Fortinet FCP_FGT_AD-7.4 Practice Test (FortiGate 7.4 Administrator)

FCP_FGT_AD-7.4 practice test: what's covered

• System Config
• Firewall Policies & NAT
• Security Profiles
• Authentication
• Security Fabric
• IPsec & SSL VPN
• Routing
• Logging & FortiView

Free FCP_FGT_AD-7.4 sample questions

1. A new FortiGate is shipped from the factory. An admin connects a laptop to the dedicated management port to reach the GUI for the first time. Which default IP address and interface combination is correct on most FortiGate models?

   • A. https://192.168.1.99 on the MGMT/port1 interface
   • B. https://10.0.0.1 on the WAN1 interface
   • C. https://172.16.0.1 on the internal switch interface
   • D. https://192.168.0.254 on the HA heartbeat interface
   Show answer

   Correct: A. Out of the box, FortiGate listens on 192.168.1.99/24 on the management (MGMT) or port1 interface for HTTPS/SSH. WAN interfaces default to DHCP, and the heartbeat interface is not used for initial GUI access.

2. An administrator wants the FortiGate to operate so that its interfaces are transparent at Layer 2 and forward traffic without changing the IP addressing of the network, inserting the device inline for inspection. Which operation mode should be selected?

   • A. Transparent mode
   • B. NAT mode
   • C. Sniffer (one-arm) mode
   • D. Virtual wire pair mode only
   Show answer

   Correct: A. In Transparent mode the FortiGate acts as a Layer 2 bridge with a single management IP and no routing/NAT, ideal for inline inspection without re-IPing. NAT mode routes between L3 interfaces. Sniffer mode only copies traffic for analysis.

3. Two FortiGate units are being joined into an FGCP active-passive HA cluster. Which two settings must match exactly on both units for the cluster to form? Pick the single answer that lists the correct mandatory matching requirement.

   • A. Identical hardware model and identical firmware version
   • B. Identical hostname and identical admin password
   • C. Identical management IP and identical serial number
   • D. Identical session-pickup timer and identical VLAN tags
   Show answer

   Correct: A. FGCP requires the cluster members to be the same model and run the same firmware build. Hostnames differ by design, serial numbers are always unique, and the management IP must be unique per unit when out-of-band management is used.

4. In an FGCP HA cluster the primary unit is selected by an election. With override disabled and all units having equal HA uptime, which factor is evaluated FIRST to elect the primary?

   • A. Highest HA priority value
   • B. Number of monitored interfaces that are up
   • C. Highest serial number
   • D. Lowest device priority number
   Show answer

   Correct: B. FGCP evaluates monitored (port-monitored) interface health first, then HA uptime, then priority, then serial number. A unit with more healthy monitored links wins regardless of configured priority.

5. An administrator is building a Fortinet Security Fabric. Which two devices can serve as the root (top) FortiGate of the Security Fabric topology? (Choose TWO.)

   • A. The FortiGate that connects to the internet edge and has Fabric enabled as root
   • B. A FortiGate downstream that has 'Security Fabric Connection' set to join an upstream device
   • C. An edge FortiGate that other FortiGates register to as downstream members
   • D. A FortiSwitch managed in FortiLink mode
   • E. A FortiAP in tunnel mode
   Show answer

   Correct: A and C. The root of the Security Fabric is the edge FortiGate where Fabric is enabled as root and downstream FortiGates connect upward to it. A downstream FortiGate joins, it is not the root. FortiSwitch and FortiAP are Fabric devices but never the root FortiGate.

Last updated: 2026-10-19

FCP_FGT_AD-7.4 practice test FAQ

Related practice tests

• NSE4 FortiOS 7.0 practice test
• FCSS enterprise firewall practice test
• NSE7 EFW practice test
• NSE 5 practice test
• PCNSA practice test
• CCSA R81 practice test