FCSS_EFW_AD-7.6 Practice Test Questions Updated 92 Questions
Fortinet FCSS_EFW_AD-7.6 Dumps - Secret To Pass in First Attempt
NEW QUESTION # 40
Refer to the exhibit, which shows a hub and spokes deployment.
An administrator is deploying several spokes, including the BGP configuration for the spokes to connect to the hub.
Which two commands allow the administrator to minimize the configuration? (Choose two.)
- A. route-reflector-client
- B. ibgp-enforce-multihop
- C. neighbor-range
- D. neighbor-group
Answer: C,D
Explanation:
neighbor-group:
This command is used to group multiple BGP neighbors with the same configuration, reducing redundant configuration.
Instead of defining individual BGP settings for each spoke, the administrator can create a neighbor-group and apply the same policies, reducing manual work.
neighbor-range:
This command allows the configuration of a range of neighbor IPs dynamically, reducing the need to manually define each spoke neighbor.
It automatically adds BGP neighbors that match a given prefix, simplifying deployment.
NEW QUESTION # 41
An administrator must standardize the deployment of FortiGate devices across branches with consistent interface roles and policy packages using FortiManager.
What is the recommended best practice for interface assignment in this scenario?
- A. Create interfaces using device database scripts to use them on the same policy package of FortiGate devices.
- B. Create normalized interface types per-platform to automatically recognize device layer interfaces based on the FortiGate model and interface name.
- C. Use the Install On feature in the policy package to automatically assign different interfaces based on the branch.
- D. Enable metadata variables to use dynamic configurations in the standard interfaces of FortiManager.
Answer: D
Explanation:
When standardizing the deployment of FortiGate devices across branches using FortiManager, the best practice is to use metadata variables. This allows for dynamic interface configuration while maintaining a single, consistent policy package for all branches.
# Metadata variables in FortiManager enable interface roles and configurations to be dynamically assigned based on the specific FortiGate device.
# This ensures scalability and consistent security policy enforcement across all branches without manually adjusting interface settings for each device.
# When a new branch FortiGate is deployed, metadata variables automatically map to the correct physical interfaces, reducing manual configuration errors.
NEW QUESTION # 42
Refer to the exhibit, which shows a partial troubleshooting command output.
An administrator is extensively using IPsec on FortiGate. Many tunnels show information similar to the output shown in the exhibit.
What can the administrator conclude?
- A. Only the outbound IPsec SA is copied to the NPU.
- B. IPsec SAs cannot be offloaded.
- C. Only the inbound IPsec SA is copied to the NPU.
- D. The two IPsec SAs, inbound and outbound, are copied to the NPU.
Answer: D
Explanation:
The diagnose vpn tunnel list name Hub2Spoke1 command output provides key information about the offloading status of an IPsec VPN tunnel to the Network Processing Unit (NPU).
# npu_flag=20:
# This flag indicates that both inbound and outbound IPsec Security Associations (SAs) have been offloaded to the NPU, meaning the VPN traffic is processed in hardware instead of the CPU.
# npu_rgwy=10.10.2.2 and npu_lgwy=10.10.1.1:
# These IPs represent the remote gateway (rgwy) and local gateway (lgwy), confirming that the tunnel is successfully offloaded.
# npu_selid=1:
# This value means the session selector for the NPU offloaded SA is active.
Since both inbound and outbound SAs are offloaded, the administrator can conclude that the FortiGate NPU is handling IPsec encryption and decryption efficiently, reducing CPU load and improving VPN performance.
NEW QUESTION # 43
An administrator is checking an enterprise network and sees a suspicious packet with the MAC address e0:23:
ff:fc:00:86.
What two conclusions can the administrator draw? (Choose two.)
- A. The suspicious packet is related to a cluster that has VDOMs enabled.
- B. The network includes FortiGate devices configured with the FGSP protocol.
- C. The suspicious packet is related to a cluster with a group-id value lower than 255.
- D. The suspicious packet corresponds to port 7 on a FortiGate device.
Answer: A,C
Explanation:
The MAC address e0:23:ff:fc:00:86 follows the format used in FortiGate High Availability (HA) clusters.
When FortiGate devices are in an HA configuration, they use virtual MAC addresses for failover and redundancy purposes.
The suspicious packet is related to a cluster that has VDOMs enabled:
FortiGate devices with Virtual Domains (VDOMs) enabled use specific MAC address ranges to differentiate HA-related traffic. This MAC address is likely part of that mechanism.
The suspicious packet is related to a cluster with a group-id value lower than 255:
FortiGate HA clusters assign virtual MAC addresses based on the group ID. The last octet (00:86) corresponds to a group ID that is below 255, confirming this option.
NEW QUESTION # 44
An administrator configured the FortiGate devices in an enterprise network to join the Fortinet Security Fabric. The administrator has a list of IP addresses that must be blocked by the data center firewall. This list is updated daily.
How can the administrator automate a firewall policy with the daily updated list?
- A. With a Security Fabric automation
- B. With FortiAnalyzer
- C. With an external connector from Threat Feeds
- D. With FortiNAC
Answer: C
Explanation:
The best way to automate a firewall policy using a daily updated list of IP addresses is by using an external connector from Threat Feeds. This allows FortiGate to dynamically retrieve real-time threat intelligence from external sources and apply it directly to security policies.
By configuring Threat Feeds, the administrator can:
# Automatically update firewall policies with the latest malicious IPs daily.
# Block traffic from those IPs in real-time without manual intervention.
# Integrate with FortiGuard, third-party threat intelligence sources, or custom feeds (CSV, STIX
/TAXII, etc.).
NEW QUESTION # 45
Refer to the exhibit, which shows the packet capture output of a three-way handshake between FortiGate and FortiManager Cloud.
What two conclusions can you draw from the exhibit? (Choose two.)
- A. The wildcard for the domain *.fortinet-ca2.support.fortinet.com must be supported by FortiManager Cloud.
- B. FortiGate will receive a certificate that supports multiple domains because FortiManager operates in a cloud computing environment.
- C. FortiGate is connecting to the same IP server and will receive an independent certificate for its connection between FortiGate and FortiManager Cloud.
- D. If the TLS handshake contains 17 cipher suites it means the TLS version must be 1.0 on this three-way handshake.
Answer: A,B
NEW QUESTION # 46
Refer to the exhibit, which shows a network diagram.
An administrator would like to modify the MED value advertised from FortiGate_1 to a BGP neighbor in the autonomous system 30.
What must the administrator configure on FortiGate_1 to implement this?
- A. network-import-check
- B. prefix-list-out
- C. route-map-out
- D. distribute-list-out
Answer: C
Explanation:
The Multi-Exit Discriminator (MED) is a BGP attribute used to influence the preferred path for incoming traffic from an external autonomous system (AS). The diagram shows that FortiGate_1 advertises MED 200, while FortiGate_2 advertises MED 300, meaning the ISP will prefer the route through FortiGate_1 because a lower MED is preferred in BGP.
To modify the MED value on FortiGate_1 for routes advertised to AS 30, the administrator must configure a route-map-out. A route map can match specific routes and set the MED value before sending them to the BGP neighbor.
NEW QUESTION # 47
A user reports that their computer was infected with malware after accessing a secured HTTPS website. However, when the administrator checks the FortiGate logs, they do not see that the website was detected as insecure despite having an SSL certificate and correct profiles applied on the policy.
How can an administrator ensure that FortiGate can analyze encrypted HTTPS traffic on a website?
- A. The administrator must enable DNS over TLS to protect against fake Server Name Indication (SNI) that cannot be analyzed in common DNS requests on HTTPS websites.
- B. The administrator must enable reputable websites to allow only SSL/TLS websites rated by FortiGuard web filter.
- C. The administrator must enable URL extraction from SNI on the SSL certificate inspection to ensure the TLS three-way handshake is correctly analyzed by FortiGate.
- D. The administrator must enable full SSL inspection in the SSL/SSH Inspection Profile to decrypt packets and ensure they are analyzed as expected.
Answer: D
Explanation:
FortiGate, like other security appliances, cannot analyze encrypted HTTPS traffic unless it decrypts it first. If only certificate inspection is enabled, FortiGate can see the certificate details (such as the domain and issuer) but cannot inspect the actual web content.
To fully analyze the traffic and detect potential malware threats:
Full SSL inspection (Deep Packet Inspection) must be enabled in the SSL/SSH Inspection Profile.
This allows FortiGate to decrypt the HTTPS traffic, inspect the content, and then re-encrypt it before forwarding it to the user.
Without full SSL inspection, threats embedded in encrypted traffic may go undetected.
NEW QUESTION # 48
Refer to the exhibit, which shows an enterprise network connected to an internet service provider.
An administrator must configure a loopback as a BGP source to connect to the ISP.
Which two commands are required to establish the connection? (Choose two.)
- A. ibgp-enforce-multihop
- B. recursive-next-hop
- C. update-source
- D. ebgp-enforce-multihop
Answer: C,D
Explanation:
When configuring a loopback interface as the BGP source for connecting to an ISP, two important settings must be applied:
1. Enable EBGP Multihop (ebgp-enforce-multihop)
BGP normally expects directly connected neighbors, but since the ISP and FortiGate A are using loopback interfaces, packets will not be sent directly between their physical interfaces.
The ebgp-enforce-multihop command allows BGP to form an eBGP peering over multiple hops.
2. Set the Update Source (update-source)
Since FortiGate is using a loopback interface as the source, the update-source command ensures that BGP updates originate from the loopback interface rather than a physical interface.
This is essential because BGP peers must match the source IP with the configured neighbor address.
NEW QUESTION # 49
Refer to the exhibits.
The configuration of a user's Windows PC, which has a default MTU of 1500 bytes, along with FortiGate interfaces set to an MTU of 1000 bytes, and the results of PC1 pinging server 172.16.0.254 are shown.
Why is the user in Windows PC1 unable to ping server 172.16.0.254 and is seeing the message: Packet needs to be fragmented but DF set?
- A. Option ip.flags.mf must be set to enable on FortiGate. The user has to adjust the ping MTU to 1000 to succeed.
- B. The user must trigger different traffic because path MTU discovery techniques do not recognize ICMP payloads.
- C. FortiGate honors the do not fragment bit and the packets are dropped. The user has to adjust the ping MTU to 972 to succeed.
- D. Fragmented packets must be encrypted. To connect any application successfully, the user must install the Fortinet_CA certificate in the Microsoft Management Console.
Answer: C
Explanation:
The issue occurs because FortiGate enforces the "do not fragment" (DF) bit in the packet, and the packet size exceeds the MTU of the network path. When the Windows PC1 (with an MTU of 1500 bytes) attempts to send a 1400-byte packet, the FortiGate interface (with an MTU of 1000 bytes) needs to fragment it. However, since the DF bit is set, FortiGate drops the packet instead of fragmenting it.
To resolve this, the user should adjust the ping packet size to fit within the path MTU. In this case, reducing the packet size to 972 bytes (1000 bytes MTU minus 28 bytes for the IP and ICMP headers) should allow successful transmission.
NEW QUESTION # 50
What does the command set forward-domain <domain_ID> in a transparent VDOM interface do?
- A. It assigns a unique domain ID to the interface, allowing it to operate across multiple VLANs within the same VDOM.
- B. It isolates traffic within a specific VLAN by assigning a broadcast domain to an interface based on the VLAN ID.
- C. It configures the interface to prioritize traffic based on the domain ID, enhancing quality of service for specified VLANs.
- D. It restricts the interface to managing traffic only from the specified VLAN, effectively segregating network traffic.
Answer: B
Explanation:
In a transparent mode Virtual Domain (VDOM) configuration, FortiGate operates as a Layer 2 bridge rather than performing Layer 3 routing. The set forward-domain <domain_ID> command is used to control how traffic is forwarded between interfaces within the same transparent VDOM.
A forward-domain acts as a broadcast domain, meaning only interfaces with the same forward-domain ID can exchange traffic. This setting is commonly used to separate different VLANs or network segments within the transparent VDOM while still allowing FortiGate to apply security policies.
NEW QUESTION # 51
Refer to the exhibits.
The Administrators section of a root FortiGate device and the Security Fabric Settings section of a downstream FortiGate device are shown.
When prompted to sign in with Security Fabric in the downstream FortiGate device, a user enters the AdminSSO credentials.
What is the next status for the user?
- A. The user accesses the downstream FortiGate with super_admin_readonly privileges.
- B. The user is prompted to create an SSO administrator account for AdminSSO.
- C. The user accesses the downstream FortiGate with super_admin privileges.
- D. The user receives an authentication failure message.
Answer: A
Explanation:
From the Root FortiGate - System Administrator Configuration exhibit:
# The AdminSSO account has the super_admin_readonly role.
From the Downstream FortiGate - Security Fabric Settings exhibit:
# The Security Fabric role is set to Join Existing Fabric, meaning it will authenticate with the root FortiGate.
# SAML Single Sign-On (SSO) is enabled, and the default admin profile is set to super_admin_readonly.
When the AdminSSO user logs into the downstream FortiGate using SSO, the authentication request is sent to the root FortiGate, where AdminSSO has super_admin_readonly permissions. Since the downstream FortiGate inherits this permission through the Security Fabric configuration, the user will be granted super_admin_readonly access.
NEW QUESTION # 52
Refer to the exhibit, which shows the ADVPN IPsec interface representing the VPN IPsec phase
1 from Hub A to Spoke 1 and Spoke 2, and from Hub to Spoke 3 and Spoke 4.
An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2.
What must the administrator configure in the phase 1 VPN IPsec configuration of the ADVPN tunnels?
- A. set auto-discovery-sender enable and set network-id x
- B. set auto-discovery-forwarder enable and set remote-as x
- C. set auto-discovery-receiver enable and set npu-offload enable
- D. set auto-discovery-crossover enable and set enforce-multihop enable
Answer: D
Explanation:
When configuring ADVPN (Auto-Discovery VPN) to connect overlay networks across different hubs using IBGP and EBGP, special configurations are required to allow spokes from different overlay networks to dynamically establish tunnels.
set auto-discovery-crossover enable
This allows cross-hub tunnel discovery in an ADVPN deployment where multiple hubs are used.
Since Hub A and Hub B belong to different overlays, enabling crossover discovery ensures that spokes from one overlay can dynamically create direct tunnels to spokes in the other overlay when needed.
set enforce-multihop enable
This setting ensures that BGP peers using loopback interfaces can establish connectivity even if they are not directly connected.
Multihop BGP sessions are required when using loopback addresses as BGP peer sources because the connection might need to traverse multiple routers before reaching the BGP neighbor. This is especially useful in ADVPN deployments with multiple hubs, where routes might need to cross from one hub to another.
NEW QUESTION # 53
Refer to the exhibit, which shows a corporate network and a new remote office network.
An administrator must integrate the new remote office network with the corporate enterprise network.
What must the administrator do to allow routing between the two networks?
- A. The administrator must implement OSPF over IPsec on both FortiGate devices.
- B. The administrator must configure a static route to the subnet 192.168.l.0/24 on the corporate FortiGate device.
- C. The administrator must configure virtual links on both FortiGate devices.
- D. The administrator must implement BGP to inject the new remote office network into the corporate FortiGate device
Answer: A
Explanation:
In this scenario, the corporate network and the new remote office network need to communicate over the Internet, which requires a secure and dynamic routing method. Since both networks are using OSPF (Open Shortest Path First) as the routing protocol, the best approach is to establish an OSPF over IPsec VPN to ensure secure and dynamic route propagation.
OSPF is already running on the corporate network, and extending it over an IPsec tunnel allows dynamic route exchange between the corporate FortiGate and the remote office FortiGate. IPsec provides encryption for traffic over the Internet, ensuring secure communication. OSPF over IPsec eliminates the need for manual static routes, allowing automatic route updates if networks change.
The new remote office's 192.168.1.0/24 subnet will be advertised dynamically to the corporate network without additional configuration.
NEW QUESTION # 54
Refer to the exhibit, which contains the partial output of an OSPF command.
An administrator is checking the OSPF status of a FortiGate device and receives the output shown in the exhibit.
Which statement on this FortiGate device is correct?
- A. The FortiGate device does not support OSPF ECMP.
- B. The FortiGate device is a backup designated router.
- C. The FortiGate device can inject external routing information.
- D. The FortiGate device is in the area 0.0.0.5.
Answer: C
Explanation:
From the OSPF status output, the key information is:
"This router is an ASBR" - This means the FortiGate is acting as an Autonomous System Boundary Router (ASBR).
An ASBR is responsible for injecting external routing information into OSPF from another routing protocol (such as BGP, static routes, or connected networks).
NEW QUESTION # 55
An administrator applied a block-all IPS profile for client and server targets to secure the server, but the database team reported the application stopped working immediately after.
How can an administrator apply IPS in a way that ensures it does not disrupt existing applications in the network?
- A. Limit the IPS profile to server targets only to avoid blocking connections from the server to clients.
- B. Select flow mode in the IPS profile to accurately analyze application patterns.
- C. Use an IPS profile with all signatures in monitor mode and verify patterns before blocking.
- D. Set the IPS profile signature action to default to discard all possible false positives.
Answer: C
Explanation:
Applying an aggressive IPS profile without prior testing can disrupt legitimate applications by incorrectly identifying normal traffic as malicious. To prevent disruptions while still monitoring for threats:
# Enable IPS in "Monitor Mode" first:
# This allows FortiGate to log and analyze potential threats without actively blocking traffic.
# Administrators can review logs and fine-tune IPS signatures to minimize false positives before switching to blocking mode.
# Verify and adjust signature patterns:
# Some signatures might trigger unnecessary blocks for legitimate application traffic.
# By analyzing logs, administrators can disable or modify specific rules causing false positives.
NEW QUESTION # 56
An administrator must enable direct communication between multiple spokes in a company's network. Each spoke has more than one internet connection. The requirement is for the spokes to connect directly without passing through the hub, and for the links to automatically switch to the best available connection. How can this automatic detection and optimal link utilization between spokes be achieved?
- A. Establish static VPN tunnels between spokes with predefined backup routes.
- B. Set up OSPF routing over static VPN tunnels between spokes.
- C. Implement SD-WAN policies at the hub to manage spoke link quality.
- D. Utilize ADVPN 2.0 to facilitate dynamic direct tunnels and automatic link optimization.
Answer: D
Explanation:
ADVPN (Auto-Discovery VPN) 2.0 is the optimal solution for enabling direct spoke-to-spoke communication without passing through the hub, while also allowing automatic link selection based on quality metrics.
Dynamic Direct Tunnels:
ADVPN 2.0 allows spokes to establish direct IPsec tunnels dynamically based on traffic patterns, reducing latency and improving performance.
Unlike static VPNs, spokes do not need to pre-configure tunnels for each other.
Automatic Link Optimization:
ADVPN 2.0 monitors the quality of multiple internet connections on each spoke. It automatically switches to the best available connection when the primary link degrades or fails.
This is achieved by dynamically adjusting BGP-based routing or leveraging SD-WAN integration.
NEW QUESTION # 57
What is the initial step performed by FortiGate when handling the first packets of a session?
- A. Data encryption and decryption
- B. Security inspections such as ACL, HPE, and IP integrity header checking
- C. Offloading the packets directly to the content processor (CP)
- D. Installation of the session key in the network processor (NP)
Answer: B
Explanation:
When FortiGate processes the first packets of a session, it follows a sequence of steps to determine how the traffic should be handled before establishing a session. The initial step involves:
# Access Control List (ACL) checks: Determines if the traffic should be allowed or blocked based on predefined security rules.
# Hardware Packet Engine (HPE) inspections: Ensures that packet headers are valid and comply with protocol standards.
# IP Integrity Header Checking: Verifies if the IP headers are intact and not malformed or spoofed.
Once these security inspections are completed and the session is validated, FortiGate then installs the session in hardware (if offloading is enabled) or processes it in software.
NEW QUESTION # 58
......
Fortinet FCSS_EFW_AD-7.6 Exam Dumps [2026] Practice Valid Exam Dumps Question: https://www.dumpstorrent.com/FCSS_EFW_AD-7.6-exam-dumps-torrent.html
FCSS_EFW_AD-7.6 Dumps - Grab Out For [NEW-2026] Fortinet Exam: https://drive.google.com/open?id=1BqOM6Em5E2AwjLzcpuXPJ0Z85wKXbxhN