGVM…649 is rebooted, FGVM…650 will become the primary and retain that role, even after FGVM…649 rejoins the cluster.  If no action is taken, the primary FortiGate will leave the cluster due to the current sync status.  If port7 becomes disconnected on the secondary, both FortiGate devices will elect itself the primary.  If a configuration change is made to the primary FortiGate at this time, the secondary will initiate a synchronization reset. QUESTION 54Refer to the exhibits, which show the configuration on FortiGate and partial internet session information from a user on the internal network.An administrator would like to test session failover between the two service provider connections.What changes must the administrator make to force this existing session to immediately start using the other interface? (Choose two.)  Configure set snat-route-change enable.  Change the priority of the port2 static route to 5.  Change the priority of the port1 static route to 11.  unset snat-route-change to return it to the default setting. QUESTION 55View the exhibit, which contains a partial output of an IKE real-time debug, and then answer the question below.Based on the debug output, which phase-1 setting is enabled in the configuration of this VPN?  auto-discovery-sender  auto-discovery-forwarder  auto-discovery-shortcut  auto-discovery-receiver QUESTION 56Refer to the exhibit, which contains partial output from an IKE real-time debug.The administrator does not have access to the remote gateway.Based on the debug output, which configuration change can the administrator make to the local gateway to resolve the phase 1 negotiation error?  In the phase 1 network configuration, set the IKE version to 2.  In the phase 1 proposal configuration, add AES128-SHA128 to the list of encryption algorithms.  In the phase 1 proposal configuration, add AESCBC-SHA2 to the list of encryption algorithms.  In the phase 1 proposal configuration, add AES256-SHA256 to the list of encryption algorithms. QUESTION 57Which configuration can be used to reduce the number of BGP sessions in an IBGP network?  Neighbor range  Route reflector  Next-hop-self  Neighbor group QUESTION 58When using the SSL certificate inspection method to inspect HTTPS traffic, how does FortiGate filler web requests when the client browser does not provide the server name indication (SNI) extension?  FortiGate switches to the full SSL inspection method to decrypt the data  FortiGate blocks the request without any further inspection  FortiGate uses the Issued To: field in the server’s certificate  FortiGate uses the requested URL from the user’s web browser QUESTION 59An administrator configured FGSP cluster members to encrypt the session synchronization. When the administrator takes a sniffer trace on the dedicated interface for the synchronization, the sniffer trace shows UDP packets only.Which two reasons could cause the sniffer to capture only UDP packets? (Choose two.)  The administration has not configured the SESSYNC_1 tunnel.  encryption is not set to enable on both members.  The psksecret value does not match.  The encryption is encapsulated in UDP packets. QUESTION 60A FortiGate device has the following LDAP configuration:The LDAP user student cannot authenticate.The exhibit shows the output of the authentication real time debug while testing the student account:Based on the above output, what FortiGate LDAP settings must the administer check? (Choose two.)  cnid.  username.  password.  dn. QUESTION 61Which statement about administrative domains (ADOMs) on FortiManager is true?  The number of configurable ADOMs is based on the FortiManager FortiCare service contract.  The ADOM feature can be enabled by any administrative user.  FortiGate devices with multiple VDOMs must be assigned to the same ADOM on FortiManager.  ADOMs allow grouping of managed devices based on management criteria and administrative access. QUESTION 62An administrator added the following Ipsec VPN to a FortiGate configuration:configvpn ipsec phasel -interfaceedit “RemoteSite”set type dynamicset interface “portl”set mode mainset psksecret ENC LCVkCiK2E2PhVUzZenextendconfig vpn ipsec phase2-interfaceedit “RemoteSite”set phasel name “RemoteSite”set proposal 3des-sha256nextendHowever, the phase 1 negotiation is failing. The administrator executed the IKF real time debug while attempting the Ipsec connection.The output is shown in the exhibit.What is causing the IPsec problem in the phase 1?  The incoming IPsec connection is matching the wrong VPN configuration  The phrase-1 mode must be changed to aggressive  The pre-shared key is wrong  NAT-T settings do not match QUESTION 63Which two statements about application layer test commands are true? (Choose two.)  They are used to filter real-time debugs.  They display real-time application debugs.  Some of them can be used to restart an application.  Some of them display statistics and configuration information about a feature or process. QUESTION 64What configuration changes can reduce the memory utilization in a FortiGate? (Choose two.)  Reduce the session time to live.  Increase the TCP session timers.  Increase the FortiGuard cache time to live.  Reduce the maximum file size to inspect. QUESTION 65Refer to the exhibit, which contains a TCL script configuration on FortiManager.An administrator has configured the TCL script on FortiManager, but failed to apply any changes to the managed device after being executed.Why did the TCL script fail to make any changes to the managed device?  Changes in an interface configuration can only be done by CLI script.  The TCL script must start with #include <>.  Incomplete commands are ignored in TCL scripts.  The TCL command run_cmd has not been created. QUESTION 66View the following exhibit:What two statements about this session are correct? (Choose two.)  It is a UDP session that has seen traffic flow both ways.  This is a TCP session that was blocked by firewall policy ID 0.  This session terminates or originates in the FortiGate device.  It is a TCP session in SYN_SENT state. QUESTION 67View the following exhibit, which contains the sniffer output for a passive mode FTP request.An administrator has created the following custom IPS signature to block all FTP requests for passive mode: F-SBID (–attack_id 1002; –name “Block.FTP “; –protocol tcp; –flow from_client; –pattern“PASV”; –no_case;) Soon after the signature is enabled in an active IPS sensor, some false positive detections are generated.Which option and value pair will allow more specific detection?  –protocol ftp  –service ftp  –name “Block.FTP.PASV”  –attack_id 1001 QUESTION 68View these partial outputs from two routing debug commands:Which outbound interface will FortiGate use to route web traffic from internal users to the Internet?  Both port1 and port2  port3  port1  port2 QUESTION 69An LDAP user cannot authenticate against a FortiGate device.Examine the real time debug output shown in the exhibit when the user attempted the authentication; then answer the question below.Based on the output in the exhibit, what can cause this authentication problem?  The FortiGate has been configured with the wrong password for the LDAP administrator.  User student is using a wrong password.  User student is not found in the LDAP server.  The FortiGate has been configured with the wrong authentication schema.  Loading … Get 100% Authentic Fortinet FCSS_EFW_AD-7.4 Dumps with Correct Answers: https://www.actualtests4sure.com/FCSS_EFW_AD-7.4-test-questions.html --------------------------------------------------- Images: https://blog.actualtests4sure.com/wp-content/plugins/watu/loading.gif https://blog.actualtests4sure.com/wp-content/plugins/watu/loading.gif --------------------------------------------------- --------------------------------------------------- Post date: 2025-03-10 13:56:39 Post date GMT: 2025-03-10 13:56:39 Post modified date: 2025-03-10 13:56:39 Post modified date GMT: 2025-03-10 13:56:39