2024年最新のFCP_FMG_AD-7.4試験問題集で最近更新された37問題
Fortinet FCP_FMG_AD-7.4リアル2024年最新のブレーン問題集で模擬試験問題集
Fortinet FCP_FMG_AD-7.4 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
| トピック 6 |
|
| トピック 7 |
|
質問 # 21
Refer to the exhibit.
Given the configuration shown in the exhibit, which two conclusions can you draw from the installation targets in the Install On column? (Choose two.)
- A. Policy seq.S will be installed on all managed devices and VDOMs that are listed under Installation Targets
- B. Policy seq.# 3 will be skipped because no installation targets are specified.
- C. Policy seq.# 2 will not be installed on the Local-FortiGate root VDOM because there is no root VDOM in the Installation Target
- D. Policy seq.# 1 will be installed on the ISFW device root[NAT] and Student[NAT] VDOMs only.
正解：A、D
解説：
* Option A: Policy seq.S will be installed on all managed devices and VDOMs that are listed under Installation Targets.This is correct. The "Install On" column indicates that the policy is targeted for installation on all listed managed devices and VDOMs under Installation Targets.
* Option D: Policy seq.# 1 will be installed on the ISFW device root[NAT] and Student[NAT] VDOMs only.This is correct. Policy sequence #1 specifies that it will be installed only on the ISFW device and the VDOMs 'root[NAT]' and 'Student[NAT]' as indicated by the "Install On" column.
Explanation of Incorrect Options:
* Option B: Policy seq.# 3 will be skipped because no installation targets are specifiedis incorrect because it is clearly listed under "Installation Targets," which means it will be installed according to the specified configuration.
* Option C: Policy seq.# 2 will not be installed on the Local-FortiGate root VDOM because there is no root VDOM in the Installation Targetis incorrect as the exhibit does not show any specific exclusion for seq.# 2 on the Local-FortiGate root VDOM.
FortiManager References:
* Refer to the FortiManager Administration Guide sections on "Policy Packages" and "Policy Installation Targets" for more details.
質問 # 22
Exhibit.
Given the configuration shown in the exhibit, which two statements are true? (Choose two.)
- A. The FortiManager ADOM workspace mode is set to Normal
- B. FortiManager is in workflow mode.
- C. The FortiManager ADOM is locked by the administrator.
- D. An administrator can also lock the Local-FortiGate_root policy package.
正解：B、C
解説：
The provided screenshot from FortiManager shows several key elements that help answer the question:
* Thepadlock iconnext to the "Remote-FortiGate" policy package indicates that this policy package is locked, which means it is currently being edited or has been checked out by an administrator. This is typical behavior when the ADOM (Administrative Domain) workspace is inuse, and a session is active where an administrator is working on a policy package.
* Theabsence of a lock iconnext to "Local-FortiGate_root" and "default" indicates that these policy packages are not locked and are available for editing.
* Statement B(FortiManager is in workflow mode): This istrue. The fact that one of the policy packages is locked suggests that FortiManager is operating inADOM workflow modeor at least in a state where it enforces locking for editing, typically seen in Normal ADOM modes. Inworkflow mode, an administrator needs to lock a workspace before making changes.
* Statement C(The FortiManager ADOM is locked by the administrator): This istrue. The presence of the padlock on "Remote-FortiGate" signifies that the ADOM, or more specifically, this policy package within the ADOM, has been locked by the administrator.
* Statement A(An administrator can also lock the Local-FortiGate_root policy package): This isnot necessarily true. The administrator can lock the "Local-FortiGate_root" policy package, but as shown in the exhibit, it iscurrently not locked, so this option is not a certainty in this state.
* Statement D(The FortiManager ADOM workspace mode is set to Normal): This istrue, but not the best option compared to B and C, as it can be inferred that the mode is set to Normal due to the locking behavior, but the more direct information is about the ADOM being locked by an administrator.
質問 # 23
Which statement about the upgrade of ADOMs on FortiManager is true?
- A. You cannot import policies from a device until its FortiOS version matches the ADOM version.
- B. To ensure database consistency, you must upgrade an ADOM before you upgrade the devices in it.
- C. ADOMs using global objects can be upgraded before or after upgrading the global database ADOM.
- D. Upgrading the FortiManager version upgrades all existing ADOMs automatically.
正解：B
解説：
* Option A: To ensure database consistency, you must upgrade an ADOM before you upgrade the devices in it.This is the correct answer. When upgrading ADOMs on FortiManager, the ADOM must be upgraded first to match the FortiOS version of the devices it manages. This is necessary to ensure compatibility and consistency between the ADOM's database schema and the FortiGate's configuration.
Explanation of Incorrect Options:
* Option B: Upgrading the FortiManager version upgrades all existing ADOMs automaticallyis incorrect because the ADOMs must be upgraded manually or individually after upgrading the FortiManager.
* Option C: You cannot import policies from a device until its FortiOS version matches the ADOM versionis incorrect because while version matching is important, it is not strictly necessary for policy import.
* Option D: ADOMs using global objects can be upgraded before or after upgrading the global database ADOMis incorrect as the order of upgrade matters to maintain compatibility.
FortiManager References:
* Refer to "FortiManager Upgrade Guide" for detailed procedures on upgrading ADOMs and devices.
質問 # 24
An administrator configures a new OSPF area on FortiManager and has not yet pushed the changes to the managed FortiGate device. In which database will the configuration be saved?
- A. Configuration-level database
- B. Device-level database
- C. ADOM-level database
- D. Revision history database
正解：B
解説：
When an administrator configures a new OSPF area on FortiManager but has not yet pushed the changes to the managed FortiGate device, the configuration is saved in theDevice-level database.
Explanation of Options:
* A. Device-level database:
* This istrue. When changes are made to a device's configuration on FortiManager, they are saved in theDevice-level database. This database stores the configuration for individual managed devices. The configuration changes remain here until they are pushed to the actual FortiGate device.
* B. ADOM-level database:
* This isfalse. The ADOM-level database holds configurations related to the entire ADOM (Administrative Domain), such as global settings that apply to all devices within the ADOM, rather than configurations specific to individual devices.
* C. Configuration-level database:
* This isfalse. The term "Configuration-level database" is not typically used in FortiManager terminology. Changes are stored in the device-level database and are applied when pushed to the FortiGate.
* D. Revision history database:
* This isfalse. The revision history database keeps track of previous versions of configurations after they have been pushed to the FortiGate device. It does not store unsaved or pending configurations that have not yet been applied to the device.
質問 # 25
Exhibit.
Given the configuration shown in the exhibit, which two statements are true? (Choose two.)
- A. An administrator can also lock the Local-FortiGate_root policy package.
- B. The FortiManager ADOM is locked by the administrator.
- C. The FortiManager ADOM workspace mode is set to Normal
- D. FortiManager is in workflow mode.
正解：A、D
質問 # 26
Which API method is used to create objects or overwrite existing ones?
- A. Exec
- B. Add
- C. Set
- D. Update
正解：C
質問 # 27
Exhibit.
An administrator would like to create three ADOMs on FortiManager with different access levels based on departments. What two conclusions can you draw from the design shown in the exhibit? (Choose two.)
- A. An administrator with the super user profile can access all theVDOMs.
- B. The FortiManager administrator must set the ADOM device mode to Advanced
- C. The administrator must configure FortiManager in workspace normal mode.
- D. Policies and objects databases can be shared between the Financial and HR ADOMs.
正解：A、B
質問 # 28
What is a characteristic of the FortiManager high availability (HA) feature?
- A. When a secondary unit is removed, FortiManager updates the managed devices using TCP port 5199.
- B. The primary unit synchronizes all configuration revision with the seconday units.
- C. All secondary units must be in the same network as the primary unit.
- D. Each cluster member must be upgraded manually, starting with the primary unit.
正解：B
解説：
The characteristic of the FortiManager high availability (HA) feature is that the primary unit synchronizes all configuration revisions with the secondary units. This ensures that all devices in the HA cluster are up-to-date with the same configurations, providing redundancy and failover capabilities.
Options A, C, and D are incorrect because:
* Arefers to a specific port number (5199), but FortiManager does not specifically use TCP port 5199 to update managed devices when a secondary unit is removed.
* Cis incorrect as secondary units do not necessarily have to be in the same network as the primary unit; they just need to be able to communicate with each other.
* Dis incorrect because HA upgrades can be automated and do not require manual upgrading, starting with the primary unit.
FortiManager References:
* Refer to FortiManager 7.4 High Availability (HA) Guide: HA Synchronization and Configuration.
質問 # 29
An administrator enabled workspace mode and now wants to delete an address object that is currently referenced in a firewall policy. Which two results can the administrator expect? (Choose two.)
- A. FortiManager will not allow the administrator to delete a referenced address object until theylockthe ADOM.
- B. FortiManager will disable the status of the address object until the changes are installed.
- C. FortiManager will replace the deleted address object with the none address object in the referenced firewall policy.
- D. FortiManager will temporarily change the status of the referenced firewall policy to disabled.
正解：A、C
質問 # 30
Refer to the exhibit.
An administrator is about to add the FortiGate device to FortiManager using the discovery process.
FortiManager is operating behind a NAT device, and the administrator configured the FortiManager NATed IP address under the FortiManager system administration settings.
What is the expected result?
- A. During discovery, FortiManager sets the FortiManager NATed IP address on FortiGate.
- B. During discovery, FortiManager sets both the FortiManager NATed IP address and NAT device IP address on FortiGate.
- C. During discovery. FortiManager uses only the FortiGate serial number to establish the connection.
- D. During discovery. FortiManager sets the NATed device IP address on FortiGate.
正解：A
解説：
When adding a FortiGate device to FortiManager that is operating behind a NAT device, and the FortiManager NATed IP address is configured under the system administration settings, FortiManager will set the FortiManager NATed IP address on the FortiGate device during the discovery process. This ensures that the FortiGate knows how to reach the FortiManager through the NAT device.
Options A, B, and C are incorrect because:
* Ais incorrect because the discovery process also requires knowing the NATed IP to establish a connection, not just the serial number.
* Bis incorrect because FortiManager does not set the NAT device's IP address on the FortiGate.
* Cis incorrect because it implies that the NAT device IP is set on FortiGate, which is not the expected outcome.
FortiManager References:
* Refer to FortiManager 7.4 Administrator Guide: Device Discovery and Management with NAT.
質問 # 31
Refer to the exhibit.
What can you conclude from the failed installation log shown in the exhibit?
- A. Policy ID 2 is installed without the remote user student.
- B. Policy ID 2 will not be installed.
- C. Policy ID 2 is installed without a source address.
- D. Policy ID 2 is installed in the disabled state.
正解：A
解説：
From the log provided in the exhibit, several conclusions can be drawn regarding the installation of Policy ID
2:
* The installation process fails when attempting to set theLDAP user "student". The log shows:
* "Attribute 'ldap-server' MUST be set.": This error indicates that when setting up the LDAP user configuration, a mandatory field (ldap-server) is missing. As a result, the configuration could not be completed for the user.
* "entry not found in datasource"and"value parse error before 'student'": These errors confirm that the user "student" could not be properly added due to a configuration issue (such as the missing LDAP server).
Because of these errors, while other configuration elements (such as source and destination interfaces, actions, and services) are properly set, the user configuration for"student"isnot applied.
Evaluation of the answer options:
* A. Policy ID 2 is installed in the disabled state.
* This isfalse. There is no indication in the log that Policy ID 2 is disabled.
* B. Policy ID 2 is installed without the remote user student.
* This istrue. Due to the failure in setting the"student"user (as indicated by the errors), the policy will be installedwithoutthat user being properly configured.
* C. Policy ID 2 will not be installed.
* This isfalse. The policy is installed, but the user configuration failed. The rest of the policy configuration appears to have proceeded without critical errors that would prevent the installation.
* D. Policy ID 2 is installed without a source address.
* This isfalse. The log shows that the source address is properly set to "all" (set srcaddr all), so this is not the cause of the issue.
From the log exhibit, we see errors related to the "ldap-server" attribute not being set and an error with the entry "student" not being found in the datasource. This indicates that Policy ID 2 will not be installed due to missing or incorrect data required for successful installation. The "Command fail. Return code -3" confirms the installation failure, so the correct answer is C.
Options A, B, and D are incorrect because:
* A suggests the policy is installed in a disabled state, which isn't supported by the log.
* B and D suggest partial installation, but the error messages indicate a complete failure to install Policy ID 2.
FortiManager References:
* Refer to FortiManager 7.4 Troubleshooting Guide: Common Errors and Log Interpretation.
質問 # 32
What must you consider before deciding to use FortiManager to manage a FortiAnalyzer device?
- A. Determine whether the VDOMs of the same FortiGate will be assigned to different ADOMs.
- B. Check whether FortiManager is part of a high availability (HA) cluster.
- C. Ensure that FortiAnalyzer features are installed in advance.
- D. Confirm that FortiManager has enough storage capacity for the expected logs.
正解：C
質問 # 33
Refer to the exhibit.
You are using the Quick Install option to install configuration changes on the managed FortiGate.
Which two statements correctly describe the result? (Choose two.)
- A. It installs provisioning template changes on the FortiGate device.
- B. It installs all the changes in the device database first and the administrator must reinstall the changes on the FortiGate device.
- C. It provides the option to preview only the policy package changes before installing them.
- D. It installs device-level changes on the FortiGate device without launching the Install Wizard
正解：C、D
解説：
* Option B: It provides the option to preview only the policy package changes before installing them.This is correct. The Quick Install option in FortiManager provides a preview of policy changes before they are applied, allowing administrators to review and confirm the changes.
* Option D: It installs device-level changes on the FortiGate device without launching the Install Wizard.This is correct. Quick Install allows for the immediate installation of device-level changes, such as interface or routing configurations, directly onto the FortiGate without going through the full Install Wizard.
Explanation of Incorrect Options:
* Option A: It installs provisioning template changes on the FortiGate deviceis incorrect because Quick Install does not specifically deal with provisioning templates.
* Option C: It installs all the changes in the device database first and the administrator must reinstall the changes on the FortiGate deviceis incorrect because Quick Install directly applies changes to the FortiGate device, not requiring a separate reinstall step.
FortiManager References:
* Refer to "FortiManager Administration Guide" for details on "Quick Install" functionality under
"Device Management."
質問 # 34
Which statement about the policy lock feature on FortiManager is true?
- A. When a policy is locked, the ADOM that contains it is also locked.
- B. Administrators in the approval group can work concurrently on a locked policy.
- C. Locking a policy takes precedence over a locked ADOM.
- D. Policy locking is available in workspace normal mode.
正解：D
解説：
The statement that is true about the policy lock feature on FortiManager is:
* A. Policy locking is available in workspace normal mode.
In FortiManager, when working in "workspace-mode normal," policies can be locked by administrators to prevent other administrators from editing them simultaneously. This ensures that only one administrator makes changes at any given time, reducing conflicts or mistakes due to concurrent modifications.
Statements B, C, and D are incorrect because:
* B is incorrect since locking a policy does not override a locked ADOM. The ADOM lock takes precedence.
* C is incorrect because when a policy is locked, it does not necessarily mean the ADOM is locked.
* D is incorrect because administrators in the approval group cannot work concurrently on a locked policy; the policy lock prevents concurrent modifications.
FortiManager References:
* Refer to FortiManager 7.4 Administrator Guide: Policy and Objects > Policy Locking to understand how the policy lock feature functions in different workspace modes.
質問 # 35
Which configuration setting for FortiGate is part o an ADOM-level database on FortiManager?
- A. SNMP
- B. NSX-T Service Template
- C. Security profiles
- D. Routing
正解：D
解説：
* Option B: Routingis the correct answer. The ADOM-level database in FortiManager stores configuration settings such as routing, firewall policies, and objects that are shared across multiple devices in the ADOM.
Explanation of Incorrect Options:
* Option A: NSX-T Service Templateis incorrect as it is not a FortiGate-specific setting managed at the ADOM level.
* Option C: SNMPis incorrect because SNMP settings are typically managed on a per-device basis.
* Option D: Security profilesis incorrect because security profiles are generally device-level configurations, not ADOM-level.
FortiManager References:
* Refer to "FortiManager Administration Guide" for further details on ADOM-level and device-level configurations.
質問 # 36
Refer to the exhibit.
You are using the Quick Install option to install configuration changes on the managed FortiGate.
Which two statements correctly describe the result? (Choose two.)
- A. It provides the option to preview only the policy package changes before installing them.
- B. It installs all the changes in the device database first and the administrator must reinstall the changes on the FortiGate device.
- C. It installs provisioning template changes on the FortiGate device.
- D. It installs device-level changes on the FortiGate device without launching the Install Wizard
正解：C、D
質問 # 37
Refer to the exhibit which shows the Download Import Report.
Why is FortiManager failing to import firewall policy ID 1?
- A. Policy ID 1 has an address object that already exists in the ADOM database with any as the interface association, and conflicts with the address object interface association locally on FortiGate.
- B. Policy ID 1 for this managed FortiGate already exists on FortiManager in the policy package named Remote-FortlGate.
- C. Policy ID 1 is configured from the interface any to port6. FortiManager rejects the request to import this policy because the any interface does not exist on FortiManager
- D. Policy ID 1 does not have the ADOM Interface mapping configured on FortiManager.
正解：C
解説：
* Option A: Policy ID 1 is configured from the interface any to port6. FortiManager rejects the request to import this policy because the any interface does not exist on FortiManager.This is the correct answer. FortiManager fails to import firewall policy ID 1 because it cannot map the "any" interface to a valid interface in its ADOM database. The error indicates that there is a binding failure due to an interface mismatch.
Explanation of Incorrect Options:
* Option B: Policy ID 1 for this managed FortiGate already exists on FortiManager in the policy package named Remote-FortiGateis incorrect because the error is related to interface mapping, not a duplicate policy ID.
* Option C: Policy ID 1 has an address object that already exists in the ADOM database with any as the interface association and conflicts with the address object interface association locally on FortiGateis incorrect because the error specifies an interface issue, not an address object conflict.
* Option D: Policy ID 1 does not have the ADOM Interface mapping configured on FortiManageris incorrect because the error directly mentions a binding failure due to the "any" interface.
FortiManager References:
* For more information, refer to the "Device Manager" section and "Configuration Import and Mapping" in the FortiManager Administration Guide.
質問 # 38
Push updates are failing on a FortiGate device that is located behind a NAT device. Which two settings should the administrator check? (Choose two.)
- A. That the external IP address on the NAT device is set to DHCP and configured with the virtual IP
- B. That the virtual IP address and correct ports are set on the NAT device
- C. That the override server IP address is set on FortiManager and the NAT device
- D. That the NAT device IP address and correct ports are configured on FortiManager
正解：B、C
解説：
When push updates are failing on a FortiGate device behind a NAT device, the administrator should check:
* A.That the override server IP address is set on FortiManager and the NAT device.
* The override server IP should be configured to ensure that FortiManager uses the correct IP address that can traverse the NAT to reach the FortiGate device.
* D.That the virtual IP address and correct ports are set on the NAT device.
* The NAT device must have the correct virtual IP (VIP) configured to map the FortiGate's internal IP to an external address, along with the correct ports needed for communication.
Options B and C are incorrect because:
* Bsuggests setting the external IP on the NAT device to DHCP, which is not relevant to solving the push update issue.
* Cimplies configuring NAT device IP and ports on FortiManager, which is less likely needed compared to configuring the correct VIP and ports.
FortiManager References:
* Refer to FortiManager 7.4 Administrator Guide: Device Management and NAT Configuration.
質問 # 39
Refer to the exhibit.
An administrator has created a firewall address object that is used in multiple policy packages for multiple FortiGate devices in an ADOM.
After the installation operation is performed, which IP/netmask is shown on FortiManager for this firewall address object for devices without a Per-Device Mapping set?
- A. FortiManager generates an error for each FortiGate without a per-device mapping defined for that object.
- B. FortiManager replaces the address object to none.
- C. 192.168.1.0/24
- D. 192.168.1.0/28
正解：D
質問 # 40
Exhibit.
What is true about the objects highlighted in the image?
- A. They can be set to optional or required.
- B. They are available across all ADOMs by default.
- C. They can be used as variables in scripts.
- D. They cannot be created in the global database ADOM.
正解：C
解説：
The objects highlighted in the image (DMZ_SUBNET, ISP1_SUBNET, LAN_SUBNET) aremetadata variables.
* C.They can be used as variables in scripts.
* These metadata variables are placeholders that can be used in FortiManager scripts to dynamically insert specific values, enabling script flexibility and scalability across multiple devices or ADOMs.
Options A, B, and D are incorrect because:
* Asuggests optional or required settings, which do not apply to metadata variables.
* Bimplies they are available across all ADOMs by default, which is not always the case.
* Dstates they cannot be created in the global database ADOM, but metadata variables are typically managed within ADOMs and can be utilized globally based on specific configurations.
FortiManager References:
* Refer to FortiManager 7.4 Administrator Guide: Using Metadata Variables and Script Management.
質問 # 41
Refer to the exhibit.
What can you conclude from the failed installation log shown in the exhibit?
- A. Policy ID 2 is installed without the remote user student.
- B. Policy ID 2 will not be installed.
- C. Policy ID 2 is installed without a source address.
- D. Policy ID 2 is installed in the disabled state.
正解：A
質問 # 42
Exhibit.
Given the configuration shown in the exhibit, what are two results from this configuration? {Choose two.)
- A. Two or more administrators can make configuration changes at the same time, in the same ADOM.
- B. You can validate administrator login attempts through external servers.
- C. The same administrator can lock more than one ADOM at the same time.
- D. Concurrent read-write access to an ADOM is disabled.
正解：C、D
質問 # 43
......
厳密検証されたFCP_FMG_AD-7.4試験問題集と解答で無料提供のFCP_FMG_AD-7.4問題と正解付き：https://jp.fast2test.com/FCP_FMG_AD-7.4-premium-file.html