View Full Fortinet FCSS_EFW_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 21

An administrator wants FortiGate to use a dynamic routing protocol to exchange route information with neighboring routers. Which protocol is commonly used for this purpose in enterprise networks?

1. OSPF
2. DHCP
3. SNMP
4. FTP

Correct Answer: 1

Explanation

OSPF, or Open Shortest Path First, is a dynamic interior gateway routing protocol commonly used in enterprise networks. FortiGate can participate in OSPF routing and exchange route information with neighboring routers. OSPF uses link-state information and calculates paths based on configured metrics. Dynamic routing can reduce the administrative effort required to maintain large routing environments because routes can adapt when network topology changes. Administrators should properly configure areas, interfaces, authentication, and route filtering to maintain predictable and secure routing behavior.

Question 22

Which routing protocol is designed primarily for exchanging routing information between autonomous systems on the Internet?

1. OSPF
2. RIP
3. BGP
4. IS-IS

Correct Answer: 3

Explanation

Border Gateway Protocol, or BGP, is designed to exchange routing information between autonomous systems. It is widely used for Internet routing and can also be used in large enterprise or service-provider environments. BGP makes routing decisions based on attributes and policies rather than simply selecting the shortest path. FortiGate supports BGP for environments requiring advanced routing control. Administrators should carefully define route advertisements, filtering policies, peer relationships, and authentication because incorrect BGP configuration can affect routing across significant portions of a network.

Question 23

A FortiGate has two Internet connections, and the administrator wants to distribute traffic between them while maintaining reliable connectivity. Which feature is specifically designed for managing multiple WAN links?

1. SD-WAN
2. DHCP relay
3. DNSSEC
4. VDOM

Correct Answer: 1

Explanation

FortiGate SD-WAN allows administrators to manage multiple WAN connections and intelligently steer traffic according to configured policies and performance criteria. SD-WAN can evaluate factors such as latency, jitter, packet loss, and link availability to select an appropriate path. This can improve application performance and resilience when multiple Internet or private WAN connections are available. Administrators can define SD-WAN rules for applications, destinations, users, or services. Proper health-check configuration is important because path decisions depend on accurate measurements of link and service performance.

Question 24

Which SD-WAN measurement represents variation in packet arrival times and can negatively affect real-time applications such as voice and video?

1. Latency
2. Jitter
3. Throughput
4. Packet size

Correct Answer: 2

Explanation

Jitter represents variation in packet arrival times. High or inconsistent jitter can negatively affect applications that depend on timely and predictable packet delivery, including voice calls, video conferencing, and interactive services. FortiGate SD-WAN can use performance measurements such as jitter when determining whether a WAN path satisfies configured service-level requirements. Administrators can define thresholds and SD-WAN rules so that traffic is directed toward paths that meet application requirements. Jitter differs from latency, which measures the time required for traffic to travel between endpoints.

Question 25

Which SD-WAN performance metric measures the time required for packets to travel between two endpoints?

1. Packet loss
2. Jitter
3. Latency
4. Bandwidth utilization

Correct Answer: 3

Explanation

Latency measures the time required for network traffic to travel between endpoints. High latency can make interactive applications feel slow and can negatively affect services such as voice, video conferencing, remote desktop sessions, and transactional applications. FortiGate SD-WAN can monitor latency as part of link-health measurements and use configured thresholds when selecting traffic paths. Administrators should evaluate latency together with packet loss and jitter because a path with low latency may still provide poor application performance if it experiences significant loss or variation.

Question 26

Which SD-WAN metric indicates the percentage of packets that fail to successfully reach their destination?

1. Packet loss
2. Latency
3. Jitter
4. Bandwidth

Correct Answer: 1

Explanation

Packet loss represents the percentage of network packets that do not successfully reach their intended destination. Excessive packet loss can cause retransmissions, reduced throughput, degraded application performance, and interruptions in real-time communications. FortiGate SD-WAN can monitor packet loss as part of link-quality measurements and use configured thresholds to influence path selection. Administrators should investigate persistent packet loss because it may indicate congestion, physical problems, routing issues, or provider-related faults. Combining packet-loss measurements with latency and jitter provides a more complete view of WAN health.

Question 27

A FortiGate administrator needs to create a secure tunnel between two FortiGate devices and wants the tunnel to negotiate cryptographic parameters automatically. Which IPsec component performs the initial negotiation?

1. Phase 1
2. Phase 2
3. Security policy
4. Routing table

Correct Answer: 1

Explanation

IPsec Phase 1 establishes the initial secure association between VPN peers and negotiates parameters used to authenticate the peers and protect subsequent negotiations. Depending on the configuration, this phase establishes an IKE security association using selected encryption, authentication, and Diffie-Hellman parameters. Phase 2 then negotiates IPsec security associations used to protect actual data traffic. Administrators must ensure that the corresponding settings on both VPN peers are compatible. Incorrect Phase 1 parameters can prevent the VPN tunnel from establishing successfully.

Question 28

Which IPsec component defines the security associations used to protect the actual data transmitted through an established VPN tunnel?

1. Phase 1
2. Phase 2
3. Administrative profile
4. Routing daemon

Correct Answer: 2

Explanation

IPsec Phase 2 establishes the security associations used to protect data traffic through the VPN tunnel. It negotiates parameters such as encryption, authentication, and the traffic selectors that determine which traffic should be protected. Phase 2 depends on a successful Phase 1 negotiation between the peers. Administrators troubleshooting an IPsec VPN should verify both phases because a successful Phase 1 does not necessarily mean that protected data traffic can pass. Firewall policies, routing, and traffic selectors must also correctly support the intended communication.

Question 29

Which FortiGate feature can use a virtual IP address to translate traffic from an external address to an internal server?

1. VIP
2. DHCP
3. DNS Filter
4. FortiView

Correct Answer: 1

Explanation

A Virtual IP, or VIP, can provide destination network address translation that maps an external address or port to an internal server or service. VIPs are commonly used when internal servers must be reachable from external networks while retaining private addressing. Administrators can associate a VIP with a firewall policy to control which traffic is permitted to reach the mapped resource. Port forwarding can also be configured when only selected services should be exposed. Careful policy design is important because unnecessarily exposed services can increase the attack surface.

Question 30

An administrator wants to translate multiple internal private addresses to a shared public address while allowing outbound Internet connections. Which NAT method is most appropriate?

1. Source NAT using a pool or interface address
2. Destination NAT using a VIP
3. DNS forwarding
4. IPsec transport mode

Correct Answer: 1

Explanation

Source NAT changes the source address of outgoing traffic, commonly allowing multiple private internal hosts to access external networks through public addressing. FortiGate can perform source NAT using the outgoing interface address or a configured IP pool. This hides internal private addresses from external destinations and allows private addressing to coexist with limited public IPv4 space. Destination NAT serves a different purpose by translating traffic destined for an external address toward an internal resource. Administrators should select NAT behavior according to traffic direction and application requirements.

Question 31

Which FortiGate capability allows an administrator to define different administrative access privileges for different administrators?

1. Administrator profiles
2. Traffic shaping
3. SD-WAN rules
4. DNS policies

Correct Answer: 1

Explanation

Administrator profiles allow FortiGate administrators to receive different levels of management permissions. A profile can control access to configuration areas, monitoring functions, and other administrative capabilities according to the administrator’s responsibilities. This supports separation of duties and least privilege by preventing every administrator from receiving unrestricted access. For example, an operator may require monitoring permissions without needing authority to modify firewall policies. Organizations should use individualized administrator accounts, strong authentication, and appropriate logging in addition to carefully designed administrator profiles.

Question 32

Which authentication method allows FortiGate administrators to use a centralized external authentication server instead of maintaining all credentials locally?

1. RADIUS
2. ARP
3. NTP
4. ICMP

Correct Answer: 1

Explanation

RADIUS provides centralized authentication and authorization services that can be used by FortiGate for administrator or user authentication. Instead of maintaining every credential locally on the FortiGate, the device can communicate with a configured RADIUS server to validate authentication requests. Centralized authentication can simplify account management and support consistent authentication policies across an organization. Administrators should secure communication with authentication servers where supported, configure appropriate shared secrets, apply least privilege, and maintain a local emergency administrative account according to organizational recovery requirements.

Question 33

Which FortiGate feature can integrate with external identity services to obtain information about authenticated users and use that information in security policies?

1. FSSO
2. NAT
3. DHCP
4. IP forwarding

Correct Answer: 1

Explanation

Fortinet Single Sign-On, or FSSO, allows FortiGate to obtain user identity information from supported authentication and directory environments. This enables security policies to be based on user or group identity rather than relying solely on IP addresses. FSSO can improve visibility and simplify access control in environments where users authenticate through centralized directory services. Administrators should ensure identity information remains accurate and that communication between FortiGate and the relevant identity components is reliable. Appropriate policy design is still necessary to enforce least-privilege access.

Question 34

A security team wants FortiGate to inspect HTTP and HTTPS traffic and identify websites based on domain and URL categories. Which security profile should be configured?

1. Web Filter
2. Antivirus
3. IPS
4. Traffic Shaping

Correct Answer: 1

Explanation

The Web Filter profile allows FortiGate to control web access according to URL categories, domain reputation, and administrator-defined rules. It can be applied to firewall policies handling web traffic and can use FortiGuard categorization services for additional classification information. Depending on the inspection configuration, FortiGate can obtain greater visibility into encrypted HTTPS traffic. Administrators should define actions carefully, such as allow, monitor, or block, and consider business requirements and privacy obligations. Web filtering complements, rather than replaces, other controls such as antivirus and IPS.

Question 35

Which FortiGate feature can block access to web resources by using category-based DNS responses rather than inspecting the complete web session?

1. DNS Filter
2. IPS
3. Antivirus
4. Application Control

Correct Answer: 1

Explanation

DNS Filter can control domain resolution according to categories, reputation information, and configured policies. When a client requests a domain that falls into a blocked category, FortiGate can prevent successful resolution or take another configured action. Because DNS filtering operates at the domain-resolution stage, it can provide an additional preventive layer before a complete web connection is established. It should not be considered a replacement for full web inspection because DNS information alone does not reveal all content or behavior within an established session.

Question 36

Which FortiGate security profile can identify and block applications based on application signatures and behavioral characteristics?

1. Application Control
2. Web Filter
3. DNS Filter
4. Email Filter

Correct Answer: 1

Explanation

Application Control identifies network applications using FortiGate application signatures and available inspection information. Administrators can configure actions for individual applications or application categories, including allowing, monitoring, or blocking selected applications. This can help organizations control unauthorized applications, reduce unnecessary bandwidth consumption, and enforce acceptable-use requirements. Application Control is different from port-based filtering because application identification can remain effective when applications use nonstandard or dynamic ports. Accurate signatures and appropriate traffic inspection are important for reliable application identification.

Question 37

A FortiGate administrator wants to inspect traffic for known exploit patterns and vulnerability attacks. Which profile should be enabled on the relevant firewall policy?

1. IPS
2. Web Filter
3. DNS Filter
4. Traffic Shaping

Correct Answer: 1

Explanation

The Intrusion Prevention System profile is designed to detect and prevent network attacks by examining traffic for known exploit patterns, vulnerabilities, malicious activity, and other suspicious behavior. FortiGate IPS uses signatures and associated security intelligence to identify threats and can take configured actions such as blocking or monitoring. Administrators should keep IPS signatures updated and tune policies according to the organization’s environment. Excessively broad or inappropriate settings can generate unnecessary alerts, while insufficient inspection can leave vulnerable services exposed to known attack techniques.

Question 38

Which FortiGate security profile is responsible for scanning files and network content for known malicious software?

1. Web Filter
2. Antivirus
3. Application Control
4. DNS Filter

Correct Answer: 2

Explanation

The Antivirus security profile scans supported traffic and files for malicious software using FortiGate’s malware detection capabilities. It can detect known malware through signatures and other supported techniques and can take configured actions when threats are identified. Antivirus inspection can be combined with web filtering, IPS, application control, and other security mechanisms for layered protection. Administrators should ensure that relevant security definitions and services remain current. They should also consider inspection performance and supported protocols when determining where antivirus inspection should be applied.

Question 39

Which FortiGate logging feature allows administrators to view events such as blocked connections, security profile actions, and policy matches directly on the device?

1. Traffic and security logs
2. Static routes
3. VIP objects
4. Address groups

Correct Answer: 1

Explanation

FortiGate traffic and security logs provide visibility into network connections and security-related events processed by the device. Depending on the configured logging and security profiles, administrators can review information about policy matches, allowed or denied sessions, detected threats, and security profile actions. Logs are valuable for troubleshooting, incident investigation, compliance, and monitoring. Administrators should configure appropriate log levels, storage destinations, retention periods, and access controls. For larger environments, logs can also be forwarded to centralized platforms such as FortiAnalyzer for broader analysis.

Question 40

A FortiGate administrator needs to determine why a firewall policy is not matching expected traffic. Which troubleshooting approach is most appropriate?

1. Review policy order, matching criteria, routing, and traffic logs
2. Disable all security profiles permanently
3. Delete all firewall policies and recreate them
4. Replace the FortiGate hardware immediately

Correct Answer: 1

Explanation

Troubleshooting a firewall policy should begin by reviewing the policy order and matching criteria, including source, destination, service, interface, schedule, and other applicable conditions. The administrator should also verify routing because traffic must reach the expected interface and next hop. Traffic logs and session information can provide evidence about which policy processed the connection and whether a security profile affected it. A structured troubleshooting process avoids unnecessary changes and helps identify the actual cause while minimizing disruption to production services.