FCSS - Enterprise Firewall 7.4 Administrator (FCSS_EFW_AD-7.4) Free Practice Test

Question 1

An administrator must enable direct communication between multiple spokes in a company's network. Each spoke has more than one internet connection. The requirement is for the spokes to connect directly without passing through the hub, and for the links to automatically switch to the best available connection. How can this automatic detection and optimal link utilization between spokes be achieved?

A. Implement SD-WAN policies at the hub to manage spoke link quality.

B. Set up OSPF routing over static VPN tunnels between spokes.

C. Establish static VPN tunnels between spokes with predefined backup routes.

D. Utilize ADVPN 2.0 to facilitate dynamic direct tunnels and automatic link optimization.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

While configuring the BGP protocol, an administrator applies the set network-import-check disable command under config network.
What will FortiGate do as a result of this command?

A. FortiGate will not advertise the prefixes, if it is not in the routing table.

B. FortiGate will not advertise any imported routes received from one BGP neighbor to another.

C. FortiGate will advertise all the prefixes in the BGP network table to its BGP neighbor, even if it is not in the routing table.

D. FortiGate will advertise only the corresponding prefixes in the BGP network table to its BGP neighbor, even if it is not in the routing table.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

Refer to the exhibit, which shows the packet capture output of a three-way handshake between FortiGate and FortiManager Cloud.

What two conclusions can you draw from the exhibit? (Choose two.)

A. The wildcard for the domain *.fortinet-ca2.support.fortinet.com must be supported by FortiManager Cloud.

B. FortiGate is connecting to the same IP server and will receive an independent certificate for its connection between FortiGate and FortiManager Cloud.

C. FortiGate will receive a certificate that supports multiple domains because FortiManager operates in a cloud computing environment.

D. If the TLS handshake contains 17 cipher suites it means the TLS version must be 1.0 on this three- way handshake.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

Refer to the exhibit, which shows an ADVPN network.

An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2.
What must the administrator configure in the phase 1 VPN IPSEC configuration of the Hub2Hub tunnels?

A. set auto-discovery-forwarder enable

B. set auto-discovery-receiver enable

C. set add-route enable

D. set auto-discovery-sender enable

Correct Answer: A

Question 5

Refer to the exhibit, which shows a partial routing table.

What two conclusions can you draw from the FortiGate output shown in the exhibit? (Choose two.)

A. FortiGate creates separate virtual interfaces for each VPN client.

B. add-route is enabled in the tunnel IPSec phase 1 configuration.

C. net-device is disabled in the tunnel IPSec phase 1 configuration.

D. FortiGate is not using the destination subnets of the quick mode selectors to populate the routing table.

Correct Answer: C,D

Question 6

Which statement about network processor (NP) offloading is true?

A. You can disable the NP for each firewall policy using the command np-acceleration set to loose.

B. For UDP traffic, the FortiGate CPU offloads the first packet to identify it as fast-path traffic.

C. The FortiGate CPU offloads all firewall sessions that require FortiOS session helper to the network processing unit (NPU).

D. When NP acceleration is enabled, firewall sessions may not offload if proxy-based security profiles are included in the firewall policy.

Correct Answer: D

Question 7

Refer to the exhibit, which shows an ADVPN network.

The client behind Spoke-1 generates traffic to the device located behind Spoke-2. What is the first message that the hub sends to Spoke-1 to bring up the dynamic tunnel?

A. Shortcut offer

B. Shortcut forward

C. Shortcut reply

D. Shortcut query

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

A FortiGate device with UTM profiles is reaching the resource limits, and the administrator expects the traffic in the enterprise network to increase.
The administrator has received an additional FortiGate of the same model. Which two protocols should the administrator use to integrate the additional FortiGate device into this enterprise network? (Choose two.)

A. FGCP in active-passive mode and with VDOM disabled

B. VRRP with switches

C. FGSP with external load balancers

D. FGCP in active-active mode and with switches

Correct Answer: C,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

Fortinet FCSS - Enterprise Firewall 7.4 Administrator (FCSS_EFW_AD-7.4) Free Practice Test