FCSS_LED_AR-7.6 practice questions 31–40

1. Question 31 · 61 in bank

   Refer to the exhibits.

   

   

   An LDAP server has been successfully configured on FortiGate, which forward LDAP authentication requests to a Windows Active Directory (AD) server. Wireless users report that they are unable to authenticate. Upon troubleshooting, you find that authentication fails when using MSCHAPv2. What is the most likely reason for this issue?

   • AFortiGate does not support MSCHAPv2 for LDAP authentication.
   • BThe FortiGate LDAP configuration is missing the correct Bind DN.
   • CA firewall policy is missing an LDAP authentication rule.
   • DThe Windows AD server requires LDAPS (LDAP over SSL) for authentication.

   Show answer

   Answer: A

   Next question

2. Question 32 · 61 in bank

   Refer to the exhibit.

   

   What can you conclude if you are accessing the FortiSwitch ports menu on FortiManager?

   • AThe ADOM is configured to support FortiSwitch central management.
   • BFortiSwitch is in standalone mode.
   • CThe ADOM is configured to support FortiSwitch per-device-management.
   • DFortiSwitch is in transparent mode.

   Show answer

   Answer: C

   Next question

3. Question 33 · 61 in bank

   What is the purpose of FortiAIOps monitoring and automatically adjusting to changes in the radio frequency (RF) environment?

   • ATo limit the number of devices connected to each access point in a given area
   • BTo monitor network traffic and adjust firewall rules in real time
   • CTo increase the signal strength of the network by boosting power levels on all access points
   • DTo detect and mitigate interference and congestion, optimizing wireless performance and coverage

   Show answer

   Answer: D

   Next question

4. Question 34 · 61 in bank

   Select 2

   Refer to the exhibits.

   

   

   The exhibits show the VAP configuration, Wi-Fi SSIDs, and zone table. Which two statements describe how FortiGate handles VLAN assignment for wireless clients? (Choose two.)

   • AClients connecting to APs in the Floor 1 group will not be able to receive an IP address.
   • BClients connecting to APs in the Office group will be assigned to VLAN 102.
   • CAll clients connecting to the Corp Zone will receive an IP address from the 10.1.20.1/24 subnet.
   • DFortiGate will load balance clients using VLAN 101 and VLAN 102 and assign them an IP address from the 10.0.3.0/24 subnet.

   Show answer

   Answer: AB

   Next question

5. Question 35 · 61 in bank

   When deploying a FortiSwitch in a network managed through FortiLink, how does the FortiGate facilitate communication to the FortiSwitch?

   • AFortiGate establishes communication with FortiSwitch using a pre-configured VLAN without requiring DHCP.
   • BFortiSwitch requires internet access to register its license in order to connect with FortiGate over FortiLink.
   • CFortiSwitch initially requires to be configured with static IP addresses to function over FortiLink.
   • DFortiGate acts as a DHCP server and provides the FortiAP with an IP address over FortiLink.

   Show answer

   Answer: A

   Next question

6. Question 36 · 61 in bank

   Refer to the exhibits. The exhibits show the FortiGate logs, widget, and CLI.

   

   

   

   Security Fabric quarantine automation is being tested using a device with the IP address 10.0.2.1, which is connected to a managed FortiSwitch. Shortly after attempting to access a malicious website, the device loses access to the internet and other VLANs within the network. However, it can still communicate with other devices within the same VLAN. Which configuration change is required to fix the issue?

   • AAdjust the indicator of compromise (IOC) on FortiAnalyzer.
   • BEnable intra-VLAN traffic blocking In the Security Fabric quarantine settings.
   • CAdjust the IP Ban settings to the Quarantine action.
   • DReplace the IP Ban action with Access Layer Quarantine.

   Show answer

   Answer: D

   Next question

7. Question 37 · 61 in bank

   Refer to the exhibits.

   

   

   You are configuring FortiAuthenticator to authenticate wireless users through Active Directory using LDAP. The users send their authentication requests to FortiAuthenticator through RADIUS, with FortiAuthenticator serving as the back-end authentication server. On FortiGate, a RADIUS server pointing to FortiAuthenticator has been configured. Although the connection to the RADIUS server is successful on FortiGate, authentication for the wireless users fails. After reviewing the configurations on both FortiGate and FortiAuthenticator, you notice that the RADIUS Service Policy appears to be misconfigured. Which configuration step might be missing?

   • AIn the Authentication Factors section, select Password-only.
   • BIn the Identity Sources section, enable Windows AD Domain Authentication.
   • CIn the Identity Sources section, select a different Username format.
   • DIn the Authentication Factors section, enable Adaptive Authentication.

   Show answer

   Answer: B

   Next question

8. Question 38 · 61 in bank

   What is the expected behavior when enabling auto TX power control on a FortiAP interface?

   • AFortiGate periodically measures the signal strength of the weakest associated client and adjusts the AP radio power to align with the detected signal strength of that client.
   • BFortiGate monitors the signal strength of nearby AP interfaces and adjusts its own transmit power every 30 seconds to match the signal strength of the adjacent AP.
   • CFortiGate measures the signal strength of nearby FortiAP interfaces every 30 seconds and adjusts their transmit power to ensure they remain detectable at -70 dBm.
   • DThe AP periodically evaluates the signal strength of its own transmission from the client perspective and adjusts its power to ensure the signal is detected at -70 dBm.

   Show answer

   Answer: D

   Next question

9. Question 39 · 61 in bank

   In each user certificate, you can define the subject field, expiration date, User Principal Name (UPN), URL for CRL download, and the OCSP URL. How does the detailed configuration of these attributes impact the certificate?

   • AIt makes the certificate easier to revoke manually because it reduces the need for automatic checks.
   • BIt enables precise identification of the user and ensures timely certificate revocation checks.
   • CIt limits the validity of the certificate to specific devices and applications, reducing its general usability.
   • DIt makes the certificate compatible with a wide range of applications and services by ensuring universal validity.

   Show answer

   Answer: B

   Next question

10. Question 40 · 61 in bank

    Why is it critical to maintain NTP synchronization between FortiGate and FortiSwitch when FortiLink is configured?

    • ATo allow FortiSwitch to function in standalone mode if FortiGate becomes unavailable
    • BTo facilitate synchronization of firmware updates across devices
    • CTo allow FortiSwitch to communicate with other FortiSwitch devices in the network
    • DTo ensure accurate time for logs, authentication, and event correlation

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCSS_LED_AR-7.6 practice, question 31. 61 questions available.