Fortinet FCSS - Enterprise Firewall 7.6 Administrator - FCSS_EFW

QUESTION NO: 1
Refer to the exhibit, which shows a partial enterprise network.

An administrator would like the area 0.0.0.0 to detect the external network.
What must the administrator configure?

A. Configure a distribute-route-map-in on FortiGate B. B. Configure a virtual link between FortiGate A and B. C. Enable RIP redistribution on FortiGate B. D. Set the area 0.0.0.l type to stub on FortiGate A and B.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
Refer to the exhibit.

A FortiGate segmented into VDOMs is shown.
You must ensure effective and accelerated internet access for all of the VDOMs in this enterprise network.
How can you achieve this?

A. Create VDOM links. B. Configure network processing unit (NPU) vlinks. C. Create VLANs over network processing unit (NPU) vlinks. D. Connect a physical interface from each VDOM to the root VDOM.

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
An administrator must standardize the deployment of FortiGate devices across branches with consistent interface roles and policy packages using FortiManager. What is the recommended best practice for interface assignment in this scenario?

A. Create normalized interface types per-platform to automatically recognize device layer interfaces based on the FortiGate model and interface name. B. Create interfaces using device database scripts to use them on the same policy package of FortiGate devices. C. Enable metadata variables to use dynamic configurations in the standard interfaces of FortiManager. D. Use the Install On feature in the policy package to automatically assign different interfaces based on the branch.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
A FortiGate device with UTM profiles is reaching the resource limits, and the administrator expects the traffic in the enterprise network to increase.
The administrator has received an additional FortiGate of the same model. Which two protocols should the administrator use to integrate the additional FortiGate device into this enterprise network? (Choose two.)

A. VRRP with switches B. FGSP with external load balancers C. FGCP in active-active mode and with switches D. FGCP in active-passive mode and with VDOM disabled

Correct Answer: B,C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 5
How can FortiGate analyze HTTPS traffic on non-standard port 8443?

A. Add 443 and 8443 mapping B. TLS 1.2 C. Enable IPS D. Proxy mode

Correct Answer: A

QUESTION NO: 6
Refer to the exhibit.

A network topology and a FortiGate routing table is shown.
What must you configure in the BGP section to add only the subnet 100.64.2.0/24in the routing table of FortiGate_A?

A. Configure connected routes redistribution on FortiGate_C. B. Configure the 100.64.2.0/24 network on FortiGate_C. C. Configure route-map-in on FortiGate_A. D. Configure BGP route redistribution on FortiGate_B.

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 7
Refer to the exhibits.

The system administrator settings configured on a root FortiGate and the Security Fabric settings configured on a downstream FortiGate are shown.
When prompted to sign in with Security Fabric to the downstream FortiGate, a user enters the single sign-on (SSO) provider credentials.
What is the result?

A. The user is prompted to create an administrator account for AdminSSO. B. The user accesses the downstream FortiGate with super_admin_readonly profile. C. The downstream FortiGate relies on the root FortiGate and does not create an administrator account. D. The downstream FortiGate creates an SSO administrator account for AdminSSO with the super_admin profile.

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
You applied a block-all intrusion prevention system (IPS) profile for client and server targets to secure the server, but the database team reported that applications stopped working immediately after. How can you apply IPS in a way that ensures it does not disrupt existing applications in the network?

A. Set the IPS profile signature action to default and verity patterns. B. Limit the IPS profile to server targets only and set the action to default. C. Use an IPS profile with all signatures in monitor mode and verify patterns before blocking. D. Select flow mode in the IPS profile and monitor the application patterns.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 9
What does the command set forward-domain <domain_ID> in a transparent VDOM interface do?

A. It isolates traffic within a specific VLAN by assigning a broadcast domain to an interface based on the VLAN ID. B. It configures the interface to prioritize traffic based on the domain ID, enhancing quality of service for specified VLANs. C. It restricts the interface to managing traffic only from the specified VLAN, effectively segregating network traffic. D. It assigns a unique domain ID to the interface, allowing it to operate across multiple VLANs within the same VDOM.

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 10
Refer to the exhibit.

An administrator is deploying a hub and spokes network and using OSPF as dynamic protocol.
Which configuration is mandatory for neighbor adjacency?

A. Set virtual-link enable in the hub interface B. Set rfc1583-compatible enable in the router configuration C. Set bfd enable in the router configuration D. Set network-type point-to-multipoint in the hub interface

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 11
Based on the TLS handshake shown, what can be inferred about the client?

A. Supports SSLv3 B. Supports TLS 1.0 only C. Supports TLS 1.2 and TLS 1.3 D. Supports DTLS

Correct Answer: C

QUESTION NO: 12
A vulnerability scan report has revealed that a user has generated traffic to the website example.com (10.10.10.10) using a weak SSL/TLS version supported by the HTTPS web server.
What can the firewall administrator do to block all outdated SSL/TLS versions on any HTTPS web server to prevent possible attacks on user traffic?

A. Enable auto-detection of outdated SSL/TLS versions in the SSL/SSH inspection profile to block vulnerable websites. B. Configure the unsupported SSL version and set the minimum allowed SSL version in the HTTPS settings of the SSL/SSH inspection profile. C. Use the latest certificate, Fortinet_SSL_ECDSA256, and replace the CA certificate in the SSL/SSH inspection profile. D. Install the required certificate in the client's browser or use Active Directory policies to block specific websites as defined in the SSL/SSH inspection profile.

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

Fortinet FCSS - Enterprise Firewall 7.6 Administrator - FCSS_EFW_AD-7.6 Exam Questions