Fortinet FCSS_EFW_AD-7.4 Practice Exams
Last updated on Oct 21,2026- Exam Code: FCSS_EFW_AD-7.4
- Exam Name: FCSS - Enterprise Firewall 7.4 Administrator
- Certification Provider: Fortinet
- Latest update: Oct 21,2026
Refer to the exhibit, which contains a session table entry.
Which statement about FortiGate inspection of this session is true?
- A . FortiGate applied proxy-based inspection.
- B . FortiGate applied flow-based NGFW policy-based inspection.
- C . FortiGate applied flow-based inspection.
- D . FortiGate forwarded this session without any inspection.
Examine the following partial outputs from two routing debug commands; then answer the question below.
# get router info kernel
tab=254 vf=0 scope=0type=1 proto=11 prio=0 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=10.200.1.254 dev=2(port1)
tab=254 vf=0 scope=0type=1 proto=11 prio=10 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=10.200.2.254 dev=3(port2)
tab=254 vf=0 scope=253type=1 proto=2 prio=0 0.0.0.0/0.0.0.0/.->10.0.1.0/24 pref=10.0.1.254 gwy=0.0.0.0 dev=4(port3)
# get router info routing-table all s*0.0.0.0/0 [10/0] via 10.200.1.254, portl [10/0] via 10.200.2.254, port2, [10/0] dO.0.1.0/24 is directly connected, port3 dO.200.1.0/24 is directly connected, portl d0.200.2.0/24 is directly connected, port2
Which outbound interface or interfaces will be used by this FortiGate to route web traffic from internal users to the Internet?
- A . Both portl and port2.
- B . port2.
- C . port!
- D . port3.
View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.
The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel.
To diagnose, the administrator enters these CLI commands:
However, the IKE real time debug does not show any output.
Why?
- A . The debug shows only error messages. If there is no output, then the tunnel is operating normally.
- B . The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.
- C . The log-filter setting was set incorrectly. The VPN’s traffic does not match this filter.
- D . The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.
Which statement is true regarding File description (FD) conserve mode?
- A . IPS inspection is affected when FortiGate enters FD conserve mode.
- B . A FortiGate enters FD conserve mode when the amount of available description is less than 5%.
- C . FD conserve mode affects all daemons running on the device.
- D . Restarting the WAD process is required to leave FD conserve mode.
Refer to the exhibits, which contain configuration on FortiGate and partial session information.
All traffic to the Internet currently egresses from port1. The exhibit shows partial session information for Internet traffic from a user on the internal network.
If the priority on route ID 1 were changed from 5 to 20, what would happen to traffic matching that user’s session?
- A . The session would remain in the session table, but its traffic would now egress from both port1 and port2.
- B . The session would remain in the session table, and its traffic would still egress from port1.
- C . The session would remain in the session table, and its traffic would start to egress from port2.
The session would be deleted, so the client would need to start a new session.
Refer to the exhibit, which shows partial outputs from two routing debug commands.
Which change must an administrator make on FortiGate to route web traffic from internal users to the internet, using ECMP?
- A . Set the priority of the static default route using port1 to 10.
- B . Set the priority of the static default route using port2 to 1.
- C . Set preserve-session-route to enable.
- D . Set snat-route-change to enable.
Refer to the exhibit, which contains partial output from an IKE real-time debug.
Based on the debug output, which phase 1 setting is enabled in the configuration of this VPN?
- A . auto-discovery-receiver
- B . auto-discovery-forwarder
- C . auto-discovery-shortcut
- D . auto-discovery-sender
Which of the following statements are correct regarding application layer test commands? (Choose two.)
- A . They are used to filter real-time debugs.
- B . They display real-time application debugs.
- C . Some of them display statistics and configuration information about a feature or process.
- D . Some of them can be used to restart an application.
Which of the following statements are true regarding the SIP session helper and the SIP application layer gateway (ALG)? (Choose three)
- A . SIP session helper runs in the kernel; SIP ALG runs as a user space process.
- B . SIP ALG supports SIP HA failover; SIR helper does not
- C . SIP ALG supports SIP over IPv6; SIR helper does not.
- D . SIP ALG can create expected sessions for media traffic; SIP helper does not.
- E . SIP helper supports SIP over TCP and UDP; SIP ALG supports only SIP over UDP.
View the exhibit, which contains a session entry, and then answer the question below.
Which statement is correct regarding this session?
- A . This traffic is using the VIP and central NAT tables.
- B . This session was successfully authenticated.
- C . Further packets for this session will be blocked.
- D . This session is offloaded to the NPU.