Free FCSS_EFW_AD-7.6: FCSS - Enterprise Firewall 7.6 Administrator Exam Questions and Answers

An administrator must allow users in the Finance VLAN to reach Microsoft 365 services over HTTPS and nothing else on the internet. Microsoft changes the IP address ranges of these services often, and the administrator does not want to maintain address objects by hand. What should the administrator configure in the firewall policy?

• AA. Set the application control profile of the policy to block every category except Business
• BB. Add the Microsoft 365 FQDNs as address objects and select them as the destination of the policy
• CC. Select the Microsoft-Office365 Internet Service object as the destination of the policy
• DD. Create wildcard URL filter entries for the Microsoft 365 domains in the web filter profile of the policy

Refer to the exhibit, which shows the OSPF neighbor table on FGT-A. Exhibit: FGT-A # get router info ospf neighbor OSPF process 0, VRF 0: Neighbor ID Pri State Dead Time Address Interface 10.0.0.2 1 ExStart/- 00:00:34 10.1.1.2 port2 The neighbor stays in this state, and the adjacency never reaches Full. Hellos are exchanged normally in both directions. What is the most likely cause?

• AA. The interface MTU values configured on the two port2 interfaces are different
• BB. The MD5 authentication keys configured on the two port2 interfaces are different
• CC. The hello and dead intervals are configured with different values on the two port2 interfaces
• DD. The two neighbors have the same interface assigned to different OSPF area IDs on port2

Refer to the exhibit, which shows partial IKE debug output on the initiator of an IKEv2 tunnel. Exhibit: ike 0:Branch1:2210: initiator: sent IKE_SA_INIT request ike 0:Branch1:2210: initiator: received IKE_SA_INIT response ike 0:Branch1:2210: initiator: sent IKE_AUTH request ike 0:Branch1:2210: initiator: received IKE_AUTH response ike 0:Branch1:2210: received notify type NO_PROPOSAL_CHOSEN ike 0:Branch1:2210: negotiation failure What is the most likely cause of the failure?

• AA. The pre-shared keys configured on the two peers are different
• BB. The remote gateway address in the phase 1 configuration points to the wrong peer
• CC. The phase 2 proposals on the two peers have no common encryption and authentication algorithm
• DD. The Diffie-Hellman groups in the two phase 1 proposals have no match

A FortiManager manages several FortiGate devices in an ADOM of version 7.4, and these devices must stay on FortiOS 7.4. The administrator now needs to add a new FortiGate running FortiOS 7.6, but FortiManager does not accept it in this ADOM. What should the administrator do?

• AA. Add the new FortiGate to the root ADOM and set its firmware version to 7.4 in the device settings
• BB. Create a new ADOM of version 7.6 and add the new FortiGate to that ADOM
• CC. Enable workspace mode in the 7.4 ADOM and then add the new FortiGate to it
• DD. Upgrade the 7.4 ADOM to version 7.6 and then add the new FortiGate to it

Employees must be able to browse and download files from Dropbox, but uploading files to Dropbox must be blocked. The traffic is encrypted with TLS. Which configuration meets this requirement?

• AA. Add dropbox.com to the static URL filter with the action Block and use certificate inspection in the policy
• BB. Use deep inspection in the policy and block the Dropbox file upload application signature in the application control profile
• CC. Set an application override for Dropbox to Block in the application control profile and use certificate inspection in the policy
• DD. Set the web filter category for file sharing and storage to Block and use certificate inspection in the policy

Refer to the exhibit, which shows the HA configuration of two FortiGate devices in an FGCP active-passive cluster. FGT-A # show system ha config system ha set group-id 7 set group-name "HQ-HA" set mode a-p set hbdev "port9" 50 "port10" 50 set session-pickup enable set override enable set priority 200 end FGT-B # show system ha config system ha set group-id 7 set group-name "HQ-HA" set mode a-p set hbdev "port9" 50 "port10" 50 set session-pickup enable set override enable set priority 100 end During a firmware upgrade, FGT-A was rebooted and FGT-B became the primary. When FGT-A finished booting, it took the primary role back and users experienced a second short outage. The administrator wants the cluster to keep FGT-B as the primary until it fails. What must the administrator do?

• AA. Disable override on FGT-A and FGT-B
• BB. Set ha-uptime-diff-margin to 600 on FGT-A and FGT-B and leave override enabled
• CC. Enable session-pickup-connectionless on FGT-A and FGT-B
• DD. Add port1 and port2 to the monitored interfaces on FGT-A and FGT-B

An administrator changed the IP address of an interface in the device database of a managed FortiGate on FortiManager. The policy package assigned to the device has not been modified. The administrator wants to push only the interface change to the FortiGate. Which installation option should the administrator use?

• AA. Install Device Settings (only)
• BB. Install Policy Package for the device
• CC. Install Interface Policy Only
• DD. Import Policy Package from the device

Refer to the exhibit, which shows the policy order on a managed FortiGate after a policy package installation from FortiManager. FGT-Branch3 # show firewall policy | grep -f "edit\|name\|action" edit 1 set name "Global-Block-P2P" set action deny edit 2 set name "Lab-Allow-All" set action accept edit 3 set name "LAN-to-Internet" set action accept edit 4 set name "Global-Footer-Deny" set action deny Policy ID 1 is a header policy that comes from a global ADOM policy package. Policy ID 2 was created by the ADOM administrator to give the lab subnet 10.50.8.0/24 unrestricted access, but peer-to-peer traffic from the lab subnet is still blocked. What must the administrator do?

• AA. Move the Lab-Allow-All policy above the Global-Block-P2P policy in the ADOM policy package
• BB. Convert the Lab-Allow-All policy to a footer policy in the ADOM policy package
• CC. Run Install Preview on the device and install the policy package again
• DD. Edit the header policy in the global ADOM to exclude the lab subnet, then assign the package to the ADOM again

An administrator has deployed an ADVPN with one hub and several spokes. Every spoke phase 1 interface has auto-discovery-receiver enabled. Traffic between two spokes always passes through the hub, and no shortcut tunnels are ever created. Which setting must the administrator configure on the hub phase 1 interface?

• AA. set auto-discovery-forwarder enable
• BB. set add-route enable
• CC. set auto-discovery-sender enable
• DD. set auto-discovery-receiver enable

A FortiGate has EBGP sessions with two ISPs in different autonomous systems, ISP-A and ISP-B. The company advertises the prefix 203.0.113.0/24 to both. The administrator wants inbound traffic from the internet to prefer ISP-A. Which two actions should the administrator take? (Choose two.)

Select 2 answers.

• AA. Prepend the company AS number several times in an outbound route map applied to the ISP-B neighbor
• BB. Set a higher weight on the ISP-A neighbor
• CC. Set a higher local preference in a route map applied to routes received from ISP-A
• DD. Advertise two more specific /25 prefixes to ISP-A only, in addition to the /24