FCSS_LED_AR-7.6 practice questions 41–50

1. Question 41 · 61 in bank

   Refer to the exhibit, which shows the WTP profile configuration.

   

   The AP profile is assigned to two FAP-231F APs that are installed in an open plan area. The first AP has 32 clients associated with the 5 GHz radios and 22 clients associated with the 2.4 GHz radio. The second AP has 12 clients associated with the 5 GHz radios and 20 clients associated with the 2.4 GHz radio. A dual-band-capable client enters the area near the first AP and the first AP measures the new client at -33 dBm signal strength. The second AP measures the new client at -43 dBm signal strength. If the new client attempts to connect to the Student01 wireless network, which AP radio will the client be associated with?

   • AThe first AP 2.4 GHz interface provides a stronger signal, which clients often prioritize.
   • BThe first AP 5 GHz interface because it has a stronger signal.
   • CThe second AP 2.4 GHz interface is preferred over 5 GHz for better speed and lower interference.
   • DThe second AP 5 GHz interface has fewer clients, which ensures better performance despite the weaker signal.

   Show answer

   Answer: D

   Next question

2. Question 42 · 61 in bank

   Refer to the exhibits.

   

   

   A set of SSID profiles has been configured on FortiManager, and an AP profile has been assigned to a group of AP managed by FortiGate. However, none of the designated SSIDs are being broadcast by these APs. Which configuration change is required to make the APs broadcast these SSIDs as intended?

   • AAdjust the AP profile to ensure all SSIDs are configured in a supported mode, either bridge or tunnel, but not a mix of both.
   • BChange the AP profile to use a platform that supports the configured mix of SSIDs.
   • CSet the Transmit Power Mode to Auto.
   • DChoose Manual in the SSIDs setting and select the SSIDs to broadcast.

   Show answer

   Answer: D

   Next question

3. Question 43 · 61 in bank

   What is the primary function of FortiLink NAC in a LAN environment?

   • ATo manage FortiSwitch devices and apply manual firewall rules
   • BTo extend security policies across FortiGate firewalls only
   • CTo ensure devices are manually placed in VLANs based on their user roles
   • DTo automate device onboarding and verify security posture

   Show answer

   Answer: D

   Next question

4. Question 44 · 61 in bank

   Select 3

   Refer to the exhibits.

   

   

   Examine the FortiGate RSSO configuration shown in the exhibit. FortiGate is set up to use RSSO for user authentication. It is currently receiving RADIUS accounting messages through port3. The incoming RADIUS accounting messages contain the username in the User-Name attribute and group membership in the Class attribute. You must ensure that the users are authenticated through these RADIUS accounting messages and accurately mapped to their respective RSSO user groups. Which three critical configurations must you implement on the FortiGate device? (Choose three.)

   • AThe sso-attribute CLI setting in the RSSO agent configuration should be set to Class.
   • BDevice detection and Security Fabric Connection should be enabled on port3.
   • CRSSO user groups should be assigned to all firewall policies.
   • DThe rsso-endpoint-attribute CLI setting in the RSSO agent configuration should be set to User-Name.
   • EThe RADIUS Attribute Value setting configured for an RSSO user group should match the Class RADIUS attribute value in the RADIUS accounting message.

   Show answer

   Answer: ACE

   Next question

5. Question 45 · 61 in bank

   Select 2

   Refer to the exhibits.

   

   

   

   

   

   Examine the FortiGate configuration, FortiAnalyzer logs, and FortiGate widget shown in the exhibits. Security Fabric quarantine automation has been configured to isolate compromised devices automatically. FortiAnalyzer has been added to the Security Fabric, and an automation stitch has been configured to quarantine compromised devices. To test the setup, a device with the IP address 10.0.2.1 that is connected through a managed FortiSwitch attempts to access a malicious website. The logs on FortiAnalyzer confirm that the event was recorded, but the device does not appear in the FortiGate quarantine widget. Which two reasons could explain why FortiGate is not quarantining the device? (Choose two.)

   • AThe threat detection services license is missing or invalid under FortiAnalyzer.
   • BThe SSL inspection should be set to deep-Inspection.
   • CThe malicious website is not recognized as an indicator of compromise (IOC) by FortiAnalyzer.
   • DThe IOC action should include only the FortiSwitch in the quarantine.

   Show answer

   Answer: AC

   Next question

6. Question 46 · 61 in bank

   When the MAC address of a device is placed in quarantine on FortiSwitch, what happens to its egress traffic?

   • ATraffic is sent to an access VLAN.
   • BTraffic is assigned to the native VLAN.
   • CTraffic is sent as untagged traffic.
   • DTraffic is sent to an allowed VLAN.

   Show answer

   Answer: A

   Next question

7. Question 47 · 61 in bank

   Select 2

   Refer to the exhibit.

   

   On FortiGate, a RADIUS server is configured to forward authentication requests to FortiAuthenticator, which acts as a RADIUS proxy. FortiAuthenticator then relays these authentication requests to a remote Windows AD server using LDAP. While testing authentication using the CLI command diagnose test authserver, the administrator observed that authentication succeeded with PAP but failed when using MS-CHAPv2. Which two solutions can the administrator implement to enable MS-CHAPv2 authentication? (Choose two.)

   • AConfigure FortiAuthenticator to use RADIUS instead of LDAP as the back-end authentication server.
   • BChange the FortiGate authentication method to CHAP instead of MS-CHAPv2.
   • CEnable Windows Active Directory domain authentication on FortiAuthenticator.
   • DEnable RADIUS attribute filtering on FortiAuthenticator.

   Show answer

   Answer: AC

   Next question

8. Question 48 · 61 in bank

   In addition to requiring a FortiAnalyzer device to configure the Security Fabric, which license must be added to FortiAnalyzer to use Indicators of Compromise (IOC) rules?

   • AIOC Subscription license
   • BThreat Detection Service license
   • CIoT Security Add-on license
   • DIOC detection is included on FAZ-Basic license

   Show answer

   Answer: B

   Next question

9. Question 49 · 61 in bank

   Select 3

   You are deploying a FortiSwitch device managed by FortiGate in a secure network environment. To ensure accurate communication, you must identify which protocols are required for communication and control between FortiGate and FortiSwitch. Which three protocols are used by FortiGate to manage and control FortiSwitch devices? (Choose three.)

   • ASNMP can be used by FortiGate to manage FortiSwitch devices by monitoring their status.
   • BHTTPS is used by FortiGate to securely manage and configure FortiSwitch devices.
   • CCAPWAP is used to establish the control channel between FortiSwitch and FortiGate.
   • DFortiGate uses the Fortilink protocol to establish communication with FortiSwitch.
   • EIGMP is required for managing communication between FortiGate and FortiSwitch devices in multicast environments.

   Show answer

   Answer: ABD

   Next question

10. Question 50 · 61 in bank

    Connectivity tests are being performed on a newly configured VLAN. The VLAN is configured on a FortiSwitch device that is managed by FortiGate. During testing, it is observed that devices within the VLAN can successfully ping FortiGate, and FortiGate can also ping these devices. Inter-VLAN communication is working as expected. However, devices within the same VLAN are unable to communicate with each other. What could be causing this issue?

    • AAccess VLAN is enabled on the VLAN.
    • BThe FortiGate ARP table is missing entries.
    • CThe native VLAN configured on the ports is incorrect.
    • DThe FortiSwitch MAC address table is missing entries.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCSS_LED_AR-7.6 practice, question 41. 61 questions available.