FCSS_LED_AR-7.6 practice questions 11–20

1. Question 11 · 61 in bank

   How does the Syslog-based single sign-on (SSO) feature in FortiAuthenticator function to correlate user activity with authentication events across multiple network devices?

   • AIt uses syslog messages to monitor authentication events and correlate them with user activities.
   • BIt modifies user credentials based on the outcome of authentication events.
   • CIt relies on external servers to analyze syslog messages for user authentication.
   • DIt authenticates users through a captive portal by monitoring login attempts.

   Show answer

   Answer: A

   Next question

2. Question 12 · 61 in bank

   In a Windows environment using AD machine authentication, how does FortiAuthenticator ensure that a previously authenticated device is maintaining its network access once the device resumes operating after sleep or hibernation?

   • AIt sends a wake-on-LAN packet to trigger reauthentication.
   • BIt caches the MAC address of authenticated devices for a configurable period of time.
   • CIt temporarily assigns the device to a guest VLAN until full reauthentication is completed.
   • DIt uses machine authentication based on the device IP address.

   Show answer

   Answer: B

   Next question

3. Question 13 · 61 in bank

   You are troubleshooting an issue where users are being intermittently redirected to an error page after submitting their login credentials on a captive portal. As part of your troubleshooting steps, you review the POST parameters sent from the client to the authentication server. What should you check in the magic ID within the POST parameters to help resolve the issue?

   • ADetermine whether the magic ID has expired, which could cause the server to reject the authentication request.
   • BValidate that the magic ID contains encryption keys for securing the user’s password during transmission.
   • CVerify whether the magi ID matches the session generated by the server to ensure the request is valid.
   • DConfirm that the magic ID is tied to the correct redirection URL for the user session.

   Show answer

   Answer: C

   Next question

4. Question 14 · 61 in bank

   You need to deploy FortiAPs at remote locations and want to avoid high latency by minimizing interference from FortiGate. Which SSID traffic mode is best suited for this deployment?

   • AHybrid mode
   • BLocal mode
   • CBridge mode
   • DTunnel mode

   Show answer

   Answer: C

   Next question

5. Question 15 · 61 in bank

   Select 2

   In which two ways is layer 2 isolation applied to a quarantined device? (Choose two.)

   • ABy configuring route policy rules to restrict traffic.
   • BBy blocking communication based on the device’s MAC address.
   • CBy blocking communication based on the device’s IP address.
   • DBy assigning a null route based on the device’s IP address.
   • EBy assigning the quarantined device to a separate VLAN.

   Show answer

   Answer: BE

   Next question

6. Question 16 · 61 in bank

   When troubleshooting a FortLink connectivity issue between FortiGate and FortiSwitch, why is it important to verify their time and date settings?

   • ATime synchronization is critical for the CAPWAP DTLS tunnel.
   • BTime and date are used to determine the encryption algorithm on FortiLink.
   • CIncorrect time synchronization may disrupt the FortiLink discovery protocol (LLDP or MCLAG).
   • DMatching time settings ensure proper STP convergence on the FortiLink interface.

   Show answer

   Answer: A

   Next question

7. Question 17 · 61 in bank

   A network administrator is configuring a RADIUS server on FortiGate to authenticate remote users. The administrator configures FortiGate to forward authentication requests to FortiAuthenticator, which then proxies these requests to a Windows Active Directory (AD) server using LDAP. Which is the primary benefit of using FortiAuthenticator in this configuration?

   • AFortiAuthenticator encrypts the RADIUS authentication traffic between FortiGate and the AD server, securing communication.
   • BThis configuration provides a solution to the CHAP-to-LDAP dilemma, enabling MSCHAPv2 authentication.
   • CFortiAuthenticator simplifies the configuration by allowing FortiGate to use LDAP directly for authentication without the need for RADIUS.
   • DThe configuration allows FortiGate to directly authenticate remote users against Windows Active Directory without the need for an intermediate proxy.

   Show answer

   Answer: B

   Next question

8. Question 18 · 61 in bank

   A network administrator is deploying a new FortiGate firewall and wants to enable zero-touch provisioning with FortiManager. The administrator has not manually configured the FortiManager IP address or FQDN on FortiGate. However, FortiGate can still discover FortiManager automatically. In this situation, where can FortiGate learn the FortiManager IP address or FQDN for zero-touch provisioning?

   • ABy retrieving options 240 or 241 from a DHCP server
   • BBy querying the local ARP table for the FortiManager IP address.
   • CBy the default static route configuration on FortiGate.
   • DBy checking the FortiGate factory default configuration.

   Show answer

   Answer: A

   Next question

9. Question 19 · 61 in bank

   What is the primary purpose of configuring an untagged VLAN on a FortiSwitch port in a network deployment?

   • ATo enable features like quarantine MAC or dynamic VLAN assignment.
   • BTo carry multiple VLANs on a single port.
   • CTo enable QoS (quality of service) on the port.
   • DTo automatically tag traffic from connected devices.

   Show answer

   Answer: A

   Next question

10. Question 20 · 61 in bank

    Select 2

    Refer to the exhibits.

    

    

    The exhibits show the WTP profile and VAP CLI configurations on FortiGate managing a remote AP. The AP is designed to grant a remote employee access to company network resources, including the database and AD servers. The employee can reach company resources but is unable to access a local printer at home. What two solutions are required to fix this issue? (Choose two.)

    • AConfigure the S231F wtp-profile to add a split tunneling ACL with a destination subnet of 192.168.1.1/24, using the command set dest-ip 192.168.1.1/24
    • BConfigure the EmployeeHome VAP profile for local bridging using the command set local-bridging enable.
    • CConfigure the EmployeeHome VAP profile to disable host isolation using the command set intra-vap-privacy disable.
    • DConfigure the S231F wtp profile to enable split tunneling to the AP subnet using the command set split-tunneling-acl-local-ap-subnet enable.

    Show answer

    Answer: AD

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCSS_LED_AR-7.6 practice, question 11. 61 questions available.