Free Fortinet FCSS_EFW_AD-7.4 Exam Questions

Become Fortinet Certified with updated FCSS_EFW_AD-7.4 exam questions and correct answers

Page: 1 / 32

Total 159 Questions | Updated On: Sep 10, 2025

Add To Cart

Question 1

Which two statements about OCVPN are true? (Choose two.)

A : Only root vdom supports OCVPN.

B : OCVPN supports static and dynamic IPs in WAN interface.

C : OCVPN offers only Hub-Spoke VPNs.

D : FortiGate devices under different FortiCare accounts can be used to form OCVPN.

Answer: A,B

Question 2

When using the SSL certificate inspection method to inspect HTTPS traffic, how does FortiGate filter web requests when the client browser does not provide the server name indication (SNI) extension?

A : FortiGate uses the CN information from the Subject field in the server certificate.

B : FortiGate switches to the full SSL inspection method to decrypt the data.

C : FortiGate uses the requested URL from the user's web browser.

D : FortiGate blocks the request without any further inspection.

Answer: A

Question 3

What is the diagnose test application ipsmonitor 99 command used for?

A : To enable IPS bypass mode

B : To provide information regarding IPS sessions

C : To disable the IPS engine

D : To restart all IPS engines and monitors

Answer: D

Question 4

Which three tasks are part of the manual registration process for adding a FortiGate device to FortiManager for central management? (Choose three.)

A : Wait for the rating databases to download on FortiManager.

B : Import the policy package from the managed FortiGate device.

C : Add the FortiManager IP address to the FortiGate central management configuration.

D : Start the rating services on FortiManager.

E : In FortiManager, add the unregistered FortiGate device.

Answer: B,C,E

Question 5

A company's guest internet policy, operating in proxy mode, blocks access to Artificial Intelligence Technology sites using FortiGuard. However, a guest user accessed a page in this category using port 8443. Which configuration changes are required for FortiGate to analyze HTTPS traffic on nonstandard ports like 8443 when full SSL inspection is active in the guest policy?

A : Add a URL wildcard domain to the website CA certificate and use it in the SSL/SSH Inspection Profile.

B : In the Protocol Port Mapping section of the SSL/SSH Inspection Profile, enter 443, 8443 to analyze both standard (443) and non-standard (8443) HTTPS ports.

C : To analyze nonstandard ports in web filter profiles, use TLSv1.3 in the SSL/SSH Inspection Profile.

D : Administrators can block traffic on nonstandard ports by enabling the SNI check in the SSL/SSH Inspection Profile.

Answer: B

Page: 1 / 32

Total 159 Questions | Updated On: Sep 10, 2025

Add To Cart