FCP-FGT-AD-7-4 Sample Questions & Answers

The implicit rule, which is the last rule in the list, catches all traffic not matched by previous rules. To meet the requirement for all other traffic, this rule must be configured with a volume-based load-balancing algorithm.

A Performance SLA (Service Level Agreement) is required to actively monitor the quality of the WAN links. To make decisions based on latency, an SLA must be configured to probe the links and measure this specific metric.

An SD-WAN rule is needed to identify the specific traffic (Salesforce, O365) and apply a routing strategy. The Best Quality strategy, tied to the latency-measuring Performance SLA, will ensure this traffic is sent over the link that currently has the lowest latency.

In SSL VPN web mode, bookmarks are shortcuts displayed on the portal page that allow users to easily access internal resources like web servers, RDP, or SSH without needing to know the internal IP address or URL. The FortiGate proxies the connection on behalf of the user.

For a Phase 1 IKE negotiation to succeed, both VPN peers must be configured with an identical set of proposals. This includes the preshared key (or certificate), the encryption algorithm (e.g., AES256), the authentication algorithm (e.g., SHA256), and the Diffie-Hellman group. A mismatch in any of these will cause the Phase 1 negotiation to fail.

Admin Profiles provide granular, role-based access control (RBAC) for FortiGate administrators. By creating a custom admin profile, you can specify read, write, or no access for each functional area of the configuration, such as Firewall, Router, System, and Security Profiles. This is the correct method for limiting an administrator's permissions to specific tasks.

One-to-One NAT creates a direct mapping between an internal source IP and an external IP from the pool. This means the number of concurrent users who can access the internet is limited to the number of available IPs in the pool. During peak times, the company has more internal users than available public IPs, leading to NAT exhaustion. The solution would be to change the IP Pool type to Overload.

Proxy-based inspection provides higher security effectiveness. It buffers the complete file or web page before delivering it to the end user, which allows the antivirus engine to perform a more comprehensive scan. This method can identify threats that flow-based inspection might miss, making it the preferred choice when security is the top priority over minimal latency.

FortiGate looks up policy routes first and consults the FIB (kernel routing table) only when no policy route matches. Source: FortiOS 7.4 Administration Guide, Routing concepts > Route look-up.

Policy routes can match on incoming interface, source and destination address, protocol, port and ToS, not only on the destination address as the routing table does. Source: FortiOS 7.4 Administration Guide, Policy routes.

SSL VPN in web mode provides clientless access through a web browser, fulfilling the first requirement. By creating bookmarks within the web portal, you can provide proxied access to internal services like web applications and SFTP, meeting the second and third requirements. This solution is secure and avoids the need for software installation on client machines.

The statement describes an Active-Passive HA cluster. In an Active-Active HA cluster, traffic processing is load-balanced across all cluster members. While one unit acts as the primary for management and some session scheduling, multiple units actively process traffic, thereby increasing throughput.

A captive portal is the feature designed for this exact scenario. It intercepts the user's first web request and redirects them to a login page (the portal). By creating local user accounts on the FortiGate for the guests, the firewall can authenticate them directly before allowing access. This method is commonly used for guest networks.