Fortinet FCSS_LED_AR-7.6 Online Practice Questions and Exam Preparation

Fortinet FCSS_LED_AR-7.6 Online Questions & Answers

• Question 11:

  Refer to the exhibits.

  

  

  A company has multiple FortiGate devices deployed and wants to centralize user authentication and authorization. The administrator decides to use FortiAuthenticator to convert RSSO messages to FSSO, allowing all FortiGate devices to receive user authentication updates.

  After configuring FortiAuthenticator to receive RADIUS accounting messages, users can authenticate, but FortiGate does not enforce the correct policies based on user groups. Upon investigation, the administrator discovers that FortiAuthenticator is receiving RADIUS accounting messages from the RADIUS server and successfully queries LDAP for user group information. But, FSSO updates are not being sent to FortiGate devices and FortiGate firewall policies based on FSSO user groups are not being

  applied.

  What is the most likely reason FortiGate is not receiving FSSO updates?

  A. The RADIUS Username and Client IPv4 attributes are not defined on FortiAuthenticator.
  B. The LDAP server is not configured to retrieve group memberships for RSSO users.
  C. FortiAuthenticator is missing the FSSO user group attribute in the configuration.
  D. The FortiAuthenticator interface is not enabled to receive RADIUS accounting messages.
  A. The RADIUS Username and Client IPv4 attributes are not defined on FortiAuthenticator.

  ---

  In this design, FortiAuthenticator receives RADIUS accounting (RSSO) messages , looks up the user in LDAP to get group information, then injects FSSO logon events toward all FortiGate devices.

  From the exhibits we know:

  FortiAuthenticator is receiving RADIUS accounting from the RADIUS server.

  LDAP queries are successful and return group membership.

  But FortiGate does not receive FSSO logons , so identity-based policies are not applied.

  For FortiAuthenticator to create an FSSO logon, the RADIUS accounting record must be correctlyparsed into at least :

  Username

  Client IP address

  These are mapped from the RADIUS attributes in the RADIUS Accounting SSO client configuration (for example, User-Name and Framed-IP-Address). If these are not defined or mapped incorrectly, FortiAuthenticator can see the accounting packet but cannot build a valid FSSO session , so no update is sent to FortiGate.

  Thus the most likely root cause is:

  # The RADIUS Username and Client IPv4 attributes are not correctly defined for that RADIUS Accounting SSO client (optionA).

  Other options conflict with the scenario:

  B. LDAP is already successfully returning groups.

  C. FSSO user group attribute is separate; even without it, FSSO logons would still be created (just without group mapping).

  D. The interface receiving RADIUS accounting, so it is clearly enabled. is

• Question 12:

  FortiGate has been added successfully to FortiAIOps and is shown as Online. The site also uses FortiSwitch managed by that FortiGate through FortiLink. The administrator wants to monitor the FortiSwitch from FortiAIOps. Which action must be performed in FortiAIOps to add the FortiSwitch?

  A. Add the FortiSwitch by entering its serial number
  B. Add the FortiSwitch by entering its management IP address
  C. No additional action is required; it is discovered automatically through the managed FortiGate
  D. Configure FortiSwitch credentials (user ID and password) in FortiAIOps
  C. No additional action is required; it is discovered automatically through the managed FortiGate

  ---

  In LAN Edge deployments, FortiSwitch is managed indirectly via FortiGate (FortiLink). When FortiAIOps is connected to FortiGate, it gains visibility into FortiGate-managed LAN edge devices (FortiSwitch/FortiAP) without separate onboarding steps per switch.

  Therefore, once the FortiGate is successfully added, the FortiSwitch is discovered automatically.

  Why the other options are incorrect:

  A/B/D describe standalone onboarding requiring direct switch details, which is not required when the switch is already managed by the FortiGate that FortiAIOps monitors.

• Question 13:

  A network administrator connects a new FortiGate to the network, allowing it to automatically discover andI register with FortiManager. What occurs after FortiGate retrieves the FortiManager address?

  A. FortiGate establishes a secure tunnel to FortiManager over TCP port 541.
  B. The device needs to be manually authorized on FortiManager.
  C. FortiGate configures its interface settings based on a DHCP response from FortiManager.
  D. FortiGate sends a discovery request to all devices on the local network using UDP port 1068.
  A. FortiGate establishes a secure tunnel to FortiManager over TCP port 541.

  ---

  When a FortiGate is deployed using Zero Touch Provisioning (ZTP) or auto-discovery:

  FortiGate retrieves the FortiManager IP address (from DHCP Option 240, FortiCloud/ZTNA provisioning, or manual set).

  The next step is not UI authorization or DHCP changes--it immediately attempts to form a FGFM (FortiGate-FortiManager) tunnel .

  The FGFM protocol uses TCP port 541 to establish a secure management channel.

  FortiManager will still require manual authorization of the device inside FortiManager , but this occurs after the tunnel is established.

  Therefore, the first automatic action after retrieving the FMG address iscreating the secure FGFM tunnel on TCP/541 .

• Question 14:

  Refer to the exhibits.

  

  An LDAP server has been successfully configured on FortiGate. which forwards LDAP authentication requests to a Windows Active Directory (AD) server. Wireless users report that they are unable to authenticate. Upon troubleshooting, you find that authentication fails when using MSCHAPv2. What is the most likely reason for this issue?

  A. A firewall policy is missing an LDAP authentication rule.
  B. The Windows AD server requires LDAPS (LDAP over SSL) for authentication.
  C. The FortiGate LDAP configuration is missing the correct Bind DN.
  D. FortiGate does not support MSCHAPv2 for LDAP authentication.
  D. FortiGate does not support MSCHAPv2 for LDAP authentication.

  ---

  From the exhibit, LDAP on FortiGate is correctly configured and tested: diagnose test authserver ldap FAC-LDAP wifi101 password authenticate 'wifi101' against 'FAC-LDAP' succeeded! Group membership(s) - CN=Domain Users,... So: LDAP connectivity works Bind DN, DN, CNID, and credentials are correct(so option is eliminated). C Firewall policies do not affect the 802.1X / Wi-Fi authentication step itself, so is not the root cause. A Nothing in the scenario indicates that AD is enforcing LDAPS-only; the LDAP test already succeeds using the configured parameters, so is also excluded. B

  The Wi-Fi supplicant is configured for PEAP with inner authentication = MSCHAPv2.

  MSCHAPv2 is a challengeesponse mechanism designed for RADIUS , not for LDAP simple bind. FortiGate's LDAP implementation uses a simple bind (username/password) over LDAP or LDAPS , and it does not implement MSCHAPv2 against LDAP backends.

  In Fortinet's design, if you need PEAP-MSCHAPv2 with Active Directory , you must use:

  A RADIUS server (such as Windows NPS or FortiAuthenticator), and Have FortiGate use RADIUS, not LDAP, as the authentication backend for 802.1X / Wi-Fi users.

  Because FortiGate cannot process MSCHAPv2 exchanges directly against an LDAP server, authentication fails when the inner method is MSCHAPv2, even though LDAP works when tested with a simple bind from the CLI.

• Question 15:

  What is the expected behavior when enabling auto TX power control on a FortiAP interface?

  A. FortiGate monitors the signal strength of nearby AP interfaces and adjusts its own transmit power every 30 seconds to match the signal strength of the adjacent AP
  B. FortiGate measures the signal strength of nearby FortiAP interfaces every 30 seconds and adjusts their transmit power to ensure they remain detectable at -70 dBm.
  C. FortiGate periodically measures the signal strength of the weakest associated client and adjusts the AP radio power to align with the detected signal strength of that client.
  D. The AP periodically evaluates the signal strength of its own transmission from the client perspective and adjusts its power to ensure the signal is detected at -70 dBm.
  C. FortiGate periodically measures the signal strength of the weakest associated client and adjusts the AP radio power to align with the detected signal strength of that client.

  ---

  Auto TX power control on FortiAP is an RF-optimization feature:

  FortiGate (as wireless controller) continuously evaluates RSSI of associated clients on each FortiAP radio.

  The algorithm focuses on the weakest client (the one with the worst signal) and adjusts the AP's transmit power so that this client's signal level stays within a configured / target range.

  This helps balance coverage and limit co-channel interference: APs don't transmit at maximum power when clients are close, but will increase power when the weakest client signal drops too low.

  Therefore the correct behavior description is:

  # AP power is adjusted based on the weakest associated client's signal. C

  Why the others are wrong:

  Aand talk about matching nearby APs' power or forcing everything to 0 dBm, which is not how B FortiAP auto TX works.

  Dincorrectly states the AP "evaluates its own transmission from the client perspective"; the AP can only infer client-side conditions from the client's RSSI at the AP , not the inverse.

• Question 16:

  When the MAC address of a device is placed in quarantine on FortiSwitch, what happens to its egress traffic?

  A. Traffic is sent to an access VLAN.
  B. Traffic is assigned to the native VLAN.
  C. Traffic is sent as untagged traffic.
  D. Traffic is sent to an allowed VLAN.
  A. Traffic is sent to an access VLAN.

  ---

  When a device's MAC address is quarantined on a FortiSwitch (via FortiLink NAC, fabric automation, or manual quarantine), FortiSwitch enforces quarantine using the quarantine VLAN , also called the access VLAN inside FortiSwitch NAC operations.

  FortiSwitch behavior is defined in LAN Edge documentation:

  Quarantined devices are moved into an "access VLAN" reserved for isolation .

  This VLAN is statically defined on the FortiGate NAC policy , and switch ports dynamically reassign the quarantined MAC into that VLAN.

  All egress traffic from the quarantined MAC is forced into this VLAN, preventing access to the production network.

  Thus, the correct description is:

  #Traffic is sent to an access VLAN.

  Options B, C, and D are incorrect because:

  Quarantine does not reassign to native VLAN.

  It does not send untagged traffic arbitrarily.

  It does not forward traffic to allowed VLANs

• Question 17:

  A FortiGate receives RADIUS accounting messages for RSSO on port3. The accounting packets include the username in User-Name and the group membership in Class. Users appear as authenticated, but they are not mapped into the expected RSSO user groups, so group-based policies do not match. Which configuration is required to ensure correct group mapping?

  A. Set the RSSO agent sso-attribute to Class and configure the RSSO user group "RADIUS Attribute Value" to match the Class value
  B. Enable device detection and Security Fabric Connection on port3
  C. Set the RSSO agent rsso-endpoint-attribute to Framed-IP-Address
  D. Configure the firewall policy to match only after captive portal authentication
  A. Set the RSSO agent sso-attribute to Class and configure the RSSO user group "RADIUS Attribute Value" to match the Class value

  ---

  RSSO group mapping depends on two things:

  1.FortiGate must be told which RADIUS attribute contains group information (sso-attribute).

  2.The RSSO user group must match the attribute value carried in the accounting message (the "RADIUS Attribute Value" used for mapping).

  Because the scenario states group membership is in Class, FortiGate must use Class as the group attribute and the RSSO group value must match the Class contents.

  Why the other options are incorrect:

  B. Device detection / Security Fabric are unrelated to RSSO parsing and mapping.

  C. rsso-endpoint-attribute identifies the username field; the scenario already states username is User-Name, and this option points to an IP attribute instead.

  D. Captive portal is unrelated to RSSO accounting-based identity.

• Question 18:

  A FortiSwitch is not appearing in the FortiGate management interface after being connected via FortiLink. What could be a first troubleshooting step?

  A. Ensure that the FortiGate security policies allow traffic from the FortiSwitch.
  B. Manually assign a static IP to the FortiSwitch.
  C. Verify that FortiGate device DHCP server is assigning an IP to the FortiSwitch.
  D. Ensure the FortiSwitch has internet access.
  C. Verify that FortiGate device DHCP server is assigning an IP to the FortiSwitch.

  ---

  In FortiLink topologies, a managed FortiSwitch normally gets its management IP automatically from the DHCP server on the FortiLink interface . If the switch does not receive an IP:

  It cannot form the FortiLink CAPWAP/DTLS control channel.

  Therefore it does not appear under WiFi and Switch Controller > FortiSwitch .

  FortiOS documentation states that FortiLink uses a built-in DHCP server on the FortiLink interface for onboarding switches.

  So the first troubleshooting step is to confirm:

  The FortiLink DHCP server is enabled.

  Leases are being handed out to the FortiSwitch MAC.

  Other options:

  A: Security policies do not affect the L2 FortiLink control channel.

  B: Static IP may be used but is not the normal first step.

  D: Internet access is not required for FortiGate to see the switch.

• Question 19:

  Refer to the exhibits.

  

  

  Which include debug output and SSL VPN configuration details.

  An SSL VPN has been configured on FortiGate. To enhance security, the administrator enabled Required Client Certificate in the SSL VPN settings. However, when a user attempts to connect, authentication fails.

  Which configuration change is needed to fix the issue and allow the user to connect?

  A. Enable Redirect HTTP to SSL-VPN on the SSL VPN configuration page.
  B. Import the CA that signed the SSL VPN Server Certificate to FortiGate.
  C. Set the user certificate as the Server Certificate on the SSL VPN configuration page.
  D. Import the CA that signed the user certificate to FortiGate.
  D. Import the CA that signed the user certificate to FortiGate.

  ---

  The SSL-VPN configuration has Require Client Certificate enabled. When this is enabled, FortiOS performs two checks:

  Normal user authentication(username/password or PKI user)

  Additional client certificate check?the client certificatemust be signed by a CA that FortiGate trusts

  FortiOS documentation for "SSL VPN with certificate authentication" states:

  "The client certificate only needs to be signed by a known CA in order to pass authentication."

  "The CA certificate is the certificate that signed both the server certificate and the user certificate... The CA certificate is available to be imported on the FortiGate."

  The debug output shows key lines:

  __quick_check_peer-CA does not match.

  Issuer of cert depth 0 is not detected in CMDB.

  This tells us:

  FortiGate does see the user's certificate ,

  But cannot find the issuing CA in its local CA certificate store ("CMDB" = configuration database).

  This means the CA that signed the user certificate has not been imported into FortiGate.

  Now evaluate the options:

  A. Enable Redirect HTTP to SSL-VPN?affects only redirection from HTTP to HTTPS; it has nothing to do with certificate validation.

  B. Import the CA that signed the SSL VPN Server Certificate?the server certificate is already working (the portal comes up) and its CA is not what the debug complains about; the error is about the peer (user) certificate. Often the same CA signs both, but the failing check specifically says the issuer of the client cert is not in CMDB.

  C. Set the user certificate as the Server Certificate?incorrect; server and client certificates serve different roles.

  D. Import the CA that signed the user certificate to FortiGate?this directly addresses the debug error and aligns with the documented requirement that the CA which issued the user certificate must be

• Question 20:

  Refer to the exhibits.

  

  

  Examine the FortiManager configuration and FortiGate CLI output shown in the exhibit.

  The NAC feature is being tested with a device connected to port2 on managed FortiSwitch S224SPTF19005867. The NAC policy has been applied to port2, and traffic was generated from the test device. However, the traffic from the test device does not match the NAC policy and remains in the onboarding VLAN.

  What are two possible reasons why the test device is not being correctly classified by the NAC policy? (Choose two.)

  A. Device detection is not enabled on VLAN 4089.
  B. The device operating system detected by FortiGate is not Linux.
  C. Management communication between FortiGate and FortiSwitch is down.
  D. The MAC address configured on the NAC policy is incorrect.
  A. Device detection is not enabled on VLAN 4089.
  B. The device operating system detected by FortiGate is not Linux.

  ---

  From the FortiManager NAC policy:

  Category =Device

  Match criteria include MAC address and Operating System = Linux

  Action =Assign VLAN "Students"

  From the FortiGate CLI:

  diagnose switch-controller switch-info mac-table ...

  MAC: 70:88:6b:8c:4a:ce VLAN: 4089 Port: port2

  diagnose switch-controller mac-device mac onboarding

  VLAN 4089 MAC 70:88:6b:8c:4a:ce

  So the device is stuck in VLAN 4089 , which is the onboarding VLAN . No NAC policy is matched.

  For a NAC policy to match, FortiGate needs device-identity information , which comes from device detection on the VLAN / FortiLink interface plus the attributes that the policy expects (OS, MAC, etc.).

  A. Device detection is not enabled on VLAN 4089.

  If device detection is disabled on the interface/VLAN where the endpoint lives, FortiGate cannot learn OS / device info.

  Without this, the NAC engine cannot compare against the NAC policy (which relies on OS and other attributes), so the device remains in the onboarding VLAN.#This is a valid root cause.

  B. The device operating system detected by FortiGate is not Linux.

  The NAC policy explicitly requires Operating System = Linux .

  If the endpoint is actually Windows/macOS, or the OS fingerprint is still "Unknown", the policy will never match, and the device stays in onboarding.#Also a valid reason.

  C. Management communication between FortiGate and FortiSwitch is down.

  CLI output (switch-info mac-table and mac-device) proves FortiGate is talking to the switch and sees MAC/VLAN/port information.#Not a valid reason.

  D. The MAC address configured on the NAC policy is incorrect.

  The exhibits show the MAC in the NAC policy matches the MAC appearing in the MAC table.

  #Not the cause here.