Fortinet FCP FortiGate Administrator FW 7.4 Exam Voucher practice questions

Q: Is this Fortinet FCP FortiGate Administrator FW 7.4 Exam Voucher practice test free?

Yes. All 15 Fortinet FCP FortiGate Administrator FW 7.4 Exam Voucher practice questions on this page are free, with instant scoring and a written explanation for each answer. You do not need an account and there is no time limit.

Q: How much does the real Fortinet FCP FortiGate Administrator FW 7.4 Exam Voucher exam cost?

The official price is $200. Cyber VK sells the same official Fortinet FCP FortiGate Administrator FW 7.4 Exam Voucher voucher for $114.99 — a saving of $85.01. The voucher is identical to one bought direct and is emailed within minutes of payment.

Q: Are these questions the same as the real Fortinet FCP FortiGate Administrator FW 7.4 Exam Voucher exam?

No. These are original practice questions written to match the published exam objectives and difficulty. They are not real exam questions — sharing or reproducing live exam content breaches every certification body's candidate agreement and can void your certification.

Q: How should I use this practice test?

Use it as a readiness check rather than a study tool. Work through the questions without notes, read the explanation for every answer including the ones you got right, and treat any domain where you miss more than a third as the area to revise before booking your exam.

Question 1

A FortiGate is running FortiOS 7.4 with several firewall policies configured. What happens to traffic that does not match any of the configured policies?

Accepted Answer

FortiOS evaluates policies top-down and places a non-editable implicit deny policy (ID 0) at the end of every policy list, so any unmatched traffic is dropped. FortiGate never defaults to permitting traffic.

Question 2

An administrator enables central NAT on a FortiGate. What is the immediate effect on existing firewall policies?

Accepted Answer

With central NAT enabled, source NAT is no longer configured per policy; it moves to the Central SNAT policy table, which is evaluated separately from firewall policies. Destination NAT is likewise handled by central DNAT/VIP entries.

Question 3

A VIP is configured to map a public IP on port1 to an internal web server. In the FortiGate packet flow, when is destination NAT applied relative to the routing decision and the firewall policy lookup?

Accepted Answer

FortiGate applies destination NAT early in the ingress path, before the route lookup, so routing and policy matching are performed using the translated destination address. This is why the route to the mapped internal subnet must exist for the VIP to work.

Question 4

Which FortiGate security profile uses FortiGuard categories to control which websites users are allowed to visit?

Accepted Answer

The web filter profile queries the FortiGuard web rating service and applies allow, block, warning, or monitor actions per category. Application control classifies applications, not website categories.

Question 5

In a proxy-based web filter profile, an administrator adds a static URL filter entry to allow a site that also belongs to a FortiGuard category set to Block. What is the result?

Accepted Answer

In proxy-based inspection FortiGate evaluates the static URL filter first, so a matching allow (exempt) entry takes effect before the FortiGuard category lookup occurs. Category blocking only applies to URLs with no matching static entry.

Question 6

A FortiGate performs full SSL (deep) inspection on outbound HTTPS traffic to a site presenting a valid, trusted server certificate. Which certificate does FortiGate use by default to re-sign the server certificate presented to the client?

Accepted Answer

Fortinet_CA_SSL is the default CA certificate used to re-sign server certificates during deep inspection, and it must be installed in the client trust store to avoid browser warnings. Fortinet_CA_Untrusted is used only when the real server certificate fails validation, so the warning is intentionally passed to the user.

Question 7

What is the default administrative distance of a static route on a FortiGate running FortiOS 7.4?

Accepted Answer

FortiOS assigns static routes a default administrative distance of 10, which is lower than OSPF (110) and BGP external (20) so static routes are preferred. Administrative distance is used to choose between routes to the same destination learned from different sources.

Question 8

A FortiGate has a policy route matching traffic from 10.10.10.0/24 to the internet, plus a default static route in the routing table. How does FortiGate handle a packet that matches the policy route?

Accepted Answer

Policy routes are checked before the FIB, so a matching policy route overrides the routing table. If the policy route's next hop or outgoing interface is unavailable, FortiGate skips it and falls back to the routing table.

Question 9

Which statement correctly describes the default reverse path forwarding (RPF) behavior of a FortiGate?

Accepted Answer

FortiGate uses feasible (loose) RPF by default, so the anti-spoofing check passes if any active route to the source address exists through any interface. The check is performed only on the first packet of a session, not on every packet.

Question 10

Which UDP port does IKE use for IPsec VPN negotiation when NAT traversal is not in use?

Accepted Answer

IKE negotiation for IPsec uses UDP port 500, and it switches to UDP 4500 only when NAT-T detects a NAT device in the path. UDP 1701 is L2TP and 1194 is OpenVPN.

Question 11

An administrator builds a route-based (interface mode) site-to-site IPsec VPN between two FortiGate devices. Besides matching phase 1 and phase 2 settings, what else is required for traffic to pass over the tunnel?

Accepted Answer

A route-based VPN creates a virtual IPsec interface, so traffic reaches the tunnel only if a static or dynamic route points the remote subnet to that interface and firewall policies allow the traffic in both directions.

Question 12

A site-to-site IPsec VPN shows phase 1 as established, but phase 2 never comes up and no traffic passes. Which cause is most consistent with these symptoms?

Accepted Answer

A successful phase 1 proves the peers agreed on authentication and IKE parameters, so the failure lies in phase 2 negotiation, most commonly mismatched quick mode selectors or a different PFS DH group. Pre-shared key and IKE version mismatches would prevent phase 1 from establishing at all.

Question 13

Which default UDP port does a FortiGate use to send authentication requests to a RADIUS server?

Accepted Answer

RADIUS authentication uses UDP 1812 by default, while UDP 1813 is reserved for RADIUS accounting. Ports 389 and 636 belong to LDAP and LDAPS.

Question 14

An organization deploys FSSO in an Active Directory environment with several domain controllers. Which FSSO collector agent deployment mode requires software to be installed on every domain controller?

Accepted Answer

DC agent mode installs a DC agent DLL on each domain controller to capture logon events in real time and forward them to the collector agent. Polling modes read security event logs remotely and require no software on the DCs.

Question 15

A firewall policy requires active authentication. A user's workstation initiates an SSH session through that policy before the user has authenticated. What is the result?

Accepted Answer

Active authentication can only prompt users over protocols that carry a credential exchange FortiGate can intercept—HTTP, HTTPS, FTP, and Telnet—so SSH traffic is dropped until the user authenticates through one of those protocols and gains an authenticated session entry.

Fortinet FCP FortiGate Administrator FW 7.4 Exam Voucher | FCP Certification Practice Test

Free Practice Test

Fortinet FCP FortiGate Administrator FW 7.4 Exam Voucher practice test — common questions