FCSS_NST_SE-7.6 practice questions 11–20

1. Question 11 · 57 in bank

   Select 2

   Refer to the exhibit. Network topology and a partial routing table

   

   Network topology and a partial routing table is shown. FortiGate has already been configured with a firewall policy that allows all ICMP traffic to flow from port1 to port3. Which two changes can the administrator perform to ensure the server at 10.4.0.1/24 receives the echo reply from the laptop at 10.1.0.1/24? (Choose two.)

   • AModify the default gateway on the laptop from 10.1.0.2 to 10.1.0.254.
   • BChange the FortiGate configuration from strict RPF check mode to feasible RPF check mode.
   • CEnable asymmetric routing under config system settings.
   • DAdd a default static route on FortiGate to forward all traffic to port3.

   Show answer

   Answer: AC

   Next question

2. Question 12 · 57 in bank

   During the SAML negotiation process, in which section does the identity Provider (IdP) provide the SAML attributes utilized in the authentication process to the service provider (SP)?

   • AAssertion dump
   • BBindings HTTP post
   • CAuthentication request
   • DAuthentication response

   Show answer

   Answer: A

   Next question

3. Question 13 · 57 in bank

   Refer to the exhibit. The output of a BGP debug command is shown.

   

   Why has the local router at 172.16.23.58 been unable to establish adjacency with its only neighbor?

   • AThe local router has not received an OPEN message from the neighbor.
   • BThere is no active route to the BGP neighbor.
   • CThe neighbor router has become unreachable, which is evident by the low ratio of messages received to messages sent.
   • DThe local router has not received a SYN/ACK packet from the neighbor.

   Show answer

   Answer: D

   Next question

4. Question 14 · 57 in bank

   Select 2

   Refer to the exhibits. Exhibit 1 -

   

   Exhibit 2 -

   

   The configuration on FortiGate and partial internet session information from a user on the internal network are shown. An administrator would like to test session failover between the two service provider connections. Which two changes must the administrator make to force this existing session to immediately start using the other interface? (Choose two.)

   • AModify the distance of the port1 route to 1.
   • BChange the priority of the port1 static route to 11.
   • CConfigure set snat-route-change enable.
   • DChange the priority of the port2 static route to 5.

   Show answer

   Answer: BC

   Next question

5. Question 15 · 57 in bank

   Select 2

   Which two statements about Security Fabric communications are true? (Choose two.)

   • AThe default ports for FortiTelemetry and Neighbor Discovery can be modified.
   • BSecurity Fabric communication is enabled by default among all Fortinet devices.
   • CFortiTelemetry must be manually enabled on the FortiGate interface.
   • DBy default, the downstream FortiGate establishes a connection with the upstream FortiGate using TCP port 8013.

   Show answer

   Answer: CD

   Next question

6. Question 16 · 57 in bank

   Refer to the exhibit.

   

   An administrator has configured a firewall policy to use proxy-based inspection mode. What could explain the messages observed in the debug flow output?

   • AThe FTP protocol has not yet been mapped to port 211 under Protocol Options.
   • BFortiGate does not have enough free memory to perform proxy-based inspections.
   • CAt least one protocol port under Protocol Options has been mapped to Any.
   • DSSL deep inspection is not configured.

   Show answer

   Answer: A

   Next question

7. Question 17 · 57 in bank

   Select 3

   Refer to the exhibit.

   

   Which three pieces of information does the diagnose sys top command provide? (Choose three.)

   • AThe miglogd daemon is running on CPU core ID 0.
   • BThe cmdbsvr process is occupying 2.4% of the total user memory space.
   • CThe diagnose sys top command has been running for 18 minutes.
   • DIf the newcli daemon continues to be in the R state, it will need to be manually restarted.
   • EThe miglogd daemon would be on top of the list, if the administrator pressed m on the keyboard.

   Show answer

   Answer: ABE

   Next question

8. Question 18 · 57 in bank

   Select 2

   Refer to the exhibit. Real-time OSPF debug output -

   

   Partial output of a real-time OSPF debug is shown. Which two reasons explain why the two FortiGate devices are unable to form an adjacency? (Choose two.)

   • AThe remote peer has either OSPF cleartext or MD5 authentication configured.
   • BThe local FortiGate has either OSPF cleartext or MD5 authentication configured.
   • CThere is an OSPF authentication configuration mismatch.
   • DThe local FortiGate does not have OSPF authentication configured.

   Show answer

   Answer: BC

   Next question

9. Question 19 · 57 in bank

   Refer to the exhibit. Debug output -

   

   The output of the command diagnose vpn tunnel list is shown. Reviewing the debug command, what is the current status of the traffic flowing through the tunnel?

   • ANP6 is handling the offloading.
   • BThe inbound IPsec SA was copied to the NPU.
   • CThe outbound IPsec SA was copied to the NPU.
   • DThe inbound and outbound IPsec SAs were copied to the NPU.

   Show answer

   Answer: B

   Next question

10. Question 20 · 57 in bank

    Select 2

    Refer to the exhibit. Debug output -

    

    Which two statements about FortiGate behavior relating to this session are correct? (Choose two.)

    • AFortiGate either initiated the session or the session terminates at FortiGate.
    • BFortiGate redirected the client to the captive portal to authenticate so that a correct policy match could be made.
    • CFortiGate forwarded this session without any inspection.
    • DFortiGate is performing a security profile inspection using the CPU.

    Show answer

    Answer: AD

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCSS_NST_SE-7.6 practice, question 11. 57 questions available.