FCSS_EFW_AD-7.6 Free Practice Test

Refer to the exhibit, which contains a partial VPN configuration.

What can you conclude from this VPN IPsec phase 1 configuration?

1. A. This configuration is the best for networks with regular traffic intervals, providing a balance between connectivity assurance and resource utilization.
2. B. Peer IDs are unencrypted and exposed, creating a security risk.
3. C. FortiGate will not add a route to its routing or forwarding information base when the dynamic tunnel is negotiated.
4. D. A separate interface is created for each dial-up tunnel, which can be slower and more resource intensive, especially in large networks.

Correct Answer: A

Refer to the exhibit, which shows a hub and spokes deployment.

An administrator is deploying several spokes, including the BGP configuration for the spokes to connect to the hub.
Which two commands allow the administrator to minimize the configuration? (Choose two.)

1. A. neighbor-group
2. B. route-reflector-client
3. C. neighbor-range
4. D. ibgp-enforce-multihop

Correct Answer: AC

What is the initial step performed by FortiGate when handling the first packets of a session?

1. A. Installation of the session key in the network processor (NP)
2. B. Data encryption and decryption
3. C. Security inspections such as ACL, HPE, and IP integrity header checking
4. D. Offloading the packets directly to the content processor (CP)

Correct Answer: C

Refer to the exhibit, which shows the packet capture output of a three-way handshake between FortiGate and FortiManager Cloud.

What two conclusions can you draw from the exhibit? (Choose two.)

1. A. FortiGate will receive a certificate that supports multiple domains because FortiManager operates in a cloud computing environment.
2. B. FortiGate is connecting to the same IP server and will receive an independent certificatefor its connection between FortiGate and FortiManager Cloud.
3. C. If the TLS handshake contains 17 cipher suites it means the TLS version must be 1.0 on this three-way handshake.
4. D. The wildcard for the domain *.fortinet-ca2.support.fortinet.com must be supported by FortiManager Cloud.

Correct Answer: D

Refer to the exhibit, which contains a partial command output.

The administrator has configured BGP on FortiGate. The status of this new BGP configuration is shown in the exhibit.
What configuration must the administrator consider next?

1. A. Configure a static route to 100.65.4.1.
2. B. Configure the local AS to 65300.
3. C. Contact the remote peer administrator to enable BGP
4. D. Enable ebgp-enforce-multihop.

Correct Answer: D