Fortinet FCSS_EFW_AD-7.4 Practice Exams
Last updated on Oct 21,2026- Exam Code: FCSS_EFW_AD-7.4
- Exam Name: FCSS - Enterprise Firewall 7.4 Administrator
- Certification Provider: Fortinet
- Latest update: Oct 21,2026
You have configured FortiManager as a local FDS to provide FortiGate AV and IPS updates, but FortiGate devices are not receiving updates to their AV signature databases, IPS engines, or IPS signature databases.
Which two settings need to be verified for these features to function? (Choose two.)
- A . FortiGate needs to have the server list entry for FortiManager set to server-type update under config system central-management.
- B . FortiManager needs to be the license validation server for FortiGate devices trying to retrieve updated AV and IPS packages.
- C . Service access needs to be enabled on FortiManager under System Settings > Network.
- D . FortiGate needs to have include-default-servers disabled under config system central-management.
Examine the output from the BGP real time debug shown in the exhibit, then the answer the question below.
Which statements are true regarding the output in the exhibit? (Choose two.)
- A . BGP peers have successfully inter changed Open and Keep alive messages.
- B . Local BGP peer received a prefix for a default route.
- C . The state of the remote BGP peer is Open Confirm.
- D . The state of the remote BGP peer will go to Connect after it confirms the received prefixes.
View the global IPS configuration, and then answer the question below.
Which of the following statements is true regarding this configuration?
- A . IPS will scan every byte in every session.
- B . FortiGate will spawn IPS engine instances based on the system load.
- C . New packets will be passed through without inspection if the IPS socket buffer runs out of memory
- D . IPS will use the faster matching algorithm which is only available for units with more than 4 GB memory.
Refer to the exhibits, which show the configuration on FortiGate and partial internet session information from a user on the internal network.
An administrator would like to test session failover between the two service provider connections.
What changes must the administrator make to force this existing session to immediately start using the other interface? (Choose two.)
- A . Configure set snat-route-change enable.
- B . Change the priority of the port2 static route to 5.
- C . Change the priority of the port1 static route to 11.
- D . unset snat-route-change to return it to the default setting.
Which command is used to enable timestamp in a real-time debug?
- A . diagnose debug console timestamp enable
- B . diagnose timestamp enable
- C . diagnose application timestamp enable
- D . diagnose debug application timestamp enable
Which two statements about the Security Fabric are true? (Choose two.)
- A . Only the root FortiGate collects network information and forwards it to FortiAnalyzer.
- B . Branch FortiGate devices must be configured first.
- C . FortiGate uses FortiTelemetry protocol to communicate with FortiAnalyzer.
- D . All FortiGate devices in the Security Fabric must have bidirectional FortiTelemetry connectivity.
An administrator configured FGSP cluster members to encrypt the session synchronization. When the administrator takes a sniffer trace on the dedicated interface for the synchronization, the sniffer trace shows UDP packets only.
Which two reasons could cause the sniffer to capture only UDP packets? (Choose two.)
- A . The administration has not configured the SESSYNC_1 tunnel.
- B . encryption is not set to enable on both members.
- C . The psksecret value does not match.
- D . The encryption is encapsulated in UDP packets.
Refer to the exhibit, which shows the output of a BGP debug command.
What can be concluded about the router in this scenario?
- A . The router 100.64.3.1 needs to update the local AS number in its BGP configuration in order to bring up the BGP session with the local router.
- B . The State/PfxRcd for neighbor 100.64.3.1 will not change until an administrator on the local router adjusts the inbound route filtering so that prefixes received can be added to the RIB.
- C . All of the neighbors displayed are part of a single BGP configuration on the local router with the neighbor-range set to a value of 4.
- D . The BGP session with peer 10.127.0.75 is up.
Which of the following statements about administrative domains (ADOMs) on FortiManager is true?
- A . The ADOM feature can be enabled by any administrator with super-user privileges.
- B . The number of configurable ADOMs is based on the FortiManager’s FortiCare service contract.
- C . ADOMs allow grouping of managed devices based on management criteria and administrative access.
- D . FortiGates with multiple VDOMs must be assigned to the same ADOM on FortiManager.
An administrator must automate a weekly backup of all the FortiGate devices in an enterprise network.
Which two steps must the administrator follow to implement this? (Choose two.)
- A . Integrate all the FortiGate devices in a Security Fabric environment.
- B . Create a script to be run in the device database.
- C . Create metadata variables for all the FortiGate devices.
- D . Create an automation stitch.