FCP_FGT_AD-7-4 Practice Questions

The exhibit shows a full (deep) SSL inspection profile configured to Allow connections with untrusted SSL certificates. 1. When a client connects to a server with a valid, trusted certificate, the FortiGate intercepts the connection. It then generates a temporary certificate for that server and signs it with its own trusted CA certificate (FortinetCASSL). This allows the FortiGate to decrypt and inspect the traffic without the browser showing an error, provided the browser trusts the FortiGate CA. This matches option C. 2. When a client connects to a server with an invalid or untrusted certificate, the Allow setting permits the connection to proceed. However, to alert the user to the risk, FortiGate generates a temporary certificate and signs it with a special untrusted FortiGate CA. This action intentionally triggers a certificate warning in the user's browser, mirroring the untrusted status of the original server. This matches option D.

A. The browser does not bypass warnings. FortiGate's configuration ensures that if the original server certificate is untrusted, a warning is presented to the user. B. This is incorrect and would be a security risk. FortiGate will not issue a trusted certificate to the client if the original server certificate is untrusted.

1. FortiOS 7.4.0 Administration Guide, SSL/SSH Inspection > Full SSL inspection, Page 1031: "If the server certificate is trusted by FortiGate, FortiGate signs the forged certificate with the trusted FortinetCASSL certificate. If the server certificate is not trusted by FortiGate, FortiGate signs the forged certificate with an untrusted FortinetCAUntrusted certificate. This causes a certificate warning to be displayed by the browser." This directly supports answers C and D.

2. FortiGate Infrastructure 7.4 Study Guide, Chapter: FortiGate Security Fabric > SSL VPN, Page 280: "If the server certificate is trusted by FortiGate, FortiGate signs the forged certificate with the trusted FortinetCASSL certificate... If the server certificate is not trusted by FortiGate, FortiGate signs the forged certificate with an untrusted FortinetCAUntrusted certificate." This confirms the two distinct behaviors for trusted and untrusted original certificates.

In FortiOS, an administrator's access rights and permissions are defined by their assigned Administrator Profile. To access and modify global settings, which affect the entire FortiGate device, an administrator account must be associated with a profile that has global access permissions. The default superadmin profile provides this level of access. If an administrator cannot see the global settings, their current profile is likely restricted to a specific Virtual Domain (VDOM). Therefore, changing the account's assigned profile to one with global permissions (like superadmin) is the necessary action.

A. This feature restricts login access to specific IP addresses for security but does not grant permissions to view or edit global settings. B. Changing the password only alters the authentication credential; it does not modify the account's authorization level or configuration permissions. C. This enhances login security by requiring a second factor for authentication but does not change the permissions assigned to the administrator profile.

1. FortiOS 7.4.0 Administration Guide, System > Administrators > Admin profiles, Page 481: "Admin profiles are used to grant administrators permissions to access and configure the FortiGate... The default superadmin profile has full permission to the FortiGate, including all VDOMs and global settings. The default profadmin profile has full permission to the VDOMs it is assigned to, but no access to global settings." This directly confirms that the profile dictates access to global settings.

2. FortiOS 7.4.0 Administration Guide, System > Administrators > Administrators, Page 478: "When creating a new administrator, you must assign them an admin profile... The profile determines what the administrator can see and do in the GUI and CLI after they log in." This reinforces that all permissions are tied to the profile.

The Remote Access IPsec wizard template is the correct choice for configuring a VPN for a single, mobile user. This template is specifically designed to create a dial-up IPsec VPN, where the FortiGate acts as a server (responder) and the traveling employee's device, typically using FortiClient, acts as the client (initiator). The client's IP address is expected to be dynamic, which is characteristic of a user traveling and connecting from various locations like hotels or public Wi-Fi. The wizard automates the creation of the necessary Phase 1, Phase 2, user group, and firewall policy settings for this scenario.

B. Site to Site: This template is used to connect two entire networks, such as a main office and a branch office, where both ends are typically gateways with static IP addresses.

C. Dial up User: This is a peer type within the Phase 1 configuration that the "Remote Access" wizard creates, but it is not the name of the wizard template itself.

D. Hub-and-Spoke: This is a topology for connecting multiple remote sites (spokes) to a central location (hub). It is a form of site-to-site VPN, not for individual remote users.

1. Fortinet FortiOS 7.0.1 Administration Guide: In the "IPsec VPN wizards" section

it states

"The IPsec VPN wizard provides templates for creating some of the most common VPN configurations... Remote Access: For remote clients

such as FortiClient

to securely connect to the internal network." (p. 1018).

2. Fortinet Cookbook (docs.fortinet.com): The recipe "IPsec VPN for remote access" for FortiOS 7.0 demonstrates the procedure. Step 1 explicitly instructs the administrator to "Go to VPN > IPsec Wizard and create a new tunnel. Name the tunnel and select the Remote Access template." This confirms the template's purpose is for remote users with FortiClient.

The serial console provides direct, out-of-band management access to the FortiGate Command Line Interface (CLI). This is achieved through a physical connection to the device's console port (typically RJ-45 or DB-9) using a console cable. This method is independent of the device's network configuration, IP addressing, or interface status, making it the fundamental way to access a device for initial setup or for recovery when network access is lost.

A. SSH console requires an active network connection and a configured IP address on a FortiGate interface to establish a session.

B. The CLI console widget is a feature within the FortiGate web-based manager (GUI), which requires network (HTTPS) access to the device.

D. Telnet console, like SSH, is a network protocol that requires an active network connection and a configured IP address to function.

1. Fortinet FortiOS 7.0.0 Administration Guide

Page 100

"Connecting to the FortiGate CLI": "You can access the CLI in two ways: ... A local console connection to the FortiGate console port. This is a direct connection to the FortiGate unit and does not require the network to be running." The guide further details SSH and Telnet as network-based access methods.

2. Fortinet FortiOS 7.0.0 CLI Reference

Page 31

"Accessing the CLI": "You can access the CLI through a direct console connection or through a network connection using SSH or Telnet." This explicitly separates the direct console connection from network-dependent methods.

3. FortiGate-70F Series QuickStart Guide

Page 4

"Basic Connections": The guide instructs the user to "Connect the Console Port to your management computer using the provided console cable" as a primary step for initial configuration

which precedes any network setup.

Reverse Path Forwarding (RPF) is a security mechanism primarily used to mitigate IP spoofing attacks. When a FortiGate receives the first packet of a new session, it performs an RPF check on the packet's source IP address. It consults its routing table to determine the egress interface it would use to send a reply packet back to that source IP. If the egress interface in the routing table does not match the ingress interface on which the packet was received, the RPF check fails, and the packet is dropped. This validation occurs only on the initial packet to establish a new session, ensuring the source is legitimate before any stateful entry is created.

B. The RPF check validates the source of the initiating packet to prevent spoofing; it is not performed on the reply packet from the destination.

C. The check is only performed on the first packet that initiates a session, not on both the sent and reply packets.

1. FortiOS 7.2 Administration Guide

Firewall > DoS policies and sensors > DoS anomalies

Page 1011: "Reverse Path Forwarding (RPF)

also called anti-spoofing

is a mechanism that protects the FortiGate unit and your network from IP spoofing attacks." This statement directly supports option D.

2. FortiOS 7.0 Handbook - Packet Flow and Security Features

Life of a Packet

Page 13: The packet flow diagram shows the "Reverse Path Forwarding check" as one of the initial steps for the first packet of a new session

occurring before a session is created in the session table. This confirms the check is performed on the first packet

supporting option A.

3. Fortinet Knowledge Base

Technical Tip: RPF (Reverse Path Forwarding) check or Anti Spoofing (FD33969): "The RPF is a mechanism that protects the FortiGate and the network from IP spoofing attacks... When a packet is received on an interface

the FortiGate will look at the source IP address of that packet and will perform a route lookup... If the outgoing interface in the route entry does not match the interface where the packet was received

the packet is dropped." This confirms the mechanism (D) and its application to incoming packets initiating a connection (A).

To block a specific website (download.com) while allowing others in the same FortiGuard category (Freeware and Software Downloads), an administrator can use features that override the general category action. The Static URL Filter allows for the creation of explicit block or allow rules for specific URLs or patterns. Creating a wildcard entry for download.com with the action Block will prevent access to it, and this check is performed before the FortiGuard category check. Alternatively, a Web Rating Override can be used to re-categorize download.com into a category that is already blocked, such as Malicious Websites. This changes the site's rating locally on the FortiGate, causing it to be blocked by the action set for the new category.

A. While a deny firewall policy can block the site, the question's context is the web filter profile. URL filtering and rating overrides are the appropriate features within that profile. B. The Warning action does not block access; it allows users to proceed after a notification. This also fails to target only download.com, affecting the entire category.

1. FortiOS 7.4.0 Administration Guide, Security Profiles > Web Filter > URL Filter, p. 1022: "The URL filter is a list of URLs that you can configure to be exempt from web filtering, or to be blocked... The URL filter is checked before the FortiGuard category filter." This supports option D.

2. FortiOS 7.4.0 Administration Guide, Security Profiles > Web Filter > Web Rating Overrides, p. 1025: "You can use web rating overrides to change the FortiGuard category of a website... For example, if you know that example.com is a real estate website, but it is categorized as 'Information Technology', you can override its category." This supports option C.

3. FortiOS 7.4.0 Administration Guide, Security Profiles > Web Filter > Web filter components and order of operations, p. 1019: This section confirms the order of operations where the Static URL Filter is checked first, followed by FortiGuard Web Filter (which includes Web Rating Overrides before checking the main category database). This confirms both D and C are effective override mechanisms.

In a FortiGate device with Virtual Domains (VDOMs) enabled, configuration settings are separated into two categories: global and per-VDOM. Global settings apply to the entire FortiGate unit, affecting its overall operation. High Availability (HA) is a system-level feature that concerns the physical clustering of the device, and therefore, its configuration is managed globally. Similarly, FortiGuard settings, which include licensing, update schedules, and service connections, are configured at the global level to serve all VDOMs on the device.

A. User & Device settings: These are configured on a per-VDOM basis to allow for separate user databases and device management for each virtual domain.

B. Firewall policies: These are the primary security rules for traffic and are configured independently within each VDOM to enforce distinct security policies.

1. Fortinet FortiOS 7.2.0 Administration Guide

Virtual Domains > Global and per-VDOM settings

Page 1019: "Some settings are global

and apply to the entire FortiGate. Other settings apply only to the VDOM. [...] Examples of global settings: system ha

system fortiguard [...] Examples of per-VDOM settings: firewall policy

user local."

2. Fortinet Certified Professional - Security Operations Study Guide for FortiOS 7.2

Chapter 11: Virtual Domains

Section: Global vs. VDOM Configuration

Page 328: "Global settings apply to the entire FortiGate device. Examples of global settings are interfaces

HA

and FortiGuard. Per-VDOM settings apply only to a specific VDOM. Examples of per-VDOM settings are firewall policies

static routes

and security profiles."

NGFW profile-based mode is the traditional and more granular method for configuring security on a FortiGate. Its defining feature is the use of separate security profiles (such as Application Control, Web Filtering, Antivirus, and IPS) which are then applied to a firewall policy. This allows for reusable and detailed security configurations. Furthermore, within these security profiles, administrators can select the inspection method—either flow-based for high performance or proxy-based for more thorough inspection. Therefore, a firewall policy in profile-based mode can leverage both inspection methods depending on the attached profiles.

A. NGFW mode is a setting configured on a per-VDOM basis, not globally. Different VDOMs on the same FortiGate can operate in different NGFW modes. B. Central Source NAT (SNAT) is an optional feature that can be used in either NGFW mode but is not a requirement for profile-based mode.

1. Fortinet FortiOS 7.0.0 Administration Guide, Page 58, "NGFW mode":

"In profile-based NGFW mode, you can apply all security profiles to a firewall policy." (Supports option D)

"You can configure NGFW mode for each VDOM." (Refutes option A)

2. Fortinet FortiOS 7.0.0 Administration Guide, Page 59, "Inspection mode":

"FortiOS can apply antivirus and web filtering in flow-based or proxy-based inspection mode. In profile-based NGFW mode, you can select the inspection mode when you configure the Antivirus and Web Filter security profiles." (Supports option C)

3. Fortinet FortiOS 7.0.0 Administration Guide, Page 1000, "Central SNAT":

The guide describes Central SNAT as a separate policy table that can be enabled. It is not presented as a prerequisite for profile-based NGFW mode, where NAT is typically configured within the firewall policy itself. (Refutes option B)

The primary differences between IKEv1 Main Mode and Aggressive Mode relate to security, speed, and flexibility.

Main Mode prioritizes security by using a six-packet exchange to establish a secure channel. This process protects the identities of the communicating peers, as their IDs are encrypted and exchanged only in the final two packets.

Aggressive Mode prioritizes speed by using a condensed three-packet exchange. To achieve this, the initiator sends its peer ID in the first packet, unencrypted. This makes the exchange faster but exposes the initiator's identity. This behavior is essential for dialup VPNs using pre-shared keys, as the responder needs the ID to find the correct policy.

B. Main mode can be used for dialup VPNs, particularly when using digital certificates for authentication, as the certificate contains the necessary identity information. Aggressive mode is only mandatory for PSK-based dialup clients.

C. XAuth (Extended Authentication) is an IKEv1 extension for user authentication that can be used after the successful completion of either Main Mode or Aggressive Mode Phase 1 negotiations.

1. Fortinet FortiOS 7.0.0 Administration Guide:

IPsec VPN > IKE version 1 > Phase 1 negotiation: "Main mode uses six messages to establish the IKE SA... The identities of the peers are encrypted." This supports option D and the identity protection aspect of option A.

IPsec VPN > IKE version 1 > Phase 1 negotiation: "Aggressive mode uses three messages to establish the IKE SA... The peer ID of the initiator is sent in the first packet and is therefore in cleartext." This supports options D and A.

IPsec VPN > Dialup IPsec VPNs: "When configuring a dialup IPsec VPN

you must use aggressive mode if you are using a pre-shared key for authentication... Aggressive mode sends a peer ID in the first packet of the exchange

which allows the gateway to look up the pre-shared key." This confirms why option B is incorrect

as the limitation is specific to PSK.

2. NIST Special Publication 800-77

Guide to IPsec VPNs:

Section 4.3.1.1

IKE Main Mode: "Main Mode requires a total of six messages... Main Mode provides identity protection for the peers." This supports option D and the reasoning for A.

Section 4.3.1.2

IKE Aggressive Mode: "Aggressive Mode requires a total of three messages... Aggressive Mode does not provide identity protection for the peers." This supports options D and A. The document also clarifies that XAuth is a subsequent exchange

not tied to a specific Phase 1 mode

which invalidates option C.

FortiOS SD-WAN rules provide several strategies for member selection. The 'Manual' strategy allows an administrator to statically select one or more interfaces; if multiple interfaces are chosen, traffic is load-balanced across them. The 'Lowest Cost (SLA)' strategy selects the member with the lowest configured cost that also meets the performance SLA. If multiple members meet the SLA and share the same lowest cost, FortiGate load-balances traffic among them. If only one member qualifies (either by cost or SLA), it is selected exclusively, resulting in no load balancing. These behaviors validate options A, B, and E.

C. Best Quality with load balancing: The 'Best Quality' strategy is designed to select only the single best-performing link based on the SLA criteria (latency, jitter, packet loss); it does not perform load balancing.

D. Lowest Quality (SLA) with load balancing: 'Lowest Quality' is not a valid member selection strategy in FortiOS SD-WAN. FortiGate prioritizes the best-performing and most cost-effective links.

1. Fortinet NSE Institute. (2021). NSE 4 FortiGate Security 7.2 Study Guide. Page 318

"SD-WAN Rules". The guide states for the 'Lowest Cost (SLA)' strategy: "If multiple members have the same cost

FortiGate load balances traffic between them." This supports option B.

2. Fortinet. (2023). FortiOS 7.4.2 SD-WAN Administration Guide. Page 41

"Strategy". This document describes the 'Manual' strategy

where selecting multiple interfaces is an option

and the 'Best Quality' strategy

which "chooses the best link" (singular). This supports option A and invalidates option C.

3. Fortinet. (2023). FortiOS 7.4.2 SD-WAN Administration Guide. Page 41

"Strategy". The description for 'Lowest Cost (SLA)' confirms it selects the link with the lowest cost that meets the SLA. This describes the fundamental behavior covered in option E.