FCSS_NST_SE-7.6 practice questions 51–57

1. Question 51 · 57 in bank

   Select 2

   Refer to the exhibit. The partial output of diagnose hardware sysinfo memory command is shown.

   

   Which two memory allocations could help you troubleshoot a potential resource issue? (Choose two.)

   • AThe user space, which has 708880 kB of physical memory that is not used by the system.
   • BThe 98908 kB of memory that will never be used.
   • CThe I/O cache, which has 641364 kB of memory allocated to it.
   • DThe unused cache page, which is represented by the value indicated next to the Inactive heading.

   Show answer

   Answer: CD

   Next question

2. Question 52 · 57 in bank

   Refer to the exhibit.

   

   The output of a policy route table entry is shown. Which type of policy route does the output show?

   • AAn SD-WAN rule
   • BA regular policy route, which is associated with an active static route in the FIB
   • CAn ISDB route
   • DA regular policy route, which is not associated with an active static route in the FIB

   Show answer

   Answer: A

   Next question

3. Question 53 · 57 in bank

   Select 2

   Refer to the exhibit.

   

   An administrator deployed FSSO in DC Agent mode but FSSO is failing on FortiGate. Pinging FortiGate from where the collector agent is deployed is successful. The administrator then produces the debug output shown in the exhibit. Which two components could be causing this error message? (Choose two.)

   • AThe collector agent preshared password is mismatched.
   • BFortiGate and the collector agent are using different TCP ports.
   • CThe connection is blocked by the Windows firewall.
   • DTCP port 445 is blocked between FortiGate and the collector agent.

   Show answer

   Answer: BC

   Next question

4. Question 54 · 57 in bank

   Select 3

   Which three common FortiGate-to-collector-agent connectivity issues can you identify using the FSSO real-time debug? (Choose three.)

   • AFortiGate cannot reach the IP address of the collector agent.
   • BThe pre-shared key does not match.
   • CThe SSL certificate used for FSSO over SSL has expired.
   • DThe group filters do not match.
   • EThe connection was refused. There may be a mismatch of the TCP port.

   Show answer

   Answer: ABE

   Next question

5. Question 55 · 57 in bank

   Refer to the exhibit.

   

   The output of diagnose sys session list command is shown. If the HA ID for the primary device is 0, what happens if the primary falils and the secondary becomes the primary?

   • AThe session is synchronized with the secondary device, however, because application control is applied, the session is marked dirty and has to be re-evaluated after failover.
   • BThe session state is preserved but the kernel will re-evaluate the session because the routing information will be flushed.
   • CThe session will be removed from the session table of the secondary device because the TCP session is not yet fully established.
   • DThe session continues to permit traffic on the new primary device after failover, without requiring the client to restart the session with the server.

   Show answer

   Answer: D

   Next question

6. Question 56 · 57 in bank

   Refer to the exhibit.

   

   FortiGate is showing continuous high CPU usage. During a maintenance window, the CLI command diagnose sys top displays the output shown in the exhibit. The CLI command diagnose test application ipsmonitor 5 was run, but the CPU usage by daemon ipsengine did not drop. Which immediate action can you take to reduce the CPU usage effectively?

   • AReduce the number of IPS signatures enabled on the active IPS profiles.
   • BBypass all IPS engines.
   • CExecute diagnose test application ipsmonitor 2 instead.
   • DDisable IPS on all firewall policies.

   Show answer

   Answer: C

   Next question

7. Question 57 · 57 in bank

   Select 2

   Refer to the exhibits.

   

   An OSPF peer is advertising route 172.16.52.0/24. The local FortiGate is configured with an inbound distribution list that allows the 172.16.0.0/16 network to be injected into its routing table. However, the 172.16.52.0/24 subnet cannot be seen in the FIB. Which two steps can the administrator of the local FortiGate take to ensure that the advertised 172.16.52.0/24 subnet will be injected into the routing table? (Choose two.)

   • AChange the le value to 16.
   • BAdd another entry to the prefix list to specifically allow the 172.16.52.0/24 network.
   • CModify the default prefix-list behavior from implicit deny to implicit allow.
   • DChange the ge value to 17.

   Show answer

   Answer: BD

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCSS_NST_SE-7.6 practice, question 51. 57 questions available.