Fortinet FCSS_EFW_AD-7.6 Online Practice Questions and Exam Preparation

Fortinet FCSS_EFW_AD-7.6 Online Questions & Answers

• Question 1:

  Refer to the exhibit, which shows the VDOM section of a FortiGate device.

  

  An administrator discovers that webfilter stopped working in Core1 and Core2 after a maintenance window. Which two reasons could explain why webfilter stopped working? (Choose two.)

  A. The root VDOM does not have access to FortiManager in a closed network.
  B. The root VDOM does not have a VDOM link to connect with the Corel and Core2 VDOMs.
  C. The Core1 and Core2 VDOMs must also be enabled as Management VDOMs to receive FortiGuard updates
  D. The root VDOM does not have access to any valid public FDN.
  B. The root VDOM does not have a VDOM link to connect with the Corel and Core2 VDOMs.
  D. The root VDOM does not have access to any valid public FDN.

  ---

  Explanation

  Since Core1 and Core2 are not designated as management VDOMs, they rely on the root VDOM for connectivity to external resources such as FortiGuard updates. If the root VDOM lacks a VDOM link to these VDOMs or cannot reach FortiGuard services, security features like web filtering will stop working.

• Question 2:

  An administrator configures OSPF between two FortiGate devices. However, the OSPF neighbor relationship remains in the INIT state. What is the most likely reason?

  A. The OSPF interfaces are configured in different areas.
  B. The network type on one side is broadcast and on the other side is point-to-point.
  C. OSPF authentication keys are mismatched.
  D. The OSPF priority on both sides is zero.
  C. OSPF authentication keys are mismatched.

  ---

  Explanation

  If OSPF neighbors remain in INIT state, it typically indicates that hello packets are received but no response is sent. This most commonly occurs when OSPF authentication fails because of mismatched keys. Ensuring the same authentication type and password on both sides resolves the issue.

• Question 3:

  Refer to the exhibit.

  A pre-run CLI template that is used in zero-touch provisioning (ZTP) and low-touch provisioning (LTP) with FortiManager is shown.

  

  The template is not assigned even though the configuration has already been installed on FortiGate. What is true about this scenario?

  A. The administrator did not assign the template correctly when adding the model device because pre-CLI templates remain permanently assigned to the firewall
  B. Pre-run CLI templates are automatically unassigned after their initial installation
  C. Pre-run CLI templates for ZTP and LTP must be unassigned manually after the first installation to avoid conflicting error objects when importing a policy package
  D. The administrator must use post-run CLI templates that are designed for ZTP and LTP
  B. Pre-run CLI templates are automatically unassigned after their initial installation

  ---

  Explanation

  In FortiManager pre-run CLI templates , are used in Zero-Touch Provisioning (ZTP) and Low-Touch Provisioning (LTP) to configure a FortiGate device before it is fully managed by FortiManager.

  These templates apply configurations when a device is initially provisioned. Once the pre-run CLI template is executed , FortiManager automatically unassigns it from the device because it is not meant to persist like other policy configurations. This prevents conflicts and ensures that the FortiGate configuration isnot repeatedly applied after the initial setup.

• Question 4:

  Refer to the exhibit, which contains the partial output of an OSPF command.

  

  An administrator is checking the OSPF status of a FortiGate device and receives the output shown in the exhibit. What two conclusions can the administrator draw? (Choose two.)

  A. The FortiGate device is a backup designated router
  B. The FortiGate device is connected to multiple areas
  C. The FortiGate device injects external routing information
  D. The FortiGate device has OSPF ECMP enabled
  B. The FortiGate device is connected to multiple areas
  C. The FortiGate device injects external routing information

  ---

  Explanation

  The output of the get router info ospf status command provides key information about the OSPF (Open Shortest Path First) configuration on the FortiGate device.

  The FortiGate device is connected to multiple areas

  # The output states: "This router is an ABR"

  # ABR (Area Border Router) means the device is connected to multiple OSPF areas and maintains routing information between them.

  # This confirms that the FortiGate is not just in one area , but at least one backbone area (Area 0) and another OSPF area .

  The FortiGate device injects external routing information

  # The output states: "Supports opaque LSA"

  # Opaque LSAs (Type 9, 10, and 11) are used in OSPF extensions , including those that support external route injection.

  # Typically, ABRs or ASBRs (Autonomous System Boundary Routers) inject external routes , allowing routes from other routing protocols (such as BGP or static routes) to be advertised into OSPF .

• Question 5:

  An administrator received a FortiAnalyzer alert that a 1 ## disk filled up in a day. Upon investigation, they found thousands of unusual DNS log requests, such as JHCMQK.website.com, with no answers. They later discovered that DNS exfiltration was occurring through both UDP and TLS.

  How can the administrator prevent this data theft technique?

  A. Create an inline-CASB to protect against DNS exfiltration.
  B. Configure a File Filter profile to prevent DNS exfiltration.
  C. Enable DNS Filter to protect against DNS exfiltration.
  D. Use an IPS profile and DNS exfiltration-related signatures.
  D. Use an IPS profile and DNS exfiltration-related signatures.

  ---

  Explanation

  The excessive DNS log requests with random subdomains suggest a DNS exfiltration attack , where attackers encode and transmit data via DNS queries. Since this technique can useboth UDP and TLS (DoH - DNS over HTTPS) , a

  comprehensive security approach is needed.

  Using an IPS profile with DNS exfiltration-specific signatures allows FortiGate to:

  # Detect and block abnormal DNS query patterns often used in exfiltration.

  # Inspect encrypted DNS (DoH, DoT) traffic if SSL inspection is enabled.

  # Identify known exfiltration domains and techniques based on FortiGuard threat intelligence.

• Question 6:

  A company's users on an IPsec VPN between FortiGate A and B have experienced intermittent issues since implementing VXLAN. The administrator suspects that packets exceeding the 1500-byte default MTU are causing the problems. In which situation would adjusting the interface's maximum MTU value help resolve issues caused by protocols that add extra headers to IP packets?

  A. Adjust the MTU on interfaces only if FortiGate has the FortiGuard enterprise bundle, which allows MTU modification.
  B. Adjust the MTU on interfaces in all FortiGate devices that support the latest family of Fortinet SPUs: NP7, CP9 and SP5.
  C. Adjust the MTU on interfaces in controlled environments where all devices along the path allow MTU interface changes.
  D. Adjust the MTU on interfaces only in wired connections like PPPoE, optic fiber, and ethernet cable.
  C. Adjust the MTU on interfaces in controlled environments where all devices along the path allow MTU interface changes.

  ---

  Explanation

  When using IPsec VPNs and VXLAN , additional headers are added to packets, which can exceed the default 1500-byte MTU . This can lead to fragmentation issues, dropped packets, or degraded performance .

  To resolve this, the MTU (Maximum Transmission Unit) should be adjusted only if all devices in the network path support it . Otherwise, some devices may still drop or fragment packets, leading to continued issues.

  Why adjusting MTU helps:

  # VXLAN adds a 50-byte overhead to packets.

  # IPsec adds additional encapsulation (ESP, GRE, etc.), increasing the packet size.

  # If packets exceed the MTU, they may be fragmented or dropped , causing intermittent connectivity issues.

  # Lowering the MTU on interfaces ensures packets stay within the supported size limit across all network devices.

• Question 7:

  Refer to the exhibit, which shows an ADVPN network An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2. What two options must the administrator configure in BGP? (Choose two.)

  

  A. set ebgp-enforce-multrhop enable
  B. set next-hop-self enable
  C. set ibgp-enforce-multihop advpn
  D. set attribute-unchanged next-hop
  A. set ebgp-enforce-multrhop enable
  B. set next-hop-self enable

  ---

  Explanation

  In this ADVPN (Auto-Discovery VPN) network , there are two hubs ( Hub A and Hub B ) connected via EBGP , while IBGP is used within each overlay. To ensure proper BGP routing between the overlays, the administrator must configure

  specific BGP options..

  set ebgp-enforce-multihop enable

  By default, EBGP requires directly connected neighbors. Since Hub A and Hub B are not directly connected but reach each other over an IPsec tunnel, multihop must be enabled for EBGP sessions to work.

  set next-hop-self enable

  In IBGP, the next-hop attribute does not change by default. When an IBGP route is advertised from a spoke to another hub or spoke, the next-hop needs to be updated to ensure proper reachability. Enabling next-hop-self forces the BGP

  speaker to advertise itself as the next-hop, ensuring that all spokes properly reach routes across the overlays.

• Question 8:

  An administrator configured a firewall policy with IPS, Application Control, and Web Filter. Users report slower browsing performance. Which configuration change can optimize performance without compromising security?

  A. Switch inspection mode from proxy to flow.
  B. Disable all SSL inspection profiles.
  C. Enable only antivirus in the policy.
  D. Disable session TTL checks.
  A. Switch inspection mode from proxy to flow.

  ---

  Explanation

  Flow-based inspection processes packets as they pass through the firewall, providing faster performance than proxy-based inspection, which buffers and reconstructs sessions. Flow mode still supports UTM features like IPS and Application Control efficiently.

• Question 9:

  Refer to the exhibit, which shows an enterprise network connected to an internet service provider.

  

  The administrator must configure the BGP section of FortiGate A to give internet access to the enterprise network. Which command must the administrator use to establish a connection with the internet service provider?

  A. config neighbor
  B. config redistribute bgp
  C. config router route-map
  D. config redistribute ospf
  A. config neighbor

  ---

  Explanation

  In BGP (Border Gateway Protocol) , a neighbor (peer) configuration is required to establish a connection between two BGP routers. SinceFortiGate A is connecting to the ISP (Autonomous System 10) from AS 30 , the administrator must

  define the ISP's BGP router as a neighbor .

  The config neighbor command is used to:

  #Define the ISP's IP address as a BGP peer

  #Specify the remote AS (AS 10 in this case)

  #Allow BGP route exchanges between FortiGate A and the ISP

• Question 10:

  What action can be taken on a FortiGate to block traffic using IPS protocol decoders, focusing on network transmission patterns and application signatures?

  A. Use the DNS filter to block application signatures and protocol decoders.
  B. Use application control to limit non-URL-based software handling.
  C. Enable application detection-based SD-WAN rules.
  D. Configure a web filter profile in flow mode.
  B. Use application control to limit non-URL-based software handling.

  ---

  Explanation

  FortiGate'sIPS protocol decodersanalyzenetwork transmission patternsandapplication signaturesto identify and block malicious traffic.Application Controlis the feature that allows FortiGate todetect, classify, and block applicationsbased on

  their behavior and signatures, even when they do not rely on traditional URLs.

  #Application Controlworks alongsideIPS protocol decodersto inspect packet payloads and enforce security policies based on recognized application behaviors.

  # It enablesgranular control over non-URL-based applicationssuch asP2P traffic, VoIP, messaging apps, and other non-web-based protocolsthat IPS can identify through protocol decoders.

  #IPS and Application Control together can detect evasive or encrypted applications that might bypass traditional firewall rules.