[Sep-2026] FCSS_EFW_AD-7.6 PDF Dumps Are Helpful To produce Your Dreams Correct QA's
New FCSS_EFW_AD-7.6 exam Free Sample Questions to Practice
Fortinet FCSS_EFW_AD-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 88
You configured the FortiGate devices in an enterprise network to join the Fortinet Security Fabric. You have a list of IP addresses that must be blocked by the data center firewall. This list is updated daily.
How can you automate updates to the firewall policy to add the IP addresses from the daily updated list?
- A. With metadata variables in FortiManager
- B. With a Security Fabric automation
- C. With a CLI script in FortiManager
- D. With an external connector from External Feeds
Answer: D
NEW QUESTION # 89
Why do the firewall policy and reinstall preview show different address names during installation?
- A. Policy conflict
- B. Object corruption
- C. Per-device mapping
- D. Address mismatch
Answer: C
Explanation:
FortiManager uses a feature called per-device mapping (also referred to as dynamic mapping) to manage environments where different FortiGate devices require different values for the same object name. For example, an address object named " LAN " might represent 172.16.0.0/24 on one device and 192.168.0.0/24 on another.
When an administrator views the policy package in the FortiManager GUI, they see the common object name used across the ADOM. However, the reinstall preview generates the actual CLI commands that will be pushed to the specific FortiGate unit. This preview reflects the specific mapped value or name defined for that individual device, which is why the names or values may appear different from the generic policy view.
NEW QUESTION # 90
Refer to the exhibit, which shows a LAN interface connected from FortiGate to two FortiSwitch devices.
What two conclusions can you draw from the corresponding LAN interface? (Choose two.)
- A. You must enable STP or RSTP on FortiGate and FortiSwitch to avoid layer 2 loopbacks.
- B. This connection is using a FortiLInk to manage VLANs on FortiGate.
- C. The LAN interface must use a 802.3ad type interface.
- D. FortiGate is using an SD-WAN-type interface to connect to a FortiSwitch device with MCLAG.
Answer: B,C
Explanation:
The diagram shows a FortiGate connected to two FortiSwitches, which suggests the use of FortiLink, Fortinet's protocol for managing switches directly from a FortiGate. Since multiple connections are being used, the LAN interface must be set to 802.3ad (LAG) mode to aggregate the links for redundancy and load balancing.
This setup allows FortiGate to handle VLAN assignments dynamically, as seen with VLAN 10 (192.168.15.1/24). FortiLink ensures seamless integration between FortiGate and FortiSwitches, making STP unnecessary because Fortinet's MCLAG prevents loops at Layer 2. SD-WAN, on the other hand, is used for WAN interfaces and does not apply to switch connectivity in this scenario.
NEW QUESTION # 91
An administrator received a FortiAnalyzer alert that a 1 disk filled up in a day. Upon investigation, they found thousands of unusual DNS log requests, such as JHCMQK.website.com, with no answers. They later discovered that DNS exfiltration was occurring through both UDP and TLS. How can the administrator prevent this data theft technique?
- A. Create an inline-CASB to protect against DNS exfiltration.
- B. Configure a File Filter profile to prevent DNS exfiltration.
- C. Use an IPS profile and DNS exfiltration-related signatures.
- D. Enable DNS Filter to protect against DNS exfiltration.
Answer: C
Explanation:
The excessive DNS log requests with random subdomains suggest a DNS exfiltration attack, where attackers encode and transmit data via DNS queries. Since this technique can use both UDP and TLS (DoH - DNS over HTTPS), a comprehensive security approach is needed.
Using an IPS profile with DNS exfiltration-specific signatures allows FortiGate to:
Detect and block abnormal DNS query patterns often used in exfiltration. Inspect encrypted DNS (DoH, DoT) traffic if SSL inspection is enabled. Identify known exfiltration domains and techniques based on FortiGuard threat intelligence.
NEW QUESTION # 92
You configured the FortiGate devices in an enterprise network to join the Fortinet Security Fabric.
You have a list of IP addresses that must be blocked by the data center firewall. The list is updated daily. How can you automate updates to the firewall policy to add the IP addresses from the daily updated list?
- A. With metadata variables in FortiManager
- B. With a Security Fabric automation
- C. With a CLI script in FortiManager
- D. With an external connector from External Feeds
Answer: D
Explanation:
An external connector using External Feeds lets FortiGate automatically retrieve a regularly updated list of IP addresses from an external source and use that list dynamically in firewall policies. This is the appropriate method when the blocklist changes daily and needs to be enforced without manual updates.
NEW QUESTION # 93
Which parameter should be configured to scale iBGP sessions?
- A. neighbor-range
- B. recursive-next-hop
- C. route-reflector-client
- D. neighbor-group
Answer: B
NEW QUESTION # 94
A company's guest internet policy, operating in proxy mode, blocks access to Artificial Intelligence Technology sites using FortiGuard. However, a guest user accessed a page in this category using port 8443.
Which configuration changes are required for FortiGate to analyze HTTPS traffic on nonstandard ports like 8443 when full SSL inspection is active in the guest policy?
- A. Administrators can block traffic on nonstandard ports by enabling the SNI check in the SSL/SSH Inspection Profile.
- B. To analyze nonstandard ports in web filter profiles, use TLSv1.3 in the SSL/SSH Inspection Profile.
- C. Add a URL wildcard domain to the website CA certificate and use it in the SSL/SSH Inspection Profile.
- D. In the Protocol Port Mapping section of the SSL/SSH Inspection Profile, enter 443, 8443 to analyze both standard (443) and non-standard (8443) HTTPS ports.
Answer: D
Explanation:
When FortiGate is operating in proxy mode with full SSL inspection enabled, it inspects encrypted HTTPS traffic by default on port 443. However, some websites may use non-standard HTTPS ports (such as 8443), which FortiGate does not inspect unless explicitly configured.
To ensure that FortiGate inspects HTTPS traffic on port 8443, administrators must manually add port 8443 in the Protocol Port Mapping section of the SSL/SSH Inspection Profile. This allows FortiGate to treat HTTPS traffic on port 8443 the same as traffic on port 443, enabling proper inspection and enforcement of FortiGuard category-based web filtering.
NEW QUESTION # 95
Why does the ISDB block layers 3 and 4 of the OSI model when applying content filtering?
(Choose two.)
- A. The ISDB blocks the IP addresses and ports of an application predefined by FortiGuard.
- B. The ISDB limits access by URL and domain.
- C. The ISDB works in proxy mode, allowing the analysis of packets in layers 3 and 4 of the OSI model.
- D. FortiGate has a predefined list of all IPs and ports for specific applications downloaded from FortiGuard.
Answer: A,D
Explanation:
The Internet Service Database (ISDB) in FortiGate is used to enforce content filtering at Layer 3 (Network Layer) and Layer 4 (Transport Layer) of the OSI model by identifying applications based on their predefined IP addresses and ports.
FortiGate has a predefined list of all IPs and ports for specific applications downloaded from FortiGuard:
FortiGate retrieves and updates a predefined list of IPs and ports for different internet services from FortiGuard.
This allows FortiGate to block specific services at Layer 3 and Layer 4 without requiring deep packet inspection.
The ISDB blocks the IP addresses and ports of an application predefined by FortiGuard:
ISDB works by matching traffic to known IP addresses and ports of categorized services. When an application or service is blocked, FortiGate prevents communication by denying traffic based on its destination IP and port number.
NEW QUESTION # 96
Refer to the exhibit.
An administrator is deploying a hub and spokes network and using OSPF as dynamic protocol.
Which configuration is mandatory for neighbor adjacency?
- A. Set virtual-link enable in the hub interface
- B. Set network-type point-to-multipoint in the hub interface
- C. Set bfd enable in the router configuration
- D. Set rfc1583-compatible enable in the router configuration
Answer: B
Explanation:
In a hub-and-spoke topology using OSPF over IPsec VPNs, the point-to-multipoint network type is necessary to establish neighbor adjacencies between the hub and spokes. This network type ensures that OSPF operates correctly without requiring a designated router (DR) and allows dynamic routing updates across the IPsec tunnels.
NEW QUESTION # 97
Which two features can you use to segment an enterprise network?
- A. ZTNA
- B. IPsec
- C. VLAN
- D. VDOM
Answer: C,D
NEW QUESTION # 98
An administrator is checking an enterprise network and sees a suspicious packet with the MAC address e0:23:ff:fc:00:86.
What two conclusions can the administrator draw? (Choose two.)
- A. The suspicious packet corresponds to port 7 on a FortiGate device.
- B. The suspicious packet is related to a cluster that has VDOMs enabled.
- C. The network includes FortiGate devices configured with the FGSP protocol.
- D. The suspicious packet is related to a cluster with a group-id value lower than 255.
Answer: A,B
Explanation:
According to the FortiOS 7.6 Infrastructure study guide and High Availability (HA) documentation, FortiGate units in an HA cluster use a virtual MAC address to ensure seamless failover. The structure of this virtual MAC address is strictly defined by the Fortinet HA protocol.
For a standard HA cluster, the virtual MAC address format is 00:09:0f:09:<group- id_hex>:<vcluster_port_hex>. However, when VDOMs are enabled, the virtual MAC address prefix changes to e0:23:ff to accommodate the additional complexity of multiple virtual domains.
Therefore, the prefix e0:23:ff in the suspicious MAC address e0:23:ff:fc:00:86 confirms that the packet originated from a cluster with VDOMs enabled (Option A).
Regarding the interface identification, the last byte (86) is calculated as follows:
The 0x80 bit indicates virtual-cluster 2 (vcluster 2). Since $0x86 = 0x80 + 0x06$, we know the packet is from vcluster 2.
The remaining value 0x06 represents the interface index. In FortiOS, the index starts at 0 (port1 =
0, port2 = 1, port3 = 2, port4 = 3, port5 = 4, port6 = 5, port7 = 6). Therefore, the index 6 corresponds exactly to port 7 (Option D).
The fourth byte (fc) represents the HA Group ID (252 in decimal). While this is indeed lower than
255, the specific logic of the virtual MAC composition in a VDOM-enabled environment points specifically to the port identification and vcluster status as the primary diagnostic conclusions.
NEW QUESTION # 99
A vulnerability scan report has revealed that a user has generated traffic to the website example.com (10.10.10.10) using a weak SSL/TLS version supported by the HTTPS web server.
What can the firewall administrator do to block all outdated SSL/TLS versions on any HTTPS web server to prevent possible attacks on user traffic?
- A. Enable auto-detection of outdated SSL/TLS versions in the SSL/SSH inspection profile to block vulnerable websites.
- B. Configure the unsupported SSL version and set the minimum allowed SSL version in the HTTPS settings of the SSL/SSH inspection profile.
- C. Use the latest certificate, Fortinet_SSL_ECDSA256, and replace the CA certificate in the SSL/SSH inspection profile.
- D. Install the required certificate in the client's browser or use Active Directory policies to block specific websites as defined in the SSL/SSH inspection profile.
Answer: B
Explanation:
The best way to block outdated SSL/TLS versions is to configure the SSL/SSH inspection profile to enforce a minimum SSL/TLS version and disable weak SSL versions.
By setting the minimum allowed SSL version in the HTTPS settings of the SSL/SSH inspection profile, FortiGate will:
# Block any connection using outdated SSL/TLS versions (such as SSLv3, TLS 1.0, or TLS 1.1).
# Enforce secure communication using only strong SSL/TLS versions (such as TLS 1.2 or TLS 1.3).
# Protect users from man-in-the-middle (MITM) and downgrade attacks that exploit weak encryption.
NEW QUESTION # 100
Refer to the exhibit, which shows a command output.
FortiGate_A and FortiGate_B are members of an FGSP cluster in an enterprise network.
While testing the cluster using the ping command, the administrator monitors packet loss and found that the session output on FortiGate_B is as shown in the exhibit.
What could be the cause of this output on FortiGate_B?
- A. session-pickup-connectionless is set to disable on FortiGate_B.
- B. The session synchronization is encrypted.
- C. FortiGate_A and FortiGate_B have the same standalone-group-id value.
- D. FortiGate_B is configured in passive mode.
Answer: A
Explanation:
The Fortinet FGSP (FortiGate Session Life Support Protocol) cluster allows session synchronization between two FortiGate devices to provide seamless failover. However, ICMP (ping) is a connectionless protocol, and by default, FortiGate does not synchronize connectionless sessions unless explicitly enabled.
In the exhibit:
The command get system session list | grep icmp on FortiGate_B returns no output, meaning that ICMP sessions are not being synchronized from FortiGate_A. If session-pickup-connectionless is disabled, FortiGate_B will not receive ICMP sessions, causing packet loss during failover.
NEW QUESTION # 101
A FortiGate device using unified threat management (UTM) profiles is reaching resource limits, and you expect traffic in your enterprise network to increase.
You received an additional FortiGate of the same model.
Which two options should you consider using to integrate the additional FortiGate into your enterprise network? (Choose two.)
- A. FortiGate Clustering Protocol (FGCP) in active-active (A-A) mode with switches
- B. FortiGate Session Life Support Protocol (FGSP) with external load balancers
- C. FortiGate Clustering Protocol (FGCP) in active-passive (A-P) mode with VDOM disabled
- D. Virtual Router Redundancy Protocol (VRRP) with switches
Answer: A,B
NEW QUESTION # 102
Which specialized acceleration hardware must you use for VXLAN?
- A. NPU7
- B. CPU
- C. NTurbo
- D. CP10
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract documents and Knowledge:
VXLAN (Virtual Extensible LAN) is a Layer 2 overlay scheme on a Layer 3 network. It uses MAC-in-UDP encapsulation, which adds 50 bytes of overhead to each packet. Processing this encapsulation and decapsulation in software (CPU) is resource-intensive and can lead to performance bottlenecks.
The NPU7 (Network Processor 7) is specifically designed to provide hardware acceleration for various tunnel protocols, including VXLAN. It allows the FortiGate to offload the encapsulation/decapsulation process to the hardware, enabling wire-speed performance and reducing the load on the main CPU. While older NPUs had limited support, the NPU7 architecture includes dedicated engines for VXLAN offloading, making it the required hardware for high-performance VXLAN environments.
NEW QUESTION # 103
An organization acquired multiple branches across different countries and must install FortiGate devices at each branch. However, their IT staff lacks the knowledge required to implement the initial configuration on the FortiGate devices. Which three approaches can the organization take to successfully deploy advanced initial configurations on the FortiGate devices at their remote branches? (Choose three.)
- A. Apply Jinja in the FortiManager scripts for large-scale and advanced deployments.
- B. Use metadata variables to dynamically assign values according to each FortiGate device.
- C. Use provisioning templates and install configuration settings at the device layer.
- D. On FortiManager, add the FortiGate devices as model devices, and use zero-touch provisioning (ZTP) or low-touch provisioning (LTP) to connect to the FortiGate devices.
- E. Use the global ADOM to deploy global object configurations to each FortiGate device.
Answer: A,B,D
Explanation:
Jinja in FortiManager scripts supports large-scale, advanced initial provisioning by allowing flexible and reusable configuration logic across many remote FortiGate devices.
Adding FortiGate devices as model devices and using ZTP or LTP enables centralized onboarding and deployment without requiring skilled staff at each branch.
Metadata variables let FortiManager dynamically assign device-specific values such as hostnames, IP addresses, and interface settings, which is essential when deploying consistent but customized initial configurations across many branches.
NEW QUESTION # 104
Refer to the exhibit, which shows the ADVPN network topology and partial BGP configuration.
Which two parameters must an administrator configure in the config neighbor range for spokes shown in the exhibit? (Choose two.)
- A. set neighbor-group advpn
- B. set route-reflector-client enable
- C. set max-neighbor-num 2
- D. set prefix 172.16.1.0 255.255.255.0
Answer: A,D
Explanation:
In the given ADVPN (Auto-Discovery VPN) topology, BGP is being used to dynamically establish routes between spokes. The neighbor-range configuration is crucial for simplifying BGP peer setup by automatically assigning neighbors based on their IP range.
set neighbor-group advpn
# The neighbor-group parameter is used to apply pre-defined settings (such as AS number) to dynamically discovered BGP neighbors.
# The advpn neighbor-group is already defined in the configuration, and assigning it to the neighbor-range ensures consistent BGP settings for all spoke neighbors.
set prefix 172.16.1.0 255.255.255.0
# This command allows dynamic BGP peer discovery by defining a range of potential neighbor IPs (172.16.1.1 - 172.16.1.255).
# Since each spoke has a unique /32 IP within this subnet, this ensures that any spoke within the 172.16.1.0/24 range can automatically establish a BGP session with the hub.
NEW QUESTION # 105
Refer to the exhibit.
A partial enterprise network is shown.
What must you configure so that FortiGate A and other OSPF routers in the backbone learn about prefixes generated within the RIP domain?
- A. Configure a distribute-route-map-in on FortiGate B.
- B. Set the area 0.0.0.1 type to stub on FortiGate A and B.
- C. Enable RIP redistribution on FortiGate B.
- D. Configure a virtual link between FortiGate A and B.
Answer: C
Explanation:
FortiGate B is the device connected to both the RIP domain and the OSPF domain, so it must redistribute RIP routes into OSPF. Once RIP redistribution is enabled on FortiGate B, FortiGate A and the other OSPF routers in the backbone can learn the prefixes from the RIP domain.
NEW QUESTION # 106
Refer to the exhibits.
The ADVPN network topology and partial BGP configuration are shown.
Which two parameters must you configure in the config neighbor range for spokes shown in the exhibit? (Choose two.)
- A. set neighbor-group advpn
- B. set route-reflector-client enable
- C. set prefix 172.16.1.0 255.255.255.0
- D. set prefix 10.0.12.0 255.255.255.0
Answer: A,C
Explanation:
For the hub to automatically create iBGP neighbors for the spokes in this ADVPN, the neighbor- range must match the spokes' overlay IP addresses (172.16.1.2 and 172.16.1.3), so the prefix is set to 172.16.1.0/24. The neighbor-range must also be tied to the preconfigured neighbor-group advpn so that all dynamically created spoke neighbors inherit the BGP settings (including remote- as 65100).
NEW QUESTION # 107
Refer to the exhibit, which shows a network diagram showing the addition of site 2 with an overlapping network segment to the existing VPN IPsec connection between the hub and site 1.
Which IPsec phase 2 configuration must an administrator make on the FortiGate hub to enable equal-cost multi-path (ECMP) routing when multiple remote sites connect with overlapping subnets?
- A. Set route-overlap to allow
- B. Set single-source to enable
- C. Set net-device to ecmp
- D. Set route-overlap to either use-new or use-old
Answer: D
Explanation:
When multiple remote sites connect to the same hub using overlapping subnets, FortiGate needs to determine which route should be used for traffic forwarding. The route-overlap setting in IPsec Phase 2 allows FortiGate to handle this scenario by deciding whether to keep the existing route (use-old) or replace it with a new route (use-new).
In an ECMP (Equal-Cost Multi-Path) routing setup, both routes should be retained and balanced, but FortiGate does not support ECMP directly over overlapping routes in IPsec Phase 2. Instead, an administrator must decide which connection takes precedence using route-overlap settings.
NEW QUESTION # 108
Refer to the exhibits.
The system administrator settings configured on a root FortiGate and the Security Fabric settings configured on a downstream FortiGate are shown.
When prompted to sign in with Security Fabric to the downstream FortiGate, a user enters the single sign-on (SSO) provider credentials.
What is the result?
- A. The user is prompted to create an administrator account for AdminSSO.
- B. The downstream FortiGate creates an SSO administrator account for AdminSSO with the super_admin profile.
- C. The downstream FortiGate relies on the root FortiGate and does not create an administrator account.
- D. The downstream FortiGate creates an SSO administrator account for AdminSSO with the super_admin_readonly profile.
Answer: D
Explanation:
In a Fortinet Security Fabric environment using SAML Single Sign-On (SSO), the root FortiGate typically acts as the SAML Identity Provider (IdP) or the primary gateway to one, while the downstream FortiGates act as SAML Service Providers (SP).
Based on the logic provided in the Fortinet Enterprise Firewall 7.6 Administrator Study Guide and the provided exhibits:
* Identity Verification: When the user attempts to log into the downstream FortiGate via SSO, the authentication is handled by the root FortiGate.
* Profile Assignment: Although the user AdminSSO may have super_admin privileges on the root FortiGate (as shown in the first exhibit), the downstream FortiGate controls what level of access that user receives locally.
* Default Fabric Settings: In the downstream FortiGate ' s Security Fabric configuration (shown in the second exhibit), there is a setting for the " Default login profile " for SAML SSO users. In standard Security Fabric deployments, this is default-set to super_admin_readonly .
* Account Creation: Upon the first successful SSO login, the downstream FortiGate automatically creates a local " SSO administrator " account entry for that user to track their session and permissions.
It applies the default profile specified in the Fabric settings.
Therefore, even though the user is a super_admin on the root, they will be restricted to the super_admin_readonly profile on the downstream device because that is the profile assigned by the downstream SP ' s configuration.
NEW QUESTION # 109
Refer to the exhibit, which shows the packet capture output of a three-way handshake between FortiGate and FortiManager Cloud.
What two conclusions can you draw from the exhibit? (Choose two.)
- A. FortiGate will receive a certificate that supports multiple domains because FortiManager operates in a cloud computing environment.
- B. FortiGate is connecting to the same IP server and will receive an independent certificate for its connection between FortiGate and FortiManager Cloud.
- C. The wildcard for the domain *.fortinet-ca2.support.fortinet.com must be supported by FortiManager Cloud.
- D. If the TLS handshake contains 17 cipher suites it means the TLS version must be 1.0 on this three-way handshake.
Answer: A,C
Explanation:
The packet capture output displays a TLS Client Hello message from FortiGate to FortiManager Cloud. This message contains Server Name Indication (SNI), which is used to indicate the domain name that FortiGate is trying to connect to.
FortiGate will receive a certificate that supports multiple domains because FortiManager operates in a cloud computing environment.
FortiManager Cloud hosts multiple customers and domains under a shared infrastructure. The TLS handshake includes SNI (Server Name Indication), which allows FortiManager Cloud to serve multiple certificates based on the requested domain. This means FortiGate will likely receive a multi-domain or wildcard certificate that can be used for multiple customers under FortiManager Cloud.
The wildcard for the domain .fortinet-ca2.support.fortinet.com must be supported by FortiManager Cloud.
The SNI extension contains the domain 9398.support.fortinet-ca2.fortinet.com.
FortiManager Cloud must support wildcard certificates such as *.fortinet-ca2.support.fortinet.com to securely manage multiple subdomains and customers.
This ensures that FortiGate can validate the server certificate without any TLS errors.
NEW QUESTION # 110
......
Cover FCSS_EFW_AD-7.6 Exam Questions Make Sure You 100% Pass: https://www.exams4collection.com/FCSS_EFW_AD-7.6-latest-braindumps.html
FCSS_EFW_AD-7.6 dumps Accurate Questions and Answers with Free: https://drive.google.com/open?id=132cNaNg5CCUr4dQG46moWsoA15zsTLLU
