Achive your Success with Latest Fortinet FCSS_EFW_AD-7.4 Exam [Dec 02, 2025]
The FCSS_EFW_AD-7.4 Exam Test For Brief Preparation
NEW QUESTION # 22
Which of the following statements is true regarding a FortiGate configured as an explicit web proxy?
- A. FortiGate limits the total number of simultaneous explicit web proxy users.
- B. FortiGate limits the number of workstations that authenticate using the same web proxy user credentials. This limit CANNOT be modified by the administrator.
- C. FortiGate limits the number of simultaneous sessions per explicit web proxy user. This limit CANNOT be modified by the administrator.
- D. FortiGate limits the number of simultaneous sessions per explicit web proxy user. The limit CAN be modified by the administrator.
Answer: A
NEW QUESTION # 23
Which setting must be enabled in an in a spoke IPsec phase 1 configuration, to indicate that it wants to participate in ADVPN?
- A. auto-discovery-receiver
- B. auto-discovery-sender
- C. auto-discovery-forwarder
- D. auto-discovery-ipsec
Answer: A
NEW QUESTION # 24
An administrator added the following Ipsec VPN to a FortiGate configuration:
configvpn ipsec phasel -interface
edit "RemoteSite"
set type dynamic
set interface "portl"
set mode main
set psksecret ENC LCVkCiK2E2PhVUzZe
next
end
config vpn ipsec phase2-interface
edit "RemoteSite"
set phasel name "RemoteSite"
set proposal 3des-sha256
next
end
However, the phase 1 negotiation is failing. The administrator executed the IKF real time debug while attempting the Ipsec connection.
The output is shown in the exhibit.
What is causing the IPsec problem in the phase 1?
- A. The pre-shared key is wrong
- B. NAT-T settings do not match
- C. The incoming IPsec connection is matching the wrong VPN configuration
- D. The phrase-1 mode must be changed to aggressive
Answer: A
NEW QUESTION # 25
Refer to the exhibits. The exhibits show a network topology, a firewall policy, and an SSL/SSH inspection profile configuration.
Why is FortiGate unable to detect HTTPS attacks on firewall policy ID 3 targeting the Linux server?
- A. The administrator must enable HTTPS in the protocol port mapping of the deep- inspection SSL/SSH inspection profile.
- B. The administrator must enable SSL inspection of the SSL server and upload the certificate of the Linux server website to the SSL/SSH inspection profile.
- C. The administrator must enable cipher suites in the SSL/SSH inspection profile to decrypt the message.
- D. The administrator must set the policy to inspection mode to analyze the HTTPS packets as expected.
Answer: B
Explanation:
The FortiGateSSL/SSH inspection profileis configured forFull SSL Inspection, which is necessary to analyze encrypted HTTPS traffic. However, the firewallpolicy is protecting an SSL server (the Linux server hosting the website), and currently, the SSL/SSH profileonly applies to client-side SSL inspection.
To detect HTTPS-based attacks targeting the Linux server:
#FortiGate must act as an SSL intermediaryto inspect encrypted traffic destined for the web server.
# The administratormust upload the SSL certificate of the Linux web serverto FortiGate so that theserver- side SSL inspectioncan decrypt incoming HTTPS traffic before analyzing it.
NEW QUESTION # 26
Refer to the exhibit, which shows a partial enterprise network.
An administrator would like the area 0.0.0.0 to detect the external network.
What must the administrator configure?
- A. Enable RIP redistribution on FortiGate B.
- B. Configure a virtual link between FortiGate A and B.
- C. Configure a distribute-route-map-in on FortiGate B.
- D. Set the area 0.0.0.l type to stub on FortiGate A and B.
Answer: A
Explanation:
The diagram shows amulti-area OSPF networkwhere:
#FortiGate Ais inOSPF Area 0 (Backbone area).
#FortiGate Bis inOSPF Area 0.0.0.1and is connected to anRIP network.
To ensure thatOSPF Area 0 (0.0.0.0) learns routes from the external RIP network, FortiGate B must redistribute RIP routes into OSPF.
Steps to achieve this:
1.Enable route redistribution on FortiGate Bto inject RIP-learned routes into OSPF.
2. This allows OSPFArea 0.0.0.1to forward RIP routes toOSPF Area 0 (0.0.0.0), making the external network visible.
NEW QUESTION # 27
Refer to the exhibit, which shows an OSPF network.
Which configuration must the administrator apply to optimize the OSPF database?
- A. Set the area 0.0.0.1 to the type NSSA in the area border FortiGate.
- B. Set an access list in the AS boundary FortiGate.
- C. Set a route map in the AS boundary FortiGate.
- D. Set the area 0.0.0.1 to the type STUB in the area border FortiGate.
Answer: D
Explanation:
TheOSPF database optimizationis necessary to reduce unnecessary routing information and improve network performance. In the given topology,Area 0.0.0.1is a non-backbone area connected toArea 0.0.0.0 (the backbone area)through anArea Border Router (ABR).
To optimize OSPF in this scenario, configuringArea 0.0.0.1 as a Stub Areawill:
#Reduce the size of the OSPF databaseby preventing external routes (from outside OSPF) from being injected into Area 0.0.0.1.
#Allow only intra-area and inter-area routes, meaning routers in Area 0.0.0.1 will rely on adefault route for external destinations.
#Improve convergence time and reduce router processing loadsince fewer LSAs (Link-State Advertisements) are exchanged.
NEW QUESTION # 28
Refer to the exhibit, which shows an enterprise network connected to an internet service provider.
An administrator must configure a loopback as a BGP source to connect to the ISP.
Which two commands are required to establish the connection? (Choose two.)
- A. update-source
- B. ibgp-enforce-multihop
- C. ebgp-enforce-multihop
- D. recursive-next-hop
Answer: A,C
Explanation:
When configuring aloopback interface as the BGP sourceforconnecting to an ISP, two important settings must be applied:
1.Enable EBGP Multihop (ebgp-enforce-multihop)
BGP normally expects directly connected neighbors, but since the ISP and FortiGate A are usingloopback interfaces,packets will not be sent directly between their physical interfaces.
Theebgp-enforce-multihopcommandallows BGP to form an eBGP peering over multiple hops.
2.Set the Update Source (update-source)
Since FortiGate is using aloopback interface as the source, theupdate-sourcecommand ensures thatBGP updates originate from the loopback interfacerather than a physical interface.
This is essential becauseBGP peers must match the source IP with the configured neighbor address.
NEW QUESTION # 29
An administrator has enabled HA session synchronization in a HA cluster with two members.
Which flag is added to a primary unit's session to indicate that it has been synchronized to the secondary unit?
- A. dirty.
- B. synced
- C. nds.
- D. redir.
Answer: B
NEW QUESTION # 30
View the following exhibit, which contains the sniffer output for a passive mode FTP request.
An administrator has created the following custom IPS signature to block all FTP requests for passive mode: F-SBID (--attack_id 1002; --name "Block.FTP "; --protocol tcp; --flow from_client; --pattern
"PASV"; --no_case;) Soon after the signature is enabled in an active IPS sensor, some false positive detections are generated.
Which option and value pair will allow more specific detection?
- A. --service ftp
- B. --name "Block.FTP.PASV"
- C. --attack_id 1001
- D. --protocol ftp
Answer: A
NEW QUESTION # 31
While configuring the BGP protocol, an administrator applies the set network-import-check disable command under config network.
What will FortiGate do as a result of this command?
- A. FortiGate will advertise only the corresponding prefixes in the BGP network table to its BGP neighbor, even if it is not in the routing table.
- B. FortiGate will advertise all the prefixes in the BGP network table to its BGP neighbor, even if it is not in the routing table.
- C. FortiGate will not advertise the prefixes, if it is not in the routing table.
- D. FortiGate will not advertise any imported routes received from one BGP neighbor to another.
Answer: A
Explanation:
Explanation:
If you disable the setting in config network, only the corresponding prefixes are advertised in the BGP network table, regardless of the active routes present in the routing table.
NEW QUESTION # 32
Which two configuration changes can be applied to optimize the memory usage on FortiGate?
(Choose two.)
- A. Decrease the sessions TTL.
- B. Increase TCP session timers.
- C. Reduce the FortiGuard cache TTL.
- D. Increase the maximum file size for AV inspection.
- E. Use flow-based inspection.
Answer: A,C
NEW QUESTION # 33
Refer to the exhibit, which shows theADVPNIPsec interface representing the VPN IPsec phase 1 from Hub A to Spoke 1 and Spoke 2, and from Hub # to Spoke 3 and Spoke 4.
An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2.
What must the administrator configure in the phase 1 VPN IPsec configuration of theADVPNtunnels?
- A. set auto-discovery-forwarder enable and set remote-as x
- B. set auto-discovery-sender enable and set network-id x
- C. set auto-discovery-crossover enable and set enforce-multihop enable
- D. set auto-discovery-receiver enable and set npu-offload enable
Answer: C
Explanation:
When configuringADVPN (Auto-Discovery VPN)to connectoverlay networks across different hubs using IBGP and EBGP, special configurations are required to allow spokes from different overlay networks to dynamically establish tunnels.
#set auto-discovery-crossover enable
# Thisallows cross-hub tunnel discoveryin an ADVPN deployment where multiple hubs are used.
# SinceHub A and Hub Bbelong to different overlays, enablingcrossover discoveryensures that spokes from one overlay can dynamically create direct tunnels to spokes in the other overlay when needed.
#set enforce-multihop enable
# This setting ensures thatBGP peers using loopback interfacescan establish connectivityeven if they are not directly connected.
#Multihop BGP sessionsare required when usingloopback addresses as BGP peer sourcesbecause the connection might need to traverse multiple routers before reaching the BGP neighbor.
# This is especially useful inADVPN deployments with multiple hubs, where routes might need to cross from one hub to another.
NEW QUESTION # 34
Refer to the exhibit, which contains the partial output of an OSPF command.
An administrator is checking the OSPF status of a FortiGate device and receives the output shown in the exhibit.
Which statement on this FortiGate device is correct?
- A. The FortiGate device can inject external routing information.
- B. The FortiGate device is a backup designated router.
- C. The FortiGate device is in the area 0.0.0.5.
- D. The FortiGate device does not support OSPF ECMP.
Answer: A
Explanation:
From theOSPF status output, the key information is:
#"This router is an ASBR"# This means the FortiGate is acting as anAutonomous System Boundary Router (ASBR).
# AnASBRis responsible for injectingexternal routing informationinto OSPF from another routing protocol (such as BGP, static routes, or connected networks).
NEW QUESTION # 35
Refer to the exhibit.
An administrator is deploying a hub and spokes network and using OSPF as dynamic protocol.
Which configuration is mandatory for neighbor adjacency?
- A. Set rfc1583-compatible enable in the router configuration
- B. Set virtual-link enable in the hub interface
- C. Set network-type point-to-multipoint in the hub interface
- D. Set bfd enable in the router configuration
Answer: C
Explanation:
In a hub-and-spoke topology using OSPF over IPsec VPNs, thepoint-to-multipointnetwork type is necessary to establish neighbor adjacencies between the hub and spokes. This network type ensures that OSPF operates correctly without requiring a designated router (DR) and allows dynamic routing updates across the IPsec tunnels.
NEW QUESTION # 36
Refer to the exhibits, which show the configuration on FortiGate and partial internet session information from a user on the internal network.
An administrator would like to test session failover between the two service provider connections.
What changes must the administrator make to force this existing session to immediately start using the other interface? (Choose two.)
- A. unset snat-route-change to return it to the default setting.
- B. Change the priority of the port2 static route to 5.
- C. Configure set snat-route-change enable.
- D. Change the priority of the port1 static route to 11.
Answer: C,D
NEW QUESTION # 37
Refer to the exhibits.
The configuration of a user's Windows PC, which has a default MTU of 1500 bytes, along with FortiGate interfaces set to an MTU of 1000 bytes, and the results of PC1 pinging server
172.16.0.254 are shown.
Why is the user in Windows PC1 unable to ping server 172.16.0.254 and is seeing the message:
Packet needs to be fragmented but DF set?
- A. Fragmented packets must be encrypted. To connect any application successfully, the user must install the Fortinet_CA certificate in the Microsoft Management Console.
- B. Option ip.flags.mf must be set to enable on FortiGate. The user has to adjust the ping MTU to
1000 to succeed. - C. FortiGate honors the do not fragment bit and the packets are dropped. The user has to adjust the ping MTU to 972 to succeed.
- D. The user must trigger different traffic because path MTU discovery techniques do not recognize ICMP payloads.
Answer: C
Explanation:
The issue occurs because FortiGate enforces the "do not fragment" (DF) bit in the packet, and the packet size exceeds the MTU of the network path. When the Windows PC1 (with an MTU of
1500 bytes) attempts to send a 1400-byte packet, the FortiGate interface (with an MTU of 1000 bytes) needs to fragment it. However, since the DF bit is set, FortiGate drops the packet instead of fragmenting it.
To resolve this, the user should adjust the ping packet size to fit within the path MTU. In this case, reducing the packet size to 972 bytes (1000 bytes MTU minus 28 bytes for the IP and ICMP headers) should allow successful transmission.
NEW QUESTION # 38
Refer to the exhibits.
The exhibits show a network diagram, the output from the command config system ha, and a firewall policy.
What source MAC address does the web server detect when a user accesses it?
- A. The physical MAC address of FortiGate B.
- B. The virtual MAC address of FortiGate B.
- C. The virtual MAC address of FortiGate A.
- D. The physical MAC address of FortiGate A.
Answer: A
NEW QUESTION # 39
Which step can be taken to ensure that only FortiAP devices receive IP addresses from a DHCP server on FortiGate?
- A. Create a reservation list in the DHCP server settings
- B. Change the interface addressing mode to FortiAP devices
- C. Use DHCP option 138 to assign IPs to FortiAP devices
- D. Configure a VCI string value of FortiAP in the DHCP server settings
Answer: D
NEW QUESTION # 40
An administrator is deploying APs that are connecting over an IPsec network. All APs have been configured to connect to FortiGate manually. FortiGate can discover the APs and authorize them.
However, FortiGate is unable to establish CAPWAP tunnels to manage the APs.
Which configuration setting can the administrator perform to resolve the problem?
- A. Assign a custom AP profile for the remote APs with the set mpls-connection option enabled
- B. Enable CAPWAP administrative access on the IPsec interface
- C. Decrease the CAPWAP tunnel MTU size for APs to prevent fragmentation
- D. Upgrade the FortiAP firmware image to ensure compatibility with the FortiOS version
Answer: D
NEW QUESTION # 41
Refer to the exhibit, which contains a TCL script configuration on FortiManager.
An administrator has configured the TCL script on FortiManager, but failed to apply any changes to the managed device after being executed.
Why did the TCL script fail to make any changes to the managed device?
- A. Changes in an interface configuration can only be done by CLI script.
- B. The TCL command run_cmd has not been created.
- C. The TCL script must start with #include <>.
- D. Incomplete commands are ignored in TCL scripts.
Answer: B
NEW QUESTION # 42
What action does FortiSwitch take when it receives a loop guard data packet (LGDP) that was sent by itself?
- A. The sending port is shut down
- B. The sending port is moved to the STP blocking state
- C. The receiving port is shut down
- D. The receiving port is moved to the STP blocking state
Answer: A
NEW QUESTION # 43
Refer to the exhibit, which shows a command output.
FortiGate_A and FortiGate_B are members of an FGSP cluster in an enterprise network.
While testing the cluster using the ping command, the administrator monitors packet loss and found that the session output on FortiGate_B is as shown in the exhibit.
What could be the cause of this output on FortiGate_B?
- A. FortiGate_A and FortiGate_B have the same standalone-group-id value.
- B. FortiGate_B is configured in passive mode.
- C. session-pickup-connectionless is set to disable on FortiGate_B.
- D. The session synchronization is encrypted.
Answer: C
Explanation:
TheFortinet FGSP (FortiGate Session Life Support Protocol) clusterallows session synchronization betweentwo FortiGate devicesto provide seamless failover. However,ICMP (ping) is a connectionless protocol, and by default, FortiGate does not synchronize connectionless sessions unless explicitly enabled.
In the exhibit:
# The commandget system session list | grep icmponFortiGate_Breturnsno output, meaning that ICMP sessions arenot being synchronizedfrom FortiGate_A.
# Ifsession-pickup-connectionlessis disabled,FortiGate_B will not receive ICMP sessions, causingpacket lossduring failover.
NEW QUESTION # 44
Refer to the exhibit, which shows the ADVPN network topology and partial BGP configuration.
Which two parameters must an administrator configure in the config neighbor range for spokes shown in the exhibit? (Choose two.)
- A. set route-reflector-client enable
- B. set prefix 172.16.1.0 255.255.255.0
- C. set neighbor-group advpn
- D. set max-neighbor-num 2
Answer: B,C
Explanation:
In the given ADVPN (Auto-Discovery VPN) topology, BGP is being used to dynamically establish routes between spokes. The neighbor-range configuration is crucial for simplifying BGP peer setup by automatically assigning neighbors based on their IP range.
set neighbor-group advpn
# Theneighbor-groupparameter is used to apply pre-defined settings (such as AS number) to dynamically discovered BGP neighbors.
# Theadvpnneighbor-group is already defined in the configuration, and assigning it to the neighbor-range ensures consistent BGP settings for all spoke neighbors.
set prefix 172.16.1.0 255.255.255.0
# This command allowsdynamic BGP peer discoveryby defining a range of potential neighbor IPs (172.16.1.1 - 172.16.1.255).
# Sinceeach spoke has a unique /32 IPwithin this subnet, this ensures that any spoke within the172.16.1.0/24 range can automatically establish a BGP session with the hub.
NEW QUESTION # 45
An administrator wants to scale the IBGP sessions and optimize the routing table in an IBGP network.
Which parameter should the administrator configure?
- A. ibgp-enforce-multihop
- B. network-import-check
- C. route-reflector-client
- D. neighbor-group
Answer: C
Explanation:
In an IBGP (Internal BGP) network, all routers must be fully meshed, meaning every router must establish a BGP session with every other router in the same autonomous system (AS). This does not scale well in large networks due to the exponential increase in BGP sessions.
To optimize and scale IBGP, Route Reflectors (RRs) are used. A Route Reflector (RR) reduces the number of IBGP peer connections by allowing a centralized router (RR) to redistribute IBGP routes to other IBGP peers (called clients). This eliminates the need for a full mesh, significantly reducing BGP session overhead.
By configuring the route-reflector-client setting on IBGP peers, an administrator can:
Scale IBGP sessions by reducing the number of direct BGP peer connections. Optimize the routing table by ensuring routes are efficiently propagated within the IBGP network. Eliminate the need for full mesh topology, making IBGP more manageable.
NEW QUESTION # 46
Refer to the exhibit.
An administrator wants to expand the network by adding two additional FortiGate devices into AS
6500.
Which configuration is the most effective way to improve BGP convergence in this scenario?
- A. Neighbor group
- B. BFD
- C. Route reflector
- D. Prefix list
Answer: C
NEW QUESTION # 47
......
Fortinet FCSS_EFW_AD-7.4 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
Revolutionary Guide To Exam Fortinet Dumps: https://www.getvalidtest.com/FCSS_EFW_AD-7.4-exam.html
Pass FCSS_EFW_AD-7.4 Exam Latest Practice Questions: https://drive.google.com/open?id=1ADHZwylzg1rbOFlSARFZOZoQ-7lrqS1Z