View Full Fortinet FCSS_EFW_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 141

Which FortiGate feature allows an administrator to divide a physical FortiGate into multiple independent virtual firewall instances?

1. SD-WAN
2. VDOM
3. VIP
4. FortiView

Correct Answer: 2

Explanation

Virtual Domains, or VDOMs, allow a FortiGate to operate as multiple logical firewall environments on the same physical device. Each VDOM can have its own interfaces, routing tables, firewall policies, and administrative configuration depending on the deployment. This separation is useful when different departments, customers, or security environments require independent administration. VDOMs can also help isolate configurations and traffic. Administrators should plan resource allocation and inter-VDOM communication carefully because improper configuration can affect connectivity or security boundaries between virtual domains.

Question 142

Which FortiGate feature is commonly used to provide redundancy by using multiple WAN connections?

1. SD-WAN
2. DNS Filter
3. FortiToken
4. Web Filter

Correct Answer: 1

Explanation

FortiGate SD-WAN can use multiple WAN connections and select paths according to configured rules and link-performance conditions. This can improve resilience because traffic can move to another available path when a preferred link fails or no longer meets the required performance criteria. Administrators can define health checks and performance thresholds based on latency, jitter, packet loss, or availability. SD-WAN therefore provides more intelligent WAN path management than relying solely on a fixed static route. Proper rule ordering and link monitoring are essential for predictable behavior.

Question 143

What does an SD-WAN performance SLA primarily measure?

1. Administrator privileges
2. Link performance
3. Antivirus signatures
4. User passwords

Correct Answer: 2

Explanation

An SD-WAN performance SLA measures characteristics of WAN paths to determine whether they meet configured performance requirements. Common measurements include latency, jitter, packet loss, and availability. FortiGate can use these measurements when making SD-WAN path-selection decisions. For example, a voice application may require a path with low latency and jitter, while another application may tolerate higher latency. Proper SLA configuration helps ensure that traffic is directed through links that satisfy the intended application requirements rather than simply selecting a path based on basic reachability.

Question 144

A WAN link is reachable but has excessive packet loss. Which SD-WAN measurement can identify this condition?

1. Packet loss
2. DNS category
3. CPU usage
4. Certificate status

Correct Answer: 1

Explanation

Packet loss measures the percentage of packets that fail to reach their destination or return successfully during an SD-WAN health check. A high packet-loss value indicates that a WAN path may be unreliable even though the link remains technically reachable. FortiGate can use packet-loss thresholds as part of SD-WAN performance monitoring and traffic-steering decisions. This allows applications to avoid paths that meet basic connectivity requirements but do not provide acceptable reliability. Administrators should evaluate packet loss together with latency, jitter, and link availability.

Question 145

Which IPsec parameter is negotiated during IKE Phase 1?

1. Phase 2 traffic selectors
2. Encryption and authentication parameters
3. Firewall policy sequence
4. DHCP address range

Correct Answer: 2

Explanation

IKE Phase 1 establishes a secure management or negotiation channel between IPsec VPN peers. During this phase, peers negotiate parameters such as encryption algorithms, authentication methods, hashing or integrity algorithms, and Diffie-Hellman settings. Successful Phase 1 negotiation establishes the secure context needed to proceed with later IPsec negotiations. If Phase 1 fails, the VPN tunnel cannot be established normally. When troubleshooting, administrators should compare IKE settings on both peers and verify authentication credentials, peer addresses, proposals, and related configuration.

Question 146

Which IPsec phase establishes the security associations used to protect actual VPN data traffic?

1. Phase 1
2. Phase 2
3. SSL inspection
4. Authentication portal

Correct Answer: 2

Explanation

IPsec Phase 2 establishes the security associations used to protect the actual data traffic traveling through the VPN. During this stage, peers negotiate parameters such as encryption, integrity, and traffic selectors for the protected networks. A VPN may show an established IKE Phase 1 while still failing to pass traffic if Phase 2 settings do not match or routing and firewall policies are incorrect. Troubleshooting should therefore examine both phases along with traffic selectors, routes, firewall policies, and tunnel status.

Question 147

Which FortiGate feature can translate an internal private source address into a public address for outbound traffic?

1. Destination NAT
2. Source NAT
3. VIP
4. IPsec

Correct Answer: 2

Explanation

Source NAT changes the source address of traffic as it leaves the private network. FortiGate can translate internal private addresses to the outgoing interface address or use an IP pool containing one or more public addresses. This allows internal clients to access external networks without exposing their private IP addresses directly. Source NAT is commonly used for Internet access and other outbound connections. Administrators should distinguish it from destination NAT, which changes the destination address and is commonly associated with publishing internal services.

Question 148

Which FortiGate object is commonly used for destination NAT and port forwarding?

1. VIP
2. Schedule
3. Service group
4. Address group

Correct Answer: 1

Explanation

A Virtual IP, or VIP, is commonly used to perform destination NAT and port forwarding on FortiGate. It can map an external IP address and, when required, an external port to an internal server address and port. A firewall policy is then used to control whether traffic matching the VIP is allowed. Administrators should expose only necessary services and restrict the source of incoming traffic whenever practical. Logging and additional security profiles can provide further visibility and protection for publicly accessible services.

Question 149

Which FortiGate feature can restrict access to a firewall policy based on a recurring time period?

1. Schedule
2. Address object
3. Service group
4. IP pool

Correct Answer: 1

Explanation

A schedule can determine when a firewall policy is active. Administrators can configure recurring time periods so that a policy applies only during defined hours or days. This can be useful for temporary access, business-hour services, maintenance activities, or limiting nonessential traffic outside working periods. A schedule does not itself identify users or services; it acts as one of the matching conditions for the firewall policy. Administrators should verify time settings and system clock synchronization so scheduled policies activate at the expected times.

Question 150

Which FortiGate feature allows multiple network interfaces to be grouped logically for policy configuration?

1. Interface zone
2. IP pool
3. VIP
4. NTP

Correct Answer: 1

Explanation

An interface zone allows multiple interfaces to be grouped logically so that firewall policies can reference the zone instead of individually listing every member interface. This can simplify policy configuration when several interfaces share similar security requirements. Zones can make policies easier to maintain, particularly in environments with multiple VLANs or network segments. Administrators should understand the traffic relationships between member interfaces before grouping them because a zone can affect how policies are matched and how access is controlled between different network connections.

Question 151

Which FortiGate feature is responsible for determining the next hop for a destination IP address?

1. Routing
2. Antivirus
3. Web Filter
4. Application Control

Correct Answer: 1

Explanation

Routing determines how FortiGate forwards packets toward their destination. The routing table contains information about available networks, next hops, interfaces, and route preferences. When traffic arrives, FortiGate uses routing information to determine where the packet should be sent after policy processing. Incorrect or missing routes can cause connectivity failures even when firewall policies are correctly configured. Administrators can inspect the routing table and use diagnostic tools such as ping, traceroute, and debug flow to understand forwarding behavior.

Question 152

A FortiGate has several possible routes to the same destination. Which route-selection attribute can influence which route is preferred?

1. Administrative distance
2. DNS category
3. SSL certificate
4. Antivirus signature

Correct Answer: 1

Explanation

Administrative distance is one factor FortiGate can use when selecting between routes learned from different sources. Generally, a route with a lower administrative distance is preferred over one with a higher value when comparing otherwise applicable routes from different routing sources. Other factors can also influence route selection, depending on the routing protocol and configuration. Administrators should examine the actual routing table rather than assuming which route will be used. Understanding route preference is important when troubleshooting unexpected forwarding behavior.

Question 153

Which routing protocol is commonly used inside an organization to exchange link-state routing information?

1. BGP
2. OSPF
3. DNS
4. DHCP

Correct Answer: 2

Explanation

OSPF is a link-state interior gateway protocol commonly used within organizational networks. Routers exchange link-state information and build a topology database from which routes are calculated. OSPF supports hierarchical designs through areas and can converge efficiently when network changes occur. FortiGate can participate in OSPF routing with other compatible routers. Administrators should configure appropriate areas, interfaces, authentication, and network statements according to the network design. OSPF troubleshooting often involves checking neighbor relationships, routing information, interface status, and route installation.

Question 154

What is the primary purpose of BGP route policies on FortiGate?

1. Control route advertisement and selection
2. Encrypt HTTPS traffic
3. Assign DHCP addresses
4. Scan files for malware

Correct Answer: 1

Explanation

BGP route policies can control which routes are accepted, rejected, modified, or advertised to BGP peers. This provides administrators with control over routing information exchanged between autonomous systems or within more complex BGP environments. Route policies can use match conditions and actions to influence routing behavior. Because incorrect BGP policies can significantly affect reachability, administrators should test and review changes carefully. Route-policy design should reflect the intended routing architecture and should prevent accidental advertisement or acceptance of inappropriate network prefixes.

Question 155

Which FortiGate feature can authenticate an administrator against an external LDAP directory?

1. LDAP
2. SD-WAN
3. VIP
4. Traffic shaping

Correct Answer: 1

Explanation

LDAP integration allows FortiGate to communicate with an external directory service for user authentication and identity-related functions. Instead of maintaining every user account locally, administrators can reference directory users or groups when configuring supported authentication workflows. This can simplify centralized account management in organizations that already use directory services. Correct LDAP server settings, credentials, search parameters, and network connectivity are required. Administrators should also ensure that directory access is protected and that FortiGate receives the expected user or group information.

Question 156

Which authentication server commonly uses a shared secret between FortiGate and the authentication server?

1. RADIUS
2. DNS
3. NTP
4. OSPF

Correct Answer: 1

Explanation

RADIUS commonly uses a shared secret to establish trust between the network device and the RADIUS server. FortiGate can send authentication requests to a configured RADIUS server, which validates the supplied credentials according to its authentication system. The shared secret must match on both sides for communication to succeed. RADIUS can centralize authentication for administrators and network users. When troubleshooting, administrators should verify the server address, UDP ports, shared secret, authentication configuration, and network connectivity between FortiGate and the RADIUS server.

Question 157

Which FortiGate security profile can control applications such as social media, streaming, and peer-to-peer services?

1. Application Control
2. NTP
3. DHCP
4. IPsec

Correct Answer: 1

Explanation

Application Control identifies applications and allows administrators to define actions for them. This can be used to monitor, allow, restrict, or block categories and individual applications such as social media, streaming platforms, messaging services, and peer-to-peer applications. Application identification can provide more granular control than relying only on destination IP addresses or port numbers. FortiGuard application signatures help FortiGate recognize applications. Administrators should review application behavior and policy requirements because some applications may use multiple protocols or change their communication methods.

Question 158

Which FortiGate security profile is designed to detect and block known malicious files?

1. Web Filter
2. Antivirus
3. Traffic Shaping
4. SD-WAN

Correct Answer: 2

Explanation

The Antivirus profile inspects supported traffic for malicious files and other malware indicators. FortiGate can use updated signatures and detection mechanisms to identify known malicious content and apply configured actions. Depending on the traffic and inspection configuration, the system can block or log detected threats. Antivirus protection is more effective when definitions and FortiGuard services remain current. It should also be combined with IPS, web filtering, application control, endpoint protection, and secure configuration because no single security control can address every type of threat.

Question 159

Which FortiGate security profile can identify malicious or suspicious URLs and web destinations?

1. Web Filter
2. DHCP
3. IPsec
4. Traffic Shaping

Correct Answer: 1

Explanation

Web Filter can evaluate requested websites and URLs using FortiGuard categorization, reputation information, and configured filtering rules. It can identify destinations associated with malicious, phishing, inappropriate, or otherwise restricted content and apply configured actions. Web filtering is particularly useful for controlling Internet access from user networks. HTTPS traffic may require suitable inspection to obtain additional visibility into encrypted sessions. Administrators should regularly review filtering policies and exceptions because website classifications and application behavior can change over time.

Question 160

Which FortiGate security profile can identify network-based exploitation attempts against vulnerable services?

1. Antivirus
2. IPS
3. DNS Filter
4. Traffic Shaping

Correct Answer: 2

Explanation

The Intrusion Prevention System detects network-based attacks and exploitation attempts using security signatures and other inspection mechanisms. IPS can identify patterns associated with known vulnerabilities, malicious protocols, and suspicious network activity and can take configured actions such as blocking or logging. FortiGate IPS signatures are updated through FortiGuard services to improve coverage against emerging threats. Administrators should tune IPS policies according to the environment and combine them with patch management, segmentation, endpoint protection, and secure configuration for a layered security strategy.