Fortinet FCSS_LED_AR-7.6 Online Practice Questions and Exam Preparation

Fortinet FCSS_LED_AR-7.6 Online Questions & Answers

• Question 1:

  Refer to the exhibits.

  

  A NAC policy has been configured to apply traffic that flows through FortiSwitch port 2. Traffic that meets the NAC policy criteria will be assigned to the Students VLAN. However, the NAC policy does not seem to be taking effect. Which configuration is missing?

  A. Port2 Access mode should be set to NAC mode.
  B. The MAC address or OS might be misconfigured for the connected device.
  C. Port2 Access mode should be set to Port Policy mode.
  D. The Students VLAN should be set to Allowed VLANs instead of Native VLAN.
  A. Port2 Access mode should be set to NAC mode.

  ---

  From the exhibits:

  FortiSwitch Ports viewshows:

  port2

  Mode: Static

  Native VLAN: Students

  Allowed VLANs: quarantine.fortilink (quarantine)

  NAC policy "Training":

  Switch FortiLink: fortilink

  Category:Device

  Matching criteria:

  MAC Address: 70:88:6b:8c:4b:0e (enabled)

  Operating System: Linux (enabled)

  Switch Controller Action:

  Assign VLAN = Students

  Bounce Port = enabled

  Design intent:

  Device with that MAC + OS Linux, when plugged into port2 , should be dynamically moved to VLAN Students by the NAC policy.

  Why it doesn't work now

  On FortiLink NAC, dynamic NAC decisions only apply on ports whose "Access Mode" is set to NAC :

  NAC mode = FortiGate controls the onboarding VLAN , evaluates NAC policies, and then dynamically reassigns the switch port VLAN (access, quarantine, etc.).

  Static mode(what we see on port2) means the port just uses its configured native/allowed VLANs , and no NAC classification happens.

  Right now:

  port2 is a static access port with Native VLAN = Students.

  The NAC policy exists, but FortiSwitch is not in NAC enforcement mode on that port , so the policy is never evaluated for traffic on port2.

  Therefore, the missing configuration is:

  Set port2 NAC mode to (sometimes called "Access mode: NAC" or "NAC LAN edge port").

  Once port2 is changed to NAC mode:

  Device initially lands in the onboarding/quarantine VLAN.

  FortiGate collects device info (MAC, OS, etc.).

  NAC policy "Training" matches MAC + Linux.

  Switch controller action Assign VLAN = Students is applied.

  Port is bounced (if configured), bringing the device back up in VLAN Students.

  Why the other options are wrong

  B. MAC or OS misconfigured

  Possible in general, but the question asks for which configuration is missing , and the exhibits clearly focus on port mode. Also, even with wrong MAC/OS, the port would still be in NAC mode; here NAC isn't even active.

  C. Port Policy mode

  Port policy (edge/trunk) is separate from NAC; NAC requires the specific NAC access mode .

  D. Students VLAN should be Allowed VLANs instead of Native VLAN

  For an access port, having Students as the native VLAN is correct. NAC policy's Assign VLAN will set that as access VLAN; no need to make it an allowed trunk VLAN.

• Question 2:

  You are setting up a captive portal to provide Wi-Fi access for visitors. To simplify the process, your team wants visitors to authenticate using their existing social media accounts instead of creating new accounts or entering credentials manually. Which two actions are required to enable this functionality? (Choose two.)

  A. Set up a remote open authorization (OAuth) server for each selected social media platform.
  B. Configure only the email login option because a social media login cannot be used with captive portals.
  C. Enable Account Login as the authentication type and configure a remote LDAP server.
  D. Set up the FortiAuthenticator internal database as the primary source for user credentials
  E. Configure the social login profiles for the supported platforms.
  A. Set up a remote open authorization (OAuth) server for each selected social media platform.
  D. Set up the FortiAuthenticator internal database as the primary source for user credentials

  ---

• Question 3:

  Refer to the exhibits.

  

  

  

  

  You are adding a new FortiSwitch to FortiGate for management. All necessary settings have been configured on FortiGate, but FortiSwitch remains offline. The cabling has been verified and is correctly connected. Which misconfiguration might be preventing FortiGate from detecting FortiSwitch?

  A. The Fortilink interface setting ip-managed-by-fortiipam must be enabled.
  B. The Fortilink interface has the wrong interface member.
  C. The Fortilink interface setting cype must be physical.
  D. The DHCP server setting vci-string is misconfigured.
  D. The DHCP server setting vci-string is misconfigured.

  ---

  On FortiLink, FortiGate's built-in DHCP server is what gives FortiSwitch its IP so it can come under management. For automatic FortiSwitch onboarding, the DHCP server is usually set with:

  set vci-match enable

  set vci-string "FortiSwitch" "FortiExtender"

  In the exhibit, the DHCP server for fortilink has:

  set vci-match enable

  set vci-string "FortiExtender"

  Because the VCI string doesn't include "FortiSwitch" , DHCP offers are only sent to clients whose Vendor Class Identifier matches FortiExtender . The FortiSwitch never receives an IP, so it stays Offline .

  Option is wrong: member "port4" matches the physical cabling in the topology. B

  Option is fine: FortiLink can be an C aggregate interface, not only physical.

  Option (ip-managed-by-fortiipam) is unrelated; FortiIPAM isn't required here. A

• Question 4:

  Why is it critical to maintain NTP synchronization between FortiGate and FortiSwitch when FortiLink is configured?

  A. To facilitate synchronization of firmware updates across devices
  B. To allow FortiSwitch to communicate with other FortiSwitche devices in the network.
  C. To ensure accurate time for logs, authentication, and event correlation
  D. To allow FortiSwitch to function in standalone mode if FortiGate becomes unavailable
  C. To ensure accurate time for logs, authentication, and event correlation

  ---

  FortiGate and FortiSwitch must share synchronized time when operating in FortiLink mode.

  Documented reasons in FortiOS:

  Accurate time synchronization is required for logs, authentication events, and fabric correlations.

  Why it's critical:

  802.1X EAP and RADIUS timestamp validation

  NAC policy enforcement timestamps

  Certificate validation

  Log correlation in Security Fabric / FortiAnalyzer

  Incorrect options:

  A: Firmware synchronization does NOT require NTP.

  B: Switch-to-switch communication does not depend on NTP.

  D: Standalone mode is unrelated to time sync.

• Question 5:

  You are troubleshooting a Syslog-based single sign-on (SSO) issue on FortiAuthenticator, where user authentication is not being correctly mapped from the syslog messages. You need a tool to diagnose the issue and understand the logs to resolve it quickly. Which tool in FortiAuthenticator can you use to troubleshoot and diagnose a Syslog SSO issue?

  A. Debug logs > Remote Servers > Syslog Viewer
  B. Parsing Test Tool
  C. Debug logs > SSO Sessions page
  D. Debug logs > Single Sign-On > Syslog SSO
  D. Debug logs > Single Sign-On > Syslog SSO

  ---

  Context: You're troubleshooting Syslog-based SSO on FortiAuthenticator :

  Devices (typically firewalls, WLAN controllers, VPN gateways) send syslog messages containing usernames, IPs, login/logout events.

  FortiAuthenticator parses those logs using Syslog SSO rules and injects logon sessions into FSSO for FortiGate.

  When users are not mapping correctly, you need to see:

  Did the syslog message arrive?

  Which matching rule (if any) caught it?

  What username and IP were extracted?

  Why was a message ignored or rejected?

  FortiAuthenticator has a dedicated debug area for this:

  Debug logs # Single Sign-On # Syslog SSO

  This view shows:

  Raw syslog lines received

  The matching rule applied (or "no match")

  Parsed fields (username, IP, group)

  Any parsing errors

  This is exactly the tool designed to troubleshoot and diagnose Syslog SSO issues .

  Why the other options are not the best for this issue

  A. Debug logs > Remote Servers > Syslog Viewer

  Lets you see syslog traffic in general, but does not show how SSO rules are applied or why they fail. Good for connectivity checks, not SSO logic.

  B. Parsing Test Tool

  Useful to test patterns and rules manually by pasting sample log lines, but it doesn't show live traffic or running SSO sessions.

  C. Debug logs > SSO Sessions page

  Shows existing SSO sessions (who is logged in), but not why a particular syslog message did not create a session.

• Question 6:

  In a Windows environment using AD machine authentication, how does FortiAuthenticator ensure that a previously authenticated device is maintaining its network access once the device resumes operating after sleep or hibernation?

  A. It temporarily assigns the device to a guest VLAN until full reauthentication is completed.
  B. It sends a wake-on-LAN packet to trigger reauthentication.
  C. It uses machine authentication based on the device IP address.
  D. It caches the MAC address of authenticated devices for a configurable period of time.
  D. It caches the MAC address of authenticated devices for a configurable period of time.

  ---

  With AD machine authentication via FortiAuthenticator:

  When a machine successfully authenticates, FortiAuthenticator records:

  Machine account / identity

  MAC addressof the device

  Associated IP and session info

  To handle sleep/hibernation:

  FortiAuthenticator keeps a cache of authenticated MAC addresses for a configured timeout.

  When the device wakes up and sends traffic again, FortiAuthenticator/FSSO can still treat it as authenticated as long as its MAC is in cache, so access is maintained without forcing a full machine re- auth immediately.

  This matches option D

  A (guest VLAN) is not the standard behavior here.

  B (WoL) is unrelated.

  C (IP-based) would break as IPs can change; MAC-based caching is what's used.

• Question 7:

  A compromised endpoint's MAC address is placed into quarantine on a managed FortiSwitch using Security Fabric automation. What happens to the endpoint's egress traffic after quarantine is applied?

  A. Traffic is forced into the configured access VLAN for isolation
  B. Traffic continues untagged on the native VLAN
  C. Traffic is forwarded normally on all allowed VLANs
  D. Traffic is redirected to the FortiGate management interface only
  A. Traffic is forced into the configured access VLAN for isolation

  ---

  In FortiSwitch quarantine behavior (NAC/quarantine automation), the switch enforces isolation by placing the quarantined MAC into the quarantine/access VLAN that is designated for restricted connectivity. Egress traffic from that endpoint is forced into the isolation VLAN, preventing access to production networks.

  Why the other options are incorrect:

  B is incorrect because quarantine is not "native VLAN" forwarding.

  C is incorrect because quarantine restricts traffic rather than allowing all permitted VLANs.

  D is incorrect because quarantine is VLAN-based isolation, not a dedicated redirection to a management interface.

• Question 8:

  Connectivity tests are being performed on a newly configured VLAN. The VLAN is configured on a FortiSwitch device that is managed by FortiGate. During testing, it is observed that devices within the VLAN can successfully ping FortiGate. and FortiGate can also ping these devices.

  Inter-VLAN communication is working as expected. However, devices within the same VLAN are unable to communicate with each other.

  What could be causing this issue?

  A. Access VLAN is enabled on the VLAN.
  B. The FortiSwitch MAC address table is missing entries.
  C. The FortiGate ARP table is missing entries.
  D. The native VLAN configured on the ports is incorrect.
  A. Access VLAN is enabled on the VLAN.

  ---

  Observed behavior:

  Devices in the VLAN can ping FortiGate # gateway reachability OK.

  FortiGate can ping devices in that VLAN # return path OK.

  Inter-VLAN routingworks # FortiGate's L3 and policies are fine.

  Devices in the same VLAN cannot ping each other# problem is on the L2 switching plane , not L3.

  On FortiSwitch (managed by FortiGate), there is a feature called Access VLAN (sometimes described in NAC /dynamic segmentation context):

  When Access VLAN is enabled on a VLAN, the switch does not perform normal L2 forwarding between hosts in that VLAN.

  Instead, all traffic from endpoints in that VLAN is forced upstream to FortiGate , as if every frame were destined for the gateway.

  This is used for designs where you want all intra-VLAN traffic inspected by the firewall , implementing micro-segmentation.

  Resulting behavior:

  Host # FortiGate: works (frames are forwarded to FortiGate).

  FortiGate # Host: works (routed back).

  Host A # Host B (same VLAN):

  Frame from A goes to FortiGate.

  FortiGate sees source and destination in same subnet ; depending on policy, it may drop or not have a policy allowing that traffic.

  Even if allowed, certain designs still break pure L2 expectations.

  In the exam scenario, the key point is:

  If Access VLAN is enabled local L2 communication within that VLAN is disabled , , so hosts in the same VLAN cannot communicate directly.

  That perfectly explains:

  Same VLAN hosts can't ping each other

  But they can both reach FortiGate and beyond

  Why the other options are less likely / incorrect

  B. FortiSwitch MAC address table is missing entries

  If MAC table were empty/bad, nothing in that VLAN would work properly, including pinging FortiGate.

  C. FortiGate ARP table is missing entries

  Then FortiGate couldn't ping the devices either; but it can.

  D. Native VLAN misconfigured on ports

  That would affect connectivity to FortiGate too, not only host-to-host.

• Question 9:

  In addition to requiring a FortiAnalyzer device to configure the Security Fabric, which license must be added to FortiAnalyzer to use Indicators of Compromise (IOC) rules?

  A. loT Security Add-on license
  B. IOC Subscription license
  C. IOC detection is included on FAZ-Basic license
  D. Threat Detection Service license
  D. Threat Detection Service license

  ---

  FortiAnalyzer requires a specific license to evaluate Indicators of Compromise (IOC).

  From the FortiAnalyzer 7.4.1 Administration Guide :

  IOC identification requires theThreat Detection Servicelicense on FortiAnalyzer.

  This license enables:

  IOC database updates

  Compromised host detection

  Event correlation based on FortiGuard threat intelligence

  Fabric-wide IOC automation triggers

  Why the other answers are incorrect:

  A: IoT Security add-on is unrelated to IOC rules.

  B: There is no IOC subscription license type for FortiAnalyzer.

  C: FAZ-Basic license does NOT include IOC detection.

• Question 10:

  Refer to the exhibit.

  

  Which shows the WTP profile configuration.

  The AP profile is assigned to two FAP-231F APs that are installed in an open plan area.

  The first AP has 32 clients associated with the 5 GHz radios and 22 clients associated with the 2.4 GHz radio. The second AP has 12 clients associated with the 5 GHz radios and 20 clients associated with the 2.4 GHz radio.

  A dual-band-capable client enters the area near the first AP and the first AP measures the new client at - 3 3 dBm signal strength. The second AP measures the new client at -43 dBm signal strength.

  If the new client attempts to conned to the student 01 wireless network, which AP radio will the client be associated with?

  A. The first AP 2.4 GHz interface provides a stronger signal, which clients often prioritize.
  B. The first AP 5 GHz interface because it has a stronger signal.
  C. The second AP 5 GHz interface has fewer clients, which ensures better performance despite the weaker signal.
  D. The second AP 2.4 GHz interface is preferred over 5 GHz for better speed and lower interference.
  C. The second AP 5 GHz interface has fewer clients, which ensures better performance despite the weaker signal.

  ---

  From the WTP profile :

  set handoff-rssi 30

  set handoff-sta-thresh 30

  config radio-1

  set band 802.11n-2G

  set vaps "Student01"

  config radio-2

  set band 802.11ac-5G

  set darrp enable

  set arrp-profile "arrp-default"

  set vaps "Student01"

  Key points:

  Same SSID (Student01)is broadcast on both APs and on both bands (2.4 and 5 GHz).

  handoff-sta-thresh 30 enables client load-balancing between APs:

  When an AP radio has more than 30 associated clients , it starts rejecting new associations so that clients connect to a neighboring AP instead (as long as RSSI is still acceptable).

  Current client counts:

  AP1:32 clients on 5 GHz, 22 on 2.4 GHz

  AP2:12 clients on 5 GHz, 20 on 2.4 GHz

  So on 5 GHz:

  AP1's 5-GHz radio exceeds the 30-client threshold (32 > 30) # it will try to push new clients away .

  AP2's 5-GHz radio is well below the threshold (12 clients) and will happily accept new clients.

  The new dual-band client is seen at:

  -33 dBmby AP1

  -43 dBmby AP2

  Even though AP1 has the stronger signal, its 5-GHz radio is already overloaded according to the configured threshold, so AP1 will refuse association attempts from that client. The client will then associate toAP2's 5- GHz radio , which:

  Has fewer clients (better airtime per device), and

  Still has an acceptable signal (-43 dBm is easily usable on 5 GHz).

  That matches option exactly. C

  Other options are incorrect because they ignore the configured client-load-balancing thresholds and assume association based purely on RSSI or prefer 2.4 GHz, which is not what this profile is tuned to do.