Fortinet FCSS - Enterprise Firewall 7.4 Administrator - FCSS_EFW_AD-7.4 FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

A vulnerability scan report has revealed that a user has generated traffic to the website example.com (10.10.10.10) using a weak SSL/TLS version supported by the HTTPS web server.
What can the firewall administrator do to block all outdated SSL/TLS versions on any HTTPS web server to prevent possible attacks on user traffic?

A. Install the required certificate in the client's browser or use Active Directory policies to block specific websites as defined in the SSL/SSH inspection profile. B. Use the latest certificate, Fortinet_SSL_ECDSA256, and replace the CA certificate in the SSL/SSH inspection profile. C. Enable auto-detection of outdated SSL/TLS versions in the SSL/SSH inspection profile to block vulnerable websites. D. Configure the unsupported SSL version and set the minimum allowed SSL version in the HTTPS settings of the SSL/SSH inspection profile.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 2

Refer to the exhibit, which shows a network diagram showing the addition of site 2 with an overlapping network segment to the existing VPN IPsec connection between the hub and site 1.

Which IPsec phase 2 configuration must an administrator make on the FortiGate hub to enable equal-cost multi-path (ECMP) routing when multiple remote sites connect with overlapping subnets?

A. Set single-source to enable B. Set net-device to ecmp C. Set route-overlap to either use-new or use-old D. Set route-overlap to allow

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 3

How would fec-ingress and fec-sgress IPsec configuration affect an IPsec tunnel?

A. FortiGate will add additional redundant information to reconstruct any lost or erratically received packets. B. If fragmentation occurs, FortiGate will allow the packets at the IKE layer. C. FortiGate will consider all IKEV2 packets as fragmentable. D. When an FGSP member in FortiGate fails, FortiGate flushes the corresponding tunnels and sends out dead peer detection probes to find unavailable remote peers.

Discussion 0

Correct Answer: A Vote an answer

Question 4

An administrator is designing an ADVPN network for a large enterprise with spokes that have varying numbers of internet links. They want to avoid a high number of routes and peer connections at the hub.
Which method should be used to simplify routing and peer management?

A. Deploy a full-mesh VPN topology to eliminate hub dependency. B. Establish a traditional hub-and-spoke VPN topology with policy routes. C. Use a dynamic routing protocol using loopback interfaces to streamline peers and routes. D. Implement static routing over IPsec interfaces for each spoke.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 5

What action can be taken on a FortiGate to block traffic using IPS protocol decoders, focusing on network transmission patterns and application signatures?

A. Configure a web filter profile in flow mode. B. Enable application detection-based SD-WAN rules. C. Use application control to limit non-URL-based software handling. D. Use the DNS filter to block application signatures and protocol decoders.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 6

Refer to the exhibit, which shows a LAN interface connected from FortiGate to two FortiSwitch devices.

What two conclusions can you draw from the corresponding LAN interface? (Choose two.)

A. The LAN interface must use a 802.3ad type interface. B. This connection is using a FortiLInk to manage VLANs on FortiGate. C. FortiGate is using an SD-WAN-type interface to connect to a FortiSwitch device with MCLAG. D. You must enable STP or RSTP on FortiGate and FortiSwitch to avoid layer 2 loopbacks.

Discussion 0

Correct Answer: A,B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 7

An administrator must optimize the performance of real-time voice and video applications across a WAN link with high packet loss.
Which combination of IPSec phase 1 parameters must the administrator configure to reduce errors and boost application reliability?

A. fec-ingress and fsc-egrsss B. keepalive and keylive C. fragmentation and fragmentation-mtu D. dpd and dpd-retryinterval

Discussion 0

Correct Answer: A Vote an answer

Question 8

While configuring the BGP protocol, an administrator applies the set network-import-check disable command under config network.
What will FortiGate do as a result of this command?

A. FortiGate will advertise all the prefixes in the BGP network table to its BGP neighbor, even if it is not in the routing table. B. FortiGate will not advertise the prefixes, if it is not in the routing table. C. FortiGate will not advertise any imported routes received from one BGP neighbor to another. D. FortiGate will advertise only the corresponding prefixes in the BGP network table to its BGP neighbor, even if it is not in the routing table.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).