FCSS - Enterprise Firewall 7.4 Administrator - FCSS_EFW

Question 1

Refer to the exhibit, which shows an OSPF network.

Which configuration must the administrator apply to optimize the OSPF database?

A. Set a route map in the AS boundary FortiGate.

B. Set the area 0.0.0.1 to the type NSSA in the area border FortiGate.

C. Set the area 0.0.0.1 to the type STUB in the area border FortiGate.

D. Set an access list in the AS boundary FortiGate.

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

During the maintenance window, an administrator must sniff all the traffic going through a specific firewall policy, which is handled by NP6 interfaces. The output of the sniffer trace provides just a few packets.
Why is the output of sniffer trace limited?

A. auto-asic-off load is set to enable in the firewall policy,

B. inspection-mode is set to proxy in the firewall policy.

C. The option npudbg is not added in the diagnose sniff packet command.

D. The traffic corresponding to the firewall policy is encrypted.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

Refer to the exhibits.

The configuration of a user's Windows PC, which has a default MTU of 1500 bytes, along with FortiGate interfaces set to an MTU of 1000 bytes, and the results of PC1 pinging server
172.16.0.254 are shown.
Why is the user in Windows PC1 unable to ping server 172.16.0.254 and is seeing the message:
Packet needs to be fragmented but DF set?

A. The user must trigger different traffic because path MTU discovery techniques do not recognize ICMP payloads.

B. Fragmented packets must be encrypted. To connect any application successfully, the user must install the Fortinet_CA certificate in the Microsoft Management Console.

C. Option ip.flags.mf must be set to enable on FortiGate. The user has to adjust the ping MTU to
1000 to succeed.

D. FortiGate honors the do not fragment bit and the packets are dropped. The user has to adjust the ping MTU to 972 to succeed.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

Refer to the exhibit, which contains a partial command output.

The administrator has configured BGP on FortiGate. The status of this new BGP configuration is shown in the exhibit.
What configuration must the administrator consider next?

A. Configure the local AS to 65300.

B. Contact the remote peer administrator to enable BGP

C. Enable ebgp-enforce-multihop.

D. Configure a static route to 100.65.4.1.

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 5

How will configuring set tcp-mss-sender and set tcp-mss-receiver in a firewall policy affect the size and handling of TCP packets in the network?

A. The administrator must consider the payload size of the packet and the size of the IP header to configure a correct value in the firewall policy.

B. Applying commands in a firewall policy determines the largest payload a device can handle in a single TCP segment.

C. The TCP packet modifies the packet size only if the size of the packet is less than the one the administrator configured in the firewall policy.

D. The maximum segment size permitted in the firewall policy determines whether TCP packets are allowed or denied.

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

The IT department discovered during the last network migration that all zero phase selectors in phase 2 IPsec configurations impacted network operations. What are two valid approaches to prevent this during future migrations? (Choose two.)

A. Configure an IPsec-aggregate to create redundancy between each firewall peer.

B. Clearly indicate to the VPN which segments will be encrypted in the phase two selectors.

C. Use routing protocols to specify allowed subnets over the tunnel.

D. Configure an IP address on the IPsec interface of each firewall to establish unique peer connections and avoid impacting network operations.

Correct Answer: B,C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

A user reports that their computer was infected with malware after accessing a secured HTTPS website. However, when the administrator checks the FortiGate logs, they do not see that the website was detected as insecure despite having an SSL certificate and correct profiles applied on the policy.
How can an administrator ensure that FortiGate can analyze encrypted HTTPS traffic on a website?

A. The administrator must enable full SSL inspection in the SSL/SSH Inspection Profile to decrypt packets and ensure they are analyzed as expected.

B. The administrator must enable reputable websites to allow only SSL/TLS websites rated by FortiGuard web filter.

C. The administrator must enable URL extraction from SNI on the SSL certificate inspection to ensure the TLS three-way handshake is correctly analyzed by FortiGate.

D. The administrator must enable DNS over TLS to protect against fake Server Name Indication (SNI) that cannot be analyzed in common DNS requests on HTTPS websites.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 8

An administrator received a FortiAnalyzer alert that a 1 disk filled up in a day. Upon investigation, they found thousands of unusual DNS log requests, such as JHCMQK.website.com, with no answers. They later discovered that DNS exfiltration was occurring through both UDP and TLS. How can the administrator prevent this data theft technique?

A. Enable DNS Filter to protect against DNS exfiltration.

B. Configure a File Filter profile to prevent DNS exfiltration.

C. Create an inline-CASB to protect against DNS exfiltration.

D. Use an IPS profile and DNS exfiltration-related signatures.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Fortinet FCSS - Enterprise Firewall 7.4 Administrator - FCSS_EFW_AD-7.4 Exam Practice Test

Latest Update

Useful Links

Contact Us