Online Access Free FCSS_EFW_AD-7.4 Practice Test

A company that acquired multiple branches across different countries needs to install new FortiGate devices on each of those branches. However, the IT staff lacks sufficient knowledge to implement the initial configuration on the FortiGate devices.
Which three approaches can the company take to successfully deploy advanced initial configurations on remote branches? (Choose three.)

• A.Use metadata variables to dynamically assign values according to each FortiGate device.
• B.Use provisioning templates and install configuration settings at the device layer.
• C.Apply Jinja in the FortiManager scripts for large-scale and advanced deployments.
• D.Use the Global ADOM to deploy global object configurations to each FortiGate device.
• E.Add FortiGate devices on FortiManager as model devices, and use ZTP or LTP to connect to FortiGate devices.

Refer to the exhibit, which shows an SSL certification inspection configuration.
SSL certification inspection configuration

While testing, the administrator updated the ssl-ssh-profile configuration with the command set sni-server-cert-check strict.
The administrator found that the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate.
With respect to the set sni-server-cert-check strict command, which action does FortiGate take?

• A.FortiGate uses the first entry listed in the SAN field in the server certificate.
• B.FortiGate uses the CN information from the Subject field in the server certificate.
• C.FortiGate closes the connection because this represents an invalid SSL/TLS header.
• D.FortiGate uses the SNI from the user's web browser.

An administrator configured the FortiGate devices in an enterprise network to join the Fortinet Security Fabric. The administrator has a list of IP addresses that must be blocked by the data center firewall. This list is updated daily.
How can the administrator automate a firewall policy with the daily updated list?

• A.With a Security Fabric automation
• B.With FortiNAC
• C.With an external connector from Threat Feeds
• D.With FortiAnalyzer

Refer to the exhibit, which shows an enterprise network connected to an internet service provider.

The administrator must configure the BGP section of FortiGate A to give internet access to the enterprise network.
Which command must the administrator use to establish a connection with the internet service provider?

• A.config neighbor
• B.config redistribute ospf
• C.config router route-map
• D.config redistribute bgp

Refer to the exhibit, which shows a physical topology and a traffic log.

The administrator is checking on FortiAnalyzer traffic from the device with IP address 10.1.10.1, located behind the FortiGate ISFW device.
The firewall policy in on the ISFW device does not have UTM enabled and the administrator is surprised to see a log with the action Malware, as shown in the exhibit.
What are the two reasons FortiAnalyzer would display this log? (Choose two.)

• A.Security rating is enabled in ISFW.
• B.ISFW is in a Security Fabric environment.
• C.ISFW is not connected to FortiAnalyzer and must go through NGFW-1.
• D.The firewall policy in NGFW-1 has UTM enabled.