Fortinet FCSS_EFW_AD-7.4テストエンジン練習テスト問題、試験問題集
100%無料FCSS_EFW_AD-7.4日常練習試験には78問があります
Fortinet FCSS_EFW_AD-7.4 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 # 12
Examine the partial output from two web filter debug commands; then answer the question below:
Based on the above outputs, which is the FortiGuard web filter category for the web site www.fgt99.com?
- A. Business.
- B. Finance and banking
- C. Information technology.
- D. General organization.
正解：C
質問 # 13
Refer to the exhibit, which shows an OSPF network.
Which configuration must the administrator apply to optimize the OSPF database?
- A. Set the area 0.0.0.1 to the type NSSA in the area border FortiGate.
- B. Set a route map in the AS boundary FortiGate.
- C. Set an access list in the AS boundary FortiGate.
- D. Set the area 0.0.0.1 to the type STUB in the area border FortiGate.
正解：D
解説：
TheOSPF database optimizationis necessary to reduce unnecessary routing information and improve network performance. In the given topology,Area 0.0.0.1is a non-backbone area connected toArea 0.0.0.0 (the backbone area)through anArea Border Router (ABR).
To optimize OSPF in this scenario, configuringArea 0.0.0.1 as a Stub Areawill:
#Reduce the size of the OSPF databaseby preventing external routes (from outside OSPF) from being injected into Area 0.0.0.1.
#Allow only intra-area and inter-area routes, meaning routers in Area 0.0.0.1 will rely on adefault route for external destinations.
#Improve convergence time and reduce router processing loadsince fewer LSAs (Link-State Advertisements) are exchanged.
質問 # 14
Which statements about bulk configuration changes using FortiManager CLI scripts are correct?
(Choose two.)
- A. When executed on the Policy Package, ADOM database, changes are applied directly to the managed FortiGate.
- B. When executed on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.
- C. When executed on the All FortiGate in ADOM, changes are automatically installed without creating a new revision history.
- D. When executed on the Device Database, you must use the installation wizard to apply the changes to the managed FortiGate.
正解：B、D
質問 # 15
Refer to the exhibit, which shows an enterprise network connected to an internet service provider.
The administrator must configure the BGP section of FortiGate A to give internet access to the enterprise network.
Which command must the administrator use to establish a connection with the internet service provider?
- A. config redistribute ospf
- B. config neighbor
- C. config redistribute bgp
- D. config router route-map
正解：B
解説：
In BGP (Border Gateway Protocol), a neighbor (peer) configuration is required to establish a connection between two BGP routers. Since FortiGate A is connecting to the ISP (Autonomous System 10) from AS 30, the administrator must define the ISP's BGP router as a neighbor.
The config neighbor command is used to:
Define the ISP's IP address as a BGP peer
Specify the remote AS (AS 10 in this case)
Allow BGP route exchanges between FortiGate A and the ISP
質問 # 16
During the maintenance window, an administrator must sniff all the traffic going through a specific firewall policy, which is handled by NP6 interfaces. The output of the sniffer trace provides just a few packets.
Why is the output of sniffer trace limited?
- A. The traffic corresponding to the firewall policy is encrypted.
- B. auto-asic-off load is set to enable in the firewall policy,
- C. inspection-mode is set to proxy in the firewall policy.
- D. The option npudbg is not added in the diagnose sniff packet command.
正解：B
質問 # 17
View the exhibit, which contains the output of diagnose sys session stat, and then answer the question below.
Which statements are correct regarding the output shown? (Choose two.)
- A. There are 0 ephemeral sessions.
- B. All the sessions in the session table are TCP sessions.
- C. No sessions have been deleted because of memory pages exhaustion.
- D. There are 166 TCP sessions waiting to complete the three-way handshake.
正解：A、C
質問 # 18
An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device.
What can the administrator do to fix this problem?
- A. Configure remote link monitoring to detect an issue in the forwarding path.
- B. Configure set send-garp-on-failover enable under config system ha on both cluster members.
- C. Configure set link-failed-signal enable under config system ha on both cluster members.
- D. Verify that the speed and duplex settings match between the FortiGate interfaces and the connected switch ports.
正解：C
質問 # 19
What action does FortiSwitch take when it receives a loop guard data packet (LGDP) that was sent by itself?
- A. The sending port is shut down
- B. The sending port is moved to the STP blocking state
- C. The receiving port is shut down
- D. The receiving port is moved to the STP blocking state
正解：A
質問 # 20
Which two statements about IKEv2 are true if an administrator decides to implement IKEv2 in the VPN topology? (Choose two.)
- A. It supports interoperability with devices using IKEv1.
- B. It exchanges a minimum of two messages to establish a secure tunnel.
- C. It includes stronger Diffie-Hellman (DH) groups, such as Elliptic Curve (ECP) groups.
- D. It supports the extensible authentication protocol (EAP).
正解：C、D
解説：
IKEv2 (Internet Key Exchange version 2) is an improvement over IKEv1, offering enhanced security, efficiency, and flexibility in VPN configurations.
It includes stronger Diffie-Hellman (DH) groups, such as Elliptic Curve (ECP) groups.
IKEv2 supports stronger cryptographic algorithms, includingElliptic Curve Diffie-Hellman (ECDH) groups such asECP256 and ECP384, providing improved security compared to IKEv1.
It supports the extensible authentication protocol (EAP).
IKEv2 natively supports EAP authentication, which allows integration with external authentication mechanisms such asRADIUS, certificates, and smart cards. This is particularly useful forremote access VPNswhere user authentication must be flexible and secure.
質問 # 21
The CLI command set intelligent-mode <enable | disable> ontrols the IPS engine's adaptive scanning behavior.
Which of the following statements describes IPS adaptive scanning?
- A. Downloads signatures on demand from FDS based on scanning requirements.
- B. Choose a matching algorithm based on available memory and the type of inspection being performed.
- C. Determines the optimal number of IPS engines required based on system load.
- D. Determines when it is secure enough to stop scanning session traffic.
正解：D
質問 # 22
Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)
- A. Installing configuration changes to managed devices.
- B. Adding devices to FortiManager.
- C. Importing interface mappings from managed devices.
- D. Previewing pending configuration changes for managed devices.
正解：A、D
質問 # 23
Which two conditions must be met for a statistic route to be active in the routing table? (Choose two.)
- A. The outgoing interface is up.
- B. The link health monitor (if configured) is up.
- C. There is no other route, to the same destination, with a higher distance.
- D. The next-hop IP address is up.
正解：A、B
質問 # 24
View the exhibit, which of the contains the partial output of an IKE real-time debug, then answer the question below.
Which of the following statements about this debug output are true? (Choose two.)
- A. Phase 1 is using a pre-shared key for authentication.
- B. Both phases 1 and 2 are up.
- C. Both gateways are using aggressive mode.
- D. The name of the tunnel being negotiated is VPN.
正解：A、D
質問 # 25
One firewall policy in an enterprise firewall is essentially used for IPS.
Which configuration must the administrator check in this firewall policy to validate optimum performance for IPS?
- A. set offload enable
- B. set inspection-mode proxy
- C. set np-acceleration enable
- D. set cp-accel-mode enable
正解：C
質問 # 26
View the exhibit, which contains a hub-and-spoke VPN topology with two hubs, then answer the question below.
An administrator wants to configure ADVPN.
Which ADVPN setting needs to be enabled in the tunnel between Hub1 and Hub2 FortiGates?
- A. set auto-discovery-receiver enabled
- B. set auto-discovery-sender enabled
- C. set auto-discovery-ipsec enabled
- D. set auto-discovery-forwarder enabled
正解：D
質問 # 27
Refer to the exhibit, which shows the device and policy layers for FortiGate key operations.
How can the administrator restore a previous FortiGate configuration, which had more policies than the current one, without the layer synchronization between the device and policy layers on FortiManager?
- A. Use the global ADOM to access the previous configurations and install policies on ADOM devices to synchronize all layers.
- B. Find the configuration file by date and time in the provisioning templates, then reinstall the policy package to apply the configuration changes.
- C. Retrieve the configuration, import system templates, and reinstall the policy package on FortiGate.
- D. Locate the configuration ID in the FortiGate revision history, click revert, install the device settings, and import policies to sync the policy package.
正解：D
質問 # 28
Refer to the exhibit, which shows a FortiGate configuration.
An administrator is troubleshooting a web filter issue on FortiGate. The administrator has configured a web filter profile and applied it to a policy; however, the web filter is not inspecting any traffic that is passing through the policy.
What must the administrator change to fix the issue?
- A. The administrator must change protocol to TCP.
- B. The administrator must increase webfilter-timeout.
- C. The administrator must disable webfilter-force-off.
- D. The administrator must enable fortiguard-anycast.
正解：C
質問 # 29
A company's users on an IPsec VPN between FortiGate A and B have experienced intermittent issues since implementing VXLAN. The administrator suspects that packets exceeding the 1500- byte default MTU are causing the problems.
In which situation would adjusting the interface's maximum MTU value help resolve issues caused by protocols that add extra headers to IP packets?
- A. Adjust the MTU on interfaces in controlled environments where all devices along the path allow MTU interface changes.
- B. Adjust the MTU on interfaces only if FortiGate has the FortiGuard enterprise bundle, which allows MTU modification.
- C. Adjust the MTU on interfaces in all FortiGate devices that support the latest family of Fortinet SPUs: NP7, CP9 and SP5.
- D. Adjust the MTU on interfaces only in wired connections like PPPoE, optic fiber, and ethernet cable.
正解：A
解説：
When using IPsec VPNs and VXLAN, additional headers are added to packets, which can exceed the default 1500-byte MTU. This can lead to fragmentation issues, dropped packets, or degraded performance.
To resolve this, the MTU (Maximum Transmission Unit) should be adjusted only if all devices in the network path support it. Otherwise, some devices may still drop or fragment packets, leading to continued issues.
Why adjusting MTU helps:
VXLAN adds a 50-byte overhead to packets.
IPsec adds additional encapsulation (ESP, GRE, etc.), increasing the packet size. If packets exceed the MTU, they may be fragmented or dropped, causing intermittent connectivity issues.
Lowering the MTU on interfaces ensures packets stay within the supported size limit across all network devices.
質問 # 30
View the exhibit, which contains the output of a real-time debug, and then answer the question below.
Which one of the following statements describes why the update is failing?
- A. FortiGate is unable to resolve the required FQDN (service.fortiguard.net) for AV and IPS updates.
- B. The update should be using port 53 or port 8888, instead of port 443.
- C. The administrator should use the execute update-wf command instead.
- D. FortiGate is unable to establish a TCP connection with FDS.
正解：D
質問 # 31
An administrator has configured two FortiGate devices for an HA cluster. While testing the HA failover, the administrator noticed that some of the switches in the network continue to send traffic to the former primary unit.
The administrator decides to enable the setting link-failed-signal to fix the problem.
Which statement is correct regarding this command?
- A. Disables all the non-heartbeat interfaces in all the HA members for two seconds after a failover.
- B. Forces the former primary device to shut down all its non-heartbeat interfaces for one second while the failover occurs.
- C. Sends a link failed signal to all connected devices.
- D. Sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.
正解：B
質問 # 32
Examine the following partial outputs from two routing debug commands; then answer the question below:
Why the default route using port2 is not displayed in the output of the second command?
- A. It is disabled in the FortiGate configuration.
- B. It has a higher distance than the default route using port1.
- C. It has a higher priority than the default route using port1.
- D. It has a lower priority than the default route using port1.
正解：B
質問 # 33
......
有効な問題最新版を試そうFCSS_EFW_AD-7.4テスト解釈FCSS_EFW_AD-7.4有効な試験ガイド：https://www.goshiken.com/Fortinet/FCSS_EFW_AD-7.4-mondaishu.html
FCSS_EFW_AD-7.4試験資料Fortinet学習ガイド：https://drive.google.com/open?id=1OiNdpzSqY_9_MgRQD-0PPs3ILXX8dbaZ