FCSS_LED_AR-7.6: FCSS - LAN Edge 7.6 Architect Fortigate Practice Questions

Refer to the exhibits. Examine the FortiManager configuration and FortiGate CLI output shown in the exhibit. The NAC feature is being tested with a device connected to port2 on managed FortiSwitch S224SPTF19005867. The NAC policy has been applied to port2, and traffic was generated from the test device. However, the traffic from the test device does not match the NAC policy and remains in the onboarding VLAN. What are two possible reasons why the test device is not being correctly classified by the NAC policy? (Choose two.)

Select 2 answers.

• AA. Device detection is not enabled on VLAN 4089.
• BB. The device operating system detected by FortiGate is not Linux.
• CC. Management communication between FortiGate and FortiSwitch is down.
• DD. The MAC address configured on the NAC policy is incorrect.

Refer to the exhibits. You are adding a new FortiSwitch to FortiGate for management. All necessary settings have been configured on FortiGate, but FortiSwitch remains offline. The cabling has been verified and is correctly connected. Which misconfiguration might be preventing FortiGate from detecting FortiSwitch?

• AA. The Fortilink interface setting ip-managed-by-fortiipam must be enabled.
• BB. The Fortilink interface has the wrong interface member.
• CC. The Fortilink interface setting cype must be physical.
• DD. The DHCP server setting vci-string is misconfigured.

Refer to the exhibits. Examine the FortiGate RSSO configuration shown in the exhibit. FortiGate is set up to use RSSO for user authentication. It is currently receiving RADIUS accounting messages through port3. The incoming RADIUS accounting messages contain the username in the User-Name attribute and group membership in the Class attribute. You must ensure that the users are authenticated through these RADIUS accounting messages and accurately mapped to their respective RSSO user groups. Which three critical configurations must you implement on the FortiGate device? (Choose three.)

Select 3 answers.

• AA. The RADIUS Attribute Value setting configured for an RSSO user group should match the class RADIUS attribute value in the RADIUS accounting message.
• BB. RSSO user groups should be assigned to all firewall policies.
• CC. Device detection and Security Fabric Connection should be enabled on port3
• DD. The sso-attribute CLI setting in the RSSO agent configuration should be set to Class.
• EE. The rsso-endpoint-attribute CLI setting in the RSSO agent configuration should be set toUser-Name.