FCP_FCT_AD-7.2 Questions PDF [2026] Use Valid New dump to Clear Exam

Passing Fortinet FCP_FCT_AD-7.2 Exam Using 2026 Practice Tests

NEW QUESTION # 34
An administrator configures ZTNA configuration on the FortiGate. Which statement is true about the firewall policy?

• A. It only uses ZTNA tags to control access for endpoints.
• B. It redirects the client request to the access proxy.
• C. It defines ZTNA server.
• D. It uses the access proxy.

Answer: B

Explanation:
"The firewall policy matches and redirects client requests to the access proxy VIP"https://docs.fortinet.com
/document/fortigate/7.0.0/new-features/194961/basic-ztna-configuration

NEW QUESTION # 35
Which security fabric component sends a notification io quarantine an endpoint after IOC detection "n the automation process?

• A. FortiClient EMS
• B. FortiAnalyzer
• C. FortiClient
• D. FortiGate

Answer: A

Explanation:
* Understanding the Automation Process:
* In the Security Fabric, automation processes can include actions such as quarantining an endpoint after an IOC (Indicator of Compromise) detection.
* Evaluating Responsibilities:
* FortiClient EMS plays a crucial role in endpoint management and can send notifications to quarantine endpoints.
* Conclusion:
* The correct security fabric component that sends a notification to quarantine an endpoint after IOC detection is FortiClient EMS.
References:
* FortiClient EMS and automation process documentation from the study guides.

NEW QUESTION # 36
Why does FortiGate need the root CA certificate of FortiCient EMS?

• A. To trust certificates issued by FortiClient EMS
• B. To revoke FortiClient client certificates
• C. To sign FortiClient CSR requests
• D. To update FortiClient client certificates

Answer: B

Explanation:
* Understanding the Need for Root CA Certificate:
* The root CA certificate of FortiClient EMS is necessary for FortiGate to trust certificates issued by FortiClient EMS.
* Evaluating Use Cases:
* FortiGate needs the root CA certificate to establish trust and validate certificates issued by FortiClient EMS.
* Conclusion:
* The primary reason FortiGate needs the root CA certificate of FortiClient EMS is to trust certificates issued by FortiClient EMS.
References:
* FortiClient EMS and FortiGate certificate management documentation from the study guides.

NEW QUESTION # 37
What action does FortiClient anti-exploit detection take when it detects exploits?

• A. Terminates the compromised application process
• B. Deletes the compromised application process
• C. Blocks memory allocation to the compromised application process
• D. Patches the compromised application process

Answer: A

Explanation:
The anti-exploit detection protects vulnerable endpoints from unknown exploit attacks. FortiClient monitors the behavior of popular applications, such as web browsers (Internet Explorer, Chrome, Firefox, Opera), Java/Flash plug-ins, Microsoft Office applications, and PDF readers, to detect exploits that use zero-day or unpatched vulnerabilities to infect the endpoint. Once detected, FortiClient terminates the compromised application process.

NEW QUESTION # 38
Refer to the exhibit.

Based on the FortiClient logs shown in the exhibit which application is blocked by the application firewall?

• A. Firefox
• B. Twitter
• C. Facebook
• D. Internet Explorer

Answer: B

Explanation:
Based on the FortiClient logs shown in the exhibit:
The first log entry shows the application "firefox.exe" trying to access a destination IP, with the threat identified as "Twitter." The action taken by the application firewall is "blocked" with the event type "appfirewall." This indicates that the application firewall has blocked access to Twitter.
Reference
FortiClient EMS 7.2 Study Guide, Application Firewall Logs Section
Fortinet Documentation on Interpreting FortiClient Logs

NEW QUESTION # 39
Refer to the exhibit.
Based on the settings shown in the exhibit which statement about FortiClient behavior is true?

• A. FortiClient copies infected files to the Resources folder without scanning them.
• B. FortiClient quarantines infected files and reviews later, after scanning them.
• C. FortiClient blocks and deletes infected files after scanning them.
• D. FortiClient scans infected files when the user copies files to the Resources folder

Answer: B

Explanation:
Action On Virus Discovery Warn the User If a Process Attempts to Access Infected Files Quarantine Infected Files. You can use FortiClient to view, restore, or delete the quarantined file, as well as view the virus name, submit the file to FortiGuard, and view logs. Deny Access to Infected Files Ignore Infected Files

NEW QUESTION # 40
Refer to the exhibit. Based on the settings shown in the exhibit, which action will FortiClient take when users try to access www.facebook.com?

• A. FortiClient will allow access to Facebook.
• B. FortiClient will prompt a warning message to want the user before they can access the Facebook website
• C. FortiClient will monitor only the user's web access to the Facebook website
• D. FortiClient will block access to Facebook and its subdomains.

Answer: A

Explanation:
Observation of Web Filter Exclusions:
The exhibit shows a web filter exclusion for "*.facebook.com" with the action set to "Allow." Evaluating Actions:
This configuration means that FortiClient will allow access to Facebook and its subdomains.
Conclusion:
When users try to access "www.facebook.com," FortiClient will allow the access based on the web filter exclusion settings.

NEW QUESTION # 41
Which security fabric component sends a notification io quarantine an endpoint after IOC detection "n the automation process?

• A. FortiClient EMS
• B. FortiAnalyzer
• C. FortiClient
• D. FortiGate

Answer: A

Explanation:
Understanding the Automation Process:
In the Security Fabric, automation processes can include actions such as quarantining an endpoint after an IOC (Indicator of Compromise) detection.
Evaluating Responsibilities:
FortiClient EMS plays a crucial role in endpoint management and can send notifications to quarantine endpoints.
Conclusion:
The correct security fabric component that sends a notification to quarantine an endpoint after IOC detection is FortiClient EMS.

NEW QUESTION # 42
An administrator installs FortiClient on Windows Server.
What is the default behavior of real-time protection control?

• A. Real-time protection must update the signature database from FortiSandbox
• B. Real-time protection must update AV signature database
• C. Real-time protection sends malicious files to FortiSandbox when the file is not detected locally
• D. Real-time protection is disabled

Answer: D

Explanation:
When FortiClient is installed on a Windows Server, the default behavior for real-time protection control is:
* Real-time protection is disabled:By default, FortiClient does not enable real-time protection on server installations to avoid potential performance impacts and because servers typically have different security requirements compared to client endpoints.
Thus, real-time protection is disabled by default on Windows Server installations.
References
* FortiClient EMS 7.2 Study Guide, Real-time Protection Section
* Fortinet Documentation on FortiClient Default Settings for Server Installations

NEW QUESTION # 43
An administrator installs FortiClient EMS in the enterprise.
Which component is responsible for enforcing protection and checking security posture?

• A. FortiClient EMS tags
• B. FortiClient vulnerability scan
• C. FortiClient
• D. FortiClient EMS

Answer: C

Explanation:
Understanding FortiClient EMS Components:
FortiClient EMS manages and configures endpoint security settings, while FortiClient installed on the endpoint enforces protection and checks security posture.
Evaluating Responsibilities:
FortiClient performs the actual enforcement of security policies and checks the security posture of the endpoint.
Conclusion:
The component responsible for enforcing protection and checking security posture is FortiClient (C).
Reference:
FortiClient EMS and endpoint security documentation from the study guides.

NEW QUESTION # 44
What is the function of the quick scan option on FortiClient?

• A. It scans programs and drivers that are currently running, for threats
• B. It scans executable files. DLLs, and drivers that are currently running, for threats.
• C. It performs a full system scan including all files, executable files. DLLs, and drivers for throats.
• D. It allows users to select a specific file folder on their local hard disk drive (HDD), to scan for threats.

Answer: B

Explanation:
Understanding Quick Scan Function:
The quick scan option on FortiClient is designed to scan certain elements of the system quickly for threats.
Evaluating Scan Scope:
The quick scan specifically targets executable files, DLLs, and drivers that are currently running, providing a rapid assessment of the active components of the system.
Conclusion:
The correct answer is D, as it accurately describes the function of the quick scan option on FortiClient.

NEW QUESTION # 45
Why does FortiGate need the root CA certificate of FortiCient EMS?

• A. To revoke FortiClient client certificates
• B. To sign FortiClient CSR requests
• C. To trust certificates issued by FortiClient EMS
• D. To update FortiClient client certificates

Answer: C

Explanation:
Understanding the Need for Root CA Certificate:
The root CA certificate of FortiClient EMS is necessary for FortiGate to trust certificates issued by FortiClient EMS.
Evaluating Use Cases:
FortiGate needs the root CA certificate to establish trust and validate certificates issued by FortiClient EMS.
Conclusion:
The primary reason FortiGate needs the root CA certificate of FortiClient EMS is to trust certificates issued by FortiClient EMS.
Reference:
FortiClient EMS and FortiGate certificate management documentation from the study guides.

NEW QUESTION # 46
ZTNA Network Topology

Refer to the exhibits, which show a network topology diagram of ZTNA proxy access and the ZTNA rule configuration.
An administrator runs the diagnose endpoint record list CLI command on FortiGateto check Remote-Client endpoint information, however Remote-Client is not showing up in the endpointrecord list.
What is the cause of this issue?

• A. Remote-Client has not initiated a connection to the ZTNA access proxy.
• B. Remote-Client provided an invalid certificate to connect to the ZTNA access proxy.
• C. Remote-Client provided an empty client certificate to connect to the ZTNA access proxy.
• D. Remote-Client failed the client certificate authentication.

Answer: D

NEW QUESTION # 47
Refer to the exhibit.

Based on the Security Fabric automation settings, what action will be taken on compromised endpoints?

• A. Endpoints will be banned on FortiGate
• B. An email notification will be sent for compromised endpoints
• C. Endpoints will be quarantined through FortiSwitch
• D. Endpoints will be quarantined through EMS

Answer: D

Explanation:
Based on the Security Fabric automation settings shown in the exhibit:
The automation stitch is configured with a trigger for a "Compromised Host." The action specified for this trigger is "Quarantine FortiClient via EMS." This indicates that when an endpoint is detected as compromised, FortiClient EMS will quarantine the endpoint as part of the automation process.
Therefore, the action taken on compromised endpoints will be to quarantine them through EMS.
Reference
FortiGate Security 7.2 Study Guide, Automation Stitches and Actions Section Fortinet Documentation on Configuring Automation Stitches and Quarantine Actions

NEW QUESTION # 48
Refer to the exhibit.

Based on the settings shown in the exhibit which statement about FortiClient behavior is true?

• A. FortiClient copies infected files to the Resources folder without scanning them.
• B. FortiClient quarantines infected files and reviews later, after scanning them.
• C. FortiClient blocks and deletes infected files after scanning them.
• D. FortiClient scans infected files when the user copies files to the Resources folder

Answer: B

Explanation:
Action On Virus Discovery Warn the User If a Process Attempts to Access Infected Files Quarantine Infected Files. You can use FortiClient to view, restore, or delete the quarantined file, as well as view the virus name, submit the file to FortiGuard, and view logs. Deny Access to Infected Files Ignore Infected Files

NEW QUESTION # 49
Which statement about the FortiClient EMS console logs is true?

• A. The FortiClient EMS administrator created an endpoint profile.
• B. The FortiClient EMS administrator assigned the endpoint profile to All Groups.
• C. The FortiClient EMS administrator deployed a new FortiClient installation to All Groups.
• D. The FortiClient EMS administrator assigned the gateway list to All Groups.

Answer: A

NEW QUESTION # 50
A FortiClient EMS administrator has enabled the compliance rule for the sales department Which Fortinet device will enforce compliance with dynamic access control?

• A. FortiAnalyzer
• B. FortiClient
• C. FortiClient EMS
• D. FortiGate

Answer: D

Explanation:
Understanding Compliance Rules:
The compliance rule for the sales department needs to be enforced dynamically.
Enforcing Compliance:
FortiGate is responsible for enforcing compliance by integrating with FortiClient EMS to apply dynamic access control based on compliance status.
Conclusion:
The Fortinet device that will enforce compliance with dynamic access control is the FortiGate.

NEW QUESTION # 51
Refer to the exhibit, which shows the Zero Trust Tagging Rule Set configuration.

Which two statements about the rule set are true? (Choose two.)

• A. The endpoint must satisfy that only Windows 10 is running.
• B. The endpoint must satisfy that only Windows Server 2012 R2 is running.
• C. The endpoint must satisfy that antivirus is installed and running and Windows 10 is running.
• D. The endpoint must satisfy that only AV software is installed and running.

Answer: B,C

Explanation:
Based on the Zero Trust Tagging Rule Set configuration shown in the exhibit:
* The rule set includes two conditions:
* AV Software is installed and running
* OS Version is Windows Server 2012 R2 or Windows 10
* The Rule Logic is specified as "(1 and 3) or 2," meaning:
* The endpoint must have antivirus software installed and running and must be running Windows
10.
* Alternatively, the endpoint must be running Windows Server 2012 R2.
Therefore, the endpoint must satisfy either:
* Antivirus is installed and running and Windows 10 is running.
* Windows Server 2012 R2 is running.
References
* FortiClient EMS 7.2 Study Guide, Zero Trust Tagging Rule Set Configuration Section
* Fortinet Documentation on Configuring Zero Trust Tagging Rules and Logic

NEW QUESTION # 52
What action does FortiClient anti-exploit detection take when it detects exploits?

• A. Terminates the compromised application process
• B. Deletes the compromised application process
• C. Patches the compromised application process
• D. Blocks memory allocation to the compromised application process

Answer: C

NEW QUESTION # 53
Refer to the exhibit.

Based on the CLI output from FortiGate. which statement is true?

• A. FortiGate is configured with local user group
• B. FortiGate is configured to pull user groups from FortiClient EMS
• C. FortiGate is configured to pull user groups from AD Server.
• D. FortiGate is configured to pull user groups from FortiAuthenticator

Answer: B

Explanation:
Based on the CLI output from FortiGate:
The configuration shows the use of "type fortiems," indicating that FortiGate is set up to interact with FortiClient EMS.
The "server" field points to an IP address (10.0.1.200), which is typically the address of the FortiClient EMS server.
The configuration includes an SSL-enabled connection, which is a common setup for secure communication between FortiGate and FortiClient EMS.
Thus, the configuration indicates that FortiGate is set up to pull user groups from FortiClient EMS.
Reference
FortiGate Security 7.2 Study Guide, FSSO Configuration Section
Fortinet Documentation on FortiGate and FortiClient EMS Integration

NEW QUESTION # 54
......

FCP_FCT_AD-7.2 Study Guide Brilliant FCP_FCT_AD-7.2 Exam Dumps PDF: https://www.testsimulate.com/FCP_FCT_AD-7.2-study-materials.html