Free FCSS_LED_AR-7.6: FCSS - LAN Edge 7.6 Architect Exam Questions and Answers

Last updated: September 19, 2026

Provider

Fortinet

Questions in our bank

1000+

Free to read

First 10, with answers

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Practice format

Multiple choice

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   You are configuring FortiAuthenticator to integrate with FSSO for user identification. To enable FortiAuthenticator to extract user information from syslog messages and inject it into FSSO, you have configured syslog matching rules. What is the role of syslog matching rules in the process of injecting user information into FSSO?

   • A. To automatically update user group memberships in FSSO based on syslog events
   • B. To enforce user authentication policies based on syslog message contents
   • C. To define how syslog messages are parsed and extract user information, such as usernames and IP addresses
   • D. To filter and block irrelevant syslog messages from being processed by the FortiAuthenticator
   Reveal Answer

2. Question #2

   Refer to the exhibits. An LDAP server has been successfully configured on FortiGate. which forwards LDAP authentication requests to a Windows Active Directory (AD) server. Wireless users report that they are unable to authenticate. Upon troubleshooting, you find that authentication fails when using MSCHAPv2. What is the most likely reason for this issue?

   
   • A. A firewall policy is missing an LDAP authentication rule.
   • B. The Windows AD server requires LDAPS (LDAP over SSL) for authentication.
   • C. The FortiGate LDAP configuration is missing the correct Bind DN.
   • D. FortiGate does not support MSCHAPv2 for LDAP authentication.
   Reveal Answer

3. Question #3

   A network engineer is deploying FortiGate devices using zero-touch provisioning (ZTP). The devices must automatically connect to FortiManager and receive their configurations upon first boot. However, after powering on the devices, they fail to register with FortiManager. What could be a possible cause of this issue?

   • A. The FortiGate device requires manual intervention to accept the FortiManager connection.
   • B. In this scenario, the ZTP process works only when devices are connected using a console cable.
   • C. The FortiGate device must be preloaded with a configuration file before ZTP can function.
   • D. The FortiManager IP address is not reachable over TCP port 541.
   Reveal Answer

4. Question #4

   In addition to requiring a FortiAnalyzer device to configure the Security Fabric, which license must be added to FortiAnalyzer to use Indicators of Compromise (IOC) rules?

   • A. loT Security Add-on license
   • B. IOC Subscription license
   • C. IOC detection is included on FAZ-Basic license
   • D. Threat Detection Service license
   Reveal Answer

5. Question #5

   A conference center wireless network provides guest access through a captive portal, allowing unregistered users to self-register and connect to the network. The IT team has been tasked with updating the existing configuration to enforce captive portal authentication over a secure HTTPS connection. Which two steps should the administrator take to implement this change? (Choose two.)

   Select 2 answers.

   • A. Enable HTTP redirect in the user authentication settings.
   • B. Create a new SSID with the HTTPS captive portal URL.
   • C. Disable HTTP administrative access on the guest SSID to enforce HTTPS connection.
   • D. Update the captive portal URL to use HTTPS on FortiGate and FortiAuthenticator.
   Reveal Answer

6. Question #6

   You are setting up a captive portal to provide Wi-Fi access for visitors. To simplify the process, your team wants visitors to authenticate using their existing social media accounts instead of creating new accounts or entering credentials manually. Which two actions are required to enable this functionality? (Choose two.)

   Select 2 answers.

   • A. Set up a remote open authorization (OAuth) server for each selected social media platform.
   • B. Configure only the email login option because a social media login cannot be used with captive portals.
   • C. Enable Account Login as the authentication type and configure a remote LDAP server.
   • D. Set up the FortiAuthenticator internal database as the primary source for user credentials
   • E. Configure the social login profiles for the supported platforms.
   Reveal Answer

7. Question #7

   Refer to the exhibits. The exhibits show the VAP configuration. Wi-Fi SSIDs. and zone table. Which two statements describe how FortiGate handles VLAN assignment for wireless clients? (Choose two.)

   

   Select 2 answers.

   • A. FortiGate will load balance clients using VLAN 101 and VLAN 102 and assign them an IP address from the 10.0.3.0/24 subnet.
   • B. All clients connecting to the Corp Zone will receive an IP address from the 10.0.20.0/24 subnet.
   • C. Clients connecting to APs in the Floor 1 group will not be able to receive an IP address.
   • D. Clients connecting to APs in the Office group will be assigned to VLAN 102.
   Reveal Answer

8. Question #8

   Refer to the exhibits. Examine the FortiManager configuration and FortiGate CLI output shown in the exhibit. The NAC feature is being tested with a device connected to port2 on managed FortiSwitch S224SPTF19005867. The NAC policy has been applied to port2, and traffic was generated from the test device. However, the traffic from the test device does not match the NAC policy and remains in the onboarding VLAN. What are two possible reasons why the test device is not being correctly classified by the NAC policy? (Choose two.)

   

   Select 2 answers.

   • A. Device detection is not enabled on VLAN 4089.
   • B. The device operating system detected by FortiGate is not Linux.
   • C. Management communication between FortiGate and FortiSwitch is down.
   • D. The MAC address configured on the NAC policy is incorrect.
   Reveal Answer

9. Question #9

   Refer to the exhibits. You are adding a new FortiSwitch to FortiGate for management. All necessary settings have been configured on FortiGate, but FortiSwitch remains offline. The cabling has been verified and is correctly connected. Which misconfiguration might be preventing FortiGate from detecting FortiSwitch?

   
   • A. The Fortilink interface setting ip-managed-by-fortiipam must be enabled.
   • B. The Fortilink interface has the wrong interface member.
   • C. The Fortilink interface setting cype must be physical.
   • D. The DHCP server setting vci-string is misconfigured.
   Reveal Answer

10. Question #10

    Refer to the exhibits. Examine the FortiGate RSSO configuration shown in the exhibit. FortiGate is set up to use RSSO for user authentication. It is currently receiving RADIUS accounting messages through port3. The incoming RADIUS accounting messages contain the username in the User-Name attribute and group membership in the Class attribute. You must ensure that the users are authenticated through these RADIUS accounting messages and accurately mapped to their respective RSSO user groups. Which three critical configurations must you implement on the FortiGate device? (Choose three.)

    

    Select 3 answers.

    • A. The RADIUS Attribute Value setting configured for an RSSO user group should match the class RADIUS attribute value in the RADIUS accounting message.
    • B. RSSO user groups should be assigned to all firewall policies.
    • C. Device detection and Security Fabric Connection should be enabled on port3
    • D. The sso-attribute CLI setting in the RSSO agent configuration should be set to Class.
    • E. The rsso-endpoint-attribute CLI setting in the RSSO agent configuration should be set toUser-Name.
    Reveal Answer