Fortinet Fortinet Certifications NSE7_SAC-6.2 Questions & Answers

• Question 1:

  Refer to the exhibit.

  Examine the output of the debug command and port configuration shown in the exhibit.

  

  FortiGate learned the MAC address 78:2b:cb:d8:36:68 dynamically.

  What action does FortiSwitch take if there is an untagged frame coming to port1 will different MAC address?

  A. The frame is accepted and assigned to the quarantine VLAN.

  B. The frame is accepted and FortiSwitch will update its mac address table with the new MAC address.

  C. The frame is dropped.

  D. The frame is accepted and assigned to the user VLAN.

  Correct Answer: A

• Question 2:

  A FortiGate has the following LDAP configuration.

  

  On the Windows LDAP server 10.0.1.10, the administrator used dsquery, which returned the following output:

  >dsquery user -samid admin*

  "CN=Administrator,CN=Users,DC=trainingAD,DC=training,DC=lab"

  According to the output, which FortiGate LDAP setting is configured incorrectly?

  A. dn

  B. sAMAccountName

  C. username

  D. cnid

  Correct Answer: B

• Question 3:

  An administrator has deployed dual band-capable wireless APs in a wireless network. Multiple 2.4 GHz wireless clients are connecting to the network, and subsequent monitoring shows that individual AP

  2.4GHz interfaces are being overloaded with wireless connections. Which configuration change would best resolve the overloading issue?

  A. Configure load balancing AP handoff on both the AP interfaces on all APs.

  B. Configure load balancing AP handoff on only the 2.4GHz interfaces of all Aps.

  C. Configure load balancing frequency handoff on both the AP interfaces.

  D. Configure a client limit on the all AP 2.4GHz interfaces.

  Correct Answer: C

• Question 4:

  Examine the following output from the FortiLink real-time debug.

  

  Based on the output, what is the status of the communication between FortiGate and FortiSwitch?

  A. FortiGate is unable to authorize the FortiSwitch.

  B. FortiGate is unable to establish FortiLink tunnel to manage the FortiSwitch.

  C. FortiGate is unable to located a previously managed FortiSwitch.

  D. The FortiLink heartbeat is up.

  Correct Answer: D

• Question 5:

  Refer to the exhibit showing certificate values.

  

  Wireless guest users are unable to authenticate because they are getting a certificate error while loading the captive portal login page. This URL string is the HTTPS POST URL guest wireless users see when attempting to access the network using the web browser:

  https://fac.trainingad.training.com/guests/login/?loginandpost=https://auth.trainingad.training.1ab:1003/fgtauthandmagic=000a038293d1f411andusermac=b8:27:eb:d8:50:02andapmac=70:4c:a5:9d:0d:28andapip=10.10.100.2anduserip=10.0.3.1andssid=Guest03andapname=PS221ETF18000148andbssid=70:4c:a5:9d:0d:30

  Which two settings are the likely causes of the issue? (Choose two.)

  A. The external server FQDN is incorrect.

  B. The FortiGate authentication interface address is using HTTPS.

  C. The wireless user's browser is missing a CA certificate.

  D. The user address is not in DDNS form.

  Correct Answer: AC

• Question 6:

  Refer to the exhibit.

  

  Given the network topology shown in the exhibit, which two ports should be configured as untrusted DHCP ports? (Choose two.)

  A. FortiSwitch A, port2

  B. FortiSwitch A, port1

  C. FortiSwitch B, port1

  D. FortiSwitch B, port2

  Correct Answer: CD

• Question 7:

  Refer to the exhibit.

  The exhibit shows a network topology and SSID settings.

  

  FortiGate is configured to use an external captive portal. However, wireless users are not able to see the captive portal login page.

  Which configuration change should the administrator make to fix the problem?

  A. Create a firewall policy to allow traffic from the Guest SSID to FortiAuthenticator and Windows AD devices.

  B. Enable the captive-portal-exemptoption in the firewall policy with the ID 10.

  C. Remove guest.portal user group in the firewall policy.

  D. FortiAuthenticator and WindowsAD address objects should be added as exempt sources.

  Correct Answer: B

  Reference: https://docs.fortinet.com/document/fortigate/6.0.0/handbook/868644/captive-portals

• Question 8:

  Which CLI command should an administrator use to view the certificate validation process in real-time?

  A. diagnose debug application certd -1

  B. diagnose debug application fnbamd -1

  C. diagnose debug application authd -1

  D. diagnose debug application foauthd -1

  Correct Answer: B

• Question 9:

  Refer to the exhibit.

  The exhibit shows two FortiGate devices in active-passive HA mode, including four FortiSwitch devices

  connected to a ring.

  

  Which two configurations are required to deploy this network topology? (Choose two.)

  A. Configure link aggregation interfaces on the FortiLink interfaces.

  B. Configure the trunk interfaces on the FortiSwitch devices as MCLAG-ISL.

  C. Enable fortilink-split-interfaceon the FortiLink interfaces.

  D. Enable STP on the FortiGate interfaces.

  Correct Answer: CD

  Reference: https://www.fortinetguru.com/2019/07/fortilink-configuration-using-the-fortigate-gui/

• Question 10:

  Refer to the exhibit.

  Examine the network topology shown in the exhibit.

  

  Which port should have root guard enabled?

  A. FortiSwitch A, port2

  B. FortiSwitch A, port1

  C. FortiSwitch B, port1

  D. FortiSwitch B, port2

  Correct Answer: A

  Reference: https://docs.fortinet.com/document/fortiswitch/6.4.2/administration-guide/364614/spanningtree-protocol