FCSS_LED_AR-7.6 practice questions 21–30

1. Question 21 · 61 in bank

   Refer to the exhibits.

   

   

   FortiGate is configured with an SSID named Corp in which dynamic VLAN assignment is enabled, and also configured with a RADIUS server to send IETF 64, IETF 65, and IETF 81 VSAs to manage VLAN allocation. The RADIUS server has been confirmed to be sending all the required information to FortiGate. However, FortiGate is not assigning the correct VLANs to wireless clients. Based on the information provided, what is causing the issue?

   • AThe administrator must define the corresponding VLANs that are sent by the RADIUS server.
   • BWireless clients bust be assigned an IP address from the 10.0.3.0/24 subnet.
   • CThe administrator must configure a firewall policy to allow wireless clients to communicate with the RADIUS server.
   • DThe RADUIS server must send the framed-ip attribute to assign wireless clients an IP address.

   Show answer

   Answer: A

   Next question

2. Question 22 · 61 in bank

   Refer to the exhibits.

   

   

   

   

   You have configured RADIUS single sign-on (RSSO) on a FortiGate device, ensuring that all settings are correct and the integration with the RADIUS server is correctly established. Communication between FortiGate and the RADIUS server is happening through port3. After testing, you notice that while user authentication and RSSO activity are functioning as expected, the RADIUS server does not display session logs or detailed usage information. What is the most likely reason for this issue?

   • AMisconfigured RADIUS shared password
   • BDisabled rsso-radius-response
   • CMisconfigured interface port3
   • DMismatched user radius sso-attribute and radius attribute value

   Show answer

   Answer: C

   Next question

3. Question 23 · 61 in bank

   Select 2

   Refer to the exhibits.

   

   

   

   

   A network administrator is configuring RADIUS single sign-on (RSSO) on FortiGate to dynamically assign users to specific user groups based on RADIUS accounting messages. Which two configuration steps are required to ensure RSSO user group matching work correctly? (Choose two.)

   • AConfigure FortiGate to send RADIUS authentication requests instead of relying on accounting messages.
   • BSet the rsso-endpoint-attribute to define which RADIUS attribute will be used to extract username.
   • CConfigure the sso-attribute in the RSSO agent settings to specify which RADIUS attribute will be used for group matching.
   • DEnable the RSSO agent service on FortiGate to actively poll RADIUS servers for authentication requests.

   Show answer

   Answer: BC

   Next question

4. Question 24 · 61 in bank

   Select 2

   Your office wants to set up a Wi-Fi network for visitors. Your company would like to require them to log in for tracking purposes. Which two types of captive portals could be enabled on an interface? (Choose two.)

   • AAuthentication
   • BGuest Pass Access
   • CDisclaimer + Authentication
   • DEmail Notification Only
   • ETerms Acknowledgement Without Authentication

   Show answer

   Answer: AC

   Next question

5. Question 25 · 61 in bank

   Refer to the exhibits to analyze a network topology and SSID settings.

   

   

   

   FortiGate is configured to use an external captive portal for authentication to grant access to a wireless network. Testing detected that users attempting to access the SSID are not able to access the captive portal login page. Which configuration change should fix this issue?

   • AChange the SSID security mode to WPA2-Enterprise for authentication.
   • BFirewall policy with the ID 13 must have NAT disabled.
   • CAddress objects FortiAuthenticator and WindowsAD must be included as exempt destinations/services.
   • DA firewall policy with port4 as source is missing.

   Show answer

   Answer: C

   Next question

6. Question 26 · 61 in bank

   Select 3

   What are three key components of the 802.1X authentication process? (Choose three.)

   • ASupplicant
   • BAuthentication Server
   • CAuthentication Service
   • DGateway
   • EAuthenticator

   Show answer

   Answer: ABE

   Next question

7. Question 27 · 61 in bank

   Refer to the exhibits.

   

   

   Examine the firewall policy configuration and SSID settings. Users trying to connect to the new Guest wireless network should be redirected to an external captive portal, however, these wireless users are not able to see the captive portal login page. The external captive portal URL has been verified as correct, yet the issue persists. Which configuration change should fix the problem?

   • AAdd FortiAuthenticator and WindowsAD as exempt sources.
   • BSecurity mode should be set to WPA2 Enterprise to authenticate through RADIUS.
   • CA firewall policy with the ID 11 is missing to enable the captive-portal-exempt option.
   • DInclude the user group guest.portal in the firewall policy.

   Show answer

   Answer: C

   Next question

8. Question 28 · 61 in bank

   Why is the suppression of rogue APs becoming more difficult with the introduction of new wireless security standards, such as 802.11w?

   • A802.11w increases the processing overhead on network devices, slowing down the detection of rogue APs.
   • BThe 802.11w standard reduces the range of wireless signals, limiting the ability to detect rogue APs at a distance.
   • C802.11w encrypts all data traffic, making it difficult to identify rogue APs through packet inspection.
   • D802.11w requires that clients authenticate management frames as legitimate, which helps prevent spoofing attacks.

   Show answer

   Answer: D

   Next question

9. Question 29 · 61 in bank

   Select 2

   A company is deploying a new FortiGate using zero-touch provisioning to streamline its setup. The IT team has already registered the FortiGate serial number of FortiManager and preconfigured its settings in advance. FortiGate is in its factory default state. However, after connecting FortiGate to the network, FortiManager does not automatically initiate the provisioning process. Which two scenarios are likely to cause this issue? (Choose two.)

   • AThe pre-shared key set on FortiManager does not match the one set on FortiGate.
   • BThe DNS server doesn’t have the A or AAAA records configured.
   • CZero-touch provisioning is disabled on FortiManager.
   • DThe serial number added on FortiManager does not match the FortiGate serial number.

   Show answer

   Answer: BD

   Next question

10. Question 30 · 61 in bank

    Select 2

    An administrator is reviewing FortiSwitch trunk configurations. Which two statements accurately describe the functionality of FortiSwitch trunks? (Choose two.)

    • AFortiSwitch trunks can only connect to other FortiSwitch devices and not to a FortiGate.
    • BFortiSwitch connecting to the FortiGate FortiLink interface automatically forms a trunk.
    • CFortiSwitch connecting to FortiGate uses the Fortinet Discovery Protocol (FDP) to automatically form a trunk.
    • DFortiSwitch uses trunk to refer to a LAG interface.

    Show answer

    Answer: BD

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCSS_LED_AR-7.6 practice, question 21. 61 questions available.