Fortinet FCP_FWF_AD-7.4 FCP - Secure Wireless LAN 7.4 Administrator Exam Practice Test

Channel utilization directly measures how much airtime is consumed by wireless transmissions (including data, management, and interference).

Monitoring channel utilization helps optimize the network by:

Identifying congestion or over-utilized channels.

Allowing channel re-planning and SSID optimization.

The other options (AP firmware, event logs, user count) are helpful, but only channel utilization gives actionable insight for radio resource optimization.

FortiPresence analytics is a platform for presence analytics—monitoring WiFi user presence, dwell time, and visitor trends in physical spaces.

A: It collects and reports details about on-site guest users, such as visit duration and repeat visits.

C: It enables comparison of current user presence and activity data with historical trends, supporting operational and marketing analysis.

B (reporting potential threats) is not a function of presence analytics.

D (predicting future guest counts) is not a core function; FortiPresence reports on actual and historical data, not predictive analytics.

When a FortiAP is directly cabled to a FortiGate interface, it sends out a broadcast CAPWAP discovery packet.

The FortiGate listens for these on its interfaces and then discovers/provisions the FortiAP automatically.

Scenario:

The IT department wants to prevent direct communication between wireless stations.

There is one SSID configured in bridge mode (all clients on the same SSID/VLAN, directly bridging to the wired network).

Correct Action:

Block intra-SSID traffic (sometimes called “client isolation” or “intra-SSID privacy”).

This feature prevents wireless clients connected to the same SSID from communicating directly with each other at Layer 2.

Each station can reach the network but cannot reach other wireless clients on the same SSID.

This is the industry-standard method to achieve the stated security goal in a wireless environment, especially in bridge mode.

Why Other Options Are Incorrect:

A. Create unique SSIDs for each FortiAP device

Impractical and unnecessary for user isolation; users on the same SSID but different APs can still be isolated with intra-SSID blocking.

B. Add an upstream layer 3 device on each FortiAP device

Overkill and not required; this does not directly solve intra-SSID traffic.

D. Drop all local traffic in the wireless network

Too broad; you only want to prevent client-to-client communication, not all local traffic (such as traffic to the gateway).

Summary:

Block intra-SSID traffic is the intended and correct configuration to prevent wireless stations from communicating directly while sharing the same SSID in bridge mode.

Analysis of Exhibits:

RF Analysis:

Channel 1 (2.4 GHz) shows very high utilization (91%) and significant overlap/interference from other APs (8 overlap-AP, 7 interfere-AP).

Channel utilization on 2.4 GHz is very high, indicating congestion and contention.

AP Diagnostic Summary:

Radio 1 (2.4 GHz):

Channel Utilization: 78%

Interfering SSIDs: 18

A long list of clients and many SSIDs being broadcast on Channel 1.

Radio 2 (5 GHz):

Channel Utilization: 0% (much lower usage; likely not all clients or SSIDs are using it).

SSID List:

Multiple SSIDs are being broadcast by the AP, which increases management overhead (beacon/probe traffic) and reduces airtime for actual data.

Problem Symptoms:

Guest users in the reception area (on 2.4 GHz, channel 1) are experiencing slow performance.

Option Analysis:

A. Reduce the number of SSIDs being broadcast by the reception AP

Correct.

Each SSID adds additional management overhead (beacons, probes) that consume airtime on already congested 2.4 GHz channels.

Reducing the number of SSIDs frees up airtime for actual client data, which can improve throughput and reduce latency, especially in high-density environments with high channel utilization.

This is a recommended best practice for optimizing Wi-Fi performance in congested environments.

B. Enable frequency handoff on the AP to band steer clients

Helpful if clients support 5 GHz, but not all client devices (especially IoT/guests) do; with such high channel utilization, this is a secondary optimization.

C. Increase the transmission power of the AP radios

This can make interference worse and does not solve airtime congestion; it may also increase contention with neighboring APs.

D. Install another AP in the reception area to improve available bandwidth

Adding more APs on congested channels can actually increase interference and may not help unless channel planning and SSID management are also addressed.

Summary:

Reducing the number of SSIDs is the most direct, configuration-based action that will improve available airtime and performance for clients in a congested, high-utilization environment like the one shown in the exhibits.

Comprehensive Detailed Step by Step Explanation from all your Knowledge and Guides availableExhibit Analysis:

The screenshot displays two FortiAPs (FP231FT and FP23JFT) in the wireless controller’s managed APs list.

Both APs are online and connected via APs.

FP231FT shows active SSIDs (“All Tunnel Mode SSIDs”) and has 11 clients connected.

FP23JFT shows “N/A” for all SSIDs and “0” clients.

Diagnosis:

“N/A” for SSIDs on FP23JFT clearly indicates it is not broadcasting any SSID.

Both APs are running the same OS version and have their respective FortiAP profiles assigned.

Evaluating the Options:

A. Enable the radios on the FAP23JF FortiAP profile.

Correct: If the radios (2.4GHz/5GHz) are disabled in the FortiAP profile, the AP will not broadcast any SSID, resulting in “N/A” and “0 clients”. This is a common issue seen in FortiOS Wireless LAN management.

This matches the symptom, as the AP is online (communicating with the controller), but has no active radio (hence, no SSID is broadcasted).

B. Replace the FortiAP device model to match the other device.

Incorrect. FortiOS supports different models in the same deployment, as long as the correct profile is applied.

C. Disable the override setting on the FortiAP that is preventing it from broadcasting SSIDs.

Misleading. Unless an override has specifically disabled SSID broadcasting, this is not directly indicated by the screenshot. Usually, radio disabled at profile is the root cause.

D. Assign the FAP231F FortiAP profile to the problematic FortiAP device.

Incorrect. The correct profile (FAP23JF) is already assigned to FP23JFT; assigning a mismatched profile can cause more issues and is not best practice.

Guide Reference & Reasoning:

FortiOS Administration Guide – Wireless Section:

When an AP is online but SSIDs are not broadcasted and “N/A” appears for radio slots, it strongly points to the radios being disabled in the FortiAP profile (see Wireless Controller > Managed FortiAPs).

The guide explains that “If the radios are disabled in the profile, the AP will not broadcast any SSID. To resolve, enable the radios (2.4GHz, 5GHz) in the FortiAP profile and reapply or reboot the AP”.

FortiAP Profile Settings:

Go to WiFi & Switch Controller > FortiAP Profiles.

Edit the FAP23JF profile.

Check both “Radio 1” and “Radio 2” (enable if disabled).

Save the changes and ensure the profile is pushed to the AP.

Typical Steps to Fix:

Log into the FortiGate.

Navigate to WiFi & Switch Controller > FortiAP Profiles.

Edit the FAP23JF profile.

Under the radio settings, ensure both radios are set to “Enable”.

Apply the changes.

The AP will now broadcast the SSIDs as configured.

Summary:

The problem is caused by disabled radios in the FAP23JF FortiAP profile. Enabling the radios in the profile will allow the AP to start broadcasting SSIDs.

Final Answer: A. Enable the radios on the FAP23JF FortiAP profile.

Analysis of the Exhibits and Scenario:

The DHCP server configuration is correct for dynamic assignment within a specified IP range for the interface “WLAN01”.

The RADIUS configuration for user1 includes:

Tunnel-Type (should be set to VLAN, but value is missing)

Tunnel-Medium-Type (set to IEEE-802, which is correct for Ethernet/WiFi)

Tunnel-Private-Group-Id (set to “infrastructure” as a string)

The problem described: Dynamic VLAN assignment is not working for user1.

How Dynamic VLAN Assignment Works in 802.1X/EAP (with FortiGate/FortiAP):

When a user authenticates, the RADIUS server returns attributes specifying the VLAN that should be assigned.

The critical attributes are:

Tunnel-Type (must be set to value “VLAN”, which is integer 13)

Tunnel-Medium-Type (must be “IEEE-802”, integer 6)

Tunnel-Private-Group-Id (can be the VLAN name or VLAN ID, depending on your configuration)

Problem in the Exhibit:

The Tunnel-Type value is missing!

It must be set to 13 (for VLAN).

The Tunnel-Medium-Type and Tunnel-Private-Group-Id are correctly set.

Corrective Action:

Update user1’s RADIUS attributes so that Tunnel-Type is set to the correct value for VLAN (integer 13).

Without this, FortiGate/FortiAP will not know to interpret the returned VLAN name or ID for dynamic assignment.

Review of Options:

Disable the DHCP server on ONBOARD to allow VLAN assignment.

Irrelevant; DHCP server presence does not affect dynamic VLAN assignment.

Add user1 in one of the VLAN names

This is not how dynamic VLAN assignment works. The RADIUS response must include the correct VLAN assignment.

Update user1 RADIUS attributes to include a VLAN ID attribute ID

Correct. You must set Tunnel-Type (13) and possibly provide the VLAN ID in Tunnel-Private-Group-Id.

Create a new VLAN name infrastructure' with a VLAN ID associated with it

Not the root cause; you must first ensure the correct attributes are present in the RADIUS response.

Summary:

The missing “Tunnel-Type” attribute value is the reason dynamic VLAN assignment is not working. The correct configuration requires setting Tunnel-Type = 13 (VLAN) for user1 in the RADIUS server.

For advanced wireless troubleshooting:

Capturing air traffic (B): This means performing a wireless packet capture (sniffing), usually via the FortiAP's diagnostic tools (e.g., cw_diag sniff), to see low-level association/authentication issues, interference, or protocol errors.

Reviewing event logs (C): Check event logs on the FortiGate and FortiAP to find authentication failures, disconnections, roaming events, or system messages specific to the wireless station.

A (creating/assigning a new profile) is not typically an advanced troubleshooting step; it's more of a configuration or workaround.

D (collecting power management info) is rarely required except for specific power-saving issues, and is not a primary advanced troubleshooting step.

When enabling a Security Fabric connection on a FortiGate interface to manage FortiAP devices, the following two types of CAPWAP (Control and Provisioning of Wireless Access Points) communication channels are established:

Control channels:

Correct. The control channel is used for management and control information between the FortiGate (controller) and FortiAP. This includes configuration, monitoring, and state updates.

Data channels:

Correct. The data channel carries client traffic between the FortiAP and FortiGate. This enables the FortiGate to apply security policies, content filtering, and other services to wireless client data.

Analysis of Other Options:

C. Security channels:

There is no specific “security channel” in CAPWAP terminology.

D. Fortlink channels:

FortLink is used for FortiSwitch management, not FortiAPs. CAPWAP is the protocol for FortiAP management.