Fortinet FCP_FCT_AD-7.4 Practice Test 38

Question 370

A device group passes general enrollment checks while its specified anti-ransomware feature is disabled. Choose THREE complementary steps: remediation, verifying evidence and a recurrence safeguard.

Inspect the effective protection modules and the profile synchronization result.
Track out-of-sync devices and their last communication time.
Retry enrollment while observing certificate validity and successful telemetry.
Create a corrected package or edit the external package and reimport it as a separate EMS package.
Review required malware subfeatures in periodic baseline audits.
Enable the compatible anti-ransomware controls in the assigned malware protection profile.

Explanation

Correct Answers

A:

Inspect the effective protection modules and the profile synchronization result. This checks the behavior at the implicated management, endpoint or enforcement boundary, not just a status icon. A registered device can still be missing a mandated FortiClient protection feature.

E:

Review required malware subfeatures in periodic baseline audits. A durable guard is necessary because a registered device can still be missing a mandated FortiClient protection feature. The immediate repair remains: Enable the compatible anti-ransomware controls in the assigned malware protection profile.

F:

Enable the compatible anti-ransomware controls in the assigned malware protection profile. This targets the documented failure because a registered device can still be missing a mandated FortiClient protection feature. Confirm the result with: Inspect the effective protection modules and the profile synchronization result.

Incorrect Answers

B:

This action is relevant to the separate case "Endpoint out-of-sync after policy change" (R181-C051), but it does not directly resolve the stated ransomware protection posture situation. The key distinction here is: A registered device can still be missing a mandated FortiClient protection feature. Verify the case-specific correction by: Inspect the effective protection modules and the profile synchronization result.

C:

This action addresses "Enrollment with invalid certificate", not the ransomware protection posture issue. The relevant mechanism is: A registered device can still be missing a mandated FortiClient protection feature. Validation: Inspect the effective protection modules and the profile synchronization result.

D:

This action addresses "Package edit after creation", not the ransomware protection posture issue. The relevant mechanism is: A registered device can still be missing a mandated FortiClient protection feature. Validation: Inspect the effective protection modules and the profile synchronization result.

Question 371

An analyst cites an old virus detection event as proof that the current engine and signatures are healthy. Which root cause should the team test first?

Expiring EMS invitation codes cannot be assumed valid after their configured expiration date.
FortiClient can reject invalid EMS certificates; weakening trust would mask a management identity problem.
EMS endpoint policy evaluation must be verified from actual effective assignment rather than guessed from naming alone.
A historical alert does not prove that the endpoint's present protection settings and updates are current.

Explanation

Correct Answer

D:

A historical alert does not prove that the endpoint's present protection settings and updates are current. The evidence is: An analyst cites an old virus detection event as proof that the current engine and signatures are healthy. Targeted correction: Inspect active malware configuration and engine/signature versions alongside event history.

Incorrect Answers

A:

This action is relevant to the separate case "Invitation expired before installation" (R181-C043), but it does not directly resolve the stated endpoint event log versus protection state situation. The key distinction here is: A historical alert does not prove that the endpoint's present protection settings and updates are current. Verify the case-specific correction by: Compare current module state and update times with EMS inventory.

B:

This action is relevant to the separate case "Enrollment with invalid certificate" (R181-C046), but it does not directly resolve the stated endpoint event log versus protection state situation. The key distinction here is: A historical alert does not prove that the endpoint's present protection settings and updates are current. Verify the case-specific correction by: Compare current module state and update times with EMS inventory.

C:

This action addresses "Policy precedence and evaluation", not the endpoint event log versus protection state issue. The relevant mechanism is: A historical alert does not prove that the endpoint's present protection settings and updates are current. Validation: Compare current module state and update times with EMS inventory.

Question 372

An analyst cites an old virus detection event as proof that the current engine and signatures are healthy. Which next action most directly fixes this failure?

Create a corrected package or edit the external package and reimport it as a separate EMS package.
Inspect active malware configuration and engine/signature versions alongside event history.
Configure installer ID group assignment rules and supply branch-specific values during installation.
Repair the EMS certificate chain or hostname and preserve the intended rejection policy.

Explanation

Correct Answer

B:

Inspect active malware configuration and engine/signature versions alongside event history. This targets the documented failure because a historical alert does not prove that the endpoint's present protection settings and updates are current. Confirm the result with: Compare current module state and update times with EMS inventory.

Incorrect Answers

A:

This action addresses "Package edit after creation", not the endpoint event log versus protection state issue. The relevant mechanism is: A historical alert does not prove that the endpoint's present protection settings and updates are current. Validation: Compare current module state and update times with EMS inventory.

C:

This action is relevant to the separate case "Installer ID site assignment" (R181-C035), but it does not directly resolve the stated endpoint event log versus protection state situation. The key distinction here is: A historical alert does not prove that the endpoint's present protection settings and updates are current. Verify the case-specific correction by: Compare current module state and update times with EMS inventory.

D:

This action is relevant to the separate case "Enrollment with invalid certificate" (R181-C046), but it does not directly resolve the stated endpoint event log versus protection state situation. The key distinction here is: A historical alert does not prove that the endpoint's present protection settings and updates are current. Verify the case-specific correction by: Compare current module state and update times with EMS inventory.

Question 373

An analyst cites an old virus detection event as proof that the current engine and signatures are healthy. What test most directly validates the intended behavior?

Inspect installer telemetry settings and verify registration against the new hostname.
Check the first telemetry connection and installed license state on the client.
Compare current module state and update times with EMS inventory.
Inspect the endpoint's ZTNA connection rule and perform an authorized application connection test.

Explanation

Correct Answer

C:

Compare current module state and update times with EMS inventory. This checks the behavior at the implicated management, endpoint or enforcement boundary, not just a status icon. A historical alert does not prove that the endpoint's present protection settings and updates are current.

Incorrect Answers

A:

This action addresses "Installer points to old EMS hostname", not the endpoint event log versus protection state issue. The relevant mechanism is: A historical alert does not prove that the endpoint's present protection settings and updates are current. Validation: Compare current module state and update times with EMS inventory.

B:

This action addresses "Provisioning requires initial EMS contact", not the endpoint event log versus protection state issue. The relevant mechanism is: A historical alert does not prove that the endpoint's present protection settings and updates are current. Validation: Compare current module state and update times with EMS inventory.

D:

This action addresses "ZTNA connection rule delivery", not the endpoint event log versus protection state issue. The relevant mechanism is: A historical alert does not prove that the endpoint's present protection settings and updates are current. Validation: Compare current module state and update times with EMS inventory.

Question 374

An analyst cites an old virus detection event as proof that the current engine and signatures are healthy. Which preventive check belongs in the rollout process?

Align invitation expiry with the actual delivery and installation timeline.
Require current-state health evidence in protection attestations.
Review every new profile for an owning endpoint policy and target group.
Include both installation and registration in the deployment success metric.

Explanation

Correct Answer

B:

Require current-state health evidence in protection attestations. A durable guard is necessary because a historical alert does not prove that the endpoint's present protection settings and updates are current. The immediate repair remains: Inspect active malware configuration and engine/signature versions alongside event history.

Incorrect Answers

A:

This action is relevant to the separate case "Invitation expired before installation" (R181-C043), but it does not directly resolve the stated endpoint event log versus protection state situation. The key distinction here is: A historical alert does not prove that the endpoint's present protection settings and updates are current. Verify the case-specific correction by: Compare current module state and update times with EMS inventory.

C:

This action addresses "Profile versus endpoint policy linkage", not the endpoint event log versus protection state issue. The relevant mechanism is: A historical alert does not prove that the endpoint's present protection settings and updates are current. Validation: Compare current module state and update times with EMS inventory.

D:

This action addresses "Install versus enrollment visibility", not the endpoint event log versus protection state issue. The relevant mechanism is: A historical alert does not prove that the endpoint's present protection settings and updates are current. Validation: Compare current module state and update times with EMS inventory.

Question 375

An analyst cites an old virus detection event as proof that the current engine and signatures are healthy. Choose TWO complementary steps: the targeted remediation and the test that proves it worked.

Compare current module state and update times with EMS inventory.
Inspect active malware configuration and engine/signature versions alongside event history.
Compare effective scan settings and last synchronization timestamps across the cohort.
Configure installer ID group assignment rules and supply branch-specific values during installation.
Track VPN profile changes separately from unrelated endpoint security settings.

Explanation

Correct Answers

A:

Compare current module state and update times with EMS inventory. This checks the behavior at the implicated management, endpoint or enforcement boundary, not just a status icon. A historical alert does not prove that the endpoint's present protection settings and updates are current.

B:

Inspect active malware configuration and engine/signature versions alongside event history. This targets the documented failure because a historical alert does not prove that the endpoint's present protection settings and updates are current. Confirm the result with: Compare current module state and update times with EMS inventory.

Incorrect Answers

C:

This action addresses "Profile version drift", not the endpoint event log versus protection state issue. The relevant mechanism is: A historical alert does not prove that the endpoint's present protection settings and updates are current. Validation: Compare current module state and update times with EMS inventory.

D:

This action is relevant to the separate case "Installer ID site assignment" (R181-C035), but it does not directly resolve the stated endpoint event log versus protection state situation. The key distinction here is: A historical alert does not prove that the endpoint's present protection settings and updates are current. Verify the case-specific correction by: Compare current module state and update times with EMS inventory.

E:

This action addresses "Remote Access VPN profile", not the endpoint event log versus protection state issue. The relevant mechanism is: A historical alert does not prove that the endpoint's present protection settings and updates are current. Validation: Compare current module state and update times with EMS inventory.

Question 376

An incident responder needs a controlled antivirus scan of a defined group but changes every endpoint's profile instead. Which explanation best identifies the failure boundary?

FortiClient System Settings is a separate managed profile section from Remote Access or ZTNA destinations.
EMS supports running AV scans on selected managed endpoints for investigation.
Deployment must use supported endpoints and OS installers rather than assuming one client package fits every system.
An active installer ID group assignment rule can reapply the group defined by that identifier.

Explanation

Correct Answer

B:

EMS supports running AV scans on selected managed endpoints for investigation. The evidence is: An incident responder needs a controlled antivirus scan of a defined group but changes every endpoint's profile instead. Targeted correction: Choose the affected endpoints and start the supported AV scan operation.

Incorrect Answers

A:

This action addresses "System settings profile changes", not the scan execution on selected endpoints issue. The relevant mechanism is: EMS supports running AV scans on selected managed endpoints for investigation. Validation: Review the scan progress and resulting endpoint events.

C:

This action addresses "Deployment scope controlled by devices", not the scan execution on selected endpoints issue. The relevant mechanism is: EMS supports running AV scans on selected managed endpoints for investigation. Validation: Review the scan progress and resulting endpoint events.

D:

This action addresses "Grouping unexpectedly reverts", not the scan execution on selected endpoints issue. The relevant mechanism is: EMS supports running AV scans on selected managed endpoints for investigation. Validation: Review the scan progress and resulting endpoint events.

Question 377

An incident responder needs a controlled antivirus scan of a defined group but changes every endpoint's profile instead. What is the best targeted configuration or operational response?

Choose the affected endpoints and start the supported AV scan operation.
Configure installer ID group assignment rules and supply branch-specific values during installation.
Verify its configured EMS server, invitation requirement and client-to-EMS connectivity.
Review the category or URL behavior and scope the exception to the authorized endpoint group.

Explanation

Correct Answer

A:

Choose the affected endpoints and start the supported AV scan operation. This targets the documented failure because eMS supports running AV scans on selected managed endpoints for investigation. Confirm the result with: Review the scan progress and resulting endpoint events.

Incorrect Answers

B:

This action addresses "Installer ID site assignment", not the scan execution on selected endpoints issue. The relevant mechanism is: EMS supports running AV scans on selected managed endpoints for investigation. Validation: Review the scan progress and resulting endpoint events.

C:

This action addresses "Install versus enrollment visibility", not the scan execution on selected endpoints issue. The relevant mechanism is: EMS supports running AV scans on selected managed endpoints for investigation. Validation: Review the scan progress and resulting endpoint events.

D:

This action is relevant to the separate case "Profile change to web filter" (R181-C058), but it does not directly resolve the stated scan execution on selected endpoints situation. The key distinction here is: EMS supports running AV scans on selected managed endpoints for investigation. Verify the case-specific correction by: Review the scan progress and resulting endpoint events.

Question 378

An incident responder needs a controlled antivirus scan of a defined group but changes every endpoint's profile instead. Which check best distinguishes success from a superficial green status?

Check an HR and Finance device in their correct group after registration.
Test the designated unauthorized application with the assigned client.
Review the scan progress and resulting endpoint events.
Compare a test endpoint's delivered profile with the intended baseline after rule evaluation.

Explanation

Correct Answer

C:

Review the scan progress and resulting endpoint events. This checks the behavior at the implicated management, endpoint or enforcement boundary, not just a status icon. EMS supports running AV scans on selected managed endpoints for investigation.

Incorrect Answers

A:

This action is relevant to the separate case "MSI installer identity parameter" (R181-C047), but it does not directly resolve the stated scan execution on selected endpoints situation. The key distinction here is: EMS supports running AV scans on selected managed endpoints for investigation. Verify the case-specific correction by: Review the scan progress and resulting endpoint events.

B:

This action addresses "Application firewall profile", not the scan execution on selected endpoints issue. The relevant mechanism is: EMS supports running AV scans on selected managed endpoints for investigation. Validation: Review the scan progress and resulting endpoint events.

D:

This action addresses "Policy precedence and evaluation", not the scan execution on selected endpoints issue. The relevant mechanism is: EMS supports running AV scans on selected managed endpoints for investigation. Validation: Review the scan progress and resulting endpoint events.

Question 379

An incident responder needs a controlled antivirus scan of a defined group but changes every endpoint's profile instead. How should the team verify this risk stays controlled over time?

Maintain a tested sandbox profile and monitor integration status.
Keep deployment script parameters versioned and test changes on both groups.
Maintain targeted response playbooks separate from baseline policy changes.
Use time-bounded documented web filter exceptions and periodic reviews.

Explanation

Correct Answer

C:

Maintain targeted response playbooks separate from baseline policy changes. A durable guard is necessary because eMS supports running AV scans on selected managed endpoints for investigation. The immediate repair remains: Choose the affected endpoints and start the supported AV scan operation.

Incorrect Answers

A:

This action addresses "Sandbox profile integration", not the scan execution on selected endpoints issue. The relevant mechanism is: EMS supports running AV scans on selected managed endpoints for investigation. Validation: Review the scan progress and resulting endpoint events.

B:

This action is relevant to the separate case "MSI installer identity parameter" (R181-C047), but it does not directly resolve the stated scan execution on selected endpoints situation. The key distinction here is: EMS supports running AV scans on selected managed endpoints for investigation. Verify the case-specific correction by: Review the scan progress and resulting endpoint events.

D:

This action is relevant to the separate case "Profile change to web filter" (R181-C058), but it does not directly resolve the stated scan execution on selected endpoints situation. The key distinction here is: EMS supports running AV scans on selected managed endpoints for investigation. Verify the case-specific correction by: Review the scan progress and resulting endpoint events.

Question 380

An incident responder needs a controlled antivirus scan of a defined group but changes every endpoint's profile instead. Choose THREE complementary steps: remediation, verifying evidence and a recurrence safeguard.

Check an HR and Finance device in their correct group after registration.
Use expiring, recipient-targeted invitations for temporary users.
Choose the affected endpoints and start the supported AV scan operation.
Review the scan progress and resulting endpoint events.
Maintain targeted response playbooks separate from baseline policy changes.
Build or provide a package with the correct reachable EMS listen address and transition affected clients.

Explanation

Correct Answers

C:

Choose the affected endpoints and start the supported AV scan operation. This targets the documented failure because eMS supports running AV scans on selected managed endpoints for investigation. Confirm the result with: Review the scan progress and resulting endpoint events.

D:

Review the scan progress and resulting endpoint events. This checks the behavior at the implicated management, endpoint or enforcement boundary, not just a status icon. EMS supports running AV scans on selected managed endpoints for investigation.

E:

Maintain targeted response playbooks separate from baseline policy changes. A durable guard is necessary because eMS supports running AV scans on selected managed endpoints for investigation. The immediate repair remains: Choose the affected endpoints and start the supported AV scan operation.

Incorrect Answers

A:

This action is relevant to the separate case "MSI installer identity parameter" (R181-C047), but it does not directly resolve the stated scan execution on selected endpoints situation. The key distinction here is: EMS supports running AV scans on selected managed endpoints for investigation. Verify the case-specific correction by: Review the scan progress and resulting endpoint events.

B:

This action addresses "Remote contractor invitation", not the scan execution on selected endpoints issue. The relevant mechanism is: EMS supports running AV scans on selected managed endpoints for investigation. Validation: Review the scan progress and resulting endpoint events.

F:

This action addresses "Installer points to old EMS hostname", not the scan execution on selected endpoints issue. The relevant mechanism is: EMS supports running AV scans on selected managed endpoints for investigation. Validation: Review the scan progress and resulting endpoint events.

Fortinet FCP_FCT_AD-7.4 Exam Dumps, Practice Test Questions

Question 370

Explanation

Correct Answers

Incorrect Answers

Question 371

Explanation

Correct Answer

Incorrect Answers

Question 372

Explanation

Correct Answer

Incorrect Answers

Question 373

Explanation

Correct Answer

Incorrect Answers

Question 374

Explanation

Correct Answer

Incorrect Answers

Question 375

Explanation

Correct Answers

Incorrect Answers

Question 376

Explanation

Correct Answer

Incorrect Answers

Question 377

Explanation

Correct Answer

Incorrect Answers

Question 378

Explanation

Correct Answer

Incorrect Answers

Question 379

Explanation

Correct Answer

Incorrect Answers

Question 380

Explanation

Correct Answers

Incorrect Answers