Which three strategies are valid SD-WAN rule strategies for member selection? (Choose three.)
Answer(s): A,B,E
https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/342836/lowest-cost-sla- strategy
Which two features of IPsec IKEv1 authentication are supported by FortiGate? (Choose two.)
Answer(s): A,B
FortiGate supports both pre-shared key and certificate signature methods for IKEv1 authentication. These methods provide flexibility depending on the security requirements of the network. Additionally, FortiGate supports Extended Authentication (XAuth), which requests a username and password from the remote peer, enhancing security by adding an extra layer of authentication. The XAuth method does not necessarily make the authentication faster; it is an additional security measure.
FortiOS 7.4.1 Administration Guide: IPsec VPN Configuration
Which two statements are true regarding FortiGate HA configuration synchronization? (Choose two.)
Answer(s): A,C
"After the initial synchronization is complete, whenever a change is made to the configuration of an HA cluster device (primary or secondary), incremental synchronization sends the same configuration change to all other cluster devices over the HA heartbeat link"
What are two features of the NGFW profile-based mode? (Choose two.)
Answer(s): C,D
NGFW (Next Generation Firewall) profile-based mode in FortiGate allows policies to use both flow-based and proxy-based inspection modes, providing flexibility depending on security and performance requirements. Additionally, profile-based mode supports applying applications and web filtering profiles directly in a firewall policy, allowing granular control over the traffic.
FortiOS 7.4.1 Administration Guide: NGFW Mode Configuration
Refer to the exhibit to view the firewall policy.Why would the firewall policy not block a well-known virus, for example eicar?
Answer(s): D
While Flow-Based inspection mode is limited, it still can scan viruses if they are not overly complex. SSL certificate inspection only inspects the certificate of the encrypted traffic, ensuring it is valid and not self-signed or expired. It does not decrypt the actual content of the SSL/TLS traffic, meaning that any malicious content inside encrypted HTTPS traffic will pass through without being inspected. So here, we can assume the EICAR file was accessed via HTTPS.
Post your Comments and Discuss Fortinet FCP_FGT_AD-7.4 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the FCP_FGT_AD-7.4 content, but please register or login to continue.