Fortinet FCSS_LED_AR-7.6 Online Practice Questions and Exam Preparation

Fortinet FCSS_LED_AR-7.6 Online Questions & Answers

• Question 21:

  A network engineer is deploying FortiGate devices using zero-touch provisioning (ZTP). The devices must automatically connect to FortiManager and receive their configurations upon first boot. However, after powering on the devices, they fail to register with FortiManager. What could be a possible cause of this issue?

  A. The FortiGate device requires manual intervention to accept the FortiManager connection.
  B. In this scenario, the ZTP process works only when devices are connected using a console cable.
  C. The FortiGate device must be preloaded with a configuration file before ZTP can function.
  D. The FortiManager IP address is not reachable over TCP port 541.
  D. The FortiManager IP address is not reachable over TCP port 541.

  ---

  Zero-Touch Provisioning (ZTP) for FortiGate devices is handled through FortiDeploy , which automatically connects a FortiGate to FortiManager so the device can download configuration templates and be centrally managed.

  For ZTP to work, the newly booted FortiGate must successfully reach FortiManager. One of thecritical requirements is connectivity over the FGFM (FortiGate-FortiManager) management protocol , which uses:

  TCP Port 541

  This is clearly stated in multiple Fortinet documents:

  FortiGate Cloud Admin Guidelists port 541 as the management channel used for FortiGate # FortiManager / FortiGate Cloud communications:"Management... Protocol: TCP, Port:541"

  FortiOS Administration Guidealso confirms this:"FortiManager provides remote management of FortiGate devices overTCP port 541."

  Since ZTP uses FortiDeploy to push the FortiManager IP to the device and relies on FGFM (port 541) for registration and configuration delivery, any failure on this port breaks the entire ZTP workflow.

  Why option D is correct

  If the FortiGate cannot reach FortiManager on TCP/541 , it cannot register , cannot be authorized, and cannot receive its configuration -- leading to a ZTP failure.

  This is the most common cause in real deployments:

  Firewall blocking TCP/541

  Upstream NAT device not forwarding 541

  ISP restrictions

  Incorrect FortiManager IP or routing issue

  ZTP device behind a network that does not allow outbound 541

  Why the other options are incorrect

  A. The FortiGate device requires manual intervention to accept the FortiManager connection.

  Incorrect.

  ZTP is built specifically to avoid manual intervention. Once the FortiDeploy key is used, the device auto- connects to FortiManager without needing local acceptance.

  B. ZTP works only when devices are connected using a console cable.

  Incorrect.

  ZTP requires no console cable -- that's the whole point. It relies on DHCP, WAN connectivity, and FortiDeploy auto-join.

  C. The FortiGate device must be preloaded with a configuration file before ZTP can function.

  Incorrect.

  Preloading configuration defeats the purpose of ZTP.

  ZTP delivers the initial configuration automatically from FortiManager using FortiDeploy.

  LAN Edge 7.6 Architect Context

  LAN Edge deployments often use FortiManager as the central orchestrator for:

  FortiSwitch management via FortiLink

  FortiAP wireless provisioning

  SD-Branch configuration templates

  Security Fabric automation

  For all of this, ZTP enables remote sites to deploy FortiGate, FortiSwitch, and FortiAP withno on-site expertise .

  If TCP/541 to FortiManager is blocked, the entire LAN Edge deployment pipeline fails, making option the D only valid and document-supported answer.

• Question 22:

  A network engineer is deploying FortiGate devices using zero-touch provisioning (ZTP) so they automatically register to FortiManager and download configuration on first boot. The WAN link is up and DHCP works, but the FortiGate devices never appear in FortiManager. Which connectivity requirement is the most critical to verify?

  A. FortiGate can reach FortiManager over TCP port 541
  B. FortiGate can reach FortiManager over UDP port 5246
  C. FortiGate can reach FortiManager over TCP port 4433
  D. FortiGate can reach FortiManager over ICMP ping
  A. FortiGate can reach FortiManager over TCP port 541

  ---

  FortiGate-to-FortiManager management (FGFM) requires connectivity over TCP/541. ZTP relies on the FortiGate establishing the FGFM tunnel to FortiManager to register and receive provisioning/configuration. If TCP/541 is blocked or unreachable, registration fails even if basic WAN connectivity exists.

  Why the other options are incorrect:

  B (CAPWAP) relates to FortiAP control, not FortiManager registration.

  C (UHTTPS/4433) is used in other Fortinet management contexts (for example, FortiLink-related secure exchanges), not FGFM registration.

  D ping reachability does not confirm the required management protocol/port is permitted.

• Question 23:

  Refer to the exhibits.

  

  

  Examine the FortiGate RSSO configuration shown in the exhibit. FortiGate is set up to use RSSO for user authentication. It is currently receiving RADIUS accounting messages through port3. The incoming RADIUS accounting messages contain the username in the User- Name attribute and group membership in the Class attribute. You must ensure that the users are authenticated through these RADIUS accounting messages and accurately mapped to their respective RSSO user groups. Which three critical configurations must you implement on the FortiGate device? (Choose three.)

  A. The RADIUS Attribute Value setting configured for an RSSO user group should match the class RADIUS attribute value in the RADIUS accounting message.
  B. RSSO user groups should be assigned to all firewall policies.
  C. Device detection and Security Fabric Connection should be enabled on port3
  D. The sso-attribute CLI setting in the RSSO agent configuration should be set to Class.
  E. The rsso-endpoint-attribute CLI setting in the RSSO agent configuration should be set to User-Name.
  A. The RADIUS Attribute Value setting configured for an RSSO user group should match the class RADIUS attribute value in the RADIUS accounting message.
  D. The sso-attribute CLI setting in the RSSO agent configuration should be set to Class.
  E. The rsso-endpoint-attribute CLI setting in the RSSO agent configuration should be set to User-Name.

  ---

  The problem states:

  FortiGate receives RADIUS accounting messages on port3 .

  User-Nameattribute contains the username.

  Classattribute contains the group membership.

  Goal: authenticate users through RSSO and map them to the correct user groups.

  To achieve this, three critical components must be configured:

  #A. RADIUS Attribute Value in the RSSO group must match the Class attribute

  This is mandatory because:

  RSSO user groups on FortiGate match users based on the value inside the RADIUS attribute (usually Class).

  For group assignment to work, FortiGate must compare:

  RSSO User Group # RADIUS Class Attribute Value

  This is exactly how FortiGate maps RSSO users to groups .

  #D. RSSO agent's sso-attribute must be set to Class

  The sso-attribute defines which RADIUS attribute contains the group information .

  Because group membership is carried in:

  #Class attribute

  You must configure:

  config user radius

  set sso-attribute Class

  end

  This tells FortiGate:

  "Use the Class attribute to derive user group membership."

  #E. rsso-endpoint-attribute must be set to User-Name

  This identifies which RADIUS attribute carries the actual username .

  In this scenario:

  RADIUS accounting messages contain the username in User-Name .

  So the correct setting is:

  config user radius

  set rsso-endpoint-attribute User-Name

  end

  This ensures the RSSO user object uses the correct username.

  #Incorrect Options Explained

  B. Assign RSSO user groups to all firewall policies

  Not required.

  You only assign them to policies where RSSO authentication is used.

  C. Device detection and Security Fabric Connection should be enabled on port3

  Totally irrelevant to RSSO.

  RSSO only needs RADIUS accounting, not device detection or Fabric services.

• Question 24:

  A company uses FortiAuthenticator for AD machine authentication. A laptop successfully authenticates and is allowed onto the network. After the laptop goes into sleep mode and later wakes up, the user reports that network access is still available without immediate full reauthentication. What mechanism most likely explains this behavior?

  A. The device is moved into a guest VLAN until reauthentication completes
  B. FortiAuthenticator sends a Wake-on-LAN packet to force reauthentication
  C. FortiAuthenticator authenticates the device only by IP address
  D. FortiAuthenticator caches the MAC address of authenticated devices for a configurable period
  D. FortiAuthenticator caches the MAC address of authenticated devices for a configurable period

  ---

  With AD machine authentication, FortiAuthenticator maintains continuity across short disruptions (sleep/hibernation) by caching the endpoint identity (commonly MAC-based) for a configurable timeout. When the endpoint resumes activity, the cached entry can still be treated as authenticated until the cache expires, avoiding immediate full reauth.

  Why the other options are incorrect:

  A is not the standard mechanism for sleep/hibernation continuity.

  B is unrelated to authentication state tracking.

  C is unreliable because IPs can change and is not the primary method described for maintaining the authenticated state.

• Question 25:

  You are deploying a FortiSwitch device managed by FortiGate in a secure network environment. To ensure accurate communication, you must identify which protocols are required for communication and control between FortiGate and FortiSwitch. Which three protocols are used by FortiGate to manage and control FortiSwitch devices? (Choose three.)

  A. SNMP can be used by FortiGate to manage FortiSwitch devices by monitoring their status.
  B. UHTTPS is usea;by FortiGate to securely manage and configure FortiSwitch devices.
  C. FortiGate uses the Fortilink protocol to establish communication with FortiSwitch.
  D. CAPWAP is used to establish the control channel between FortiSwitch and FortiGate.
  E. IGMP is required for managing communication between FortiGate and FortiSwitch devices in multicast environments.
  B. UHTTPS is usea;by FortiGate to securely manage and configure FortiSwitch devices.
  C. FortiGate uses the Fortilink protocol to establish communication with FortiSwitch.
  D. CAPWAP is used to establish the control channel between FortiSwitch and FortiGate.

  ---

  Let's verify each protocol:

  C. FortiGate uses the FortiLink protocol to establish communication with FortiSwitch.#

  FortiLink is the management and control protocol , encapsulated over:

  LLDPfor discovery

  CAPWAP (UDP/5246?247)for control channel

  DHB (Device Handshake Bus)inside CAPWAP frames

  Thus, FortiLink is required .

  D. CAPWAP is used to establish the control channel between FortiSwitch and FortiGate.#

  Although CAPWAP is commonly associated with FortiAP, FortiSwitch also uses CAPWAP internally when managed by FortiGate.

  This is documented in:

  FortiSwitch Administration Guide

  LAN Edge deployment guide

  So D is correct .

  B. UHTTPS is used by FortiGate to securely manage and configure FortiSwitch devices.#

  FortiLink session actually uses:

  Encrypted CAPWAP (over DTLS)

  UHTTPS (port 4433)for secure configuration exchanges

  This protocol is mandatory for:

  Switch configuration synchronization

  Firmware upgrade

  NAC data exchange

  VLAN provisioning

  Therefore UHTTPS is indeed one of the key protocols .

  Why the incorrect options are wrong:

  A. SNMP can be used by FortiGate to manage FortiSwitch.#

  FortiGate does not use SNMP to manage FortiSwitch.

  SNMP is for monitoring by external systems, not for FortiLink control.

  E. IGMP is required for management.#

  IGMP is a multicast protocol, irrelevant for FortiGate-FortiSwitch management.

• Question 26:

  You've configured the FortiLink interface, and the DHCP server is enabled by default. The resulting DHCP server settings are shown in the exhibit.

  

  What is the role of the vci-string setting in this configuration?

  A. To ignore DHCP requests coming from FortiSwitch and FortiExtender devices.
  B. To restrict the IP address assignment to devices that have FortiSwitch or FortiExtender as their hostname.
  C. To connect, devices must match the VCI string; otherwise, they will not receive an IP address.
  D. To reserve IP addresses for FortiSwitch and FortiExtender devices.
  C. To connect, devices must match the VCI string; otherwise, they will not receive an IP address.

  ---

  The DHCP configuration shows:

  set vci-match enable

  set vci-string "FortiSwitch" "FortiExtender"

  What this means

  VCI = Vendor Class Identifier (DHCP option 60)

  When vci-match is enabled, the DHCP server will only respond to DHCP requests from clients whose VCI string matches the configured vendor identifiers.

  FortiSwitch and FortiExtender both send DHCP option 60 with:

  "FortiSwitch"

  "FortiExtender"

  This is used in FortiLink deployments so only these devices receive IP addresses on the FortiLink network.

  Therefore:

  C. To connect, devices must match the VCI string; otherwise, they will not receive an IP address.

  #Correct.

  This perfectly matches FortiGate FortiLink DHCP behavior.

  Summary of incorrect options

  A -- Ignore FortiSwitch/FortiExtender

  #Opposite behavior.

  B -- Restrict based on hostname

  #VCI does NOT check hostname.

  D -- Reserve IPs

  #No reservation occurs; it's filtering, not reserving.

• Question 27:

  Refer to the exhibits.

  

  

  

  

  A FortiSwitch is successfully managed by a FortiGate. FortiAP is connected to port1 of the managed FortiSwitch. On FortiGate, the VLAN AP is configured to detect and manage FortiAP, along with a DHCP server for the VLAN AP. Additionally, the VLAN AP is assigned to port1 of FortiSwitch. However. FortiGate is unable to detect or manage FortiAP.

  Which FortiGate misconfiguration is preventing the detection of FortiAP?

  A. Security Fabric is disabled in the administrative access options of the VLAN.
  B. The FortiAP firmware is incompatible with the FortiGate firmware version.
  C. The VLAN is not tagged correctly on the FortiSwitch uplink port.
  D. The CAPWAP ports (UDP 5246 and 5247) are not open on FortiGate.
  A. Security Fabric is disabled in the administrative access options of the VLAN.

  ---

  From the exhibits:

  Interface "APs" is a VLAN sub-interface on fortilink with IP 10.10.100.254/24 and a DHCP server scope 10.10.100.1?0.10.100.253.

  This VLAN is assigned to port1 on the managed FortiSwitch for FortiAPs.

  The interface config shows only allowaccess ping -- Security Fabric Connection is not enabled.

  In LAN Edge designs, FortiAPs connected through FortiSwitch are discovered and managed asLAN edge devices of the Security Fabric . FortiOS documentation states that FortiAPs and FortiSwitches appear in the Fabric topology only when connected on an interface with Security Fabric Connection enabled . If the VLAN/AP management interface lacks Security Fabric Connection:

  FortiGate does not treat that network as a Fabric connection segment.

  CAPWAP discovery from FortiAPs on that VLAN will not result in the AP being onboarded and shown for management.

  Therefore the key misconfiguration is:

  #A - Security Fabric is disabled on the VLAN interface used for AP management.

  Why the others are not the root cause:

  B. Firmware incompatibility - would usually show as a "Managed (upgrade required)" or similar status after discovery, not complete non-detection. The scenario specifically points to a configuration issue, not firmware.

  C. VLAN not tagged correctly on uplink - The FortiSwitch uplink to FortiGate is the FortiLink trunk, and the VLAN sub-interface APs is already bound to fortilink, so tagging on the uplink is correct by definition.

  D. CAPWAP ports not open - CAPWAP (UDP 5246/5247) is terminated locally on FortiGate and does not depend on any firewall policy; these ports are open on the FortiGate itself by default.

• Question 28:

  During testing of an external captive portal, users are redirected to a custom HTTPS login page hosted on a third-party web server. After submitting credentials, authentication fails and FortiGate logs indicate an invalid or missing session token. Which POST parameter must be preserved and returned to FortiGate to validate the captive portal session?

  A. username
  B. redir
  C. magic
  D. email
  C. magic

  ---

  In FortiGate captive portal workflows (local or external), FortiGate inserts a hidden per-session token into the redirect. That token must be returned unchanged in the HTTPS POST request so FortiGate can associate the login submission with the correct intercepted session.

  The required parameter is magic:

  It is generated per captive portal session.

  It ties the POST submission back to the original user session (IP/interface/session context).

  If the external portal does not preserve and resend it exactly, FortiGate rejects the login as invalid or "session not found".

  Why the other options are incorrect:

  A. username -- user input field; not a session integrity token.

  B. redir -- used for post-login redirection; not used to validate the session.

  D. email -- optional field in some guest flows; not used for session validation.

• Question 29:

  An administrator enables Require Client Certificate for SSL VPN on FortiGate. Users can reach the SSL VPN portal, but the connection fails during authentication with certificate validation errors indicating the issuer is unknown on FortiGate. Which configuration change is required to resolve the issue?

  A. Enable Redirect HTTP to SSL-VPN
  B. Import the CA certificate that signed the SSL VPN server certificate
  C. Replace the SSL VPN server certificate with the user certificate
  D. Import the CA certificate that signed the user certificate
  D. Import the CA certificate that signed the user certificate

  ---

  When Require Client Certificate is enabled, FortiGate must trust the CA that issued the client (user) certificate. If FortiGate does not have the issuing CA in its local CA store, client certificate validation fails even if the portal is reachable and the server certificate is valid. Importing the user-certificate issuing CA allows FortiGate to validate the client certificate chain and complete authentication.

• Question 30:

  You are deploying a FortiSwitch device managed by FortiGate in a secure network environment. To ensure accurate communication, you must identify which protocols are required for communication and control between FortiGate and FortiSwitch. Which three protocols are used by FortiGate to manage and control FortiSwitch devices? (Choose three.)

  A. SNMP can be used by FortiGate to manage FortiSwitch devices by monitoring their status.
  B. UHTTPS is usea;by FortiGate to securely manage and configure FortiSwitch devices.
  C. FortiGate uses the Fortilink protocol to establish communication with FortiSwitch.
  D. CAPWAP is used to establish the control channel between FortiSwitch and FortiGate.
  E. IGMP is required for managing communication between FortiGate and FortiSwitch devices in multicast environments.
  B. UHTTPS is usea;by FortiGate to securely manage and configure FortiSwitch devices.
  C. FortiGate uses the Fortilink protocol to establish communication with FortiSwitch.
  D. CAPWAP is used to establish the control channel between FortiSwitch and FortiGate.

  ---

  Let's verify each protocol:

  C. FortiGate uses the FortiLink protocol to establish communication with FortiSwitch.#

  FortiLink is the management and control protocol , encapsulated over:

  LLDPfor discovery

  CAPWAP (UDP/5246?247)for control channel

  DHB (Device Handshake Bus)inside CAPWAP frames

  Thus, FortiLink is required .

  D. CAPWAP is used to establish the control channel between FortiSwitch and FortiGate.#

  Although CAPWAP is commonly associated with FortiAP, FortiSwitch also uses CAPWAP internally when managed by FortiGate.

  This is documented in:

  FortiSwitch Administration Guide

  LAN Edge deployment guide

  So D is correct .

  B. UHTTPS is used by FortiGate to securely manage and configure FortiSwitch devices.#

  FortiLink session actually uses:

  Encrypted CAPWAP (over DTLS)

  UHTTPS (port 4433)for secure configuration exchanges

  This protocol is mandatory for:

  Switch configuration synchronization

  Firmware upgrade

  NAC data exchange

  VLAN provisioning

  Therefore UHTTPS is indeed one of the key protocols .

  Why the incorrect options are wrong:

  A. SNMP can be used by FortiGate to manage FortiSwitch.#

  FortiGate does not use SNMP to manage FortiSwitch.

  SNMP is for monitoring by external systems, not for FortiLink control.

  E. IGMP is required for management.#

  IGMP is a multicast protocol, irrelevant for FortiGate-FortiSwitch management.