FCSS_EFW_AD-7.6 by Fortinet Actual Free Exam Questions And Answers

Question 1

You applied a block-all intrusion prevention system (IPS) profile for client and server targets to secure the server, but the database team reported that applications stopped working immediately after. How can you apply IPS in a way that ensures it does not disrupt existing applications in the network?

A. Limit the IPS profile to server targets only and set the action to default.

B. Select flow mode in the IPS profile and monitor the application patterns.

C. Use an IPS profile with all signatures in monitor mode and verify patterns before blocking.

D. Set the IPS profile signature action to default and verity patterns.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 2

Users in your organization who are on an IPsec VPN between FortiGate A and FortiGate B are experiencing intermittent issues since implementing VXLAN. You suspect that packets exceeding the 1500-byte default maximum transmission unit (MTU) are causing the problems. How would you adjust the interface MTU value help resolve issues caused by protocols that add extra headers to IP packets?

A. Adjust the MTU on all FortiGate interfaces after adjusting the TCP maximum segment size (MSS).

B. Adjust the MTU on interfaces in controlled environments where all devices along the path allow MTU interface changes.

C. Adjust the MTU on interfaces only in wired connections like Point-to-Point Protocol over Ethernet (PPPOE), optic fiber, and Ethernet cable.

D. Adjust the MTU on interfaces only on FortiGate A and FortiGate B.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 3

Refer to the exhibit.

FortiGate_A and FortiGate_B are members of a FortiGate Session Life Support Protocol (FGSP) cluster in an enterprise network.
While testing the cluster using the ping command, you monitor packet loss and on FortiGate_B, you see the session list output is shown in the exhibit.
What is causing this output on FortiGate_B?

A. The session synchronization is encrypted.

B. session-pickup-connectionless is set to disable on FortiGate_B.

C. standalone-config-sync is set to disable on FortiGate_B.

D. FortiGate_B is configured in passive mode.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 4

You must enable direct communication between multiple spokes in a organization's network.
Each spoke has more than one internet connection. Each spoke must connect directly without passing through the hub and the links must automatically switch to the best available connection.
How can you achieve automatic detection and optimal link utilization between spokes?

A. Use ADVPN 2.0 to facilitate dynamic direct tunnels and automatic link optimization.

B. Establish dynamic VPN tunnels between spokes with predefined backup routes.

C. Set up OSPF routing over dynamic VPN tunnels between spokes.

D. Implement SD-WAN policies at the hub and the spokes.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 5

A company that acquired multiple branches across different countries needs to install new FortiGate devices on each of those branches. However, the IT staff lacks sufficient knowledge to implement the initial configuration on the FortiGate devices.
Which three approaches can the company take to successfully deploy advanced initial configurations on remote branches? (Choose three.)

A. Apply Jinja in the FortiManager scripts for large-scale and advanced deployments.

B. Use the Global ADOM to deploy global object configurations to each FortiGate device.

C. Use metadata variables to dynamically assign values according to each FortiGate device.

D. Add FortiGate devices on FortiManager as model devices, and use ZTP or LTP to connect to FortiGate devices.

E. Use provisioning templates and install configuration settings at the device layer.

Discussion 0

Correct Answer: C,D,E Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 6

Refer to the exhibits. The exhibits show a network topology, a firewall policy, and an SSL/SSH inspection profile configuration.

Why is FortiGate unable to detect HTTPS attacks on firewall policy ID 3 targeting the Linux server?

A. The administrator must enable HTTPS in the protocol port mapping of the deep- inspection SSL/SSH inspection profile.

B. The administrator must set the policy to inspection mode to analyze the HTTPS packets as expected.

C. The administrator must enable SSL inspection of the SSL server and upload the certificate of the Linux server website to the SSL/SSH inspection profile.

D. The administrator must enable cipher suites in the SSL/SSH inspection profile to decrypt the message.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 7

Refer to the exhibit, which shows an ADVPN network.

An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2.
What must the administrator configure in the phase 1 VPN IPSEC configuration of the Hub2Hub tunnels?

A. set add-route enable

B. set auto-discovery-forwarder enable

C. set auto-discovery-receiver enable

D. set auto-discovery-sender enable

Discussion 0

Correct Answer: B Vote an answer

Question 8

A vulnerability scan report has revealed that a user has generated traffic to the website example.com (10.10.10.10) using a weak SSL/TLS version supported by the HTTPS web server.
What can the firewall administrator do to block all outdated SSL/TLS versions on any HTTPS web server to prevent possible attacks on user traffic?

A. Install the required certificate in the client's browser or use Active Directory policies to block specific websites as defined in the SSL/SSH inspection profile.

B. Configure the unsupported SSL version and set the minimum allowed SSL version in the HTTPS settings of the SSL/SSH inspection profile.

C. Enable auto-detection of outdated SSL/TLS versions in the SSL/SSH inspection profile to block vulnerable websites.

D. Use the latest certificate, Fortinet_SSL_ECDSA256, and replace the CA certificate in the SSL/SSH inspection profile.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Fortinet FCSS - Enterprise Firewall 7.6 Administrator - FCSS_EFW_AD-7.6 Exam Practice Test

Contact Us

Useful Links

Latest Updated