Free Fortinet FCP_FWF_AD-7.4 Practice Exam with Questions & Answers

FortiPresence analytics is a platform for presence analytics—monitoring WiFi user presence, dwell time, and visitor trends in physical spaces.

A: It collects and reports details about on-site guest users, such as visit duration and repeat visits.

C: It enables comparison of current user presence and activity data with historical trends, supporting operational and marketing analysis.

B (reporting potential threats) is not a function of presence analytics.

D (predicting future guest counts) is not a core function; FortiPresence reports on actual and historical data, not predictive analytics.

Wireless Intrusion Detection System (WIDS) in Fortinet’s Secure Wireless LAN (SWLAN) platform monitors for threats to the wireless environment and detects a range of attacks and misconfigurations.

The main threats detected by WIDS include:

Rogue access points: These are unauthorized APs plugged into the network, posing a security risk. WIDS scans and identifies any AP that is not part of the authorized network, flagging them as potential rogues.

Unauthorized wireless connections: WIDS can detect clients that connect to unauthorized or suspicious wireless networks, as well as unauthorized wireless devices attempting to connect to the network.

Analysis of Options:

A. Brute-force dictionary attacks:

WIDS does not specifically detect brute-force dictionary attacks against authentication. It focuses more on network topology threats and unauthorized devices.

B. Unauthorized wireless connection:

Correct. WIDS can detect unauthorized wireless connections, such as clients connecting to networks/APs that are not trusted.

C. Rogue access points:

Correct. Detecting rogue APs is a primary function of WIDS.

D. WPA2 authentication vulnerabilities:

WIDS does not specifically scan for cryptographic protocol vulnerabilities. It detects behavioral/network threats.

Analysis of Exhibits:

RF Analysis:

Channel 1 (2.4 GHz) shows very high utilization (91%) and significant overlap/interference from other APs (8 overlap-AP, 7 interfere-AP).

Channel utilization on 2.4 GHz is very high, indicating congestion and contention.

AP Diagnostic Summary:

Radio 1 (2.4 GHz):

Channel Utilization: 78%

Interfering SSIDs: 18

A long list of clients and many SSIDs being broadcast on Channel 1.

Radio 2 (5 GHz):

Channel Utilization: 0% (much lower usage; likely not all clients or SSIDs are using it).

SSID List:

Multiple SSIDs are being broadcast by the AP, which increases management overhead (beacon/probe traffic) and reduces airtime for actual data.

Problem Symptoms:

Guest users in the reception area (on 2.4 GHz, channel 1) are experiencing slow performance.

Option Analysis:

A. Reduce the number of SSIDs being broadcast by the reception AP

Correct.

Each SSID adds additional management overhead (beacons, probes) that consume airtime on already congested 2.4 GHz channels.

Reducing the number of SSIDs frees up airtime for actual client data, which can improve throughput and reduce latency, especially in high-density environments with high channel utilization.

This is a recommended best practice for optimizing Wi-Fi performance in congested environments.

B. Enable frequency handoff on the AP to band steer clients

Helpful if clients support 5 GHz, but not all client devices (especially IoT/guests) do; with such high channel utilization, this is a secondary optimization.

C. Increase the transmission power of the AP radios

This can make interference worse and does not solve airtime congestion; it may also increase contention with neighboring APs.

D. Install another AP in the reception area to improve available bandwidth

Adding more APs on congested channels can actually increase interference and may not help unless channel planning and SSID management are also addressed.

Summary:

Reducing the number of SSIDs is the most direct, configuration-based action that will improve available airtime and performance for clients in a congested, high-utilization environment like the one shown in the exhibits.

When enabling a Security Fabric connection on a FortiGate interface to manage FortiAP devices, the following two types of CAPWAP (Control and Provisioning of Wireless Access Points) communication channels are established:

Control channels:

Correct. The control channel is used for management and control information between the FortiGate (controller) and FortiAP. This includes configuration, monitoring, and state updates.

Data channels:

Correct. The data channel carries client traffic between the FortiAP and FortiGate. This enables the FortiGate to apply security policies, content filtering, and other services to wireless client data.

Analysis of Other Options:

C. Security channels:

There is no specific “security channel” in CAPWAP terminology.

D. Fortlink channels:

FortLink is used for FortiSwitch management, not FortiAPs. CAPWAP is the protocol for FortiAP management.

When a FortiAP is directly cabled to a FortiGate interface, it sends out a broadcast CAPWAP discovery packet.

The FortiGate listens for these on its interfaces and then discovers/provisions the FortiAP automatically.

When a client moves out of range, the connection drops.

The normal behavior is for the client to disconnect and then seek out and connect to another AP with a stronger signal.

The AP does not force disconnection or send alerts; the client handles roaming.

Clients do not increase their own radio power substantially in response to poor signals due to hardware limits.

WPA3 improves security over WPA2 by, among other things:

Using robust key establishment (SAE/Dragonfly), which is not vulnerable to KRACK (Key Reinstallation Attack).

WPA3 does not enforce only enterprise mode, nor does it universally prevent all legacy protocols, nor is 128-bit key size unique to WPA3.

FortiAP and Rogue AP Detection:

Background Scanning:

FortiAPs can perform background scanning for rogue APs while actively servicing clients (broadcasting SSIDs). This means they periodically switch from client service to scan the air for unauthorized APs.

This enables detection of threats without a dedicated radio, using periodic scans on service radios.

Manual Suppression:

Suppression of rogue APs (for example, sending de-auth frames to clients of a rogue) must be triggered manually by an administrator from the FortiGate/FortiAP interface.

Automatic Suppression:

FortiAPs do NOT offer automatic suppression of rogue APs by default. Suppression is an explicit administrative action.

Dedicated Monitoring Radios:

Some APs (higher-end models) may have dedicated radios, but this is not the case for all FortiAPs; background scanning is the standard.

Option Breakdown:

A. FortiAP offers automatic suppression of rogue APs when broadcasting SSIDs

Incorrect. Suppression is manual.

B. FortiAP scans rogue APs in the background while broadcasting SSIDs

Correct. Background scanning is supported.

C. FortiAP detects rogue APs on dedicated monitoring radios

Incorrect for most deployments. Dedicated monitoring radios are available only in some models.

D. FortiAP suppresses detected rogue APs manually

Correct. Manual suppression is available via the management interface.

Comprehensive Detailed Step by Step Explanation from all your Knowledge and Guides availableExhibit Analysis:

The screenshot displays two FortiAPs (FP231FT and FP23JFT) in the wireless controller’s managed APs list.

Both APs are online and connected via APs.

FP231FT shows active SSIDs (“All Tunnel Mode SSIDs”) and has 11 clients connected.

FP23JFT shows “N/A” for all SSIDs and “0” clients.

Diagnosis:

“N/A” for SSIDs on FP23JFT clearly indicates it is not broadcasting any SSID.

Both APs are running the same OS version and have their respective FortiAP profiles assigned.

Evaluating the Options:

A. Enable the radios on the FAP23JF FortiAP profile.

Correct: If the radios (2.4GHz/5GHz) are disabled in the FortiAP profile, the AP will not broadcast any SSID, resulting in “N/A” and “0 clients”. This is a common issue seen in FortiOS Wireless LAN management.

This matches the symptom, as the AP is online (communicating with the controller), but has no active radio (hence, no SSID is broadcasted).

B. Replace the FortiAP device model to match the other device.

Incorrect. FortiOS supports different models in the same deployment, as long as the correct profile is applied.

C. Disable the override setting on the FortiAP that is preventing it from broadcasting SSIDs.

Misleading. Unless an override has specifically disabled SSID broadcasting, this is not directly indicated by the screenshot. Usually, radio disabled at profile is the root cause.

D. Assign the FAP231F FortiAP profile to the problematic FortiAP device.

Incorrect. The correct profile (FAP23JF) is already assigned to FP23JFT; assigning a mismatched profile can cause more issues and is not best practice.

Guide Reference & Reasoning:

FortiOS Administration Guide – Wireless Section:

When an AP is online but SSIDs are not broadcasted and “N/A” appears for radio slots, it strongly points to the radios being disabled in the FortiAP profile (see Wireless Controller > Managed FortiAPs).

The guide explains that “If the radios are disabled in the profile, the AP will not broadcast any SSID. To resolve, enable the radios (2.4GHz, 5GHz) in the FortiAP profile and reapply or reboot the AP”.

FortiAP Profile Settings:

Go to WiFi & Switch Controller > FortiAP Profiles.

Edit the FAP23JF profile.

Check both “Radio 1” and “Radio 2” (enable if disabled).

Save the changes and ensure the profile is pushed to the AP.

Typical Steps to Fix:

Log into the FortiGate.

Navigate to WiFi & Switch Controller > FortiAP Profiles.

Edit the FAP23JF profile.

Under the radio settings, ensure both radios are set to “Enable”.

Apply the changes.

The AP will now broadcast the SSIDs as configured.

Summary:

The problem is caused by disabled radios in the FAP23JF FortiAP profile. Enabling the radios in the profile will allow the AP to start broadcasting SSIDs.

Final Answer: A. Enable the radios on the FAP23JF FortiAP profile.