FCSS_NST_SE-7.6 practice questions 41–50

1. Question 41 · 57 in bank

   Select 2

   Refer to the exhibits.

   

   Partial configurations of two VPNs on FortiGate are shown. An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovers that FortiGate is not matching the user-2 VPN for members of the Users-2 group. Which two changes must the administrator make to fix the issue? (Choose two.)

   • AChange to aggressive mode on both VPNs.
   • BEnable XAuth on both VPNs.
   • CSet up specific peer IDs on both VPNs.
   • DUse different pre-shared keys on both VPNs.

   Show answer

   Answer: AC

   Next question

2. Question 42 · 57 in bank

   Select 2

   Refer to the exhibit. The output of diagnose automation test command is shown.

   

   Which two observations can you make from the output? (Choose two.)

   • AThe test was unsuccessful.
   • BThe automation stitch test is not being logged.
   • CA high availability (HA) failover occurred.
   • DThe configuration was backed up.

   Show answer

   Answer: AB

   Next question

3. Question 43 · 57 in bank

   Select 2

   Refer to the exhibit.

   

   The output of the command diagnose vpn tunnel list is shown. Which two statements accurately describe the status of the tunnel? (Choose two.)

   • APhase 1 is down.
   • BBoth Phase 1 and Phase 2 were negotiated successfully.
   • CPhase 2 is down.
   • DThere is currently no traffic traversing the tunnel.

   Show answer

   Answer: CD

   Next question

4. Question 44 · 57 in bank

   Refer to the exhibit.

   

   If the default settings are in place, what can you conclude about the conserve mode shown in the exhibit?

   • AFortiGate is currently allowing new sessions that require flow-based or proxy-based content inspection, but is not performing inspection on those sessions.
   • BFortiGate is currently blocking all new sessions regardless of the content inspection requirements or configuration settings because of high memory use.
   • CFortiGate is currently allowing new sessions that require flow-based content inspection and blocking sessions that require proxy-based content inspection.
   • DFortiGate is currently allowing new sessions and will continue to allow sessions if memory increases another 6%.

   Show answer

   Answer: A

   Next question

5. Question 45 · 57 in bank

   Select 2

   Refer to the exhibit. Partial output of diagnose sys session stat command is shown.

   

   An administrator has noticed unusual behavior from FortiGate. It appears that sessions are randomly removed. Which two reasons could explain this? (Choose two.)

   • AFortiGate is flushing sessions because of high memory usage.
   • BFortiGate is deleting sessions because the kernel cannot allocate more memory pages.
   • CFortiGate is not accepting sessions because the device has been down 16 out of 120 seconds.
   • DFortiGate is dropping all TCP sessions with incomplete three-way handshakes.

   Show answer

   Answer: AB

   Next question

6. Question 46 · 57 in bank

   Select 2

   Refer to the exhibit.

   

   A partial output of diagnose npu np6 port-list on FortiGate 2000E is shown. An administrator is unable to analyze traffic flowing between port1 and port17 using the diagnose sniffer command. Which two commands allow the administrator to view the traffic? (Choose two.)

   • Adiagnose npu np6 port-list disable 5 17
   • Bdiagnose npu np6 fastpath disable 1
   • Cconfig system npu set fastpath disable end
   • Dconfig firewall policy edit 5 set auto-asic-offload disable end next edit 17 set auto-asic-offload disable end

   Show answer

   Answer: BD

   Next question

7. Question 47 · 57 in bank

   Select 2

   What are two reasons you might see iprope_in_check() check failed, drop when using the debug flow? (Choose two.)

   • AThe packet was dropped because the trusted host list is misconfigured.
   • BThe packet was dropped because it is not allowed by any firewall policy.
   • CThe packet was dropped because the requested service is not enabled on FortiGate.
   • DThe packet was dropped because there is no route to the source.

   Show answer

   Answer: AC

   Next question

8. Question 48 · 57 in bank

   Refer to the exhibit.

   

   The administrator did not override the FortiGuard FQDN or IP address in the FortiGate configuration. Which IP address did FortiGate get when resolving the service.fortiguard.net name?

   • A64.26.151.37
   • B209.22.147.36
   • C208.91.112.194
   • D96.45.33.65

   Show answer

   Answer: C

   Next question

9. Question 49 · 57 in bank

   Refer to the exhibit.

   

   An IPsec VPN tunnel is dropping, as shown by the debug output. Analyzing the debug output, what could be causing the tunnel to go down?

   • AThe local FortiGate is dropping the incoming IKE packets from the peer.
   • BThe NAT-T negotiation was unsuccessful.
   • CDead Peer Detection is not receiving its acknowledge packet.
   • DThere is no active route to the remote peer.

   Show answer

   Answer: C

   Next question

10. Question 50 · 57 in bank

    What is the correct order of the IKEv2 request-and-response protocol?

    • ACreate_Child_SA, IKE_AUTH, IKE_SA_INIT
    • BIKE_AUTH, IKE_SA_INIT, Create_Child_SA
    • CCreate_Child_SA, IKE_SA_INIT, IKE_AUTH
    • DIKE_SA_INIT, IKE_AUTH, Create_Child_SA

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCSS_NST_SE-7.6 practice, question 41. 57 questions available.