FCSS - Network Security 7.6 Support Engineer - FCSS_NST

Question 1

What can cause an IKEv2 tunnel to go down after it was initially brought up successfully?

A. A mismatched Diffie-Hellman group was detected during the IKE_SA_INIT exchange.

B. Mismatched quick-mode selectors were detected during the CREATE_CHILD_SA exchange.

C. A mismatched pre-shared key was detected during the IKE_AUTH exchange.

D. A mismatched proposal was detected during the IKE_AUTH exchange.

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

Refer to the exhibit, which shows one way communication of the downstream FortiGate with the upstream FortiGate within a Security Fabric.

What three actions must you take to ensure successful communication? (Choose three.)

A. Ensure the port for Neighbor Discovery has been changed.

B. You must enable Security Fabric/Fortitelemetry on the receiving interface of the upstream FortiGate.

C. You must authorize the downstream FortiGate on the root FortiGate.

D. FortiGate must not be in NAT mode.

E. Ensure TCP port 8013 is not blocked along the way.

Correct Answer: B,C,E

Question 3

Consider the scenario where the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate. Which two actions will FortiGate take when using the default settings for SSL certificate inspection? (Choose two answers)

A. FortiGate does not decrypt the traffic if the traffic is blocked by the web filter profile.

B. FortiGate does not decrypt the traffic if the traffic is allowed by the web filter profile.

C. FortiGate uses the CN information from the Subject field in the server certificate.

D. FortiGate uses the SNI from the user ' s web browser.

Correct Answer: B,C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

During which phase of IKEv2 does the Diffie-Helman key exchange take place?

A. IKE_Auth

B. Create_CHILD_SA

C. IKE_Req_INIT

D. IKE_SA_INIT

Correct Answer: D

Question 5

Which three conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three answers)

A. OSPF interface network types match.

B. OSPF interface priority settings are unique.

C. OSPF router IDs are unique.

D. OSPF link costs match.

E. Authentication settings match.

Correct Answer: A,C,E

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

Refer to the exhibit.
Partial output of diagnose sys session stat command is shown.

An administrator has noticed unusual behavior from FortiGate. It appears that sessions are randomly removed.
Which two reasons could explain this? (Choose two.)

A. FortiGate is not accepting sessions because the device has been down 10 out of 120 seconds.

B. FortiGate is dropping all TCP sessions with incomplete three-way handshakes.

C. FortiGate is flushing sessions because of high memory usage.

D. FortiGate is deleting sessions because the kernel cannot allocate more memory pages

Correct Answer: C,D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

What is an accurate description of LDAP authentication using the regular bind type?

A. The regular bind type is the easiest bind type to configure on ForbOS.

B. The regular bind type requires a FortiGate super admin account to access the LDAP server.

C. The regular bind requires the client to send the full distinguished name (ON).

D. It is not often used as a bind type

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 8

Refer to the exhibit.

The output of the command diagnose vpn tunnel list is shown.
Reviewing the debug command, what is the current status of the traffic flowing through the tunnel?

A. The inbound IPsec SA was copied to the NPU.

B. The inbound and outbound IPsec SAs were copied to the NPU.

C. The outbound IPsec SA was copied to the NPU.

D. NP6 is handling the offloading.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Fortinet FCSS - Network Security 7.6 Support Engineer - FCSS_NST_SE-7.6 Exam Practice Test

Latest Update

Useful Links

Contact Us