Fortinet FCSS_NST_SE-7.6 Online Practice Questions and Exam Preparation

Fortinet FCSS_NST_SE-7.6 Online Questions & Answers

• Question 1:

  Refer to the exhibit

  

  Which shows a FortiGate configuration.

  An administrator is troubleshooting a web filter issue on FortiGate. The administrator has configured a web filter profile and applied it to a policy; however the web filter is not inspecting any traffic that is passing through the policy.

  What must the administrator do to fix the issue?

  A. Disable webfilter-force-off.
  B. Increase webfilter-timeout.
  C. Enable fortiguard-anycast.
  D. Change protocol to TCP.
  A. Disable webfilter-force-off.

• Question 2:

  Which shows a partial output of the fssod daemon real-time debug command.

  # diagnose debug application fssod -1

  # diagnose debug enable

  [fssosvr.c:save_result:579] event_id=4768, logon=bobby, domain=FSSO workstation=, ip=10.124.2.90 port=49215, time=1372061722

  What two conclusions can you draw Itom the output? (Choose two.)

  A. The workstation with IP 10.124.2.90 will be polled frequently using TCP port 445 to see if the user is still logged on.
  B. The logon event can be seen on the collector agent installed on Windows.
  C. FSSO is using DC agent mode to detect logon events.
  D. FSSO is using agentless polling mode to detect logon events.
  A. The workstation with IP 10.124.2.90 will be polled frequently using TCP port 445 to see if the user is still logged on.
  D. FSSO is using agentless polling mode to detect logon events.

• Question 3:

  Refer to the exhibits

  

  Which show the configuration on FortiGate and partial internet session information from a user on the internal network. An administrator would like to lest session failover between the two service provider connections. Which two changes must the administrator make to force this existing session to immediately start using the other interface? (Choose

  two.)

  A. Change the priority of the port1 static route to 11.
  B. Change the priority of the port2 static route to 5.
  C. Configure unset snat-route-change to return it to the default setting.
  D. Configure set snat-route-change enable.
  A. Change the priority of the port1 static route to 11.
  D. Configure set snat-route-change enable.

  ---

  Explanation

  FortiOS Admin Guide: Static Routing, SNAT Route Change Feature

• Question 4:

  Which statement about parallel path processing is correct (PPP)?

  A. PPP chooses from a group of parallel options lo identity the optimal path tor processing a packet.
  B. Only FortiGate hardware configurations affect the path that a packet takes.
  C. PPP does not apply to packets that are part of an already established session.
  D. Software configuration has no impact on PPP.
  A. PPP chooses from a group of parallel options lo identity the optimal path tor processing a packet.

• Question 5:

  Refer to the exhibit, which shows a partial web filter profile configuration.

  

  The URL www.dropbox.com is categorized as File Sharing and Storage.

  Which action does FortiGate take if a user attempts to access www.dropbox.com?

  A. FortiGate blocks the connection as an invalid URL.
  B. Based on the URL Filter configuration, FortiGate allows the connection.
  C. FortiGate blocks the connection, based on the FortiGuard category-based filter configuration.
  D. Based on the Web Content filter configuration, access to www.dropbox.com would be exempted.
  B. Based on the URL Filter configuration, FortiGate allows the connection.

• Question 6:

  Which two situations will trigger FortiGate to enter conserve mode? (Choose two.)

  A. System memory usage exceeds the red threshold.
  B. Session table utilization drops below 50%.
  C. Log disk utilization exceeds 90%.
  D. IPS engine memory allocation reaches its limit.
  A. System memory usage exceeds the red threshold.
  D. IPS engine memory allocation reaches its limit.

• Question 7:

  Refer to the exhibit.

  The output of a BGO debug command is shown.

  

  What is the most likely reason that the local FortiGate is not receiving any prefixes from its neighbors?

  A. The local router is waiting for the keepalive message from the router 10.125.0.60.
  B. None of the three neighbors has successfully established the TCP three-way handshake with the local router.
  C. The router 100.64.3.1 is waiting for the OPEN message from the local router.
  D. The RIB-OUT configuration for router 10.127.0.75 prevents any route advertisement to the local router.
  D. The RIB-OUT configuration for router 10.127.0.75 prevents any route advertisement to the local router.

  ---

  Explanation

  To identify the reason for the lack of prefixes, we must interpret the State/PfxRcd and Up/Down columns in the get router info bgp summary exhibit.

  Analyze Neighbor Status: Neighbor 10.125.0.60: State is OpenSent. This session is not established. It is stuck in the negotiation phase. Neighbor 100.64.3.1: State is Active. This session is not established.

  The router is actively trying to initiate a TCP connection. Neighbor 10.127.0.75:

  Up/Down: 02:45:55. This indicates the BGP session has been Up (Established) for almost 3 hours. State/PfxRcd: 0. This number represents the count of prefixes received. The session is fully established, but the neighbor has sent zero routes. Determine the Cause: Since the session with 10.127.0.75 is established, connectivity and handshakes (Options A, B, C) are not the issue for this neighbor. The fact that it is Up but sending 0 prefixes strongly implies that the neighbor is configured to filter out its routes before sending them to the local FortiGate. Option D correctly identifies this as a RIB-OUT (Routing Information Base - Outbound) configuration issue on the neighbor (Router 10.127.0.75),

  which prevents it from advertising its routes.

  References:

  FortiGate Security 7.6 Study Guide (BGP): "In the BGP summary, if the State/PfxRcd shows a number (e.g., 0), the session is Established. A value of 0 means the peering is up, but no routes have been received, often due to route-map or prefix-list filtering on the remote peer."

• Question 8:

  Refer to the exhibit.

  

  If the default settings are m place, what can you conclude about the conserve mode shown in the exhibit?

  A. FortiGate is currently allowing new sessions that require flow-based content inspection and blocking sessions that require proxy-based content inspection
  B. FortiGate is currently allowing new sessions and will continue to allow sessions if memory increases another 6%.
  C. FortiGate is currently allowing now sessions that require flow-based or proxy-based content inspection, but is not performing inspection on those sessions.
  D. FortiGate is currently blocking all new sessions regardless of the content inspection requirements or configuration settings because of high memory use.
  A. FortiGate is currently allowing new sessions that require flow-based content inspection and blocking sessions that require proxy-based content inspection

  ---

  Explanation

  To determine the behavior, we must analyze the memory thresholds and the current status shown in the exhibit: Analyze the Thresholds (The Three States): Green (Exit): 82% (Memory usage is safe). Red (Enter Conserve Mode): 88% (Memory usage is high; action is required). Extreme (Kernel Conserve Mode): 95% (Memory is critical; drastic action is required). Determine the

  Current State:

  Current Memory Used: 89%.

  Since 89% is greater than the Red threshold (88%) but lower than the Extreme threshold (95%), the FortiGate is in Red Conserve Mode (User-space conserve mode), not Extreme mode. Evaluate the Behavior in "Red"

  Mode: In Red Conserve Mode, the FortiGate's primary goal is to prevent memory exhaustion while still processing traffic if possible.

  Proxy-based inspection (handled by the WAD process) is memory-intensive because it buffers content. To save memory, the system stops accepting new sessions that require proxy-based inspection.

  Flow-based inspection (handled by the IPS engine) streams data and consumes significantly less memory. Therefore, in Red mode, the system typically continues to allow and inspect flow-based sessions. Option A correctly describes this split behavior: allowing flow-based (lighter) but blocking proxy-based (heavier). Why other options are incorrect:

  B: If memory increases another 6% (89% + 6% = 95%), the device hits the Extreme threshold. At 95%, the kernel begins dropping all new sessions to prevent a system crash. Thus, it will not continue to allow sessions.

  C: This describes "Fail-Open" behavior (passing traffic without inspection). While configurable (set av-failopen pass), the default is usually "Fail-Close" (blocking). More importantly, the distinction between flow and proxy availability is the key architectural feature of Red mode.

  D: Blocking all new sessions regardless of type is the behavior of Extreme Conserve Mode (95%). Since the device is only at 89%, this drastic measure is not yet active.

  References:

  FortiGate Security 7.6 Study Guide (Diagnostics & Resource Usage): "When memory usage exceeds the red threshold... the FortiGate enters conserve mode. New sessions requiring proxy-based inspection may be dropped...

  When the extreme threshold is reached, all new sessions are dropped."

• Question 9:

  Refer to the exhibit.

  

  Which shows the output of diagnose automation test.

  What can you observe from the output? (Choose two.)

  A. The automation stitch test is not being logged.
  B. The automation stitch test failed but the HA failover was successful.
  C. An HA failover occurred.
  D. The test was unsuccessful.
  A. The automation stitch test is not being logged.
  D. The test was unsuccessful.

• Question 10:

  Refer to the exhibit, which shows a session entry.

  

  Which statement about this session is true?

  A. Return traffic to the initiator is sent to 10.1.0.1.
  B. Return traffic to the initiator is sent lo 10.200.1.254.
  C. It is an ICMP session from 10.1.10.10 to 10.200.1.1.
  D. It is an ICMP session from 10.1.10.1 to 10.200.5.1.
  D. It is an ICMP session from 10.1.10.1 to 10.200.5.1.