FCSS - Enterprise Firewall 7.4 Administrator - FCSS_EFW

Question 1

Which two statements about IKE version 2 fragmentation are true? (Choose two.)

A. IKEv2 fragmentation is performed at IP layer.

B. Only some IKE version 2 packets are considered fragmentable.

C. The reassembly timeout default value is 30 seconds.

D. The maximum number of IKE version 2 fragments are 64.

Correct Answer: B,D

Question 2

An administrator wants to scale the IBGP sessions and optimize the routing table in an IBGP network.
Which parameter should the administrator configure?

A. neighbor-group

B. network-import-check

C. ibgp-enforce-multihop

D. route-reflector-client

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

Refer to the exhibit. The routing tables of FortiGate_A and FortiGate_B are shown. FortiGate_A and FortiGate_B are in the same autonomous system.

The administrator wants to dynamically add only route 172.16.1.248/30 on FortiGate_A.
What must the administrator configure?

A. Enable Redistribute Connected in the BGP section on FortiGate_B.

B. A BGP route map out for 172.16.1.248/30 on FortiGate_B

C. A BGP route map in for 172.16.1.248/30 on FortiGate_A

D. The prefix 172.16.1.248/30 in the BGP Networks section on FortiGate_B

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

What is the initial step performed by FortiGate when handling the first packets of a session?

A. Installation of the session key in the network processor (NP)

B. Data encryption and decryption

C. Security inspections such as ACL, HPE, and IP integrity header checking

D. Offloading the packets directly to the content processor (CP)

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 5

Refer to the exhibit, which shows a partial routing table.

What two conclusions can you draw from the FortiGate output shown in the exhibit? (Choose two.)

A. add-route is enabled in the tunnel IPSec phase 1 configuration.

B. net-device is disabled in the tunnel IPSec phase 1 configuration.

C. FortiGate creates separate virtual interfaces for each VPN client.

D. FortiGate is not using the destination subnets of the quick mode selectors to populate the routing table.

Correct Answer: B,D

Question 6

Refer to the exhibit. A pre-run CLI template that is used in zero-touch provisioning (ZTP) and low- touch provisioning (LTP) with FortiManager is shown.

The template is not assigned even though the configuration has already been installed on FortiGate.
What is true about this scenario?

A. The administrator must use post-run CLI templates that are designed for ZTP and LTP

B. Pre-run CLI templates are automatically unassigned after their initial installation

C. Pre-run CLI templates for ZTP and LTP must be unassigned manually after the first installation to avoid conflicting error objects when importing a policy package

D. The administrator did not assign the template correctly when adding the model device because pre-CLI templates remain permanently assigned to the firewall

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

Which two configurations are mandatory for an auto-discovery VPN (ADVPN) implementation on a hub? (Choose two.)

A. set add-route must be enabled to add routes.

B. An overlay IP address with a mask of /32 must be assigned to the IPsec virtual interface.

C. The remote-ip must be on a different IP address from the overlay subnet.

D. set net-device must be disabled to avoid dynamic interface creation.

Correct Answer: B,D

Question 8

During the maintenance window, an administrator must sniff all the traffic going through a specific firewall policy, which is handled by NP6 interfaces. The output of the sniffer trace provides just a few packets.
Why is the output of sniffer trace limited?

A. auto-asic-off load is set to enable in the firewall policy,

B. inspection-mode is set to proxy in the firewall policy.

C. The option npudbg is not added in the diagnose sniff packet command.

D. The traffic corresponding to the firewall policy is encrypted.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Fortinet FCSS - Enterprise Firewall 7.4 Administrator - FCSS_EFW_AD-7.4 Exam Practice Test

Latest Update

Useful Links

Contact Us