Free FCP_FCT_AD-7.4 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

Endpoint policies in EMS are evaluated top-to-bottom; the first policy whose conditions all match is applied.

The “Training” policy is placed above “Sales” and contains two conditions:

1. User = student

2. AD Domain = trainingAD.

The account “student” logging in from a machine joined to trainingAD satisfies both conditions, so EMS immediately assigns the Training policy and stops further evaluation. Therefore only the Training policy is pushed to that endpoint.

A. Sales is lower in the list; evaluation stops once Training matches, so Sales is ignored.

C. The Default policy is applied only if no other policy matches; Training matches, so Default is not used.

D. Policy evaluation does not split on/off-fabric once a higher rule matches; Training alone is assigned.

1. Fortinet, “FortiClient EMS 7.4 Administration Guide,” Sec. “Policy evaluation order,” p. 93.

2. Fortinet, “FortiClient EMS 7.4 Administration Guide,” Example-2 “Selecting policy based on user and domain,” p. 95.

The exhibit shows the configuration for a FortiGate user group named "EMSZTNAALL". The critical line set member "EMS1ZTNA" indicates that the members of this group are defined by an external connector named "EMS1ZTNA". In FortiOS, this syntax is used to reference a FortiClient EMS Connector. Therefore, the FortiGate is configured to dynamically pull endpoint information, such as ZTNA tags which function as groups, from a FortiClient EMS server.

B. FortiGate is configured with local user group: A local user group would list locally defined usernames as members, not a connector object.

C. FortiGate is configured to pull user groups from FortiAuthenticator: The member syntax for a FortiAuthenticator group would reference a FortiAuthenticator server object.

D. FortiGate is configured to pull user groups from AD Server: The member syntax for an AD group would reference an LDAP server object and a group distinguished name (DN).

1. FortiGate CLI Reference 7.4, "config user group," Volume 2, page 1038. The documentation shows that the member attribute can accept the name of a fabric connector, including FortiClient EMS.

2. FortiClient EMS Administration Guide 7.4, "Configuring ZTNA tags and firewall policies," page 235. This section details creating a FortiClient EMS connector on FortiGate and using it as a member in a user group for policy enforcement.

3. ZTNA Deployment Guide 7.4, "Configuring ZTNA tags on FortiGate," page 28. The guide provides an example of creating a user group on FortiGate with the FortiClient EMS connector as a member.

FortiGate needs the FortiClient EMS root CA certificate to establish a trust relationship and validate certificates issued by EMS. When FortiClient EMS acts as a Certificate Authority, it issues certificates to FortiClient endpoints. FortiGate must have the EMS root CA certificate installed to verify the authenticity of these client certificates during authentication. This is a fundamental PKI principle where the validating entity (FortiGate) must trust the issuing CA (EMS) to accept certificates signed by it.

A. To revoke FortiClient client certificates - Certificate revocation is performed by the issuing CA (EMS), not by FortiGate.

B. To sign FortiClient CSR requests - Certificate signing is done by the CA (EMS), not by FortiGate which acts as the validator.

C. To update FortiClient client certificates - Certificate updates/renewals are managed by EMS, not by FortiGate.

- FortiClient EMS 7.0 Administration Guide, Section "Certificate Management", pages 234-236

- FortiGate FortiOS 7.0 Handbook, "PKI Users and Certificates" chapter, pages 412-415

- Fortinet Document Library, "FortiClient EMS Certificate Authority Configuration", Doc ID: FD-50124

The exhibit displays a Zero Trust Tagging rule that applies the "Non-compliant" tag to endpoints meeting specific criteria. To make an endpoint compliant, it must not meet these criteria. The rules for being non-compliant are: 1) having high, critical, or medium severity vulnerabilities, 2) having the Web Filter disabled, and 3) running the Calculator application. Therefore, an administrator must patch the specified vulnerabilities and enable the web filter profile to move the endpoint towards a compliant state.

B. Run Calculator application on the endpoint. This action would trigger one of the non-compliant conditions, making the endpoint non-compliant.

C. Integrate FortiSandbox for infected file analysis. This action is irrelevant as FortiSandbox integration is not a condition in the displayed Zero Trust Tagging rule.

FortiClient EMS 7.4 Administration Guide, "Zero Trust Fabric Connectivity," page 111, "Configuring Zero Trust tagging rules." This section details how rules are created based on endpoint state, such as vulnerability status and feature enablement. An endpoint becomes compliant by negating the conditions defined in the non-compliant tagging rule.

In a Fortinet Security Fabric automation stitch, the FortiGate acts as the central enforcement point. When FortiAnalyzer detects an Indicator of Compromise (IOC), it sends an event trigger to the FortiGate. The FortiGate then executes the configured action, which in this case is to send a notification to quarantine the compromised endpoint. This action can be a webhook to FortiClient EMS or applying a quarantine tag for ZTNA enforcement, but the FortiGate is the component that initiates the action.

A. FortiAnalyzer: FortiAnalyzer detects the IOC and sends the trigger, but it does not execute the quarantine action itself.

B. FortiClient: FortiClient is the endpoint agent that is the target of the quarantine action; it does not initiate it.

C. FortiClient EMS: FortiClient EMS receives the quarantine command from FortiGate and applies it to the endpoint, but it doesn't send the initial notification in the stitch.

1. FortiGate Administration Guide 7.4, "Automation stitches," page 1238. The guide explains that stitches consist of a trigger and one or more actions, which are configured and executed on the FortiGate.

2. FortiAnalyzer Administration Guide 7.4, "Event handlers," page 321. This section describes how FortiAnalyzer generates events that can be used as triggers for automation stitches on a FortiGate.

3. Fortinet Security Fabric Cookbook 7.4, "Automatically quarantine a compromised host," page 15. This recipe explicitly shows the FortiGate as the action component that quarantines a device based on a trigger from FortiAnalyzer.

The exhibit displays two deployment profiles. Deployment-2 is configured with the action "Upgrade" and targets both an Active Directory (AD) group named "AD-Group" and a workgroup named "Workgroup". Therefore, this profile is set to upgrade existing FortiClient installations on endpoints within both of these specified groups. The action and targets are clearly defined in the profile's configuration shown.

B. Deployment-1 targets an "AD group", not an "AO group". The action is correct (Install), but the target group name is misrepresented.

C. The action for Deployment-2 is "Upgrade", not "Install". This profile is intended to update existing clients, not perform new installations.

D. Deployment-1's action is "Install", not "Upgrade", and it targets an AD group, not a workgroup.

1. FortiClient EMS 7.4 Administration Guide, "Creating a deployment package" section, page 113. This section details the configuration options for deployment profiles, including setting the action to "Install" or "Upgrade" and defining targets such as AD groups or workgroups.

The policy shown limits real-time (on-access) scanning to the specified directory “Resources.” FortiClient therefore triggers malware scanning only when a user writes or copies a file into that folder; other folders are unaffected. If malware is detected the configured post-scan action (quarantine/delete) will occur, but the event that invokes scanning is the copy operation into the Resources folder.

B. Quarantine is an action after detection, not the trigger condition illustrated.

C. The file is first scanned; it is never copied without inspection.

D. Deleting is configurable but the exhibit shows the behavioural trigger of scanning, not necessarily deletion.

1. Fortinet, “FortiClient EMS Administration Guide 7.2,” Section 6.3 “Real-time Scan—Scan only these directories” (p. 176-177).

2. Fortinet, “FortiClient for Windows Administration Guide 7.2,” Table 59 “On-access Scan Behaviour” (p. 92).

The endpoint record list is populated only after the client presents a certificate that FortiGate successfully authenticates.

If Remote-Client sends a certificate that cannot be validated against the CA chain or does not meet the rule’s certificate criteria, the TLS handshake fails; FortiGate drops the connection and never creates an endpoint entry, so diagnose endpoint record list shows nothing. This indicates a failure in client-certificate authentication.

A. If no connection attempt occurred, no access-proxy log entries would be present; the question implies a connection attempt.

B. An empty certificate is rejected at the TLS layer; FortiGate logs “no certificate” rather than “authentication failed”.

C. “Invalid certificate” refers to format errors; the most common operational cause is failed authentication, not malformed cert.

1. Fortinet, “FortiOS 7.4 Zero-Trust Network Access,” Sec. “Client certificate troubleshooting,” p. 133.

2. Fortinet, “FortiOS 7.4 CLI Reference,” cmd: diagnose endpoint record list – description, p. 2113.

3. Fortinet, “FortiOS 7.4 Log Reference,” TLS client-auth failure messages, p. 456.

When the FortiClient EMS web console (GUI) is inaccessible, the primary tool for initial investigation and diagnostics is the command-line interface (CLI) on the EMS server itself. The EMS installation includes a set of CLI tools that allow an administrator to check the status of essential services (including the web server), review configurations, and perform diagnostic tests without relying on the web interface. This is the standard procedure for troubleshooting when a server's GUI becomes unresponsive.

B. Web server logs are located on the EMS server's file system, not within the PostgreSQL database server. This option misidentifies the source of the logs.

C. This option is not viable because the premise of the question is that the administrator has already lost access to the FortiClient EMS GUI.

D. While a log generator from the support site is a valid tool for collecting comprehensive data for a support ticket, it is not the primary, built-in tool for initial investigation.

1. FortiClient EMS 7.4 Administration Guide, "Appendix A: CLI commands" section, p. 288. This appendix documents the available CLI commands for managing and troubleshooting the EMS server, such as femssystem status to check service states, which is a critical first step when the GUI is down.

2. Fortinet Certified Professional - FortiClient EMS Study Guide, "Troubleshooting" module. This official courseware emphasizes using the CLI for initial diagnostics when the web console is unavailable.

FortiClient provides three distinct antivirus scanning modes to suit different security and performance needs. A 'Quick Scan' checks critical system areas and running processes for active threats. A 'Full Scan' performs an exhaustive check of all files and folders on the endpoint. A 'Custom Scan' allows the user or administrator to specify particular files or folders to be scanned, offering flexibility for targeted checks.

A. Proxy scan is an inspection method used by FortiGate firewalls to scan traffic as it passes through the proxy, not a local endpoint scan type in FortiClient.

D. Flow scan (flow-based inspection) is a high-speed inspection mode used by FortiGate firewalls, which analyzes traffic as it flows, rather than a local endpoint AV scan.

- FortiClient 7.4 Administration Guide, page 101, "Malware Protection": "You can configure FortiClient to run a quick, full, or custom malware scan on the endpoint."

In a FortiGate ZTNA configuration, the FortiGate itself functions as an access proxy, mediating all connections to protected resources. A ZTNA firewall policy is a specific type of proxy policy that defines the rules for this access. It specifies which users and devices (identified by ZTNA tags) are permitted to access specific applications (represented by ZTNA server objects). When a client connects, the traffic is handled by the access proxy, which then consults the ZTNA firewall policy to make an access decision.

A. The firewall policy does not redirect the request; the client connection is already terminated at the FortiGate access proxy based on ZTNA server settings.

C. The ZTNA server object, which maps external FQDNs to internal servers, is defined separately and used as the destination in the firewall policy.

D. The policy uses ZTNA tags as one of several criteria, but it also relies on user identity, source/destination, and other parameters, not "only" tags.

1. FortiOS 7.4 Administration Guide, "ZTNA", p. 1003. "The ZTNA rule is a proxy policy..." and "The FortiGate... functions as a ZTNA proxy".

2. Fortinet Certified Professional - Security Operations Study Guide for FortiOS 7.4, "ZTNA", p. 289. "ZTNA rules are proxy policies that are configured on FortiGate to allow or deny traffic."

ZTNA tags are created and managed in FortiClient EMS. EMS evaluates endpoint posture (OS, patch level, running processes, etc.), assigns the appropriate tag, and shares those tags with connected FortiGate devices through the Security Fabric connector. FortiGate and its Access Proxy then reference the EMS-defined tags when enforcing ZTNA and firewall policies.

A. FortiClient only reports telemetry and receives tags; it does not create them.

B. FortiGate consumes tag information but cannot define or edit tags.

D. The Access Proxy enforces ZTNA policies but has no tagging mechanism.

1. FortiClient EMS 7.0 Administration Guide, “Configuring ZTNA Tags”, p.178-180.

2. FortiOS 7.2 Administration Guide, “Using EMS tags in firewall policies”, p.3110-3112.

FortiClient EMS assigns policies to endpoints based on priority, starting with the lowest number (highest priority). EMS evaluates policies in ascending order of their priority number. The first policy that matches the endpoint's group membership is applied, and the evaluation stops. In this case, the endpoint is in the trainingAD group. EMS first checks the "Sales" policy (Priority 1) but finds no match. It then checks the "Training" policy (Priority 2), which matches the trainingAD group. Therefore, the "Training" policy is applied.

B. Both the Sales and Training policies because their priority is higher than the Default policy. Only a single endpoint policy can be active on an endpoint at any given time.

C. The Default policy because it has the highest priority. The Default policy has the highest number (10), which signifies the lowest priority. It is a catch-all policy.

D. The sales policy. The endpoint is not a member of the SalesAD group, so the "Sales" policy criteria are not met.

FortiClient EMS 7.4 Administration Guide, "Endpoints," page 61, "Policy assignment and priority." The guide states, "EMS checks policies in order of priority, from lowest number to highest number. EMS assigns the first matching policy to the endpoint."

In a multitenant FortiClient EMS deployment, the Settings Administrator role is restricted to the Global site. It can configure system-wide settings and view logs but cannot switch to, or manage, any tenant sites, satisfying the “global-only” access requirement.

A. Tenant administrator – limited to its own tenant site, no access to Global site.

C. Standard administrator – access is granted per specific tenant(s); not confined to Global site.

D. Global administrator – has full Global plus all tenant-site access, not “global-only”.

1. FortiClient EMS 7.2 Administration Guide, “Managing administrators” → Table 15 “Administrator roles”, pp. 54-55.

2. Fortinet KB Article 84603, “How administrator roles work in multitenant EMS”, para. 2-3.

In a Fortinet Security Fabric environment, roles are distributed. FortiClient EMS acts as the Policy Administration and Decision Point, defining compliance rules and assigning Zero Trust tags to endpoints. The FortiClient agent on the endpoint reports its status and acts as the Policy Information Point. The FortiGate acts as the Policy Enforcement Point. It receives the ZTNA tags from EMS and uses them in ZTNA rules and firewall policies to dynamically grant or deny access to network resources, thereby enforcing compliance.

A. FortiClient reports its compliance status to EMS but does not enforce network access control policies on the FortiGate; it is the agent being monitored.

B. FortiClient EMS defines the rules and assigns tags but does not sit in the data path to block or allow traffic to corporate resources.

D. FortiAnalyzer is a logging and analytics platform; it collects data and provides reports but does not actively enforce security policies in real-time.

1. FortiClient EMS 7.2 Administration Guide, Page 258, "Zero Trust Tags". The guide explains, "FortiClient EMS sends endpoint information including ZTNA tags to FortiGate. You can use ZTNA tags on FortiGate to enforce dynamic access control."

2. FortiGate ZTNA Deployment Guide 7.2, Page 10, "ZTNA configuration overview". The guide shows that ZTNA rules are configured on the FortiGate to check for tags and enforce access.