最新 [2024年10月26日]FCP_FCT_AD-7.2試験問題には有効なFCP_FCT_AD-7.2問題集PDF
FCP_FCT_AD-7.2練習テスト問題解答は更新された57問があります
質問 # 32
A FortiClient EMS administrator has enabled the compliance rule forthe sales department Which Fortinet device will enforce compliance with dynamic access control?
- A. FortiGate
- B. FortiClient
- C. FortiAnalyzer
- D. FortiClient EMS
正解：A
解説：
* Understanding Compliance Rules:
* The compliance rule for the sales department needs to be enforced dynamically.
* Enforcing Compliance:
* FortiGate is responsible for enforcing compliance by integrating with FortiClient EMS to apply dynamic access control based on compliance status.
* Conclusion:
* The Fortinet device that will enforce compliance with dynamic access control is the FortiGate.
References:
* Compliance and enforcement documentation from FortiGate and FortiClient EMS study guides.
質問 # 33
Which security fabric component sends a notification io quarantine an endpoint after IOC detection "n the automation process?
- A. FortiClient
- B. FortiGate
- C. FortiClient EMS
- D. FortiAnalyzer
正解：C
解説：
Understanding the Automation Process:
In the Security Fabric, automation processes can include actions such as quarantining an endpoint after an IOC (Indicator of Compromise) detection.
Evaluating Responsibilities:
FortiClient EMS plays a crucial role in endpoint management and can send notifications to quarantine endpoints.
Conclusion:
The correct security fabric component that sends a notification to quarantine an endpoint after IOC detection is FortiClient EMS.
Reference:
FortiClient EMS and automation process documentation from the study guides.
質問 # 34
ZTNA Network Topology
Refer to the exhibits, which show a network topology diagram of ZTNA proxy access and the ZTNA rule configuration.
An administrator runs the diagnose endpoint record list CLI command on FortiGate to check Remote-Client endpoint information, however Remote-Client is not showing up in the endpoint record list.
What is the cause of this issue?
- A. Remote-Client failed the client certificate authentication.
- B. Remote-Client provided an invalid certificate to connect to the ZTNA access proxy.
- C. Remote-Client has not initiated a connection to the ZTNA access proxy.
- D. Remote-Client provided an empty client certificate to connect to the ZTNA access proxy.
正解：A
質問 # 35
An administrator installs FortiClient on Windows Server.
What is the default behavior of real-time protection control?
- A. Real-time protection is disabled
- B. Real-time protection must update the signature database from FortiSandbox
- C. Real-time protection sends malicious files to FortiSandbox when the file is not detected locally
- D. Real-time protection must update AV signature database
正解：A
解説：
When FortiClient is installed on a Windows Server, the default behavior for real-time protection control is:
Real-time protection is disabled: By default, FortiClient does not enable real-time protection on server installations to avoid potential performance impacts and because servers typically have different security requirements compared to client endpoints.
Thus, real-time protection is disabled by default on Windows Server installations.
Reference
FortiClient EMS 7.2 Study Guide, Real-time Protection Section
Fortinet Documentation on FortiClient Default Settings for Server Installations
質問 # 36
An administrator has a requirement to add user authentication to the ZTNA access for remote or off-fabric users Which FortiGate feature is required m addition to ZTNA?
- A. FortiGate explicit proxy
- B. FortiGate certificates
- C. FortiGate FSSO
- D. FortiGate endpoint control
正解：A
解説：
For adding user authentication to the ZTNA access for remote or off-fabric users, the following FortiGate feature is required in addition to ZTNA:
FortiGate explicit proxy allows FortiGate to intercept web traffic for authentication purposes.
ZTNA integrates with various FortiGate features to provide secure access and ensure that users are authenticated before accessing resources.
By using an explicit proxy, FortiGate can handle web traffic and enforce authentication policies for remote users who are not directly on the corporate network (off-fabric).
Thus, the correct feature to use for this requirement is the FortiGate explicit proxy.
Reference
FortiGate Security 7.2 Study Guide, ZTNA and Proxy Configuration Sections Fortinet Documentation on FortiGate Explicit Proxy and ZTNA Integration
質問 # 37
Which three features does FortiClient endpoint security include? (Choose three.)
- A. DLP
- B. Real-lime protection
- C. lPsec
- D. Vulnerability management
- E. L2TP
正解：B、C、D
解説：
* Understanding FortiClient Features:
* FortiClient endpoint security includes several features aimed at protecting and managing endpoints.
* Evaluating Feature Set:
* Vulnerability management is a key feature of FortiClient, helping to identify and address vulnerabilities (B).
* IPsec is supported for secure VPN connections (D).
* Real-time protection is crucial for detecting and preventing threats in real-time (E).
* Eliminating Incorrect Options:
* Data Loss Prevention (DLP) (A) is typically managed by FortiGate or FortiMail.
* L2TP (C) is a protocol used for VPNs but is not specifically a feature of FortiClient endpoint security.
References:
* FortiClient endpoint security features documentation from the study guides.
質問 # 38
Refer to the exhibit.
Based on the settings shown in the exhibit what action will FortiClient take when it detects that a user is trying to download an infected file?
- A. Quarantines the infected files and logs all access attempts
- B. Allows the infected file to download without scan
- C. Blocks the infected files as it is downloading
- D. Sends the infected file to FortiGuard for analysis
正解：B
解説：
Block Malicious Website has nothing to do with infected files. Since Realtime Protection is OFF, it will be allowed without being scanned.
Based on the settings shown in the exhibit:
* Realtime Protection:OFF
* Dynamic Threat Detection:OFF
* Block malicious websites:ON
* Threats Detected:75
The "Realtime Protection" setting is crucial for preventing infected files from being downloaded and executed.
Since "Realtime Protection" is OFF, FortiClient will not actively scan files being downloaded. The setting
"Block malicious websites" is intended to prevent access to known malicious websites but does not scan files for infections.
Therefore, when a user tries to download an infected file, FortiClient will allow the file to download without scanning it due to the Realtime Protection being OFF.
References
* FortiClient EMS 7.2 Study Guide, Antivirus Protection Section
* Fortinet Documentation on FortiClient Real-time Protection Settings
質問 # 39
In a ForliSandbox integration, what does the remediation option do?
- A. Exclude specified files
- B. Wait for FortiSandbox results before allowing files
- C. Alert and notify only
- D. Deny access to a tile when it sees no results
正解：C
解説：
* Understanding FortiSandbox Integration:
* In a FortiSandbox integration, various remediation options are available for handling suspicious files.
* Evaluating Remediation Options:
* The remediation option for alerting and notifying without blocking access or waiting for results is essential to understand.
* Conclusion:
* The correct action for the remediation option in this context is to alert and notify only.
References:
* FortiSandbox integration documentation from the study guides.
質問 # 40
Refer to the exhibit.
An administrator has restored the modified XML configuration file to FortiClient and sees the error shown in the exhibit.
Based on the XML settings shown in the exhibit, what must the administrator do to resolve the issue with the XML configuration file?
- A. The administrator must use a password to decrypt the file
- B. The administrator must save the file as FortiClient-config conf.
- C. The administrator must change the file size
- D. The administrator must resolve the XML syntax error.
正解：D
解説：
Based on the error message and the XML configuration file shown in the exhibit:
The error "Failed to process the file" typically indicates an issue with the XML syntax.
Upon reviewing the XML content, it is crucial to ensure that all tags are correctly formatted, properly opened and closed, and that there are no syntax errors.
Resolving any XML syntax errors will allow FortiClient to successfully process and restore the configuration file.
Therefore, the administrator must resolve the XML syntax error to fix the issue.
Reference
FortiClient EMS 7.2 Study Guide, Configuration File Management Section
General XML Syntax Guidelines and Best Practices
質問 # 41
What action does FortiClient anti-exploit detection take when it detects exploits?
- A. Patches the compromised application process
- B. Deletes the compromised application process
- C. Blocks memory allocation to the compromised application process
- D. Terminates the compromised application process
正解：A
質問 # 42
An administrator is required to maintain a software vulnerability on the endpoints, without showing the feature on the FortiClient. What must the administrator do to achieve this requirement?
- A. Disable select the vulnerability scan feature in the deployment package
- B. Click the hide icon on the vulnerability scan profile assigned to endpoint
- C. Use the default endpoint profile
- D. Select the vulnerability scan feature in the deployment package, but disable the feature on the endpoint profile
正解：B
解説：
Requirement Analysis:
The administrator needs to maintain a software vulnerability scan on endpoints without showing the feature on FortiClient.
Evaluating Options:
Disabling the feature in the deployment package or endpoint profile would remove the functionality entirely, which is not desired.
Using the default endpoint profile may not meet the specific requirement of hiding the feature.
Clicking the hide icon on the vulnerability scan profile assigned to the endpoint will keep the feature active but hidden from the user's view.
Conclusion:
The correct action is to click the hide icon on the vulnerability scan profile assigned to the endpoint (C).
Reference:
FortiClient EMS feature configuration and management documentation from the study guides.
質問 # 43
When site categories are disabled in FortiClient web filter, which feature can be used to protect the endpoint from malicious web access?
- A. Real-time protection list
- B. Web exclusion list
- C. Block maliciouswebsites on antivirus
- D. FortiSandbox URL list
正解：B
解説：
* Web Filter Functionality:
* When site categories are disabled in the FortiClient web filter, the endpoint still requires protection from malicious web access.
* Alternative Protection Features:
* The web exclusion list can be used to manage and block specific URLs that are known to be malicious, providing a way to control and secure web access even without site categories being enabled.
* Conclusion:
* The correct feature that can be used to protect the endpoint in this scenario is the web exclusion list (D).
References:
* FortiClient web filter configuration and features from the study guides.
質問 # 44
An administrator installs FortiClient on Windows Server.
What is the default behavior of real-time protection control?
- A. Real-time protection is disabled
- B. Real-time protection must update the signature database from FortiSandbox
- C. Real-time protection sends malicious files to FortiSandbox when the file is not detected locally
- D. Real-time protection must update AV signature database
正解：A
解説：
When FortiClient is installed on a Windows Server, the default behavior for real-time protection control is:
* Real-time protection is disabled:By default, FortiClient does not enable real-time protection on server installations to avoid potential performance impacts and because servers typically have different security requirements compared to client endpoints.
Thus, real-time protection is disabled by default on Windows Server installations.
References
* FortiClient EMS 7.2 Study Guide, Real-time Protection Section
* Fortinet Documentation on FortiClient Default Settings for Server Installations
質問 # 45
Refer to the exhibit.
Based on the Security Fabric automation settings, what action will be taken on compromised endpoints?
- A. Endpoints will be quarantined through EMS
- B. Endpoints will be banned on FortiGate
- C. Endpoints will be quarantined through FortiSwitch
- D. An email notification will be sent for compromised endpoints
正解：A
解説：
Based on the Security Fabric automation settings shown in the exhibit:
* The automation stitch is configured with a trigger for a "Compromised Host."
* The action specified for this trigger is "Quarantine FortiClient via EMS."
* This indicates that when an endpoint is detected as compromised, FortiClient EMS will quarantine the endpoint as part of the automation process.
Therefore, the action taken on compromised endpoints will be to quarantine them through EMS.
References
* FortiGate Security 7.2 Study Guide, Automation Stitches and Actions Section
* Fortinet Documentation on Configuring Automation Stitches and Quarantine Actions
質問 # 46
Which security fabric component sends a notification to quarantine an endpoint after IOC detection in the automation process?
- A. FortiClient
- B. ForbClient EMS
- C. D. Forti Gate
- D. FortiAnalyzer
正解：C
質問 # 47
Which two statements are true about ZTNA? {Choose two.)
- A. ZTNA manages access through the client only.
- B. ZTNA manages access for remote users only.
- C. ZTNA provides role-based access.
- D. ZTNA provides a security posture check.
正解：C、D
解説：
ZTNA (Zero Trust Network Access) is a security architecture that is designed to provide secure access to network resources for users, devices, and applications. It is based on the principle of "never trust, always verify," which means that all access to network resources is subject to strict verification and authentication.
Two functions of ZTNA are:
ZTNA provides a security posture check: ZTNA checks the security posture of devices and users that are attempting to access network resources. This can include checks on the device's software and hardware configurations, security settings, and the presence of malware.
ZTNA provides role-based access: ZTNA controls access to network resources based on the role of the user or device. Users and devices are granted access to only those resources that are necessary for their role, and all other access is denied. This helps to prevent unauthorized access and minimize the risk of data breaches.
質問 # 48
Refer to the exhibit, which shows the endpoint summary information on FortiClient EMS.
What two conclusions can you make based on the Remote-Client status shown above? (Choose two.)
- A. The endpoint is configured to support FortiSandbox.
- B. The endpoint has been assigned the Default endpoint policy.
- C. The endpoint is currently off-net.
- D. The endpoint is classified as at risk.
正解：B、C
解説：
Based on the Remote-Client status shown in the exhibit:
Endpoint Policy: The "Policy" field shows "Default," indicating that the endpoint has been assigned the Default endpoint policy.
Connection Status: The "Location" field shows "Off-Fabric," meaning that the endpoint is currently off the corporate network (off-net).
Therefore, the two conclusions that can be made are:
The endpoint has been assigned the Default endpoint policy.
The endpoint is currently off-net.
Reference
FortiClient EMS 7.2 Study Guide, Endpoint Summary Information Section
Fortinet Documentation on Endpoint Policies and Status Indicators
質問 # 49
Exhibit.
Based on the FortiClient logs shown in the exhibit, which endpoint profile policy is currently applied lo the ForliClient endpoint from the EMS server?
- A. Compliance rules default
- B. Default configuration policy c
- C. Fortinet-Training
- D. Default
正解：C
解説：
Observation of Logs:
The logs show a policy named "Fortinet-Training" being applied to the endpoint.
Evaluating Policies:
The log entries indicate that the "Fortinet-Training" policy was received and applied.
Conclusion:
Based on the logs, the currently applied policy on the FortiClient endpoint is "Fortinet-Training".
Reference:
FortiClient EMS policy configuration and log analysis documentation from the study guides.
質問 # 50
Refer to the exhibit.
Based on the settings shown in the exhibit which statement about FortiClient behavior is true?
- A. FortiClient blocks and deletes infected files after scanning them.
- B. FortiClient scans infected files when the user copies files to the Resources folder
- C. FortiClient copies infected files to the Resources folder without scanning them.
- D. FortiClient quarantines infected files and reviews later, after scanning them.
正解：D
解説：
Action On Virus Discovery Warn the User If a Process Attempts to Access Infected Files Quarantine Infected Files. You can use FortiClient to view, restore, or delete the quarantined file, as well as view the virus name, submit the file to FortiGuard, and view logs. Deny Access to Infected Files Ignore Infected Files
質問 # 51
Refer to the exhibits.
Which show the Zero Trust Tag Monitor and the FortiClient GUI status.
Remote-Client is tagged as Remote-Users on the FortiClient EMS Zero Trust Tag Monitor.
What must an administrator do to show the tag on the FortiClient GUI?
- A. Change the user identity settings to enable tag visibility
- B. B. Change the FortiClient system settings to enable tag visibility
- C. Change the endpoint control setting to enable tag visibility
- D. Update tagging rule logic to enable tag visibility
正解：B
解説：
Based on the exhibits provided:
* The "Remote-Client" is tagged as "Remote-Users" in the FortiClient EMS Zero Trust Tag Monitor.
* To ensure that the tag "Remote-Users" is visible in the FortiClient GUI, the system settings within FortiClient need to be updated to enable tag visibility.
* The tag visibility feature is controlled by FortiClient system settings which manage how tags are displayed in the GUI.
Therefore, the administrator needs to change the FortiClient system settings to enable tag visibility.
References
* FortiClient EMS 7.2 Study Guide, Zero Trust Tagging Section
* FortiClient Documentation on Tag Management and Visibility Settings
質問 # 52
Which security fabric component sends a notification io quarantine an endpoint after IOC detection "n the automation process?
- A. FortiClient
- B. FortiGate
- C. FortiClient EMS
- D. FortiAnalyzer
正解：C
質問 # 53
In aForliSandbox integration, whatdoes the remediation option do?
- A. Alertand notify only
- B. Exclude specified files
- C. Wait for FortiSandbox results before allowing files
- D. Deny access to a tile when it sees no results
正解：A
解説：
* Understanding FortiSandbox Integration:
* In a FortiSandbox integration, various remediation options are available for handling suspicious files.
* Evaluating Remediation Options:
* The remediation option for alerting and notifying without blocking access or waiting for results is
* essential to understand.
* Conclusion:
* The correct action for the remediation option in this context is to alert and notify only.
References:
* FortiSandbox integration documentation from the study guides.
質問 # 54
Refer to the exhibit.
Based on the Security Fabric automation settings, what action will be taken on compromised endpoints?
- A. Endpoints will be quarantined through EMS
- B. Endpoints will be banned on FortiGate
- C. Endpoints will be quarantined through FortiSwitch
- D. An email notification will be sent for compromised endpoints
正解：A
解説：
Based on the Security Fabric automation settings shown in the exhibit:
* The automation stitch is configured with a trigger for a "Compromised Host."
* The action specified for this trigger is "Quarantine FortiClient via EMS."
* This indicates that when an endpoint is detected as compromised, FortiClient EMS will quarantine the endpoint as part of the automation process.
Therefore, the action taken on compromised endpoints will be to quarantine them through EMS.
References
* FortiGate Security 7.2 Study Guide, Automation Stitches and Actions Section
* Fortinet Documentation on Configuring Automation Stitches and Quarantine Actions
質問 # 55
......
Fortinet FCP_FCT_AD-7.2 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
FCP_FCT_AD-7.2問題集で合格確定させる練習には57問があります：https://jp.fast2test.com/FCP_FCT_AD-7.2-premium-file.html