FCP_FWF_AD-7.4 Fortinet FCP - Secure Wireless LAN 7.4 Administrator Free Practice Exam Questions (2025 Updated)

Channels 52 through 144 in the 5 GHz band (shown as UNII-2, UNII-2-Extended, and some adjacent channels) are marked in regulatory domains as DFS (Dynamic Frequency Selection) channels.

DFS channels must be monitored for radar activity (such as weather radar). If radar is detected, the AP must switch channels to avoid interference.

These channels can be used, but only if the AP supports DFS and performs the necessary checks before use.

WIDS can scan these channels but that’s not the defining characteristic.

Regulatory restrictions (B) apply only if DFS is not supported, which is rare on modern equipment.

Radio Resource Provisioning (C) is unrelated to DFS usage.

When a FortiAP is directly cabled to a FortiGate interface, it sends out a broadcast CAPWAP discovery packet.

The FortiGate listens for these on its interfaces and then discovers/provisions the FortiAP automatically.

Analysis of Exhibits:

RF Analysis:

Channel 1 (2.4 GHz) shows very high utilization (91%) and significant overlap/interference from other APs (8 overlap-AP, 7 interfere-AP).

Channel utilization on 2.4 GHz is very high, indicating congestion and contention.

AP Diagnostic Summary:

Radio 1 (2.4 GHz):

Channel Utilization: 78%

Interfering SSIDs: 18

A long list of clients and many SSIDs being broadcast on Channel 1.

Radio 2 (5 GHz):

Channel Utilization: 0% (much lower usage; likely not all clients or SSIDs are using it).

SSID List:

Multiple SSIDs are being broadcast by the AP, which increases management overhead (beacon/probe traffic) and reduces airtime for actual data.

Problem Symptoms:

Guest users in the reception area (on 2.4 GHz, channel 1) are experiencing slow performance.

Option Analysis:

A. Reduce the number of SSIDs being broadcast by the reception AP

Correct.

Each SSID adds additional management overhead (beacons, probes) that consume airtime on already congested 2.4 GHz channels.

Reducing the number of SSIDs frees up airtime for actual client data, which can improve throughput and reduce latency, especially in high-density environments with high channel utilization.

This is a recommended best practice for optimizing Wi-Fi performance in congested environments.

B. Enable frequency handoff on the AP to band steer clients

Helpful if clients support 5 GHz, but not all client devices (especially IoT/guests) do; with such high channel utilization, this is a secondary optimization.

C. Increase the transmission power of the AP radios

This can make interference worse and does not solve airtime congestion; it may also increase contention with neighboring APs.

D. Install another AP in the reception area to improve available bandwidth

Adding more APs on congested channels can actually increase interference and may not help unless channel planning and SSID management are also addressed.

Summary:

Reducing the number of SSIDs is the most direct, configuration-based action that will improve available airtime and performance for clients in a congested, high-utilization environment like the one shown in the exhibits.

Exhibit Analysis:

The diagram shows a section of the 5 GHz Wi-Fi band, with several adjacent channels: 149, 153, 157, 161.

The red line outlines a wider frequency range covering multiple adjacent channels (149, 153, 157).

What this means:

In Wi-Fi (especially 802.11ac/ax), “channel bonding” means combining adjacent 20 MHz channels into a wider channel (40, 80, or even 160 MHz).

The red line indicates the frequency range that would be used if an 80 MHz channel (covering channels 149, 153, 157, 161) is formed by bonding the narrower channels together.

This increases throughput because a wider channel allows more data to be transmitted at once.

Option Review:

A. Practical channel bonding to increase high throughput

Correct. The red line represents the spectrum occupied when several 20 MHz channels are bonded into a single, wider channel to increase data rates.

B. A pool of channels for the wireless radio to broadcast the wireless signal.

Incorrect. A pool would be all available channels, not the bonded range.

C. The range of channels used to allocate available airtime while transmitting data

Incorrect. This is about frequency, not time.

D. The total length of the wireless signal wavelength

Incorrect. The line indicates frequency spectrum, not wavelength length.

Summary:

The red line shows how multiple adjacent 20 MHz channels are bonded together (in this case, most likely into an 80 MHz channel), a practical method to increase wireless throughput in modern Wi-Fi networks.

Control traffic (CAPWAP control) is crucial for AP configuration, updates, monitoring, and management between FortiAP and FortiGate.

Data traffic carries user/client data, but management/configuration relies on control traffic.

For remote sites with no on-site IT, you should:

A: Use APs that support Fortinet UTM (i.e., FortiAPs that can tunnel traffic back to a FortiGate for UTM enforcement).

D: Use cloud-based management (FortiLAN Cloud) and configure tunnel SSIDs so all traffic from the AP is sent back for security inspection at a central FortiGate.

B refers to PoE power but isn’t essential if APs can be powered in another way.

C (bridge mode to local subnet) would not allow centralized UTM enforcement unless local FortiGate is present.

WPA3 improves security over WPA2 by, among other things:

Using robust key establishment (SAE/Dragonfly), which is not vulnerable to KRACK (Key Reinstallation Attack).

WPA3 does not enforce only enterprise mode, nor does it universally prevent all legacy protocols, nor is 128-bit key size unique to WPA3.

The scenario involves employees connecting via remote FortiAP (FAP) devices, with a requirement to enforce corporate security policies for all wireless stations at branch/remote sites.

Teleworker topology (also called remote AP, or split-tunnel mode) is designed exactly for this:

FortiAP at remote sites connects to the main office FortiGate via a secure tunnel (CAPWAP over VPN or DTLS).

Traffic destined for corporate resources is tunneled back to the main office for full security inspection and policy enforcement.

Local internet-bound traffic can be split off locally (split-tunnel) or tunneled back as well (full-tunnel), based on policy.

This ensures all employee wireless sessions accessing corporate resources are subject to central security policies, without requiring local IT staff.

Option A (VPN tunnels) is part of the teleworker topology but doesn't by itself ensure wireless security enforcement or policy application for wireless stations—teleworker/split-tunnel is more precise.

Option B is impractical and unnecessary.

Option C moves resources to the cloud, but this does not ensure security enforcement for wireless clients over remote links.

Summary: Teleworker topology on FortiAP allows secure, policy-enforced connectivity from remote sites back to HQ for all wireless stations.