Special Summer Sale - 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: dm70dm

FCSS_EFW_AD-7.4 FCSS - Enterprise Firewall 7.4 Administrator Questions and Answers

Questions 4

Refer to the exhibit, which shows the VDOM section of a FortiGate device.

FCSS_EFW_AD-7.4 Question 4

An administrator discovers that webfilter stopped working in Core1 and Core2 after a maintenance window.

Which two reasons could explain why webfilter stopped working? (Choose two.)

Options:

A.

The root VDOM does not have access to FortiManager in a closed network.

B.

The root VDOM does not have a VDOM link to connect with the Corel and Core2 VDOMs.

C.

The Core1 and Core2 VDOMs must also be enabled as Management VDOMs to receive FortiGuard updates

D.

The root VDOM does not have access to any valid public FDN.

Buy Now
Questions 5

Refer to the exhibit, which shows an enterprise network connected to an internet service provider.

FCSS_EFW_AD-7.4 Question 5

The administrator must configure the BGP section of FortiGate A to give internet access to the enterprise network.

Which command must the administrator use to establish a connection with the internet service provider?

Options:

A.

config neighbor

B.

config redistribute bgp

C.

config router route-map

D.

config redistribute ospf

Buy Now
Questions 6

An administrator must minimize CPU and RAM use on a FortiGate firewall while also enabling essential security features, such as web filtering and application control for HTTPS traffic.

Which SSL inspection setting helps reduce system load while also enabling security features, such as web filtering and application control for encrypted HTTPS traffic?

Options:

A.

Use full SSL inspection to thoroughly inspect encrypted payloads.

B.

Disable SSL inspection entirely to conserve resources.

C.

Configure SSL inspection to handle HTTPS traffic efficiently.

D.

Enable SSL certificate inspection mode to perform basic checks without decrypting traffic.

Buy Now
Questions 7

Refer to the exhibits.

FCSS_EFW_AD-7.4 Question 7

FCSS_EFW_AD-7.4 Question 7

FCSS_EFW_AD-7.4 Question 7

The configuration of a user's Windows PC, which has a default MTU of 1500 bytes, along with FortiGate interfaces set to an MTU of1000bytes, and the results of PC1 pinging server172.16.0.254are shown.

Why is the user in Windows PC1 unable to ping server172.16.0.254and is seeing the message:Packet needs to be fragmented but DF set?

Options:

A.

Option ip.flags.mf must be set to enable on FortiGate. The user has to adjust the ping MTU to 1000 to succeed.

B.

Fragmented packets must be encrypted. To connect any application successfully, the user must install the Fortinet_CA certificate in the Microsoft Management Console.

C.

FortiGate honors the do not fragment bit and the packets are dropped. The user has to adjust the ping MTU to 972 to succeed.

D.

The user must trigger different traffic because path MTU discovery techniques do not recognize ICMP payloads.

Buy Now
Questions 8

Refer to the exhibit, which shows a command output.

FCSS_EFW_AD-7.4 Question 8

FortiGate_A and FortiGate_B are members of an FGSP cluster in an enterprise network.

While testing the cluster using the ping command, the administrator monitors packet loss and found that the session output on FortiGate_B is as shown in the exhibit.

What could be the cause of this output on FortiGate_B?

Options:

A.

The session synchronization is encrypted.

B.

session-pickup-connectionless is set to disable on FortiGate_B.

C.

FortiGate_B is configured in passive mode.

D.

FortiGate_A and FortiGate_B have the same standalone-group-id value.

Buy Now
Questions 9

What does the command set forward-domain in a transparent VDOM interface do?

Options:

A.

It configures the interface to prioritize traffic based on the domain ID, enhancing quality of service for specified VLANs.

B.

It isolates traffic within a specific VLAN by assigning a broadcast domain to an interface based on the VLAN ID.

C.

It restricts the interface to managing traffic only from the specified VLAN, effectively segregating network traffic.

D.

It assigns a unique domain ID to the interface, allowing it to operate across multiple VLANs within the same VDOM.

Buy Now
Questions 10

Refer to the exhibit.

A pre-run CLI template that is used in zero-touch provisioning (ZTP) and low-touch provisioning (LTP) with FortiManager is shown.

FCSS_EFW_AD-7.4 Question 10

The template is not assigned even though the configuration has already been installed on FortiGate.

What is true about this scenario?

Options:

A.

The administrator did not assign the template correctly when adding the model device because pre-CLI templates remain permanently assigned to the firewall

B.

Pre-run CLI templates are automatically unassigned after their initial installation

C.

Pre-run CLI templates for ZTP and LTP must be unassigned manually after the first installation to avoid conflicting error objects when importing a policy package

D.

The administrator must use post-run CLI templates that are designed for ZTP and LTP

Buy Now
Questions 11

A FortiGate device with UTM profiles is reaching the resource limits, and the administrator expects the traffic in the enterprise network to increase.

The administrator has received an additional FortiGate of the same model.

Which two protocols should the administrator use to integrate the additional FortiGate device into this enterprise network? (Choose two.)

Options:

A.

FGSP with external load balancers

B.

FGCP in active-active mode and with switches

C.

FGCP in active-passive mode and with VDOM disabled

D.

VRRP with switches

Buy Now
Questions 12

Refer to the exhibit, which shows the HA status of an active-passive cluster.

FCSS_EFW_AD-7.4 Question 12

An administrator wants FortiGate_B to handle the Core2 VDOM traffic.

Which modification must the administrator apply to achieve this?

Options:

A.

The administrator must disable override on FortiGate_A.

B.

The administrator must change the priority from 100 to 160 for FortiGate_B.

C.

The administrator must change the load balancing method on FortiGate_B.

D.

The administrator must change the priority from 128 to 200 for FortiGate_B.

Buy Now
Questions 13

An administrator configured the FortiGate devices in an enterprise network to join the Fortinet Security Fabric. The administrator has a list of IP addresses that must be blocked by the data center firewall. This list is updated daily.

How can the administrator automate a firewall policy with the daily updated list?

Options:

A.

With FortiNAC

B.

With FortiAnalyzer

C.

With a Security Fabric automation

D.

With an external connector from Threat Feeds

Buy Now
Questions 14

Refer to the exhibit, which shows an ADVPN network

FCSS_EFW_AD-7.4 Question 14

An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2.

What two options must the administrator configure in BGP? (Choose two.)

Options:

A.

set ebgp-enforce-multrhop enable

B.

set next-hop-self enable

C.

set ibgp-enforce-multihop advpn

D.

set attribute-unchanged next-hop

Buy Now
Questions 15

An administrator needs to install an IPS profile without triggering false positives that can impact applications and cause problems with the user's normal traffic flow.

Which action can the administrator take to prevent false positives on IPS analysis?

Options:

A.

Use the IPS profile extension to select an operating system, protocol, and application for all the network internal services and users to prevent false positives.

B.

Enable Scan Outgoing Connections to avoid clickingsuspicious links or attachments that can deliver botnet malware and create false positives.

C.

Use an IPS profile with action monitor, however, the administrator must be aware that this can compromise network integrity.

D.

Install missingor expired SSUTLS certificates on the client PC to prevent expected false positives.

Buy Now
Questions 16

What is the initial step performed by FortiGate when handling the first packets of a session?

Options:

A.

Installation of the session key in the network processor (NP)

B.

Data encryption and decryption

C.

Security inspections such as ACL, HPE, and IP integrity header checking

D.

Offloading the packets directly to the content processor (CP)

Buy Now
Questions 17

Refer to the exhibit, which shows a network diagram showing the addition of site 2 with an overlapping network segment to the existing VPN IPsec connection between the hub and site 1.

FCSS_EFW_AD-7.4 Question 17

Which IPsec phase 2 configuration must an administrator make on the FortiGate hub to enable equal-cost multi-path (ECMP) routing when multiple remote sites connect with overlapping subnets?

Options:

A.

Set route-overlap to either use-new or use-old

B.

Set net-device to ecmp

C.

Set single-source to enable

D.

Set route-overlap to allow

Buy Now
Exam Code: FCSS_EFW_AD-7.4
Exam Name: FCSS - Enterprise Firewall 7.4 Administrator
Last Update: Mar 28, 2025
Questions: 57

PDF + Testing Engine

$49.5  $164.99

Testing Engine

$37.5  $124.99
buy now FCSS_EFW_AD-7.4 testing engine

PDF (Q&A)

$31.5  $104.99
buy now FCSS_EFW_AD-7.4 pdf
dumpsmate guaranteed to pass
24/7 Customer Support

DumpsMate's team of experts is always available to respond your queries on exam preparation. Get professional answers on any topic of the certification syllabus. Our experts will thoroughly satisfy you.

Site Secure

mcafee secure

TESTED 04 Apr 2025