[2025年03月]更新のFortinet FCSS_EFW_AD-7.4試験練習テスト問題
更新された認定試験FCSS_EFW_AD-7.4問題集で練習テスト問題
質問 # 94
An administrator is deploying APs that are connecting over an IPsec network. All APs have been configured to connect to FortiGate manually. FortiGate can discover the APs and authorize them.
However, FortiGate is unable to establish CAPWAP tunnels to manage the APs.
Which configuration setting can the administrator perform to resolve the problem?
- A. Enable CAPWAP administrative access on the IPsec interface
- B. Decrease the CAPWAP tunnel MTU size for APs to prevent fragmentation
- C. Assign a custom AP profile for the remote APs with the set mpls-connection option enabled
- D. Upgrade the FortiAP firmware image to ensure compatibility with the FortiOS version
正解：D
質問 # 95
An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer. If the administrator knows that there is no NAT device located between both FortiGates, What command should the administrator execute?
- A. diagnose sniffer packet any 'esp'
- B. diagnose sniffer packet any 'udp port 500'
- C. diagnose sniffer packet any 'udp port 4500'
- D. diagnose sniffer packet any 'udp port 500 or udp port 4500'
正解：A
質問 # 96
An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage.
However, after the changes, one network application started to have problems.
During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets, and before the arrival of the SYN/ACKs.
When the SYN/ACK packets arrive to the FortiGate, the unit has already deleted the respective sessions.
Which TCP session timer must be increased to fix this problem?
- A. TCP half close.
- B. TCP half open.
- C. TCP time wait.
- D. TCP session time to live.
正解：B
質問 # 97
Which of the following troubleshooting steps is applicable when investigating antivirus and IPS update issues on FortiGate?
- A. Use the alternate service port 8888.
- B. Verify outbound ICMP connectivity.
- C. Use the diagnose debug rating command to check active servers.
- D. Validate DNS resolution for update.fortiguard.net.
正解：D
質問 # 98
An administrator must ensure that users cannot access sites containing malware and spyware, while also protecting them from phishing attempts.
What is the most resource-efficient method to block access to these sites?
- A. Create a custom IPS policy to monitor and block all outbound traffic related to malware, spyware, and phishing sites.
- B. Set up a DNS filter and block domains related to these categories to stop users from reaching malicious content.
- C. Configure FortiGuard Web Filtering and block the categories malware, spyware, and phishing to prevent access to such sites.
- D. Enable antivirus profiles to scan all web traffic and block downloads from these malicious sites.
正解：C
質問 # 99
View the central management configuration shown in the exhibit, and then answer the question below.
Which server will FortiGate choose for antivirus and IPS updates if 10.0.1.243 is experiencing an outage?
- A. One of the public FortiGuard distribution servers
- B. 0.0.1.244
- C. 10.0.1.242
- D. 10.0.1.240
正解：A
質問 # 100
View the IPS exit log, and then answer the question below.
What is the status of IPS on this FortiGate?
- A. There are communication problems between the IPS engine and the management database.
- B. All IPS-related features have been disabled in FortiGate's configuration.
- C. IPS engine memory consumption has exceeded the model-specific predefined value.
- D. IPS daemon experienced a crash.
正解：B
質問 # 101
Refer to the exhibit, which shows the output of a web filtering diagnose command.
Which configuration change would result in non-zero results in the cache statistics section?
- A. set webfilter-cache enable under config system fortiguard
- B. set server-type rating under config system central-management
- C. set webfilter-force-off disable under config system fortiguard
- D. set ngfw-mode policy-based under config system settings
正解：A
質問 # 102
Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)
- A. Importing interface mappings from managed devices.
- B. Previewing pending configuration changes for managed devices.
- C. Installing configuration changes to managed devices.
- D. Adding devices to FortiManager.
正解：B、C
質問 # 103
An administrator has configured a FortiGate device with two VDOMs: root and internal.
The administrator has also created and inter-VDOM link that connects both VDOMs. The objective is to have each VDOM advertise some routes to the other VDOM via OSPF through the inter-VDOM link.
What OSPF configuration settings must match in both VDOMs to have the OSPF adjacency successfully forming? (Choose three.)
- A. Interface subnet mask.
- B. OSPF interface MTU.
- C. OSPF interface area.
- D. OSPF interface cost.
- E. Router ID.
正解：A、B、C
質問 # 104
Which of the following statements is true regarding a FortiGate configured as an explicit web proxy?
- A. FortiGate limits the number of simultaneous sessions per explicit web proxy user. The limit CAN be modified by the administrator.
- B. FortiGate limits the number of simultaneous sessions per explicit web proxy user. This limit CANNOT be modified by the administrator.
- C. FortiGate limits the number of workstations that authenticate using the same web proxy user credentials. This limit CANNOT be modified by the administrator.
- D. FortiGate limits the total number of simultaneous explicit web proxy users.
正解：D
質問 # 105
What is an OSPF area border router?
- A. A router with all its interfaces in the backbone area.
- B. A router that is redistributing non-OSPF routes into the OSPF network.
- C. A router with interfaces in multiple OSPF areas.
- D. A router that is redistributing connected subnets into the OSPF network.
正解：C
質問 # 106
View the following exhibit:
Which two statements about the BGP peer are true? (Choose two.)
- A. The local BGP peer has received a total of three BGP prefixes.
- B. The local BGP peer has not established a TCP session to the BGP peer 10.200.3.1.
- C. Since the BGP counters were last reset, the BGP peer 10.200.3.1 has never been down.
- D. For the peer 10.125.0.60, the BGP state is Established.
正解：B、D
質問 # 107
Refer to the exhibit, which contains partial output from an IKE real-time debug.
Which two statements about this debug output are correct? (Choose two.)
- A. Perfect Forward Secrecy (PFS) is enabled in the configuration.
- B. It shows a phase 2 negotiation.
- C. The local gateway IP address is 10.0.0.1.
- D. The initiator provided remote as its IPsec peer ID.
正解：C、D
質問 # 108
Exhibits:
Refer to the exhibits, which contain the network topology and BGP configuration for a hub.
An administrator is trying to configure ADVPN with a hub-spoke VPN setup using iBGP. All the VPNs are up and connected to the hub. The hub is receiving route information from both spokes over iBGP; however, the spokes are not receiving route information from each other.
What change must the administrator make to the hub BGP configuration so that the routes learned by one spoke are forwarded to the other spokes?
- A. Make the configuration of remote-as different from the configuration of local-as.
- B. Configure an individual neighbor and remove neighbor-range configuration.
- C. Configure the hub as a route reflector client.
- D. Change the router id to 10.1.0.254.
正解：C
質問 # 109
You have configured FortiManager as a local FDS to provide FortiGate AV and IPS updates, but FortiGate devices are not receiving updates to their AV signature databases, IPS engines, or IPS signature databases.
Which two settings need to be verified for these features to function? (Choose two.)
- A. Service access needs to be enabled on FortiManager under System Settings > Network.
- B. FortiGate needs to have the server list entry for FortiManager set to server-type update under config system central-management.
- C. FortiGate needs to have include-default-servers disabled under config system central-management.
- D. FortiManager needs to be the license validation server for FortiGate devices trying to retrieve updated AV and IPS packages.
正解：A、B
質問 # 110
Refer to the exhibit, which contains the partial output of an IKE real-time debug.
Why did the tunnel not come up?
- A. The pre-shared keys do not match
- B. The remote gateway phase 2 configuration does not match the local gateway phase 2 configuration.
- C. The remote gateway phase 1 configuration does not match the local gateway phase 1 configuration.
- D. The remote gateway is using aggressive mode and the local gateway is configured to use main mode.
正解：C
質問 # 111
Which two statements correctly describe the characteristics of the Fortinet Security Fabric? (Choose two.)
- A. It contains individual management platforms for each device to provide granular control.
- B. The core of the Security Fabric includes FortiMail, FortiWeb, and FortiSandbox.
- C. It provides a single pane of glass for reporting for all devices in the Security Fabric.
- D. It supports an open API, allowing third-party product integration.
正解：C、D
質問 # 112
View the exhibit, which contains the output of a debug command, and then answer the question below:
What statement is correct about this FortiGate?
- A. It is currently in kernel conserve mode because of high memory usage
- B. It is currently in system conserve mode because of high CPU usage.
- C. It is currently in FD conserve mode,
- D. It is currently in system conserve mode because of high memory usage
正解：D
質問 # 113
Refer to the exhibit, which contains a CLI script configuration on FortiManager.
An administrator configured the CLI script on FortiManager, but the script failed to apply any changes to the managed device after being executed.
What are two reasons why the script did not make any changes to the managed device? (Choose two.)
- A. CLI scripts must start with #!.
- B. Static routes can be added using only TCL scripts.
- C. Incomplete commands can cause CLI scripts to fail.
- D. The commands that start with the # sign did not run.
正解：C、D
質問 # 114
Which two conditions would prevent a static route from being added to the routing table? (Choose two.)
- A. The route has a lower priority value than another route to the same destination.
- B. The next-hop IP address is unreachable.
- C. The interface specified in the route configuration is down
- D. There is another other route to the same destination, with a lower distance.
正解：C、D
質問 # 115
......
更新された検証済みのFCSS_EFW_AD-7.4問題集と解答で合格保証もしくは全額返金：https://jp.fast2test.com/FCSS_EFW_AD-7.4-premium-file.html