Question 1

Refer to the exhibit.
Why did FortiGate drop the packet?

Accepted Answer

The debug trace output shows that the packet was "Denied by forward policy check (policy 0)." In FortiGate, policy ID 0 corresponds to the default implicit deny
policy. This means that if a packet does not match any configured firewall policies, it is denied by the default implicit policy.
References:
 FortiOS 7.4.1 Administration Guide: Firewall Policies

Question 2

A network administrator is configuring an IPsec VPN tunnel for a sales employee travelling abroad. Which IPsec Wizard template must the administrator apply?

Accepted Answer

For configuring an IPsec VPN tunnel for a sales employee traveling abroad, the "Remote Access" template is the most appropriate choice. This template is
designed to allow remote users to securely connect to the internal network of an organization from any location using FortiClient or a compatible client. The other
options, such as "Site to Site," "Dial up User," and "iHub-and-Spoke," are used for connecting different networks or sites, not individual remote users.
References:
 FortiOS 7.4.1 Administration Guide: IPsec Wizard Template Types

Question 3

What are two features of collector agent advanced mode? (Choose two.)

Accepted Answer

Advanced mode allows for configuration as an LDAP client and supports group filtering directly on the FortiGate, as well as nested or inherited groups.

Question 4

Refer to the exhibit, which shows a partial configuration from the remote authentication server.
Why does the FortiGate administrator need this configuration?

Accepted Answer

Correct answer: A

Question 5

Refer to the exhibit.
Which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules?

Accepted Answer

For traffic that does not match any of the defined SD-WAN rules, the default implicit SD-WAN rule is applied. By default, the FortiGate uses a "source-destination
IP-based" algorithm, which means all traffic from a specific source IP to a specific destination IP is sent through the same interface. This ensures that a consistent
path is used for traffic between the same source and destination IP addresses. Options B, C, and D do not apply because the default algorithm does not prioritize
by latency, session count, or source IP alone.
References:
 FortiOS 7.4.1 Administration Guide: SD-WAN Load Balancing Algorithms

Question 6

An administrator manages a FortiGate model that supports NTurbo. How does NTurbo enhance performance for flow-based inspection?

Accepted Answer

NTurbo enhances performance for flow-based inspection by offloading traffic to the content processor.

Question 7

FortiGate is integrated with FortiAnalyzer and FortiManager.
When a firewall policy is created, which attribute is added to the policy to improve functionality and to support recording logs to FortiAnalyzer or FortiManager?

Accepted Answer

When a firewall policy is created in FortiGate integrated with FortiAnalyzer and FortiManager, a Universally Unique Identifier (UUID) is added to the policy to
support logging and management.

Question 8

Which two statements are true regarding FortiGate HA configuration synchronization? (Choose two.)

Accepted Answer

/FCP_FGT_AD-7.4-exam/ (86 Q&As)
In FortiGate HA (High Availability) configuration, checksums of device configurations are compared to ensure they are synchronized and identical across the
cluster. Incremental synchronization can only happen from changes made on the primary device to ensure consistency and integrity across the cluster members.
Changes made on non-primary devices do not initiate synchronization.
References:
 FortiOS 7.4.1 Administration Guide: HA Configuration Synchronization

Question 9

Which two settings are required for SSL VPN to function between two FortiGate devices? (Choose two.)

Accepted Answer

For SSL VPN to function correctly between two FortiGate devices, the following settings are required:
 B. The server FortiGate requires a CA certificate to verify the client FortiGate certificate: The server FortiGate must have a Certificate Authority (CA)
certificate installed to authenticate and verify the certificate presented by the client FortiGate device.
 C. The client FortiGate requires a client certificate signed by the CA on the server FortiGate: The client FortiGate must have a client certificate that is signed
by the same CA that the server FortiGate uses for verification. This ensures a secure SSL VPN connection between the two devices.
The other options are not directly necessary for establishing SSL VPN:
 A. The client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN: This is incorrect as SSL VPN does not require a specific tunnel
interface type; it typically uses an SSL VPN client profile.
 D. The client FortiGate requires a manually added route to remote subnets: While routing may be necessary, it is not specifically required for the SSL VPN
functionality between two FortiGates.
References
 FortiOS 7.4.1 Administration Guide - Configuring SSL VPN, page 1203.
 FortiOS 7.4.1 Administration Guide - SSL VPN Authentication, page 1210.

Question 10

Which statement is a characteristic of automation stitches?

Accepted Answer

Automation stitches on FortiGate can have one or more triggers, which are conditions or events that activate the automation stitch. The trigger defines when the
automation stitch should execute the defined actions. Actions within a stitch can be executed sequentially or in parallel, depending on the configuration.
References:
 FortiOS 7.4.1 Administration Guide: Automation Stitches