View Full Fortinet FCSS_EFW_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 201

Which FortiGate feature can steer specific application traffic over a preferred WAN link?

1. SD-WAN rule
2. DNS Filter
3. Address group
4. FortiToken

Correct Answer: 1

Explanation

SD-WAN rules allow FortiGate to make WAN path-selection decisions based on configured traffic characteristics and link-performance requirements. Administrators can create rules that identify applications, destinations, services, or other traffic attributes and then select preferred members or strategies. Performance criteria such as latency, jitter, packet loss, and availability can also influence path selection. This provides more control than simply routing all traffic through one default WAN connection. Correct rule order and health-check configuration are important because multiple SD-WAN rules may potentially match the same traffic.

Question 202

Which SD-WAN metric measures variation in packet delay?

1. Latency
2. Jitter
3. Packet loss
4. Bandwidth

Correct Answer: 2

Explanation

Jitter measures variation in packet delay over a network path. High jitter can negatively affect applications that depend on consistent packet delivery, particularly voice and real-time video. FortiGate SD-WAN can monitor jitter as part of performance measurements and use configured thresholds when evaluating WAN paths. A link with acceptable average latency may still perform poorly for real-time applications if its jitter is excessive. Administrators should therefore consider application requirements when selecting SD-WAN performance thresholds instead of relying on a single measurement.

Question 203

Which SD-WAN metric represents the time required for traffic to travel between endpoints?

1. Packet loss
2. Jitter
3. Latency
4. Availability

Correct Answer: 3

Explanation

Latency represents the delay experienced as traffic travels between endpoints or across a monitored network path. Lower latency is generally important for interactive and real-time applications because excessive delay can affect responsiveness. FortiGate SD-WAN can measure latency as part of performance monitoring and use configured thresholds in path-selection decisions. Administrators can create different requirements for different applications depending on their sensitivity to delay. Latency should be evaluated together with packet loss, jitter, and availability because a low-latency path may still have poor overall reliability.

Question 204

A WAN connection responds to health checks but has unacceptable jitter for voice traffic. What should FortiGate use to evaluate this condition?

1. SD-WAN performance SLA
2. DNS Filter
3. Address group
4. Administrator profile

Correct Answer: 1

Explanation

An SD-WAN performance SLA can monitor link characteristics such as jitter and determine whether a WAN path meets configured application requirements. For voice traffic, excessive jitter can cause uneven packet arrival and degrade call quality even when the link remains reachable. Administrators can configure performance thresholds and associate SD-WAN rules with applications or traffic classes that require consistent network performance. This allows FortiGate to avoid unsuitable paths when alternatives are available. SLA thresholds should reflect realistic application requirements and the normal performance characteristics of the WAN links.

Question 205

Which IPsec setting identifies the networks that should be protected by a Phase 2 tunnel?

1. Traffic selectors
2. Administrator profile
3. Service group
4. Schedule

Correct Answer: 1

Explanation

IPsec Phase 2 traffic selectors identify the source and destination networks or address ranges that should be protected by the VPN security association. The selectors must be compatible between the VPN peers for the intended traffic to pass through the tunnel. If the tunnel establishes but specific networks cannot communicate, administrators should check Phase 2 selectors along with routing and firewall policies. More specific selectors can be used when different network pairs require separate security associations. Correct selector configuration is therefore important for predictable route-based or policy-based VPN operation.

Question 206

Which IPsec component is responsible for authenticating peers and establishing the initial secure negotiation channel?

1. IKE Phase 1
2. IPsec Phase 2
3. Traffic shaping
4. Web Filter

Correct Answer: 1

Explanation

IKE Phase 1 authenticates the VPN peers and establishes a secure channel used for subsequent IPsec negotiations. During this process, peers negotiate parameters such as encryption, authentication, integrity, and Diffie-Hellman settings according to the configured proposal. Authentication may use a pre-shared key or supported certificate-based methods. If Phase 1 fails, the VPN cannot progress to normal Phase 2 establishment. Troubleshooting should compare peer addresses, authentication settings, proposals, and related IKE configuration on both sides.

Question 207

Which FortiGate feature can protect traffic between two private networks over an untrusted Internet connection?

1. Site-to-site IPsec VPN
2. Web Filter
3. DHCP
4. Traffic shaping

Correct Answer: 1

Explanation

A site-to-site IPsec VPN creates an encrypted tunnel between network gateways, allowing private networks to communicate securely across an untrusted network such as the public Internet. FortiGate can negotiate the tunnel using IKE and protect data using IPsec security associations. Administrators must configure compatible Phase 1 and Phase 2 settings, routing, and firewall policies. Monitoring the tunnel and protected traffic is also important because an established VPN does not automatically guarantee that every required network is reachable. Proper selectors and routing are essential for successful communication.

Question 208

Which FortiGate VPN design uses a logical tunnel interface that can participate in routing?

1. Route-based VPN
2. DNS-based VPN
3. Web-based VPN
4. Address-based NAT

Correct Answer: 1

Explanation

A route-based IPsec VPN uses a logical tunnel interface that can participate in FortiGate routing. Administrators can install routes pointing toward the tunnel and then use firewall policies to control traffic entering or leaving the VPN interface. This design provides flexibility for dynamic routing and multiple network relationships. It also separates routing decisions from the definition of protected traffic. Successful operation still requires compatible IPsec parameters, correct routes, and suitable firewall policies. Route-based VPNs are commonly useful in larger or more dynamic network environments.

Question 209

Which FortiGate feature can publish an internal HTTPS server using a public IP address?

1. VIP
2. SD-WAN
3. FortiView
4. NTP

Correct Answer: 1

Explanation

A Virtual IP, or VIP, can map an external public address and port to an internal server and service. For an HTTPS server, administrators can configure the appropriate external and internal addresses and port mapping, then create a firewall policy permitting only the required traffic. This allows external clients to reach the internal service without directly exposing the server’s private address. Security controls such as IPS, logging, and appropriate inspection can provide additional protection. Only necessary services should be published to minimize external exposure.

Question 210

Which NAT method changes the destination address of incoming traffic?

1. Source NAT
2. Destination NAT
3. IP pool
4. Central SNAT only

Correct Answer: 2

Explanation

Destination NAT changes the destination address of incoming traffic, allowing a public-facing address to be translated to an internal destination. FortiGate commonly uses VIP objects to implement destination NAT and port forwarding for published services. Source NAT performs the opposite type of translation by changing the source address, typically for outbound traffic. Administrators should understand which address is being translated when troubleshooting NAT behavior. Correct firewall policies, routing, and VIP configuration are required for destination NAT to work as intended.

Question 211

Which FortiGate feature can control whether an administrator may modify firewall policies?

1. Administrator profile
2. DNS Filter
3. SD-WAN SLA
4. VLAN interface

Correct Answer: 1

Explanation

Administrator profiles define the permissions available to individual FortiGate administrator accounts. A profile can grant or restrict access to functions such as firewall policy configuration, system settings, monitoring, and other administrative areas. This supports role-based access control and the principle of least privilege. For example, an administrator responsible only for monitoring may receive read-only access rather than permission to modify policies. Restricting configuration privileges reduces the potential impact of compromised accounts and accidental changes. Profiles should be reviewed regularly as responsibilities change.

Question 212

Which authentication protocol can FortiGate use to communicate with a centralized user authentication server?

1. RADIUS
2. NTP
3. OSPF
4. DNS

Correct Answer: 1

Explanation

RADIUS is a commonly supported protocol for centralized authentication. FortiGate can send authentication requests to a configured RADIUS server, which validates user credentials according to the organization’s authentication system. Centralized authentication reduces the need to maintain separate credentials on every network device and can support consistent access-control policies. Administrators must configure the server address, shared secret, authentication settings, and network connectivity correctly. When troubleshooting RADIUS, checking communication, authentication logs, and server-side configuration can help identify whether failures originate on FortiGate or the authentication server.

Question 213

Which FortiGate integration can obtain user identity information from an Active Directory environment without requiring users to repeatedly log in to the firewall?

1. FSSO
2. IP pool
3. SD-WAN
4. FortiView

Correct Answer: 1

Explanation

Fortinet Single Sign-On, or FSSO, can provide FortiGate with user identity information from supported Windows and Active Directory environments. Users authenticate through the domain environment, and the identity information can then be used by FortiGate for identity-based policies. This reduces the need for separate firewall authentication prompts in supported deployments. FSSO relies on correctly configured identity collectors and communication with the relevant directory environment. Administrators should monitor identity mappings because stale or incorrect identity information could result in users receiving unexpected access.

Question 214

Which FortiGate feature can require users to authenticate through a browser before accessing a protected network?

1. Captive portal
2. IP pool
3. Service group
4. Static route

Correct Answer: 1

Explanation

A captive portal presents users with a web-based authentication page before permitting access according to the configured firewall policy. It is commonly used for guest networks, wireless environments, and other situations where user authentication is required before Internet or network access. FortiGate can integrate captive portal authentication with local or external authentication mechanisms depending on the configuration. Administrators should define appropriate policies for authenticated and unauthenticated users. Session timeouts, authentication requirements, and access permissions should also be reviewed to prevent excessive or unintended access.

Question 215

Which FortiGate feature can identify a client device based on its network characteristics?

1. Device detection
2. Schedule
3. VIP
4. Service group

Correct Answer: 1

Explanation

Device detection provides information about endpoints observed on FortiGate-connected networks. Depending on the available traffic and detection mechanisms, FortiGate can identify characteristics such as device type or operating system. This visibility can help administrators discover devices, investigate unexpected endpoints, and support network access decisions. Device detection is especially useful in environments where many devices connect dynamically. Detection information should not automatically be treated as absolute proof of device identity; administrators should validate important security decisions using additional authentication or endpoint information where appropriate.

Question 216

Which FortiGate feature can separate traffic between users or systems by placing them into different logical networks?

1. VLAN segmentation
2. NTP
3. FortiToken
4. IP pool

Correct Answer: 1

Explanation

VLAN segmentation separates network traffic into logical Layer 2 segments using VLAN identifiers. FortiGate can provide VLAN interfaces and enforce policies between those segments. Organizations can use separate VLANs for departments, servers, guests, voice systems, or other security zones. Segmentation reduces unnecessary direct communication and can limit the impact of a compromised endpoint. Administrators should configure matching VLAN IDs on connected switches and create explicit firewall policies between segments. Segmentation is most effective when combined with least-privilege access rules and monitoring.

Question 217

Which FortiGate feature can store and display information about currently active network sessions?

1. Session monitor
2. DNS Filter
3. NTP
4. FortiToken

Correct Answer: 1

Explanation

The session monitor provides visibility into active sessions currently handled by FortiGate. Administrators can examine information about connections and associated traffic to understand what is happening on the firewall at a particular moment. This can be useful for troubleshooting unexpected connections, verifying that traffic is passing, and investigating active communication between hosts. Session information differs from historical traffic logs because it focuses on current session state. Administrators can combine session monitoring with policy lookup, routing information, and debug tools for deeper troubleshooting.

Question 218

Which FortiGate tool can show detailed information about how a packet is processed by the firewall?

1. Debug flow
2. FortiView
3. Web Filter
4. DHCP

Correct Answer: 1

Explanation

Debug flow provides detailed diagnostic information about packet processing on FortiGate. Administrators can apply filters for particular traffic and observe routing decisions, policy matching, and other processing steps. This makes it particularly useful when a packet is not being handled as expected and normal logs do not provide enough detail. Debug flow should be used carefully because unrestricted output can become extensive. Administrators should filter the relevant traffic, collect the required information, and stop debugging afterward to minimize unnecessary processing and output.

Question 219

Which FortiGate diagnostic method allows an administrator to inspect actual packets crossing an interface?

1. Packet capture
2. Administrator profile
3. Policy schedule
4. FortiToken

Correct Answer: 1

Explanation

Packet capture allows administrators to inspect actual packets observed by FortiGate. Captures can reveal addresses, protocols, ports, packet direction, and other header information that can help identify connectivity problems. This is useful when investigating whether traffic reaches an interface or whether responses return as expected. Packet capture should be targeted to the required interface and traffic whenever possible. Since packet data can contain sensitive information, administrators should protect captured files and avoid collecting more traffic than necessary during troubleshooting.

Question 220

Which FortiGate feature can provide centralized configuration management for a large number of firewalls?

1. FortiManager
2. FortiAnalyzer
3. FortiWeb
4. FortiEDR

Correct Answer: 1

Explanation

FortiManager provides centralized management for multiple FortiGate devices. It can help administrators organize devices, manage policy packages, maintain configuration revisions, and deploy changes from a central management system. This is particularly useful in environments with many firewalls because common policies and configurations can be managed consistently. Centralized management also requires strong change-control procedures because a configuration error can potentially affect multiple devices. FortiManager focuses primarily on device and policy management, while FortiAnalyzer focuses on centralized logging, analysis, and reporting.