View Full Fortinet FCSS_EFW_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 41

Which FortiGate feature provides detailed information about active sessions and their associated traffic?

1. Session monitor
2. Web Filter
3. FortiGuard
4. DHCP

Correct Answer: 1

Explanation

The session monitor provides visibility into active sessions passing through FortiGate. Administrators can use session information to investigate traffic flows, identify communicating endpoints, and troubleshoot connectivity problems. Session details can help determine whether traffic is being processed as expected and can provide useful information about protocols, addresses, ports, and interfaces. This information is especially valuable when diagnosing firewall policy behavior or unexpected network activity. Session monitoring should be used together with traffic logs and other troubleshooting tools when investigating complex connectivity or security issues.

Question 42

Which command is commonly used in the FortiGate CLI to display the routing table?

1. get router info routing-table all
2. diagnose debug application ssl
3. show system interface
4. execute ping-options

Correct Answer: 1

Explanation

The get router info routing-table all command displays routing information on a FortiGate device. It is useful when troubleshooting connectivity because administrators can determine which routes are installed and which destinations are reachable through specific interfaces or gateways. Reviewing the routing table can reveal missing routes, unexpected paths, or incorrect next-hop information. Other CLI commands provide information about interfaces or troubleshooting functions, but they do not directly display the complete routing table. Administrators should verify routing before assuming a firewall policy is causing connectivity problems.

Question 43

What is the primary purpose of a firewall policy on FortiGate?

1. Control traffic between interfaces
2. Store firmware images
3. Manage administrator passwords
4. Collect FortiAnalyzer reports

Correct Answer: 1

Explanation

A FortiGate firewall policy determines how traffic is handled between interfaces or zones based on configured criteria. Policies can specify source and destination addresses, services, schedules, incoming and outgoing interfaces, and security profiles. An action such as accept or deny determines whether matching traffic is permitted. Firewall policies are fundamental to FortiGate security because they define the conditions under which network communication is allowed. Administrators should keep policies specific, properly ordered, documented, and regularly reviewed to reduce unnecessary access.

Question 44

Which action does FortiGate take when a firewall policy is configured with the DENY action?

1. Encrypts the traffic
2. Blocks the matching traffic
3. Redirects traffic to DNS
4. Converts the source address

Correct Answer: 2

Explanation

A firewall policy configured with a deny action blocks traffic that matches the policy conditions. This prevents the specified communication from being permitted through the FortiGate policy-processing path. Deny policies can be used to explicitly block unwanted sources, destinations, services, or applications. Administrators should understand policy ordering because another earlier policy may process traffic before the intended deny rule is reached. Logging denied traffic can also help identify attempted connections and support troubleshooting or security investigations.

Question 45

Which address object represents a group of multiple IP addresses or networks in FortiGate?

1. Service group
2. Address group
3. VIP
4. IP pool

Correct Answer: 2

Explanation

An address group combines multiple address objects into a single logical group that can be referenced by firewall policies and other configurations. Instead of creating separate policy entries for every individual address, administrators can create an address group containing the required hosts or networks. This simplifies policy management and can make configurations easier to maintain. Address groups should be organized logically and reviewed regularly so that obsolete addresses do not remain unnecessarily included. Service groups perform a similar organizational function for network services rather than IP addresses.

Question 46

A FortiGate policy needs to permit only HTTPS traffic. Which service should be selected?

1. HTTP
2. DNS
3. HTTPS
4. FTP

Correct Answer: 3

Explanation

HTTPS is the appropriate service when a firewall policy should permit secure web traffic using the standard HTTPS service. FortiGate service objects define network protocols and ports that policies can match. Selecting HTTPS allows administrators to create a more specific rule than permitting all TCP traffic. Depending on inspection requirements, additional security profiles can be applied to HTTPS traffic. Administrators should avoid overly broad service definitions when a narrower service is sufficient because restricting unnecessary protocols and ports supports stronger access control.

Question 47

Which FortiGate object is used to define a collection of ports and protocols that can be referenced by firewall policies?

1. Address object
2. Service object
3. User group
4. Interface group

Correct Answer: 2

Explanation

Service objects define network protocols, ports, or port ranges that FortiGate firewall policies can use when matching traffic. Examples include HTTP, HTTPS, SSH, DNS, and custom application services. Administrators can use predefined services or create custom service objects when applications require nonstandard ports. Service groups can combine multiple services into one logical object. Using appropriate service definitions helps create precise policies and limits permitted communication. Administrators should avoid using overly broad services such as unrestricted TCP or UDP when specific application requirements are known.

Question 48

Which FortiGate feature can group interfaces together so policies can be applied to a logical interface rather than individual physical ports?

1. Interface zone
2. FortiGuard
3. IP pool
4. Security profile

Correct Answer: 1

Explanation

An interface zone allows multiple interfaces to be grouped into a logical security zone. Firewall policies can then reference the zone instead of individually listing every member interface, simplifying policy administration. Zones can be useful when several interfaces share similar security requirements or when administrators want to organize network segments logically. The exact behavior depends on the FortiOS configuration and interface design. Administrators should ensure that grouping interfaces does not unintentionally combine networks requiring different security policies or access restrictions.

Question 49

Which FortiGate feature can automatically block or restrict traffic from sources identified as malicious by threat intelligence?

1. FortiGuard security services
2. DHCP server
3. Traffic shaping
4. Static routing

Correct Answer: 1

Explanation

FortiGuard security services provide threat intelligence that FortiGate can use for security decisions. Depending on the subscribed service and configuration, FortiGuard information can help identify malicious IP addresses, domains, URLs, applications, and other threats. This intelligence can be integrated into security controls such as web filtering and other inspection mechanisms. Using current threat intelligence can improve protection against newly identified threats. Administrators should maintain valid subscriptions and verify that FortiGate can communicate with the required FortiGuard services to receive current security information.

Question 50

What is the purpose of a firewall policy schedule?

1. Define when the policy is active
2. Assign an IP address
3. Encrypt firewall logs
4. Configure DNS records

Correct Answer: 1

Explanation

A firewall policy schedule determines when the policy can be used to process matching traffic. FortiGate supports schedules that can define recurring periods, such as business hours, or other configured time ranges. Scheduling allows administrators to enforce different access rules depending on operational requirements. For example, a policy could permit access to a service only during specific working periods. Administrators should ensure that schedules use the correct system time and timezone because inaccurate time configuration can cause policies to become active or inactive at unexpected times.

Question 51

Which FortiGate feature can identify suspicious network behavior and generate security events for analysis?

1. Intrusion Prevention System
2. DHCP relay
3. NAT
4. Static route

Correct Answer: 1

Explanation

The Intrusion Prevention System can inspect network traffic for patterns associated with attacks, exploits, and other suspicious activity. FortiGate IPS uses security signatures and related inspection capabilities to identify potentially malicious traffic and can take configured actions such as monitoring or blocking. Security events generated by IPS can provide useful information for incident investigation and threat monitoring. Administrators should keep IPS definitions current and tune configurations appropriately for the environment. Proper tuning can help reduce unnecessary alerts while maintaining meaningful protection against known attack techniques.

Question 52

Which FortiGate feature helps prevent unauthorized applications from consuming excessive network bandwidth?

1. Application Control
2. Antivirus
3. Certificate inspection
4. DHCP

Correct Answer: 1

Explanation

Application Control can identify specific applications and allow administrators to control how those applications use the network. When combined with appropriate policies and traffic-shaping configurations, it can help restrict or manage applications that consume excessive bandwidth. For example, an organization may identify recreational or peer-to-peer applications and apply different controls to them. Application Control focuses on application identification and policy enforcement rather than simply filtering traffic based on port numbers. Accurate application signatures and suitable inspection settings are important for effective identification.

Question 53

What does FortiGate use to determine which firewall policy should process matching traffic?

1. Policy sequence and matching criteria
2. CPU temperature
3. FortiAnalyzer storage size
4. Administrator username

Correct Answer: 1

Explanation

FortiGate evaluates firewall policies using their configured sequence and matching criteria. These criteria can include source and destination interfaces, addresses, services, schedules, users, and other policy attributes. Policy ordering is important because traffic may be handled by the first applicable policy according to FortiGate’s policy-processing logic. Administrators should place more specific rules appropriately and avoid unnecessary broad policies that could unintentionally match traffic. Reviewing policy order and matching conditions is a fundamental step when troubleshooting unexpected allow or deny results.

Question 54

Which VPN technology commonly uses IKE to negotiate security parameters before establishing protected IPsec communication?

1. SSL VPN
2. IPsec VPN
3. GRE
4. PPTP

Correct Answer: 2

Explanation

IPsec VPN commonly uses Internet Key Exchange, or IKE, to negotiate authentication and cryptographic parameters between VPN peers. The negotiation establishes the security associations required to protect IPsec traffic. FortiGate supports IPsec VPN deployments for site-to-site and other secure connectivity requirements. Administrators must ensure that both peers have compatible authentication, encryption, Diffie-Hellman, and traffic-selection settings. Successful IKE negotiation alone does not guarantee that data traffic will pass, because routing and firewall policies must also permit the intended communication.

Question 55

Which protocol is commonly used by FortiGate for secure remote administration through the CLI?

1. Telnet
2. FTP
3. SSH
4. HTTP

Correct Answer: 3

Explanation

SSH, or Secure Shell, provides encrypted remote administrative access to the FortiGate command-line interface. It protects management traffic from interception compared with insecure protocols such as Telnet. Administrators should restrict SSH access to trusted management networks or authorized hosts and avoid exposing administrative services unnecessarily to the public Internet. Strong authentication and appropriate administrator permissions should also be used. FortiGate can provide additional management security through trusted hosts, administrative profiles, and other controls that limit who can access and modify the device.

Question 56

Which protocol provides encrypted web-based access to the FortiGate graphical administration interface?

1. HTTPS
2. HTTP
3. FTP
4. TFTP

Correct Answer: 1

Explanation

HTTPS provides encrypted web communication for accessing the FortiGate graphical user interface when HTTPS administration is enabled. It uses TLS to protect credentials and management information exchanged between the administrator’s browser and FortiGate. Administrators should prefer HTTPS over unencrypted HTTP for management access and restrict administrative access to trusted networks or hosts where possible. The administrative certificate should also be appropriately managed so that users can validate the secure connection. Management interfaces should never be unnecessarily exposed to untrusted networks.

Question 57

An administrator wants to verify whether a remote host is reachable from FortiGate. Which diagnostic utility is commonly used?

1. Ping
2. Traceroute
3. Packet capture
4. Debug flow

Correct Answer: 1

Explanation

Ping is a basic diagnostic utility used to test IP connectivity between FortiGate and a destination host. It sends ICMP echo requests and evaluates whether responses are received. Ping can help determine whether a destination is reachable, although a failed response does not always prove that the destination is unavailable because ICMP may be filtered. Traceroute can provide information about the path traffic takes, while packet capture and debug flow provide deeper troubleshooting information. Administrators should select diagnostic tools based on the specific problem being investigated.

Question 58

Which diagnostic tool is most useful for examining the path traffic takes through intermediate routers?

1. Ping
2. Traceroute
3. DNS lookup
4. Session clear

Correct Answer: 2

Explanation

Traceroute identifies the intermediate routing hops between a source and destination. It can help administrators determine where traffic may be experiencing delays, routing problems, or failures. On FortiGate, traceroute can be used as part of network troubleshooting when connectivity does not follow the expected path. A traceroute result should be interpreted carefully because intermediate devices may rate-limit or block diagnostic responses without actually preventing application traffic. Combining traceroute with routing-table information, ping tests, and traffic logs provides a more complete troubleshooting picture.

Question 59

Which FortiGate diagnostic method can show the processing path of a packet through firewall policies?

1. Debug flow
2. Web Filter
3. FortiGuard
4. DHCP

Correct Answer: 1

Explanation

Debug flow is a powerful FortiGate troubleshooting mechanism that can show how packets are processed through routing and firewall policy logic. Administrators can use it to determine why traffic is being accepted, denied, routed unexpectedly, or otherwise handled differently than expected. Because debug output can be extensive, administrators should apply suitable filters and carefully interpret the results. Debugging should generally be performed for a specific troubleshooting purpose and stopped when no longer required. This reduces unnecessary processing and excessive diagnostic output.

Question 60

Which FortiGate troubleshooting method captures packets so administrators can inspect the actual traffic exchanged between network endpoints?

1. Policy lookup
2. Packet capture
3. FortiView
4. Traffic shaping

Correct Answer: 2

Explanation

Packet capture records network packets passing through a selected interface or traffic path so administrators can inspect their contents and characteristics. It can help identify protocol problems, retransmissions, incorrect addressing, unexpected traffic, or communication failures. Packet captures are particularly useful when logs do not provide enough detail to identify the cause of a problem. Administrators should capture only the traffic necessary for troubleshooting and protect captured data because packets may contain sensitive information. Appropriate filters can reduce capture size and simplify analysis.