Fortinet FCSS_NST_SE-7.4 Exam Questions and Answers, FCSS - Network Security 7.4 Support Engineer

Question #1

Exhibit. Refer to the exhibit, which shows a FortiGate configuration. An administrator is troubleshooting a web filter issue on FortiGate. The administrator has configured a web filter profile and applied it to a policy; however the web filter is not inspecting any traffic that is passing through the policy. What must the administrator do to fix the issue?

A. Disable webfilter-force-off

B. Increase webfilter-timeout

C. Enable fortiguard-anycast

D. Change protocol to TC

View answer

Correct Answer: A

Question #2

Refer to the exhibit. The exhibit shows the output from using the command diagnose debug application samld -1 to diagnose a SAML connection. Based on this output, what can you conclude?

A. Active Directory is used for authentication

B. The authentication request is for an SSL VPN connection

C. The IdP IP address is 10

D. The IdP IP address is 10

View answer

Correct Answer: D

Question #3

Exhibit. Refer to the exhibit, which shows the output of a diagnose command. What can you conclude about the debug output in this scenario?

A. Servers with a negative TZ value are less preferred for rating requests

B. FortiGate used 64

C. There is a natural correlation between the value in the FortiGuard-requests field and the value in the Weight field

D. The first server provided to FortiGate when it performed a DNS query looking for a list of rating servers, was 121

View answer

Correct Answer: C

Question #4

Exhibit. Refer to the exhibit, which shows a FortiGate configuration. An administrator is troubleshooting a web filter issue on FortiGate. The administrator has configured a web filter profile and applied it to a policy; however the web filter is not inspecting any traffic that is passing through the policy. What must the administrator do to fix the issue?

A. Disable webfilter - force - off

B. Increase webfilter - timeout

C. Enable fortiguard - anycast

D. Change protocol to TCP

View answer

Correct Answer: A

Question #5

Exhibit.Refer to the exhibit, which shows a FortiGate configuration.An administrator is troubleshooting a web filter issue on FortiGate. The administrator has configured a web filter profile and applied it to a policy; however the web filter is not inspecting any traffic that is passing through the policy.What must the administrator do to fix the issue?

A. Disable webfilter-force-off

B. Increase webfilter-timeout

C. Enable fortiguard-anycast

D. Change protocol to TCP

View answer

Correct Answer: A

Question #6

Refer to the exhibit. Which three pieces of information does the diagnose sys top command provide? (Choose three.)

A. The miglogd daemon is running on CPU core ID 0

B. The diagnose sys top command has been running for 18 minutes

C. The miglogd daemon would be on top of the list, if the administrator pressed m on the keyboard

D. The cmdbsvr process is occupying 2

E. If the neweli daemon continues to be in the R state, it will need to be manually restarted

View answer

Correct Answer: ACD

Question #7

Refer to the exhibit, which shows the output of the command get router info bgp neighbors 100.64.2.254 advertised-routes. What can you conclude from the output?

A. The BGP state of the two BGP participants is OpenConfirm

B. The router ID of the neighbor is 100

C. The BGP neighbor is advertising the 10

D. The local router is advertising the 10

View answer

Correct Answer: D

Question #8

Exhibit.

A. Perfect Forward Secrecy (PFS) is enabled in the configuration

B. The local gateway IP address is 10

C. It shows a phase 2 negotiation

D. The initiator provided remote as its IPsec peer Icorrect

View answer

Correct Answer: ACD

Question #9

Refer to the exhibits. An administrator Is expecting to receive advertised route 8.8.8.8/32 from FGT-A. On FGT-B, they confirm that the route is being advertised and received, however, the route is not being injected into the routing table. What is the most likely cause of this issue?

A. A batter route to the 8

B. FGT-B is configured with a prefix list denying the 8

C. The administrator has misconfigured redistribution of routes on FGT-

D. FGT-8 is configured with a distribution list denying the 8

View answer

Correct Answer: B

Question #10

Refer to the exhibit, which shows the partial output of a real-time OSPF debug. Why are the two FortiGate devices unable to form an adjacency?

A. The Hello packet is being sent from an OSPF router with ID 0

B. The two FortiGate devices attempting adjacency are in area 0

C. One FortiGate device is configured to require authentication, while the other is not

D. The passwords on the FortiGate devices do not match

View answer

Correct Answer: C

Question #11

Which two statements about conserve mode are true? (Choose two.)

A. FortiGate enters conserve mode when the system memory reaches the configured extreme threshold

B. FortiGate starts taking the configured action for new sessions requiring content inspection when the system memory reaches the configured red threshold

C. FortiGate exits conserve mode when the system memory goes below the configured green threshold

D. FortiGate starts dropping all new sessions when the system memory reaches the configured red threshold

View answer

Correct Answer: BC

Question #12

Which two statements are true regarding heartbeat messages sent from an FSSO collector agent to FortiGate? (Choose two.)

A. The heartbeat messages can be seen using the command diagnose debug authd fsso list

B. The heartbeat messages can be seen in the collector agent logs

C. The heartbeat messages can be seen on FortiGate using the real-lime FSSO debug

D. The heartbeat messages must be manually enabled on FortiGate

View answer

Correct Answer: ABC

Question #13

Refer to the exhibit, which shows a truncated output of a real-time LDAP debug. What two conclusions can you draw from the output? (Choose two.)

A. The name of the configured LDAP server is Lab

B. The user is authenticating using CN=John Smith

C. FortiOS is able to locate the user in step 3 (Bind Request) of the LDAP authentication process

D. FortiOS is performing the second step (Search Request) in the LDAP authentication process

View answer

Correct Answer: ABD

Question #14

Refer to the exhibit, which shows the output of a debug command. Which two statements about the output are true? (Choose two.)

A. The interlace is part of the OSPF backbone area

B. There are a total of five OSPF routers attached to the vorz4 network segment

C. One of the neighbors has a router ID of 0

D. In the network connected to port4, two OSPF routers are down

View answer

Correct Answer: AD

Question #15

Refer to the exhibit, which a network topology and a partial routing table. FortiGate has already been configured with a firewall policy that allows all ICMP traffic to flow from port1 to port3. Which changes must the administrator perform to ensure the server at 10.4.0.1/24 receives the echo reply from the laptop at 10.1.0.1/24?

A. Enable asymmetric routing under config system settings

B. Change the configuration from strict RPF check mode to feasible RPF check mode

C. A firewall policy that allows all ICMP traffic from port3 to port1

D. Modify the default gateway on the laptop from 10

View answer

Correct Answer: C

Question #16

An administrator wants to capture encrypted phase 2 traffic between two FotiGate devices using the built-in sniffer. If the administrator knows that there Is no NAT device located between both FortiGate devices, which command should the administrator run?

A. diagnose sniffer packet any 'udp port 500'

B. diagnose sniffer packet any 'lp proto 50'correct

C. diagnose sniffer packet any 'udp port 4500'

D. diagnose sniffer packet any 'ah'

View answer

Correct Answer: B

Question #17

Exhibit. Refer to the exhibit, which contains partial output from an IKE real - time debug. Which two statements about this debug output are correct? (Choose two.)

A. Perfect Forward Secrecy (PFS) is enabled in the configuration

B. The local gateway IP address is 10

C. It shows a phase 2 negotiation

D. The initiator provided remote as its IPsec peer ID

View answer

Correct Answer: CD

Question #18

Exhibit. Refer to the exhibit, which shows the output of a session. Which two statements are true? (Choose Iwo.)

A. The TCP session has been successfully established

B. The session was initiated from an authenticated user

C. The session is being inspected using flow inspection

D. The session is being offloaded

View answer

Correct Answer: AB

Question #19

Which statement about parallel path processing is correct (PPP)?

A. PPP does not apply to packets that are part of an already established session

B. Software configuration has no impact on PPP

C. PPP chooses from a group of parallel options lo identity the optimal path tor processing a packet

D. Only FortiGate hardware configurations affect the path that a packet takes

View answer

Correct Answer: C

Question #20

Refer to the exhibit, which shows the output of a debug command. Which two statements about the output are true? (Choose two.)

A. The interlace is part of the OSPF backbone area

B. There are a total of five OSPF routers attached to the vorz4 network segment

C. One of the neighbors has a router ID of 0

D. In the network connected to port4, two OSPF routers are down

View answer

Correct Answer: AD

Question #21

Refer to the exhibit, which shows the port1 interface configuration on FortiGate and partial session information for ICMP traffic. What happens to the session information if a routing change occurs that affects this session?

A. Only the interface and gateway information for dev=7 will be removed

B. The session information will not change unless the current route has been removed from the routing table

C. The session will be flagged as dirty but no route lookups will be performed

D. Sessions involving port7 or port19 will not have their routing information flushed

View answer

Correct Answer: B

Question #22

Refer to the exhibit, which shows the output of a policy route table entry.

A. An ISDB routecorrect

B. A regular policy route

C. A regular policy route, which is associated with an active static route in the FIB

D. An SD-WAN rule

View answer

Correct Answer: A

Question #23

Exhibit. Refer to the exhibit, which shows the output of a diagnose command. What can you conclude about the debug output in this scenario?

A. The first server provided to FortiGate when it performed a DNS query looking for a list of rating servers, was 121

B. There is a natural correlation between the value in the FortiGuard - requests field and the value in the Weight field

C. FortiGate used 64

D. Servers with a negative TZ value are less preferred for rating requests

View answer

Correct Answer: B

Question #24

Exhibit 1. Exhibit 2. Refer to the exhibits, which show the configuration on FortiGate and partial internet session information from a user on the internal network. An administrator would like to lest session failover between the two service provider connections. Which two changes must the administrator make to force this existing session to immediately start using the other interface? (Choose two.)

A. Change the priority of the port! static route to 11

B. Change the priority of the port2 static route to 5

C. Configure unset snat-route-change to return it to the default setting

D. Configure set snat-route-change enable

View answer

Correct Answer: AD

Question #25

Refer to the exhibit, which shows the output of a policy route table entry. Which type of policy route does the output show?

A. A regular policy route

B. A regular policy route, which is associated with an active static route in the FIB

C. An SD-WAN rule

D. An ISDB route

View answer

Correct Answer: D

Question #26

The local OSPF router is unable to establish adjacency with a peer. Which two things should the administrator do to troubleshoot the issue? (Choose two.)

A. Check whether both peers have an IP address within the same subnet

B. Check if IP protocol 89 is blocked

C. Check whether TCP port 179 is blocked

D. Check if there is an active static route to the peer

View answer

Correct Answer: AB

Question #27

Consider the scenario where the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate. Which action will FortiGate take when using the default settings for SSL certificate inspection?

A. FortiGate uses the SNI from the user's web browser

B. FortiGate closes the connection because this represents an invalid SSL/TLS configuration

C. FortiGate uses the first entry listed in the SAN field in the server certificate

D. FortiGate uses the CN information from the Subject field in the server certificate

View answer

Correct Answer: D

Question #28

Refer to the exhibit, which shows the partial output of FortiOS kernel slabs. Which statement is true?

A. The total slab size of the sctp_session slab is 0 kB and is associated with the user space

B. The total slab size of the ip_session slab is 3600 kB and is associated with the user space

C. The total slab size of the ip6_session slab is 1300 kB and is associated with the kernel

D. The total slab size of the tcp_session slab is 7500 kB and is associated with the kernel

View answer

Correct Answer: D

Question #29

Refer to the exhibit, which shows a session entry.Which statement about this session is true?

A. Return traffic to the initiator is sent to 10

B. Return traffic to the initiator is sent lo 10

C. It is an ICMP session from 10

D. It is an ICMP session from 10

View answer

Correct Answer: D

Question #30

Which two statements about conserve mode are true? (Choose two.)

A. FortiGate enters conserve mode when the system memory reaches the configured extreme threshold

B. FortiGate starts taking the configured action for new sessions requiring content inspection when the system memory reaches the configured red threshold

C. FortiGate exits conserve mode when the system memory goes below the configured green threshold

D. FortiGate starts dropping all new sessions when the system memory reaches the configured red threshold

View answer

Correct Answer: BC

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Fortinet FCSS_NST_SE-7.4 Exam Questions and Answers, FCSS - Network Security 7.4 Support Engineer | SPOTO

View The Updated Fortinet Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Fortinet FCSS_NST_SE-7.4 Exam Questions and Answers, FCSS - Network Security 7.4 Support Engineer | SPOTO

View The Updated Fortinet Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now