Fortinet FCSS_EFW_AD-7.6 Practice Exam Questions

Fortinet FCSS_EFW_AD-7.6 Sample Question Answers

Question # 1

An administrator wants to scale the IBGP sessions and optimize the routing table in an IBGP network. Which parameter should the administrator configure? 

A. network-import-check
B. ibgp-enforce-multihop
C. neighbor-group
D. route-reflector-client

Show Answer

Question # 2

A FortiGate device with UTM profiles is reaching the resource limits, and the administrator expectsthe traffic in the enterprise network to increase.The administrator has received an additional FortiGate of the same model.Which two protocols should the administrator use to integrate the additional FortiGate device intothis enterprise network? (Choose two.)

A. FGSP with external load balancers
B. FGCP in active-active mode and with switches
C. FGCP in active-passive mode and with VDOM disabled
D. VRRP with switches

Show Answer

Question # 3

An administrator is designing an ADVPN network for a large enterprise with spokes that have varyingnumbers of internet links. They want to avoid a high number of routes and peer connections at thehub.Which method should be used to simplify routing and peer management?

A. Deploy a full-mesh VPN topology to eliminate hub dependency.
B. Implement static routing over IPsec interfaces for each spoke.
C. Use a dynamic routing protocol using loopback interfaces to streamline peers and routes.
D. Establish a traditional hub-and-spoke VPN topology with policy routes.

Show Answer

Question # 4

What action can be taken on a FortiGate to block traffic using IPS protocol decoders, focusing on network transmission patterns and application signatures? 

A. Use the DNS filter to block application signatures and protocol decoders.
B. Use application control to limit non-URL-based software handling.
C. Enable application detection-based SD-WAN rules.
D. Configure a web filter profile in flow mode.

Show Answer

Question # 5

An administrator must standardize the deployment of FortiGate devices across branches withconsistent interface roles and policy packages using FortiManager.What is the recommended best practice for interface assignment in this scenario?

A. Enable metadata variables to use dynamic configurations in the standard interfaces ofFortiManager.
B. Use the Install On feature in the policy package to automatically assign different interfaces basedon the branch.
C. Create interfaces using device database scripts to use them on the same policy package ofFortiGate devices.
D. Create normalized interface types per-platform to automatically recognize device layer interfacesbased on the FortiGate model and interface name.

Show Answer

Question # 6

An administrator must minimize CPU and RAM use on a FortiGate firewall while also enabling essential security features, such as web filtering and application control for HTTPS traffic. Which SSL inspection setting helps reduce system load while also enabling security features, such as web filtering and application control for encrypted HTTPS traffic? 

A. Use full SSL inspection to thoroughly inspect encrypted payloads.
B. Disable SSL inspection entirely to conserve resources.
C. Configure SSL inspection to handle HTTPS traffic efficiently.
D. Enable SSL certificate inspection mode to perform basic checks without decrypting traffic.

Show Answer

Question # 7

An administrator is setting up an ADVPN configuration and wants to ensure that peer IDs are not exposed during VPN establishment. Which protocol can the administrator use to enhance security?

A. Use IKEv2, which encrypts peer IDs and prevents exposure.
B. Opt for SSL VPN web mode because it does not use peer IDs at all.
C. Choose IKEv1 aggressive mode because it simplifies peer identification.
D. Stick with IKEv1 main mode because it offers better performance.

Show Answer

Question # 8

A vulnerability scan report has revealed that a user has generated traffic to the website example.com (10.10.10.10) using a weak SSL/TLS version supported by the HTTPS web server. What can the firewall administrator do to block all outdated SSL/TLS versions on any HTTPS web server to prevent possible attacks on user traffic? 

A. Configure the unsupported SSL version and set the minimum allowed SSL version in the HTTPSsettings of the SSL/SSH inspection profile.
B. Enable auto-detection of outdated SSL/TLS versions in the SSL/SSH inspection profile to blockvulnerable websites.
C. Install the required certificate in the client's browser or use Active Directory policies to blockspecific websites as defined in the SSL/SSH inspection profile.
D. Use the latest certificate, Fortinet_SSL_ECDSA256, and replace the CA certificate in the SSL/SSHinspection profile.

Show Answer

Question # 9

How will configuring set tcp-mss-sender and set tcp-mss-receiver in a firewall policy affect the size and handling of TCP packets in the network?

A. The maximum segment size permitted in the firewall policy determines whether TCP packets are allowed or denied.
B. Applying commands in a firewall policy determines the largest payload a device can handle in asingle TCP segment.
C. The administrator must consider the payload size of the packet and the size of the IP header to configure a correct value in the firewall policy.
D. The TCP packet modifies the packet size only if the size of the packet is less than the one the administrator configured in the firewall policy. 

Show Answer

Question # 10

The IT department discovered during the last network migration that all zero phase selectors inphase 2 IPsec configurations impacted network operations.What are two valid approaches to prevent this during future migrations? (Choose two.)

A. Use routing protocols to specify allowed subnets over the tunnel.
B. Configure an IPsec-aggregate to create redundancy between each firewall peer.
C. Clearly indicate to the VPN which segments will be encrypted in the phase two selectors.
D. Configure an IP address on the IPsec interface of each firewall to establish unique peerconnections and avoid impacting network operations.

Show Answer