[2025年12月]更新のFortinet FCSS_EFW_AD-7.4試験一発合格保証！
完全版FCSS_EFW_AD-7.4練習テスト78独特な解答と解釈が待ってます！今すぐ取得せよ！
質問 # 27
Refer to the exhibit, which shows a revision history window in the FortiManager device layer.
The IT team is trying to identify the administrator responsible for the most recent update in the FortiGate device database.
Which conclusion can you draw about this scenario?
- A. To identify the user who created the event, check it on the Configuration and Installation widget on FortiGate within the FortiManager device layer.
- B. Find the user in the FortiManager system logs and use the type=script command to find the administrator user in the user field.
- C. This retrieved process was automatically triggered by a Remote FortiGate Directly (via CLI) script.
- D. The user script_manager is an API user from the Fortinet Developer Network (FDN) retrieving a configuration.
正解：B
解説：
TheConfiguration Revision Historywindow inFortiManagershows that the most recent configuration change (ID 10) was created byscript_managerwith the actionRetrieved.
Sincescript_manageris a system-level script execution user, the IT team needs to findwho actually triggered this script. This can be done by:
# Checking theFortiManager system logsforscript execution events.
# Using thetype=scriptfilter to locate the administrator associated with the script execution.
質問 # 28
Refer to the exhibit, which shows a FortiGate configuration.
An administrator is troubleshooting a web filter issue on FortiGate. The administrator has configured a web filter profile and applied it to a policy; however, the web filter is not inspecting any traffic that is passing through the policy.
What must the administrator change to fix the issue?
- A. The administrator must change protocol to TCP.
- B. The administrator must disable webfilter-force-off.
- C. The administrator must increase webfilter-timeout.
- D. The administrator must enable fortiguard-anycast.
正解：B
質問 # 29
A static route is configured for a FortiGate unit from the CLI using the following commands.
config router static
edit 1
set device "wan1"
set distance 20
set gateway 192.168.100.1
next
end
Which of the following conditions are required for this static default route to be displayed in the FortiGate unit's routing table? (Choose two.)
- A. The administrative status of the wan1 interface is displayed as down.
- B. All other default routes should have a lower distance.
- C. The wan1 interface address and gateway address are on the same subnet.
- D. The link status of the wan1 interface is displayed as up.
正解：C、D
質問 # 30
A FortiGate device has the following LDAP configuration:
The administrator executed the 'dsquery' command in the Windows LDAp server 10.0.1.10, and got the following output:
>dsquery user -samid administrator
"CN-Administrator, CN-Users, DC=trainingAD, DC-training, DC-lab"
Based on the output, what FortiGate LDAP setting is configured incorrectly?
- A. password.
- B. dn.
- C. username.
- D. cnid.
正解：C
質問 # 31
View the exhibit, which contains an entry in the session table, and then answer the question below.
Which one of the following statements is true regarding FortiGate's inspection of this session?
- A. FortiGate applied explicit proxy-based inspection.
- B. FortiGate applied proxy-based inspection.
- C. FortiGate forwarded this session without any inspection.
- D. FortiGate applied flow-based inspection.
正解：B
質問 # 32
Examine the IPsec configuration shown in the exhibit; then answer the question below.
An administrator wants to monitor the VPN by enable the IKE real time debug using these commands:
diagnose vpn ike log-filter src-addr4 10.0.10.1
diagnose debug application ike -1
diagnose debug enable
The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are being interchanged between both Ipsec gateways. However, the IKE rea time debug does NOT show any output.
Why isn't there any output?
- A. The IKE real time debug shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.
- B. The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.
- C. The log-filter setting is set incorrectly. The VPN's traffic does not match this filter.
- D. The IKF real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.
正解：C
質問 # 33
In which of the following states is a given session categorized as ephemeral? (Choose two.)
- A. A TCP session waiting for FIN ACK.
- B. A TCP session waiting to complete the three-way handshake.
- C. A UDP session with only one packet received.
- D. A UDP session with packets sent and received.
正解：B、C
質問 # 34
Refer to the exhibit, which contains partial output from an IKE real-time debug.
Based on the debug output, which phase 1 setting is enabled in the configuration of this VPN?
- A. auto-discovery-shortcut
- B. auto-discovery-receiver
- C. auto-discovery-forwarder
- D. auto-discovery-sender
正解：D
質問 # 35
Examine the output of the 'diagnose debug rating' command shown in the exhibit; then answer the question below.
Which statement are true regarding the output in the exhibit? (Choose two.)
- A. There are three FortiGuard servers that are not responding to the queries sent by the FortiGate.
- B. The TZ value represents the delta between each FortiGuard server's time zone and the FortiGate's time zone.
- C. A server's round trip delay (RTT) is not used to calculate its weight.
- D. FortiGate will send the FortiGuard queries to the server with highest weight.
正解：B、D
質問 # 36
How would fec-ingress and fec-sgress IPsec configuration affect an IPsec tunnel?
- A. FortiGate will consider all IKEV2 packets as fragmentable.
- B. When an FGSP member in FortiGate fails, FortiGate flushes the corresponding tunnels and sends out dead peer detection probes to find unavailable remote peers.
- C. If fragmentation occurs, FortiGate will allow the packets at the IKE layer.
- D. FortiGate will add additional redundant information to reconstruct any lost or erratically received packets.
正解：D
質問 # 37
Refer to the exhibit, which shows the packet capture output of a three-way handshake between FortiGate and FortiManager Cloud.
What two conclusions can you draw from the exhibit? (Choose two.)
- A. The wildcard for the domain *.fortinet-ca2.support.fortinet.com must be supported by FortiManager Cloud.
- B. FortiGate will receive a certificate that supports multiple domains because FortiManager operates in a cloud computing environment.
- C. FortiGate is connecting to the same IP server and will receive an independent certificate for its connection between FortiGate and FortiManager Cloud.
- D. If the TLS handshake contains 17 cipher suites it means the TLS version must be 1.0 on this three-way handshake.
正解：A
解説：
The packet capture output displays aTLS Client Hellomessage from FortiGate to FortiManager Cloud. This message containsServer Name Indication (SNI), which is used to indicate the domain name that FortiGate is trying to connect to.
FortiGate will receive a certificate that supports multiple domains because FortiManager operates in a cloud computing environment.
# FortiManager Cloud hostsmultiple customersand domains under ashared infrastructure.
# The TLS handshake includesSNI (Server Name Indication), which allows FortiManager Cloud toserve multiple certificatesbased on the requested domain.
# This means FortiGate will likely receive amulti-domain or wildcard certificatethat can be used for multiple customers under FortiManager Cloud.
The wildcard for the domain .fortinet-ca2.support.fortinet.com must be supported by FortiManager Cloud.
# The SNI extension contains the domain9398.support.fortinet-ca2.fortinet.com.
# FortiManager Cloud must supportwildcard certificatessuch as *.fortinet-ca2.support.fortinet.com to securely manage multiple subdomains and customers.
# This ensures that FortiGate can validate the server certificate without any TLS errors.
質問 # 38
Which statement about administrative domains (ADOMs) on FortiManager is true?
- A. The number of configurable ADOMs is based on the FortiManager FortiCare service contract.
- B. The ADOM feature can be enabled by any administrative user.
- C. FortiGate devices with multiple VDOMs must be assigned to the same ADOM on FortiManager.
- D. ADOMs allow grouping of managed devices based on management criteria and administrative access.
正解：D
質問 # 39
Refer to the exhibit, which shows a hub and spokes deployment.
An administrator is deploying several spokes, including the BGP configuration for the spokes to connect to the hub.
Which two commands allow the administrator to minimize the configuration? (Choose two.)
- A. route-reflector-client
- B. neighbor-group
- C. neighbor-range
- D. ibgp-enforce-multihop
正解：B、C
解説：
neighbor-group:
# This command is used to group multipleBGP neighborswith the same configuration, reducing redundant configuration.
# Instead of defining individual BGP settings for each spoke, the administrator can create aneighbor-group and apply the same policies, reducing manual work.
neighbor-range:
# This command allows the configuration ofa range of neighbor IPs dynamically, reducing the need to manually define each spoke neighbor.
# It automatically addsBGP neighborsthat match a given prefix, simplifying deployment.
質問 # 40
An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device.
What can the administrator do to fix this problem?
- A. Configure remote link monitoring to detect an issue in the forwarding path.
- B. Configure set link-failed-signal enable under config system ha on both cluster members.
- C. Configure set send-garp-on-failover enable under config system ha on both cluster members.
- D. Verify that the speed and duplex settings match between the FortiGate interfaces and the connected switch ports.
正解：B
質問 # 41
Examine the output of the 'get router info bgp summary' command shown in the exhibit; then answer the question below.
Which statements are true regarding the output in the exhibit? (Choose two.)
- A. BGP peer 10.200.3.1 has never been down since the BGP counters were cleared.
- B. Local BGP peer has not received an OpenConfirm from 10.200.3.1.
- C. BGP state of the peer 10.125.0.60 is Established.
- D. The local BGP peer has received a total of 3 BGP prefixes.
正解：B、C
質問 # 42
Refer to the exhibit, which shows an ADVPN network.
The client behind Spoke-1 generates traffic to the device located behind Spoke-2. What is the first message that the hub sends to Spoke-1 to bring up the dynamic tunnel?
- A. Shortcut reply
- B. Shortcut offer
- C. Shortcut query
- D. Shortcut forward
正解：B
解説：
In an ADVPN (Auto-Discovery VPN) network, a dynamic VPN tunnel is established on-demand between spokes to optimize traffic flow and reduce latency.
Process:
1. Traffic Initiation:
A client behind Spoke-1 sends traffic to a device behind Spoke-2.
The traffic initially flows through the hub, following the pre-established overlay tunnel.
2. Hub Detection:
The hub detects that Spoke-1 is communicating with Spoke-2 and determines that a direct shortcut tunnel between the spokes can optimize the connection.
3. Shortcut Offer:
The hub sends a "Shortcut Offer" message to Spoke-1, informing it that a direct dynamic tunnel to Spoke-2 is possible.
4. Tunnel Establishment:
Spoke-1 and Spoke-2 then negotiate and establish a direct IPsec tunnel for communication.
質問 # 43
When using the SSL certificate inspection method to inspect HTTPS traffic, how does FortiGate filler web requests when the client browser does not provide the server name indication (SNI) extension?
- A. FortiGate uses the Issued To: field in the server's certificate
- B. FortiGate switches to the full SSL inspection method to decrypt the data
- C. FortiGate uses the requested URL from the user's web browser
- D. FortiGate blocks the request without any further inspection
正解：A
質問 # 44
View the exhibit, which contains the output of a real-time debug, and then answer the question below.
Which of the following statements is true regarding this output? (Choose two.)
- A. The web request was allowed by FortiGate
- B. The requested URL belongs to category ID 52.
- C. FortiGate found the requested URL in its local cache.
- D. This web request was inspected using the root web filter profile.
正解：B、C
質問 # 45
Refer to the exhibit, which contains a partial command output.
The administrator has configured BGP on FortiGate. The status of this new BGP configuration is shown in the exhibit.
What configuration must the administrator consider next?
- A. Enable ebgp-enforce-multihop.
- B. Configure the local AS to 65300.
- C. Contact the remote peer administrator to enable BGP
- D. Configure a static route to 100.65.4.1.
正解：A
解説：
From the BGP neighbor status output, the key issue is that BGP is stuck in the "Idle" state, meaning the FortiGate is unable to establish a BGP session with its peer 100.65.4.1 (Remote AS
65300).
The output also shows:
"Not directly connected EBGP" This means the BGP peer is not on the same subnet, requiring multihop BGP.
"Update source is Loopback" Since a loopback interface is used, FortiGate must be configured to allow BGP neighbors over multiple hops.
To resolve this issue, the administrator must enable ebgp-enforce-multihop, which allows BGP sessions to be established even when the neighbors are not directly connected.
質問 # 46
Which the following events can trigger the election of a new primary unit in a HA cluster? (Choose two.)
- A. The FortiGuard license for the primary unit is updated.
- B. One of the monitored interfaces in the primary unit is disconnected.
- C. A secondary unit is removed from the HA cluster.
- D. Primary unit stops sending HA heartbeat keep alives.
正解：B、D
質問 # 47
......
あなたの合格を助けるFortinet認証と最新のJPNTest FCSS_EFW_AD-7.4試験問題集解答：https://drive.google.com/open?id=1_KLcBxb47BoCueafSoMLE_XWUN_-kg0u
最新FCSS_EFW_AD-7.4問題集試験解答はここにある：https://www.jpntest.com/shiken/FCSS_EFW_AD-7.4-mondaishu