Free Practice Questions for Fortinet FCP_FWF_AD-7.4 Exam

Exhibit Analysis:

The diagram shows a section of the 5 GHz Wi-Fi band, with several adjacent channels: 149, 153, 157, 161.

The red line outlines a wider frequency range covering multiple adjacent channels (149, 153, 157).

What this means:

In Wi-Fi (especially 802.11ac/ax), “channel bonding” means combining adjacent 20 MHz channels into a wider channel (40, 80, or even 160 MHz).

The red line indicates the frequency range that would be used if an 80 MHz channel (covering channels 149, 153, 157, 161) is formed by bonding the narrower channels together.

This increases throughput because a wider channel allows more data to be transmitted at once.

Option Review:

A. Practical channel bonding to increase high throughput

Correct. The red line represents the spectrum occupied when several 20 MHz channels are bonded into a single, wider channel to increase data rates.

B. A pool of channels for the wireless radio to broadcast the wireless signal.

Incorrect. A pool would be all available channels, not the bonded range.

C. The range of channels used to allocate available airtime while transmitting data

Incorrect. This is about frequency, not time.

D. The total length of the wireless signal wavelength

Incorrect. The line indicates frequency spectrum, not wavelength length.

Summary:

The red line shows how multiple adjacent 20 MHz channels are bonded together (in this case, most likely into an 80 MHz channel), a practical method to increase wireless throughput in modern Wi-Fi networks.

When a client moves out of range, the connection drops.

The normal behavior is for the client to disconnect and then seek out and connect to another AP with a stronger signal.

The AP does not force disconnection or send alerts; the client handles roaming.

Clients do not increase their own radio power substantially in response to poor signals due to hardware limits.

Wireless Intrusion Detection System (WIDS) in Fortinet’s Secure Wireless LAN (SWLAN) platform monitors for threats to the wireless environment and detects a range of attacks and misconfigurations.

The main threats detected by WIDS include:

Rogue access points: These are unauthorized APs plugged into the network, posing a security risk. WIDS scans and identifies any AP that is not part of the authorized network, flagging them as potential rogues.

Unauthorized wireless connections: WIDS can detect clients that connect to unauthorized or suspicious wireless networks, as well as unauthorized wireless devices attempting to connect to the network.

Analysis of Options:

A. Brute-force dictionary attacks:

WIDS does not specifically detect brute-force dictionary attacks against authentication. It focuses more on network topology threats and unauthorized devices.

B. Unauthorized wireless connection:

Correct. WIDS can detect unauthorized wireless connections, such as clients connecting to networks/APs that are not trusted.

C. Rogue access points:

Correct. Detecting rogue APs is a primary function of WIDS.

D. WPA2 authentication vulnerabilities:

WIDS does not specifically scan for cryptographic protocol vulnerabilities. It detects behavioral/network threats.

Scenario:

The IT department wants to prevent direct communication between wireless stations.

There is one SSID configured in bridge mode (all clients on the same SSID/VLAN, directly bridging to the wired network).

Correct Action:

Block intra-SSID traffic (sometimes called “client isolation” or “intra-SSID privacy”).

This feature prevents wireless clients connected to the same SSID from communicating directly with each other at Layer 2.

Each station can reach the network but cannot reach other wireless clients on the same SSID.

This is the industry-standard method to achieve the stated security goal in a wireless environment, especially in bridge mode.

Why Other Options Are Incorrect:

A. Create unique SSIDs for each FortiAP device

Impractical and unnecessary for user isolation; users on the same SSID but different APs can still be isolated with intra-SSID blocking.

B. Add an upstream layer 3 device on each FortiAP device

Overkill and not required; this does not directly solve intra-SSID traffic.

D. Drop all local traffic in the wireless network

Too broad; you only want to prevent client-to-client communication, not all local traffic (such as traffic to the gateway).

Summary:

Block intra-SSID traffic is the intended and correct configuration to prevent wireless stations from communicating directly while sharing the same SSID in bridge mode.

Exhibit Review and Feature Analysis:

The SSID "CORP_DATA" is configured with Tunnel NAC as the "NAC profile" (Network Access Control).

NAC quarantine host is enabled, which means when a station is identified as compromised, it will be placed into quarantine automatically by the FortiAP.

How This Works:

In Security Fabric deployments, when a FortiGate detects a compromised endpoint (via integration with FortiAnalyzer and endpoint telemetry), it can instruct FortiAPs (broadcasting the relevant SSID with NAC enabled) to move compromised clients into a quarantine VLAN or block their network access.

The NAC quarantine feature is specifically designed to isolate infected or non-compliant devices automatically, without waiting for manual SOC action.

Option Explanations:

A: NAC does not simply onboard compromised stations—it isolates or restricts them.

B: Disassociation and permanent blocking is not the default; quarantine is preferred.

C: FortiAnalyzer does generate reports, but this does not describe the action taken by FortiGate or FortiAP.

D: Correct. FortiAPs, following FortiGate's NAC/quarantine policy, will isolate (quarantine) compromised clients on the CORP_DATA SSID.

When a FortiAP is directly cabled to a FortiGate interface, it sends out a broadcast CAPWAP discovery packet.

The FortiGate listens for these on its interfaces and then discovers/provisions the FortiAP automatically.

For advanced wireless troubleshooting:

Capturing air traffic (B): This means performing a wireless packet capture (sniffing), usually via the FortiAP's diagnostic tools (e.g., cw_diag sniff), to see low-level association/authentication issues, interference, or protocol errors.

Reviewing event logs (C): Check event logs on the FortiGate and FortiAP to find authentication failures, disconnections, roaming events, or system messages specific to the wireless station.

A (creating/assigning a new profile) is not typically an advanced troubleshooting step; it's more of a configuration or workaround.

D (collecting power management info) is rarely required except for specific power-saving issues, and is not a primary advanced troubleshooting step.

Exhibit Analysis:

Bandwidth: The Tx (2.06 kbps) and Rx (2.09 kbps) are balanced and low, showing steady, light activity.

Signal Strength/Noise: The signal appears to be relatively stable, not showing drops to 0 dB or significant noise spikes.

Transmission Discard/Retry:

Transmission Discard Percentage: 0% (normal; no packets are being discarded).

Transmission Retry Percentage: 25% (abnormally high; typically, values above 10-15% suggest issues).

Option Breakdown:

A. The wireless client has been experiencing high background noise within the last 5 minutes

Incorrect. The Signal Strength/Noise graph is steady and does not indicate abnormal noise.

B. The wireless client has been dropping half of the packets transmitted within the last 5 minutes.

Incorrect in wording: The Discard Percentage is 0%. So, no packets are being dropped, but...

However, the Transmission Retry Percentage is high (25%). This indicates many packets are having to be retransmitted (due to interference, weak signal, or congestion), which is abnormal. If "dropping" is interpreted as "requiring retry," then this fits.

C. The wireless client has been transmitting traffic with all performance metrics within the normal levels

Incorrect. The Retry Percentage is not normal.

D. The wireless client has been switching between available wireless bands within the last 5 minutes

Incorrect. There is no data here to suggest band steering or band switching.

Clarification:

The only abnormal value is Transmission Retry Percentage (25%), which is significantly high. This indicates repeated transmission attempts due to interference, poor signal quality, or congestion.

Best Match:

B. The wireless client has been dropping half of the packets transmitted within the last 5 minutes.

More precisely, it's retransmitting, not dropping, but this is the best answer provided.