Fortinet FCSS_NST_SE-7.6 Online Practice Questions and Exam Preparation

Fortinet FCSS_NST_SE-7.6 Online Questions & Answers

• Question 101:

  Refer to the exhibits.

  

  

  An administrator Is expecting to receive advertised route 8.8.8.8/32 from FGT-A. On FGT-B, they confirm that the route is being advertised and received, however, the route is not being injected into the routing table.

  What is the most likely cause of this issue?

  A. A batter route to the 8.8.8.8/32 network exists in the routing table.
  B. FGT-B is configured with a prefix list denying the 8.8.8.8/32 network to be injected into the routing table.
  C. The administrator has misconfigured redistribution of routes on FGT-A.
  D. FGT-8 is configured with a distribution list denying the 8.8.8.8/32 network to be injected into the routing table.
  B. FGT-B is configured with a prefix list denying the 8.8.8.8/32 network to be injected into the routing table.

• Question 102:

  Refer to the exhibit, which shows the output of get router info bgp summary.

  

  Which two statements are true? (Choose two.)

  A. The local ForliGate has received one prefix from BGP neighbor 100.64.1.254.
  B. The TCP connection with BGP neighbor 100.64.2.254 was successful.
  C. The local FortiGate has received 18 packets from a BGP neighbor.
  D. The local FortiGate is still calculating the prefixes received from BGP neighbor 100.64.2.264
  A. The local ForliGate has received one prefix from BGP neighbor 100.64.1.254.
  C. The local FortiGate has received 18 packets from a BGP neighbor.

• Question 103:

  A FortiGate administrator is troubleshooting a VPN that is failing to establish. As a first step, the administrator is attempting to sniff the traffic using the command: # diagnose sniffer packet any ''udp port 500 or udp port 4500 or esp'' 4 After several minutes there is still no output.

  What is the most Likely reason for this?

  A. The VPN is configured to use IKE over TCP
  B. esp is not a valid sniffer argument.
  C. The ISP is blocking all VPN traffic.
  D. Mismatched IKE versions are detected on the VPN peers
  A. The VPN is configured to use IKE over TCP

  ---

  Explanation

  The administrator is running a packet sniffer with the filter 'udp port 500 or udp port 4500 or esp'. The result is "no output," even though the VPN is attempting to establish (failing).

  A. The VPN is configured to use IKE over TCP: Standard IPsec IKE negotiation uses UDP port 500 (IKE) and UDP port 4500 (NAT-T). However, if IKEv2 over TCP (RFC 8229) or Fortinet's proprietary IKE over TCP is configured (often used to bypass firewalls that block UDP), the traffic will use TCP (often port 4500 or 443). The sniffer filter explicitly looks for udp or esp (IP Protocol 50). If the traffic is encapsulated in TCP, it matches tcp protocol, not udp or esp (raw ESP). Therefore, the sniffer sees zero packets matching the filter. Why other options are incorrect: B: esp is a valid argument for diagnose sniffer packet. It is equivalent to filtering for IP protocol 50. C: If the ISP were blocking traffic, the sniffer (running on the local FortiGate) would still see the outbound packets generated by the FortiGate trying to initiate the connection. "No output" implies the local device isn't even generating packets matching that filter. D: Mismatched IKE versions would still generate IKE negotiation packets (proposals/errors) that would be captured by the sniffer.

  References:

  FortiGate Security 7.6 Study Guide (IPsec VPN): "IKEv2 over TCP is available for environments where UDP 500/4500 is blocked. When enabled, IKE and ESP packets are encapsulated in TCP headers."

• Question 104:

  Refer to the exhibit.

  

  The output of the command diagnose vpn tunnels liar is shown.

  Which two statements accurately describe the status of the tunnel? (Choose two.)

  A. Phase 2 is down
  B. Phase 1 is down.
  C. There is currently no traffic traversing the tunnel
  D. Both Phase 1 and Phase 2 were negotiated successfully.
  A. Phase 2 is down
  C. There is currently no traffic traversing the tunnel

  ---

  Explanation

  Based on the Fortinet FCSS - Network Security 7.6 documents and the analysis of the VPN tunnel exhibit, here is the verified answer. Questions no: 91 Verified Answer: A, C Comprehensive and Detailed Explanation with all FCSS - Network Security 7.6 documents: To determine the status of the VPN tunnel, we must examine the specific counters and fields in the diagnose vpn tunnel list output provided in the exhibit. Analyze Phase 2 Status (Option A): The output displays child_num=0. In IKEv2 (and IKEv1 implementations in FortiOS), "Child SAs" refer to the Phase 2 (IPsec) Security Associations that carry the actual data traffic. A value of 0 indicates that no Phase 2 tunnels are established. If Phase 2 were up, child_num would be at least 1. Additionally, under the proxyid section, the field sa=0 confirms there is no active Security Association for that traffic selector.

  Analyze Traffic Status (Option C): The stat line shows: rxp=0 txp=0 rxb=0 txb=0. rxp (Received Packets) and txp (Transmitted Packets) are both zero. This definitively confirms that no traffic is traversing the tunnel currently. This is expected since Phase 2 is down. Analyze Phase 1

  Status (Why B is incorrect): The tunnel entry exists in the list with a valid tun_id, and NAT-Traversal is active (natt: mode=keepalive). The presence of the tunnel in this command output, along with active Keepalive mechanisms, typically indicates that Phase 1 (IKE SA) is established and the peers are communicating on port 4500 (NAT-T), even though the data tunnels (Phase 2) failed to negotiate. If Phase 1 were down, the tunnel would often not appear in this "list" view or would show different status flags indicating a complete connection failure.

  Conclusion: The exhibit shows a scenario where the Phase 1 control channel is likely up (evidenced by the entry existence and NATT keepalives), but the Phase 2 data channel is down (child_num=0), resulting in zero traffic flow (rxp=0/txp=0).

• Question 105:

  Which statement about IKEv2 is true?

  A. Both IKEv1 and IKEv2 share the feature of asymmetric authentication.
  B. IKEv1 and IKEv2 have enough of the header format in common that both versions can run over the same UDP port.
  C. IKEv1 and IKEv2 use same TCP port but run on different UDP ports.
  D. IKEv1 and IKEv2 share the concept of phase1 and phase2.
  B. IKEv1 and IKEv2 have enough of the header format in common that both versions can run over the same UDP port.

• Question 106:

  Which three common FortiGate-to-collector-agent connectivity issues can you identify using the FSSO real-time debug? (Choose three.)

  A. Log is full on the collector agent.
  B. Inability to reach IP address of the collector agent.
  C. Refused connection. Potential mismatch of TCP port.
  D. Mismatched pre-shared password.
  E. Incompatible collector agent software version.
  B. Inability to reach IP address of the collector agent.
  C. Refused connection. Potential mismatch of TCP port.
  D. Mismatched pre-shared password.

• Question 107:

  Refer to the exhibit, which contains partial output from an IKE real-time debug.

  

  The administrator does not have access to the remote gateway.

  Based on the debug output, which configuration change the administrator make to the local gateway to resolve the phase 1 negotiation error?

  A. In the phase 1 proposal configuration, add AES256-SHA256 to the list of encryption algorithms.
  B. In the phase 1 proposal configuration, add AESCBC-SHA2 to the list of encryption algorithms.
  C. In the phase 1 network configuration, set the IKE version to 2.
  D. In the phase 1 proposal configuration, add AES128-SHA128 to the list of encryption algorithms.
  A. In the phase 1 proposal configuration, add AES256-SHA256 to the list of encryption algorithms.

• Question 108:

  What are two reasons that an OSPF router does not have any type 5 tank-state advertisements (LSAs) In its link-stale database (LSD6)? (Choose two.)

  A. There is no autonomous system border router (ASBR) in the network,
  B. The peer of the local router is using a prefix-list-out. configuration to prevent all type 5 LSAs to be advertised.
  C. The local router is located in a stub area
  D. IP protocol 89 is blocked between the local router and its peer.
  A. There is no autonomous system border router (ASBR) in the network,
  C. The local router is located in a stub area

  ---

  Explanation

  To understand why Type 5 LSAs (AS External LSAs) are missing from the Link-State Database (LSDB), we must look at how OSPF generates and propagates them:

  A. There is no autonomous system border router (ASBR) in the network: Reason: Type 5 LSAs are exclusively generated by an ASBR to advertise routes redistributed from other protocols (like Static, BGP, or RIP) into the OSPF domain. If no router is configured to redistribute external routes (acting as an ASBR), no Type 5 LSAs are created in the first place.

  C. The local router is located in a stub area: Reason: By definition, a Stub Area (and a Totally Stubby Area) prevents Type 5 LSAs from entering. The Area Border Router (ABR) connecting the stub area to the backbone filters out all Type 5 LSAs to reduce the size of the LSDB and routing table for routers inside that area. Instead, a default route is usually injected. Why other options are incorrect: B: While database filtering exists, standard prefix-list filtering typically affects the routing table (RIB) generation, not the underlying LSDB propagation of Type 5 LSAs, or it is less common than the architectural reasons (Stub/No ASBR). D: IP Protocol 89 is the transport for OSPF itself. If this were blocked, the OSPF adjacency would not form at all, meaning the router would receive no LSAs (Type 1, 2, etc.), not specifically just Type 5.

  References:

  FortiGate Security 7.6 Study Guide (OSPF): "Type 5 LSAs are generated by ASBRs... Stub areas do not allow Type 5 LSAs

  they are replaced by a default route."

• Question 109:

  Refer to the exhibit, which shows the partial output of a diagnose command.

  

  Which two conclusions can you draw from the output shown in the exhibit? (Choose two.)

  A. FortiGate will drop the expected traffic if it does not arrive within 23 seconds.
  B. Clearing the master session has no impact on the expectation session.
  C. This is a pinhole session to allow traffic for a TCP protocol that dynamically assigns TCP ports.
  D. The session is checked against firewall policy ID 25.
  A. FortiGate will drop the expected traffic if it does not arrive within 23 seconds.
  C. This is a pinhole session to allow traffic for a TCP protocol that dynamically assigns TCP ports.

• Question 110:

  Which exchange lakes care of DoS protection in IKEv2?

  A. Create_CHILD_SA
  B. IKE_Auth
  C. IKE_Req_INIT
  D. IKE_SA_NIT
  C. IKE_Req_INIT