Pass the Fortinet Fortinet Certified Professional Network Security FCP_FWF_AD-7.4 Questions and answers with CertsForce

802.1X is the standard for port-based network access control, widely used in enterprise Wi-Fi to:

Authenticate users and devices before granting access to the network.

Authorize network access (optionally placing users into specific VLANs).

It is not for home Wi-Fi (C), does not provide admin privilege (B), and is more complex than open guest Wi-Fi (D).

When a FortiAP is directly cabled to a FortiGate interface, it sends out a broadcast CAPWAP discovery packet.

The FortiGate listens for these on its interfaces and then discovers/provisions the FortiAP automatically.

For remote sites with no on-site IT, you should:

A: Use APs that support Fortinet UTM (i.e., FortiAPs that can tunnel traffic back to a FortiGate for UTM enforcement).

D: Use cloud-based management (FortiLAN Cloud) and configure tunnel SSIDs so all traffic from the AP is sent back for security inspection at a central FortiGate.

B refers to PoE power but isn’t essential if APs can be powered in another way.

C (bridge mode to local subnet) would not allow centralized UTM enforcement unless local FortiGate is present.

Channel utilization directly measures how much airtime is consumed by wireless transmissions (including data, management, and interference).

Monitoring channel utilization helps optimize the network by:

Identifying congestion or over-utilized channels.

Allowing channel re-planning and SSID optimization.

The other options (AP firmware, event logs, user count) are helpful, but only channel utilization gives actionable insight for radio resource optimization.

When enabling a Security Fabric connection on a FortiGate interface to manage FortiAP devices, the following two types of CAPWAP (Control and Provisioning of Wireless Access Points) communication channels are established:

Control channels:

Correct. The control channel is used for management and control information between the FortiGate (controller) and FortiAP. This includes configuration, monitoring, and state updates.

Data channels:

Correct. The data channel carries client traffic between the FortiAP and FortiGate. This enables the FortiGate to apply security policies, content filtering, and other services to wireless client data.

Analysis of Other Options:

C. Security channels:

There is no specific “security channel” in CAPWAP terminology.

D. Fortlink channels:

FortLink is used for FortiSwitch management, not FortiAPs. CAPWAP is the protocol for FortiAP management.

Channels 52 through 144 in the 5 GHz band (shown as UNII-2, UNII-2-Extended, and some adjacent channels) are marked in regulatory domains as DFS (Dynamic Frequency Selection) channels.

DFS channels must be monitored for radar activity (such as weather radar). If radar is detected, the AP must switch channels to avoid interference.

These channels can be used, but only if the AP supports DFS and performs the necessary checks before use.

WIDS can scan these channels but that’s not the defining characteristic.

Regulatory restrictions (B) apply only if DFS is not supported, which is rare on modern equipment.

Radio Resource Provisioning (C) is unrelated to DFS usage.

Scenario Analysis:

The wireless client is redirected to a captive portal for authentication.

The authentication settings (see second exhibit) show:

Captive portal type: FQDN is selected.

Certificate: Fortinet_Factory (the default self-signed certificate).

The browser is reporting a certificate validation error when the redirection to the captive portal occurs.

Certificate Validation and Captive Portals:

When FQDN is used for captive portal redirection, the browser expects the SSLcertificate to be valid for the FQDN (e.g., “captive.company.com”).

If the certificate is self-signed or does not match the FQDN (common when using the Fortinet factory default certificate), the browser will trigger a certificate error.

This is a common issue when FQDN-based portals are used without a publicly trusted certificate matching the FQDN.

Option Analysis:

A. The FortiGate IP address in the POST parameters is using a numerical IP address

Not relevant; the browser validates the page being loaded, not the POST parameters.

B. The external server address is not the FQDN address

In this case, the external captive portal URL is using FQDN, as set in the authentication setting.

C. The used credential is not embedded in the captive portal parameters

Credential handling is not related to certificate errors; it would result in login/authentication failures, not browser SSL warnings.

D. The captive portal setting in the authentication setting is set to use FQDN as the captive portal type

Correct. When FQDN is used, the SSL certificate presented must be trusted and match the FQDN. The factory certificate will not match (it is not publicly trusted), so clients will see a validation error.

Summary:

Certificate validation fails because the captive portal is accessed via FQDN, but the FortiGate presents its self-signed factory certificate, which does not match the FQDN or is not trusted by browsers.

Comprehensive Detailed Step by Step Explanation from all your Knowledge and Guides availableExhibit Analysis:

The screenshot displays two FortiAPs (FP231FT and FP23JFT) in the wireless controller’s managed APs list.

Both APs are online and connected via APs.

FP231FT shows active SSIDs (“All Tunnel Mode SSIDs”) and has 11 clients connected.

FP23JFT shows “N/A” for all SSIDs and “0” clients.

Diagnosis:

“N/A” for SSIDs on FP23JFT clearly indicates it is not broadcasting any SSID.

Both APs are running the same OS version and have their respective FortiAP profiles assigned.

Evaluating the Options:

A. Enable the radios on the FAP23JF FortiAP profile.

Correct: If the radios (2.4GHz/5GHz) are disabled in the FortiAP profile, the AP will not broadcast any SSID, resulting in “N/A” and “0 clients”. This is a common issue seen in FortiOS Wireless LAN management.

This matches the symptom, as the AP is online (communicating with the controller), but has no active radio (hence, no SSID is broadcasted).

B. Replace the FortiAP device model to match the other device.

Incorrect. FortiOS supports different models in the same deployment, as long as the correct profile is applied.

C. Disable the override setting on the FortiAP that is preventing it from broadcasting SSIDs.

Misleading. Unless an override has specifically disabled SSID broadcasting, this is not directly indicated by the screenshot. Usually, radio disabled at profile is the root cause.

D. Assign the FAP231F FortiAP profile to the problematic FortiAP device.

Incorrect. The correct profile (FAP23JF) is already assigned to FP23JFT; assigning a mismatched profile can cause more issues and is not best practice.

Guide Reference & Reasoning:

FortiOS Administration Guide – Wireless Section:

When an AP is online but SSIDs are not broadcasted and “N/A” appears for radio slots, it strongly points to the radios being disabled in the FortiAP profile (see Wireless Controller > Managed FortiAPs).

The guide explains that “If the radios are disabled in the profile, the AP will not broadcast any SSID. To resolve, enable the radios (2.4GHz, 5GHz) in the FortiAP profile and reapply or reboot the AP”.

FortiAP Profile Settings:

Go to WiFi & Switch Controller > FortiAP Profiles.

Edit the FAP23JF profile.

Check both “Radio 1” and “Radio 2” (enable if disabled).

Save the changes and ensure the profile is pushed to the AP.

Typical Steps to Fix:

Log into the FortiGate.

Navigate to WiFi & Switch Controller > FortiAP Profiles.

Edit the FAP23JF profile.

Under the radio settings, ensure both radios are set to “Enable”.

Apply the changes.

The AP will now broadcast the SSIDs as configured.

Summary:

The problem is caused by disabled radios in the FAP23JF FortiAP profile. Enabling the radios in the profile will allow the AP to start broadcasting SSIDs.

Final Answer: A. Enable the radios on the FAP23JF FortiAP profile.

For advanced wireless troubleshooting:

Capturing air traffic (B): This means performing a wireless packet capture (sniffing), usually via the FortiAP's diagnostic tools (e.g., cw_diag sniff), to see low-level association/authentication issues, interference, or protocol errors.

Reviewing event logs (C): Check event logs on the FortiGate and FortiAP to find authentication failures, disconnections, roaming events, or system messages specific to the wireless station.

A (creating/assigning a new profile) is not typically an advanced troubleshooting step; it's more of a configuration or workaround.

D (collecting power management info) is rarely required except for specific power-saving issues, and is not a primary advanced troubleshooting step.