FCSS_EFW_AD-7.6 practice questions 1–10

1. Question 1 · 66 in bank

   Select 2

   Refer to the exhibit. An enterprise network connected to an ISP is shown.

   

   You must configure a loopback as a BGP source to connect to the ISP. Which two commands must you use to establish the connection? (Choose two.)

   • Aibgp-enfогсе-multihop
   • Bebgp-enfоrce-multihop
   • Crecursive-next-hop
   • Dupdate-source

   Show answer

   Answer: BD

   Next question

2. Question 2 · 66 in bank

   You must minimize CPU and RAM use on a FortiGate firewall while also enabling essential security features, such as web filtering and application control for HTTPS traffic. Which SSL inspection setting reduces system load while also enabling security features, such as web filtering and application control for encrypted HTTPS traffic?

   • AEnable SSL certificate inspection mode to perform basic checks without decrypting traffic.
   • BDisable SSL inspection to preserve resources.
   • CUse deep SSL inspection to inspect encrypted HTTPS traffic.
   • DConfigure SSL inspection to handle HTTPS traffic efficiently.

   Show answer

   Answer: A

   Next question

3. Question 3 · 66 in bank

   Refer to the exhibits.

   

   The configuration of Windows PC, PC 1, with a default MTU of 1500 bytes, FortiGate interfaces with an MTU of 1000 bytes, and the results of PC 1 pinging over server 172.16.0.251 are shown. Why is the PC1 user unable to ping server 172.16.0.254 and seeing the message: Packet needs to be fragmented but DF set?

   • AThe user must adjust the TCP maximum segment size (MSS) to 1000 for the ping to succeed
   • BThe ip.flags.mf option must be enabled on FortiGate. The user must adjust the ping MTU to 1000 to succeed.
   • CThe user must account for the size of the Ethernet header when configuring the MTU value.
   • DFortiGate honors the do not fragment bit and the packets are dropped. The user must adjust the ping MTU to 972 to succeed.

   Show answer

   Answer: D

   Next question

4. Question 4 · 66 in bank

   Refer to the exhibit.

   

   A network topology and a FortiGate routing table is shown. What must you configure in the BGP section to add only the subnet 100.64.2.0/24 in the routing table of FortiGate_A?

   • AConfigure route-map-in on FortiGate_A.
   • BConfigure connected routes redistribution on FortiGate_C.
   • CConfigure BGP route redistribution on FortiGate_B.
   • DConfigure the 100.64.2.0/24 network on FortiGate_C.

   Show answer

   Answer: D

   Next question

5. Question 5 · 66 in bank

   You receive a FortiAnalyzer alert warning that a 1 ТВ disk filled up in a day. Upon investigation, you find thousands of unusual DNS log requests, such as JHCMQK.website.com, with no answers. You later discover that DNS exfiltration is occurring through both UDP and TLS. How can you prevent this data theft technique?

   • AUse a file filter profile to protect against DNS exfiltration.
   • BUse an intrusion prevention system (IPS) profile and DNS exfiltration-related signatures.
   • CEnable DNS filter to protect against DNS exfiltration.
   • DEnable data loss prevention (DLP) to prevent DNS exfiltration.

   Show answer

   Answer: B

   Next question

6. Question 6 · 66 in bank

   Refer to the exhibit.

   

   Based on the exhibit, what is the first message that Spoke 1 replies to the hub instructing it to bring up the dynamic tunnel if a client generates traffic destined to Spoke 2?

   • AShortcut query
   • BShortcut forward
   • CShortcut offer
   • DShortcut reply

   Show answer

   Answer: A

   Next question

7. Question 7 · 66 in bank

   Refer to the exhibit.

   

   An HA configuration of an active-active (A-A) cluster with the same HA uptime shown. You want HQ-NGFW-2 to handle the Core2 VDOM traffic. Which modification must you make to achieve this outcome?

   • AEnable override in virtual duster 2 for HQ-NGFW-2.
   • BChange the priority from 120 to 200 for HQ-NGFW-2.
   • CChange the priority from 100 to 160 for HQ-NGFW-2.
   • DReboot HQ-NGFW-2.

   Show answer

   Answer: B

   Next question

8. Question 8 · 66 in bank

   Select 2

   Refer to the exhibit.

   

   A network diagram with a hub and spokes deployment is shown. You must deploy several spokes, including the BGP configuration for the spokes that connect to the hub. Which two commands would you use to minimize the amount of configuration needed on the hub? (Choose two.)

   • Aebgp-multipath
   • Broute-overlap
   • Cneighbor-range
   • Dneighbor-group

   Show answer

   Answer: CD

   Next question

9. Question 9 · 66 in bank

   Select 2

   Refer to the exhibit.

   

   The VDOM configuration on a FortiGate device is shown. You discover that web filtering stopped working in Corel and Core2 after a maintenance window. What are two reasons why web filtering stopped working? (Choose two.)

   • AThe root VDOM does not use a VDOM link to connect with the Core1 and Core2 VDOMs.
   • BThe root VDOM does not have access to any valid, public Fortinet Distribution Network (FDN).
   • CThe root VDOM does not have access to FortiManager in a dosed network.
   • DThe Core1 and Core2 VDOMs must also be enabled as management VDOMs to receive FortiGuard updates.

   Show answer

   Answer: BC

   Next question

10. Question 10 · 66 in bank

    Refer to the exhibit. An OSPF network is shown.

    

    Which configuration must you apply to optimize the OSPF database?

    • ASet the area 0.0.0.1 to the type Stub in the area border FortiGate.
    • BSet a route map in the autonomous system boundary FortiGate.
    • CSet the area 0.0.0.l to the type NSSA in the area border FortiGate.
    • DSet a prefix list in the autonomous system boundary FortiGate.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCSS_EFW_AD-7.6 practice, question 1. 66 questions available.