Fortinet FCSS_LED_AR-7.6 Online Practice Questions and Exam Preparation

Fortinet FCSS_LED_AR-7.6 Online Questions & Answers

• Question 41:

  Refer to the exhibit.

  

  A RADIUS server has been successfully configured on FortiGate, which sends RADIUS authentication requests to FortiAuthenticator. FortiAuthenticator, in turn, relays the authentication using LDAP to a Windows Active Directory server.

  It was reported that wireless users are unable to authenticate successfully.

  The FortiGate configuration confirms that it can connect to the RADIUS server without issues.

  While testing authentication on FortiGate using the command diagnose test authserver radius, it was observed that authentication succeeds with PAP but fails with MSCHAPv2.

  Additionally, the Remote LDAP Server configuration on FortiAuthenticator was reviewed.

  Which configuration change might resolve this issue?

  A. Change the RADIUS authentication protocol to CHAP
  B. Enable Windows Active Directory Domain Authentication.
  C. Manually add user credentials to the FortiAuthenticator local database
  D. Use RADIUS attributes under the FortiGate configuration.
  B. Enable Windows Active Directory Domain Authentication.

  ---

  From the exhibits and text:

  FortiGate # RADIUS # FortiAuthenticator

  FortiAuthenticator # LDAP # Windows AD

  diagnose test authserver radius ... papsucceeds

  diagnose test authserver radius ... mschap2fails

  This behavior matches a classic limitation documented in FortiOS:

  When using LDAP as the back-end, the RADIUS server must use PAP . CHAP/MS-CHAPv2 are not supported with plain LDAP because the server cannot validate the challengeesponse without access to password hashes.

  In the Remote LDAP server config on FortiAuthenticator, the option"Windows Active Directory Domain Authentication" is disabled. When this feature is enabled, FortiAuthenticator can talk to AD using Kerberos /NTLM instead of a simple LDAP bind, which does support MS-CHAPv2 for incoming RADIUS authentications.

  So to allow MS-CHAPv2 all the way from FortiGate to AD, you must:

  Keep FortiGate using RADIUS with MS-CHAPv2 # FortiAuthenticator

  Enable Windows Active Directory Domain Authentication so FortiAuthenticator can properly validate MS-CHAPv2 against AD.

  Why the other options are wrong:

  A. Change to CHAP?CHAP still cannot be validated over LDAP; docs say LDAP back-ends must use PAP .

  C. Manually add users to local DB?That would allow local-DB auth but does not fix MS-CHAPv2 against AD.

  D. Use RADIUS attributes on FortiGate?Attributes do not influence the EAP inner method; they don't fix MS-CHAPv2 failures.

  Therefore the configuration change that can realistically fix the MS-CHAPv2 problem isenabling Windows Active Directory Domain Authentication on FortiAuthenticator (B).

• Question 42:

  A FortiGate wireless deployment uses VLAN pooling with vlan-pooling wtp-group. VLAN 201 is mapped to WTP group "Lobby", and VLAN 202 is mapped to WTP group "Office". The administrator configures the Wi-Fi zone table so that VLAN 202 has an IP subnet and DHCP, but VLAN 201 is left without an IP configuration. What is the expected client behavior for devices connecting to APs in the "Lobby" WTP group?

  A. Clients will load-balance between VLAN 201 and 202 automatically
  B. Clients will receive an IP address from VLAN 202 because it is the only VLAN with DHCP
  C. Clients will fail to obtain an IP address because their WTP group maps them to VLAN 201
  D. Clients will be placed into the FortiGate default VLAN until DHCP is available
  C. Clients will fail to obtain an IP address because their WTP group maps them to VLAN 201

  ---

  With vlan-pooling wtp-group, VLAN assignment is determined by the AP's WTP group, not by per-client load balancing. If the "Lobby" group maps to VLAN 201, clients associating through those APs are placed in VLAN 201.

  If VLAN 201 has no IP/subnet/DHCP configuration, clients in that VLAN cannot obtain an IP address, even if another VLAN in the pool (VLAN 202) is properly configured.

  Why the other options are incorrect:

  A is incorrect because wtp-group mode does not load-balance VLANs per client.

  B is incorrect because clients do not "fallback" to a different VLAN's DHCP scope.

  D is incorrect because VLAN assignment follows the pool mapping, not a generic default VLAN.

• Question 43:

  In each user certificate, you can define the subject field, expiration date. User Principal Name (UPN), URL for CRL download, and the OCSP URL. How does the detailed configuration of these attributes impact the certificate?

  A. It makes the certificate easier to revoke manually because it reduces the need for automatic checks.
  B. It limits the validity of the certificate to specific devices and applications, reducing its general usability.
  C. It enables precise identification of the user and ensures timely certificate revocation checks.
  D. It makes the certificate compatible with a wide range of applications and services by ensuring universal validity
  C. It enables precise identification of the user and ensures timely certificate revocation checks.

  ---

  In user certificates used with FortiGate / FortiAuthenticator / SSL-VPN / 802.1X, the following attributes are important:

  Subject field and UPN

  Provide a unique identity for the user (CN and/or UPN).

  FortiGate can use the SAN/UPN field for LDAP-integrated certificate authentication.

  Expiration date

  Limits how long the certificate is valid, enforcing lifecycle and rotation.

  CRL URL and OCSP URL

  Tell FortiGate (or any relying party) where to check if the certificate has been revoked .

  Enables near real-time revocation using OCSP or periodic CRL downloads instead of relying only on expiration.

  By carefully configuring these fields:

  The certificate uniquely and correctly identifies the user.

  Relying systems can perform accurate and timely revocation checks , improving security.

  Why other options are wrong:

  A: It does the opposite--CRL/OCSP increase automation, not manual revocation.

  B: These attributes do not inherently limit a cert to specific devices; that's done via key usage, EKU, or device certs.

  D: They don't "ensure universal validity"; they make the cert precisely bound to one identity with enforceable lifetime and revocation.

• Question 44:

  Refer to the exhibits.

  

  \

  

  Examine the FortiGate configuration, FortiAnalyzer logs, and FortiGate widget shown in the exhibits.

  Security Fabhc quarantine automation has been configured to isolate compromised devices automatically. FortiAnalyzer has been added to the Security Fabric, and an automation stitch has been configured to quarantine compromised devices.

  To test the setup, a device with the IP address 10.0.2.1 that is connected through a managed FortiSwitch attempts to access a malicious website. The logs on FortiAnalyzer confirm that the event was recorded, but the device does not appear in the FortiGate quarantine widget.

  Which two reasons could explain why FortiGate is not quarantining the device? (Choose two.)

  A. The IOC action should include only the FortiSwitch in the quarantine.
  B. The SSL inspection should be set to deep-Inspection
  C. The malicious website is not recognized as an indicator of compromise (IOC) by FortiAnalyzer.
  D. The threat detection services license is missing or invalid under FortiAnalyzer.
  C. The malicious website is not recognized as an indicator of compromise (IOC) by FortiAnalyzer.
  D. The threat detection services license is missing or invalid under FortiAnalyzer.

  ---

  In this scenario:

  FortiGate + FortiAnalyzer are part of theSecurity Fabric

  An Automation Stitch is configured:

  Trigger:Compromised Host ?High(IOC from FortiAnalyzer)

  Action:Quarantine on FortiSwitch + FortiAP

  A test device 10.0.2.1 visits a malicious website.

  FortiAnalyzer logs show the event, but FortiGate does NOT quarantine the device .

  This means the automation did not receive an IOC trigger , OR the Fabric did not classify it as a compromise .

  Let's evaluate each answer option.

  #C. The malicious website is not recognized as an indicator of compromise (IOC) by FortiAnalyzer.

  #Correct.

  For FortiGate to quarantine a device:

  FortiAnalyzer must classify the event as aCompromised Host # High / Medium / Critical

  FortiAnalyzer must generate anIOC event

  FortiGate must receive that IOC through the Fabric

  Even though the FAZ log shows:

  Action = blocked

  Category = Malicious Websites

  # That does NOT automatically mean an IOC was generated.

  A blocked website event is not always an IOC unless:

  It is included in theIOC database

  FAZ's Analytics / UTM / IOC engine marks it as a compromise Thus, if FAZ only logs a "Malicious Website" event but does not classify it as an IOC ,

• Question 45:

  Which VLAN is used by FortiGate to place devices that fail to match any configured NAC policies? CRSPAN

  A. NAC
  B. segment
  C. Quarantine
  D. Onboarding
  D. Onboarding

  ---

  In FortiLink NAC for LAN Edge:

  When a device first connects, it is placed into the onboarding VLAN .

  NAC policies then classify the device (by MAC, OS, user, EMS tag, etc.).

  If a NAC policy matches, the device may be moved to an access VLAN quarantine VLAN or .

  If no NAC policy matches , the device simply stays in the onboarding VLAN . FortiOS / LAN Edge documentation describes the onboarding VLAN as thedefault VLAN for unknown or unclassified devices , until NAC policy evaluation moves them elsewhere.

• Question 46:

  Refer to the exhibit.

  

  

  Review the exhibits to analyze the network topology, SSID settings, and firewall policies.

  FortiGate is configured to use an external captive portal for authentication to grant access to a wireless network. During testing, it was found that users attempting to connect to the SSID cannot access the captive portal login page.

  What configuration change should be made to resolve this issue to allow users to access the captive portal?

  A. Change the SSID security mode to WPA2-Enterprise for authentication.
  B. Disable HTTPS redirection for the captive portal authentication page.
  C. Exclude FortiAuthenticator and Windows AD address objects from filtering.
  D. A firewall policy allowing Guest SSID traffic to reach FortiAuthenticator and Windows AD.
  D. A firewall policy allowing Guest SSID traffic to reach FortiAuthenticator and Windows AD.

  ---

  From the exhibits:

  SSID "Guest"

  Security mode:Open

  Captive Portal: Enabled, portal typeAuthentication # External

  External portal URL: https://fac.trainingad.training.lab/guest (FortiAuthenticator)

  Exempt destinations/services:FortiAuthenticator and WindowsAD

  Firewall policy

  From the Guest interface/zone port1 (Internet) to

  Source user group: guest.portal (authenticated users)

  The flow for an external captive portal is:

  Client associates to the open Guest SSID .

  Client makes an HTTP(S) request.

  FortiGate intercepts and redirects the client to the external portal .

  Client must be able to reach FortiAuthenticator's IP (and AD if the portal needs it) before authentication .

  In this setup:

  The exempt destination setting tells the captive portal logic not to require authentication for traffic going to FortiAuthenticator and WindowsAD.

  However, there still must be a firewall policy that allows traffic from the Guest SSID subnet to those exempt destinations.

  The existing firewall policy uses the guest.portal user group as a source condition, which only matches after successful portal authentication. Before login, the client has no user identity, so:

  Traffic from the unauthenticated Guest client # FortiAuthenticator is not matched by that policy.

  It hits the implicit deny , so the browser never reaches the login page.

  To fix this, the administrator must:

  Create or modify a firewall policy thatallows traffic from the Guest SSID subnet/interface to FortiAuthenticator and WindowsAD without requiring user authentication .

  That is exactly what option describes. D

  Why the others are wrong:

  A. Change SSID security mode to WPA2-Enterprise?External captive portals are normally used with open SSIDs; WPA2-Enterprise uses 802.1X, not captive portal.

  B. Disable HTTPS redirection?Redirection is required so users are sent to the portal; disabling it doesn't solve reachability.

  C. Exclude FortiAuthenticator and Windows AD from filtering?They're already listed asexempt destinations in the SSID configuration; the missing piece is the firewall policy , not the exemption.

• Question 47:

  How can FortiAIOps help optimize network performance in an SD-Branch deployment with FortiGate, FortiSwitch, and FortiAP?

  A. It disables low-performing APs and switches automatically.
  B. It uses Al-driven analytics to identify network issues and provide optimization recommendations.
  C. It removes the need for SD-WAN configuration by automating all routing decisions.
  D. It predicts and resolves all network issues without any human intervention.
  B. It uses Al-driven analytics to identify network issues and provide optimization recommendations.

  ---

  In an SD-Branch deployment (FortiGate + FortiSwitch + FortiAP), FortiAIOps :

  Collects telemetry and logs from Fabric devices

  Uses machine-learning / AI analytics to:

  Spot anomalies (latency, packet loss, RF issues, misconfigurations)

  Highlight root causes

  Propose optimization recommendations (e.g., channel changes, power tuning, config fixes)

  It does not :

  Automatically disable devices ( false) A

  Replace SD-WAN config or all routing ( false) C

  Fix all issues with zero human input ( is marketing fantasy, not reality) D

• Question 48:

  A conference center wireless network provides guest access through a captive portal, allowing unregistered users to self-register and connect to the network. The IT team has been tasked with updating the existing configuration to enforce captive portal authentication over a secure HTTPS connection. Which two steps should the administrator take to implement this change? (Choose two.)

  A. Enable HTTP redirect in the user authentication settings.
  B. Create a new SSID with the HTTPS captive portal URL.
  C. Disable HTTP administrative access on the guest SSID to enforce HTTPS connection.
  D. Update the captive portal URL to use HTTPS on FortiGate and FortiAuthenticator.
  A. Enable HTTP redirect in the user authentication settings.
  D. Update the captive portal URL to use HTTPS on FortiGate and FortiAuthenticator.

  ---

  Goal: enforce captive portal authentication over HTTPS for guests.

  On FortiGate/FortiAuthenticator captive portal setups:

  HTTP redirectis used so that when a guest browses to any HTTP site, their request is redirected to the portal URL .

  The portal URL itself must be HTTPS if you want a secure login page.

  FortiOS captive portal and firewall authentication guidelines recommend:

  Enabling HTTP redirect so unauthenticated HTTP traffic is transparently sent to the portal.

  Configuring the portal URL with HTTPS , often referencing a certificate on FortiGate or FortiAuthenticator. Therefore:

  A. Enable HTTP redirect in the user authentication settings.#This ensures unauthenticated HTTP requests are redirected to the (now HTTPS) portal.

  D. Update the captive portal URL to use HTTPS on FortiGate and FortiAuthenticator.#This makes the login itself secure (TLS-protected).

  Incorrect:

  B-You don't need a new SSID; the same SSID can use HTTPS portal.

  C-Disabling HTTP admin access on the SSID doesn't control the captive portal scheme; HTTPS enforcement is done by the portal configuration and redirect, not by admin-access flags.