Fortinet FCP_FWF_AD-7.4 FCP - Secure Wireless LAN 7.4 Administrator Exam Practice Test

WPA3 improves security over WPA2 by, among other things:

Using robust key establishment (SAE/Dragonfly), which is not vulnerable to KRACK (Key Reinstallation Attack).

WPA3 does not enforce only enterprise mode, nor does it universally prevent all legacy protocols, nor is 128-bit key size unique to WPA3.

The logs show repeated client-association-failure events followed by RADIUS authentication failure messages for client

This means the station successfully associated at Layer 2 but failed at the RADIUS authentication step (802.1X/EAP), typically due to invalid credentials or a misconfiguration on the RADIUS server.

Eventually, the log shows a successful authentication, indicating the credentials or RADIUS issue was resolved on a later attempt.

Exhibit Analysis:

The diagram shows a section of the 5 GHz Wi-Fi band, with several adjacent channels: 149, 153, 157, 161.

The red line outlines a wider frequency range covering multiple adjacent channels (149, 153, 157).

What this means:

In Wi-Fi (especially 802.11ac/ax), “channel bonding” means combining adjacent 20 MHz channels into a wider channel (40, 80, or even 160 MHz).

The red line indicates the frequency range that would be used if an 80 MHz channel (covering channels 149, 153, 157, 161) is formed by bonding the narrower channels together.

This increases throughput because a wider channel allows more data to be transmitted at once.

Option Review:

A. Practical channel bonding to increase high throughput

Correct. The red line represents the spectrum occupied when several 20 MHz channels are bonded into a single, wider channel to increase data rates.

B. A pool of channels for the wireless radio to broadcast the wireless signal.

Incorrect. A pool would be all available channels, not the bonded range.

C. The range of channels used to allocate available airtime while transmitting data

Incorrect. This is about frequency, not time.

D. The total length of the wireless signal wavelength

Incorrect. The line indicates frequency spectrum, not wavelength length.

Summary:

The red line shows how multiple adjacent 20 MHz channels are bonded together (in this case, most likely into an 80 MHz channel), a practical method to increase wireless throughput in modern Wi-Fi networks.

The scenario involves employees connecting via remote FortiAP (FAP) devices, with a requirement to enforce corporate security policies for all wireless stations at branch/remote sites.

Teleworker topology (also called remote AP, or split-tunnel mode) is designed exactly for this:

FortiAP at remote sites connects to the main office FortiGate via a secure tunnel (CAPWAP over VPN or DTLS).

Traffic destined for corporate resources is tunneled back to the main office for full security inspection and policy enforcement.

Local internet-bound traffic can be split off locally (split-tunnel) or tunneled back as well (full-tunnel), based on policy.

This ensures all employee wireless sessions accessing corporate resources are subject to central security policies, without requiring local IT staff.

Option A (VPN tunnels) is part of the teleworker topology but doesn't by itself ensure wireless security enforcement or policy application for wireless stations—teleworker/split-tunnel is more precise.

Option B is impractical and unnecessary.

Option C moves resources to the cloud, but this does not ensure security enforcement for wireless clients over remote links.

Summary: Teleworker topology on FortiAP allows secure, policy-enforced connectivity from remote sites back to HQ for all wireless stations.

Exhibit Review:

The diagnostics panel for FortiAP FP231FTF2001 shows:

Tx bandwidth label: 150.54 Mbps (likely the negotiated or theoretical maximum).

Bandwidth graph (actual traffic): Transmit (Tx) bandwidth peaked at only ~3 Mbps over the last 5 minutes—far below the maximum.

Radio 1 (2.4 GHz) shows 10 interfering SSIDs and 40% channel utilization.

Radio 2 (5 GHz) is not the focus in the current graph.

Interpretation:

The significant difference between the potential (label) and actual (graph) throughput indicates that something is preventing the AP from delivering full speed.

This could be resource overload (e.g., too many clients, too much interference, CPU/memory constraints), leading to overall reduced throughput for all users.

The graph represents real-time/actual usage, not just the theoretical capability.

Option Breakdown:

A. Resources on FortiAP are overloaded which limits speed rates for all users

Correct. Overload (either due to too many clients, high interference, or hardware resources) is a logical reason why actual throughput is far below the possible maximum.

B. Label values are historical and provide average bandwidth

Incorrect. The label reflects the maximum link rate or negotiated data rate, not an average or historical usage value.

C. FortiAP is dual band and is transmitting data faster with a higher frequency band

Not supported by the evidence. The current data is for Radio 1 (2.4 GHz) and does not show high usage on either band.

D. Bandwidth is shared with other SSID signals broadcasting for nearby AP devices

While interference does share airtime, the drastic drop in throughput strongly suggests an overload or other limiting factor on this AP.

Summary:

The large gap between the expected maximum (label) and the actual throughput observed suggests that resource overload is the root cause of poor wireless speeds for all users.

When you need different access levels for various users and device types but want to keep the SSID structure simple, dynamic VLAN assignment is the best practice.

With dynamic VLANs, all clients connect to the same SSID. The RADIUS server (via 802.1X authentication or MAC authentication) assigns each user or device to a specific VLAN based on attributes (like user group, device type, etc.).

This design:

Reduces SSID sprawl.

Allows flexible, scalable, and policy-driven access.

Simplifies management and enhances security.

The other options are either less scalable (multiple SSIDs) or do not provide the required dynamic access control (user groups or NAC alone without VLAN assignment).

FortiPresence is Fortinet’s Wi-Fi analytics/cloud presence platform.

FortiAPs can be managed directly by FortiGate or FortiLAN Cloud and connect their analytics/events to the FortiPresence cloud for presence analytics.

FortiSASE and FortiSwitch Manager do not provide FortiPresence integration for APs.

Exhibit Analysis:

Bandwidth: The Tx (2.06 kbps) and Rx (2.09 kbps) are balanced and low, showing steady, light activity.

Signal Strength/Noise: The signal appears to be relatively stable, not showing drops to 0 dB or significant noise spikes.

Transmission Discard/Retry:

Transmission Discard Percentage: 0% (normal; no packets are being discarded).

Transmission Retry Percentage: 25% (abnormally high; typically, values above 10-15% suggest issues).

Option Breakdown:

A. The wireless client has been experiencing high background noise within the last 5 minutes

Incorrect. The Signal Strength/Noise graph is steady and does not indicate abnormal noise.

B. The wireless client has been dropping half of the packets transmitted within the last 5 minutes.

Incorrect in wording: The Discard Percentage is 0%. So, no packets are being dropped, but...

However, the Transmission Retry Percentage is high (25%). This indicates many packets are having to be retransmitted (due to interference, weak signal, or congestion), which is abnormal. If "dropping" is interpreted as "requiring retry," then this fits.

C. The wireless client has been transmitting traffic with all performance metrics within the normal levels

Incorrect. The Retry Percentage is not normal.

D. The wireless client has been switching between available wireless bands within the last 5 minutes

Incorrect. There is no data here to suggest band steering or band switching.

Clarification:

The only abnormal value is Transmission Retry Percentage (25%), which is significantly high. This indicates repeated transmission attempts due to interference, poor signal quality, or congestion.

Best Match:

B. The wireless client has been dropping half of the packets transmitted within the last 5 minutes.

More precisely, it's retransmitting, not dropping, but this is the best answer provided.

Channel utilization directly measures how much airtime is consumed by wireless transmissions (including data, management, and interference).

Monitoring channel utilization helps optimize the network by:

Identifying congestion or over-utilized channels.

Allowing channel re-planning and SSID optimization.

The other options (AP firmware, event logs, user count) are helpful, but only channel utilization gives actionable insight for radio resource optimization.