Instant Download FCSS_EFW_AD-7.6 Dumps Q&As Provide PDF&Test Engine [Q51-Q69]

Rate this post

Instant Download FCSS_EFW_AD-7.6 Dumps Q&As Provide PDF&Test Engine

Fast Exam Updates FCSS_EFW_AD-7.6 dumps with PDF Test Engine Practice

Q51. Refer to the exhibit, which shows a partial troubleshooting command output.

An administrator is extensively using IPsec on FortiGate. Many tunnels show information similar to the output shown in the exhibit.
What can the administrator conclude?

IPsec SAs cannot be offloaded.

The two IPsec SAs, inbound and outbound, are copied to the NPU.

Only the outbound IPsec SA is copied to the NPU.

Only the inbound IPsec SA is copied to the NPU.

Q52. A company’s guest internet policy, operating in proxy mode, blocks access to Artificial Intelligence Technology sites using FortiGuard. However, a guest user accessed a page in this category using port 8443.
Which configuration changes are required for FortiGate to analyze HTTPS traffic on nonstandard ports like 8443 when full SSL inspection is active in the guest policy?

Add a URL wildcard domain to the website CA certificate and use it in the SSL/SSH Inspection Profile.

In the Protocol Port Mapping section of the SSL/SSH Inspection Profile, enter 443, 8443 to analyze both standard (443) and non-standard (8443) HTTPS ports.

To analyze nonstandard ports in web filter profiles, use TLSv1.3 in the SSL/SSH Inspection Profile.

Administrators can block traffic on nonstandard ports by enabling the SNI check in the SSL/SSH Inspection Profile.

Q53. To secure your enterprise network traffic, which step does FortiGate perform first, when handling the first packets of a session? (Choose one answer)

Installation of the session key in the network processor (NP)

Decryption

A reverse path forwarding (RPF) check

IP integrity header checking

Q54. You receive a FortiAnalyzer alert warning that a 1 TB disk filled up in a day. Upon investigation, you find thousands of unusual DNS log requests, such as JHCMQK.website.com, with no answers. You later discover that DNS exfiltration is occurring through both UDP and TLS. How can you prevent this data theft technique?

Use a file filter profile to protect against DNS exfiltration.

Use an intrusion prevention system (IPS) profile and DNS exfiltration-related signatures.

Enable DNS filter to protect against DNS exfiltration.

Enable data loss prevention (DLP) to prevent DNS exfiltration.

Q55. How would fec-ingress and fec-sgress IPsec configuration affect an IPsec tunnel?

When an FGSP member in FortiGate fails, FortiGate flushes the corresponding tunnels and sends out dead peer detection probes to find unavailable remote peers.

FortiGate will consider all IKEV2 packets as fragmentable.

If fragmentation occurs, FortiGate will allow the packets at the IKE layer.

FortiGate will add additional redundant information to reconstruct any lost or erratically received packets.

Q56. Refer to the exhibit, which shows device registration on FortiManager.

What can you conclude about the Spoke-1 and Spoke-2 configurations with respect to the information cond: Modified (recent auto-updated)?

Based on the policy configuration on NGFW-1, the configuration on both spokes is modified and automatically updated.

On NGFW-1, the configuration was changed and spokes are wailing for an autoupdate.

On both Spoke-1 and Spoke-2, the configuration was changed directly on the FortiGate device, and the changes were automatically retrieved by the device database.

Spoke-1 and Spoke-2 are sharing the same security policy configuration and the same policy package.

Q57. An administrator needs to install an IPS profile without triggering false positives that can impact applications and cause problems with the user’s normal traffic flow. Which action can the administrator take to prevent false positives on IPS analysis?

Use the IPS profile extension to select an operating system, protocol, and application for all the network internal services and users to prevent false positives.

Enable Scan Outgoing Connections to avoid clicking suspicious links or attachments that can deliver botnet malware and create false positives.

Use an IPS profile with action monitor, however, the administrator must be aware that this can compromise network integrity.

Install missing or expired SSUTLS certificates on the client PC to prevent expected false positives.

Q58. An administrator wants to scale the IBGP sessions and optimize the routing table in an IBGP network.
Which parameter should the administrator configure?

network-import-check

ibgp-enforce-multihop

neighbor-group

route-reflector-client

Q59. Refer to the exhibit, which shows an enterprise network connected to an internet service provider.

An administrator must configure a loopback as a BGP source to connect to the ISP.
Which two commands are required to establish the connection? (Choose two.)

ebgp-enforce-multihop

update-source

ibgp-enforce-multihop

recursive-next-hop

Q60. Refer to the exhibit, which shows a network diagram.

An administrator would like to modify the MED value advertised from FortiGate_1 to a BGP neighbor in the autonomous system 30.
What must the administrator configure on FortiGate_1 to implement this?

route-map-out

network-import-check

prefix-list-out

distribute-list-out

Q61. Refer to the exhibit, which shows an enterprise network connected to an internet service provider.

An administrator must configure a loopback as a BGP source to connect to the ISP.
Which two commands are required to establish the connection? (Choose two.)

ebgp-enforce-multihop

update-source

ibgp-enforce-multihop

recursive-next-hop

Q62. A vulnerability scan report has revealed that a user has generated traffic to the website example.com (10.10.10.10) using a weak SSL/TLS version supported by the HTTPS web server.
What can the firewall administrator do to block all outdated SSL/TLS versions on any HTTPS web server to prevent possible attacks on user traffic?

Configure the unsupported SSL version and set the minimum allowed SSL version in the HTTPS settings of the SSL/SSH inspection profile.

Enable auto-detection of outdated SSL/TLS versions in the SSL/SSH inspection profile to block vulnerable websites.

Install the required certificate in the client’s browser or use Active Directory policies to block specific websites as defined in the SSL/SSH inspection profile.

Use the latest certificate, Fortinet_SSL_ECDSA256, and replace the CA certificate in the SSL/SSH inspection profile.

Q63. An administrator is setting up an ADVPN configuration and wants to ensure that peer IDs are not exposed during VPN establishment.
Which protocol can the administrator use to enhance security?

Use IKEv2, which encrypts peer IDs and prevents exposure.

Opt for SSL VPN web mode because it does not use peer IDs at all.

Choose IKEv1 aggressive mode because it simplifies peer identification.

Stick with IKEv1 main mode because it offers better performance.

Q64. An administrator configured the FortiGate devices in an enterprise network to join the Fortinet Security Fabric. The administrator has a list of IP addresses that must be blocked by the data center firewall. This list is updated daily.
How can the administrator automate a firewall policy with the daily updated list?

With FortiNAC

With FortiAnalyzer

With a Security Fabric automation

With an external connector from Threat Feeds

Q65. Refer to the exhibit, which shows an ADVPN network.

The client behind Spoke-1 generates traffic to the device located behind Spoke-2. What is the first message that the hub sends to Spoke-1 to bring up the dynamic tunnel?

Shortcut query

Shortcut offer

Shortcut reply

Shortcut forward

Q66. A company that acquired multiple branches across different countries needs to install new FortiGate devices on each of those branches. However, the IT staff lacks sufficient knowledge to implement the initial configuration on the FortiGate devices.
Which three approaches can the company take to successfully deploy advanced initial configurations on remote branches? (Choose three.)

Use metadata variables to dynamically assign values according to each FortiGate device.

Use provisioning templates and install configuration settings at the device layer.

Use the Global ADOM to deploy global object configurations to each FortiGate device.

Apply Jinja in the FortiManager scripts for large-scale and advanced deployments.

Add FortiGate devices on FortiManager as model devices, and use ZTP or LTP to connect to FortiGate devices.

Q67. Refer to the exhibit, which shows a partial troubleshooting command output.

An administrator is extensively using IPsec on FortiGate. Many tunnels show information similar to the output shown in the exhibit.
What can the administrator conclude?

IPsec SAs cannot be offloaded.

The two IPsec SAs, inbound and outbound, are copied to the NPU.

Only the outbound IPsec SA is copied to the NPU.

Only the inbound IPsec SA is copied to the NPU.

Q68. Refer to the exhibit, which shows a revision history window in the FortiManager device layer.

The IT team is trying to identify the administrator responsible for the most recent update in the FortiGate device database.
Which conclusion can you draw about this scenario?

This retrieved process was automatically triggered by a Remote FortiGate Directly (via CLI) script.

The user script_manager is an API user from the Fortinet Developer Network (FDN) retrieving a configuration.

To identify the user who created the event, check it on the Configuration and Installation widget on FortiGate within the FortiManager device layer.

Find the user in the FortiManager system logs and use the type=script command to find the administrator user in the user field.

Q69. Refer to the exhibit, which shows a revision history window in the FortiManager device layer.

The IT team is trying to identify the administrator responsible for the most recent update in the FortiGate device database.
Which conclusion can you draw about this scenario?

This retrieved process was automatically triggered by a Remote FortiGate Directly (via CLI) script.

The user script_manager is an API user from the Fortinet Developer Network (FDN) retrieving a configuration.

To identify the user who created the event, check it on the Configuration and Installation widget on FortiGate within the FortiManager device layer.

Find the user in the FortiManager system logs and use the type=script command to find the administrator user in the user field.

Fortinet FCSS_EFW_AD-7.6 Exam Syllabus Topics:

Topic	Details
Topic 1	Security Profiles: This section of the exam measures the skills of a Threat Prevention Specialist and covers the configuration and management of comprehensive security profiling systems. It includes implementing SSL SSH inspection, combining web filtering and application control mechanisms, integrating intrusion prevention systems, and utilizing the Internet Service Database to create layered security protections for organizational networks.
Topic 2	System Configuration: This section of the exam measures the skills of a Network Security Architect and covers the implementation and integration of core Fortinet infrastructure components. It includes deploying the Security Fabric, enabling hardware acceleration, configuring high availability operational modes, and designing enterprise networks utilizing VLANs and VDOM technologies to meet specific organizational requirements.
Topic 3	VPN: This section of the exam measures the skills of a VPN Solutions Engineer and covers the implementation of various virtual private network technologies. It includes configuring IPsec VPN using IKE version 2 protocols and implementing Automatic Discovery VPN solutions to establish on-demand secure tunnels between multiple sites within an enterprise network infrastructure.
Topic 4	Central Management: This section of the exam measures the skills of a Security Operations Manager and covers the implementation of centralized management systems for coordinated control and oversight of distributed Fortinet security infrastructures across enterprise environments.
Topic 5	Routing: This section of the exam measures the skills of a Network Infrastructure Engineer and covers the implementation of dynamic routing protocols for enterprise network traffic management. It includes configuring both OSPF and BGP routing protocols to ensure efficient and reliable data transmission across complex organizational networks.