Fortinet FCP_FGT_AD-7.4 問題集

質問 1：
Refer to the exhibit.

The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile.
An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category.
What are two solutions for satisfying the requirement? (Choose two.)
A. Configure a static URL filter entry for download, com with Type and Action set to Wildcard and Block, respectively.
B. Configure a separate firewall policy with action Deny and an FQDN address object for *. download, com as destination address.
C. Configure a web override rating for download, com and select Malicious Websites as the subcategory.
D. Set the Freeware and Software Downloads category Action to Warning
正解：A,C

質問 2：
Which two statements explain antivirus scanning modes? (Choose two.)
A. In flow-based inspection mode files bigger than the buffer size are scanned
B. In proxy-based inspection mode antivirus scanning buffers the whole file for scanning, before sending it to the client
C. In flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client.
D. In proxy-based inspection mode files bigger than the buffer size are scanned
正解：B,C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Which method allows management access to the FortiGate CLI without network connectivity?
A. SSH console
B. Serial console
C. Telnet console
D. CLI console widget
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 4：
Refer to the exhibits.



The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration.
An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2.
The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver.
Which two configuration changes can the administrator make to the policy to deny Webserver access for Remote-User2? (Choose two.)
A. Set the Destination address as Webserver in the Deny policy.
B. Enable match-vip in the Deny policy.
C. Disable match-vip in the Deny policy.
D. Set the Destination address as Deny_IP in the Allow_access policy.
正解：A,B
解説: (Topexam メンバーにのみ表示されます)

質問 5：
Which two settings are required for SSL VPN to function between two FortiGate devices? (Choose two.)
A. The client FortiGate requires a manually added route to remote subnets.
B. The server FortiGate requires a CA certificate to verify the client FortiGate certificate.
C. The client FortiGate requires a client certificate signed by the CA on the server FortiGate.
D. The client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN.
正解：B,D
解説: (Topexam メンバーにのみ表示されます)

質問 6：
Which two statements are true about the FGCP protocol? (Choose two.)
A. FGCP elects the primary FortiGate device
B. FGCP is not used when FortiGate is in transparent mode
C. FGCP runs only over the heartbeat links
D. FGCP is used to discover FortiGate devices in different HA groups
正解：A,C
解説: (Topexam メンバーにのみ表示されます)

質問 7：
An administrator configured a FortiGate to act as a collector for agentless polling mode.
What must the administrator add to the FortiGate device to retrieve AD user group information?
A. LDAP server
B. Windows server
C. RADIUS server
D. DHCP server
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 8：
Refer to the exhibits.



FGT-1 and FGT-2 are updated with HA configuration commands shown in the exhibit.
What would be the expected outcome in the HA cluster?
A. The HA cluster will become out of sync because the override setting must match on all HA members.
B. FGT-1 will synchronize the override disable setting with FGT-2.
C. FGT-2 will take over as the primary because it has the override enable setting and higher priority than FGT-1.
D. FGT-1 will remain the primary because FGT-2 has lower priority.
正解：C
解説: (Topexam メンバーにのみ表示されます)