Free FCSS_NST_SE-7.4: FCSS - Network Security 7.4 Support Engineer Exam Questions and Answers

Refer to the exhibit. FGT # diagnose sniffer packet any 'host 192.0.2.50 and tcp port 443' 4 0 l interfaces=[any] filters=[host 192.0.2.50 and tcp port 443] 2026-10-09 10:15:03.125311 port2 in 10.0.1.10.51022 -> 192.0.2.50.443: syn 2819405511 2026-10-09 10:15:03.125402 port1 out 198.51.100.2.51022 -> 192.0.2.50.443: syn 2819405511 2026-10-09 10:15:04.127118 port2 in 10.0.1.10.51022 -> 192.0.2.50.443: syn 2819405511 2026-10-09 10:15:04.127190 port1 out 198.51.100.2.51022 -> 192.0.2.50.443: syn 2819405511 A user on 10.0.1.10 cannot open an HTTPS site at 192.0.2.50. What can the administrator conclude from the output?

• AA. FortiGate receives the SYN/ACK on port1, but an implicit deny drops it after session creation
• BB. FortiGate forwards the SYN with source NAT applied, but no reply reaches port1
• CC. The server replies, but the reverse path forwarding check drops the SYN/ACK on port1
• DD. The firewall policy is denying the SYN packets before they leave FortiGate

Which two statements about the IPS fail-open setting are true? (Choose two.)

Select 2 answers.

• AA. When disabled, FortiGate keeps inspecting traffic with the last loaded signatures if the IPS engine stops
• BB. It is configured globally under config ips global
• CC. It is configured per IPS sensor in each security profile
• DD. When enabled, FortiGate allows traffic without IPS inspection if the IPS engine crashes or becomes unresponsive

Refer to the exhibit. FGT # diagnose debug authd fsso server-status Server Name Connection Status Version Address ------------------------------------------------------------- CollectorAgent1 disconnected unknown 10.30.5.50 FGT # diagnose sniffer packet any 'host 10.30.5.50 and port 8000' 4 0 l 2026-10-09 08:15:01.220114 port2 out 10.0.1.1.41230 -> 10.30.5.50.8000: syn 2879415107 2026-10-09 08:15:02.220301 port2 out 10.0.1.1.41230 -> 10.30.5.50.8000: syn 2879415107 2026-10-09 08:15:04.220655 port2 out 10.0.1.1.41230 -> 10.30.5.50.8000: syn 2879415107 No FSSO logons appear on FortiGate. The collector agent service is running on 10.30.5.50 and the FortiGate is configured with the correct collector agent address and password. What is the most likely cause of the problem?

• AA. A firewall in the path or on the collector agent host is dropping TCP port 8000 traffic.
• BB. The domain controllers are not forwarding Windows security event log entries to the collector agent.
• CC. The FSSO group filter on the collector agent excludes the groups that the logged-on users belong to.
• DD. A mismatch between the FortiGate and collector agent passwords is preventing the FSSO group list from synchronizing.

Refer to the exhibit. Branch1 # show vpn ipsec phase1-interface To-HQ config vpn ipsec phase1-interface edit "To-HQ" set interface "wan1" set ike-version 1 set nattraversal disable set remote-gw 198.51.100.20 next end Branch1 # diagnose sniffer packet any 'host 198.51.100.20 and (udp port 500 or udp port 4500 or esp)' 4 0 l 2026-10-09 10:22:01.113284 wan1 out 10.200.1.1.500 -> 198.51.100.20.500: udp 296 2026-10-09 10:22:01.151907 wan1 in 198.51.100.20.500 -> 10.200.1.1.500: udp 296 2026-10-09 10:22:09.402518 wan1 out 10.200.1.1 -> 198.51.100.20: ip-proto-50 132 2026-10-09 10:22:10.404116 wan1 out 10.200.1.1 -> 198.51.100.20: ip-proto-50 132 Branch1 is behind a NAT device. The tunnel shows as up, but no return traffic arrives from HQ. What should the administrator do?

• AA. Enable NAT traversal in the phase 1 settings on both FortiGate devices.
• BB. Change the IKE version from 1 to 2 in the phase 1 settings on both FortiGate devices.
• CC. Increase the DPD retry count and interval in the phase 1 settings on both FortiGate devices.
• DD. Enable perfect forward secrecy in the phase 2 settings on both FortiGate devices.

Refer to the exhibit. FGT # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP S* 0.0.0.0/0 [10/0] via 203.0.113.1, port4 C 10.0.1.0/24 is directly connected, port1 C 10.0.2.0/24 is directly connected, port2 C 10.0.3.0/24 is directly connected, port3 S 172.16.0.0/16 [10/0] via 10.0.2.2, port2 FGT # diagnose debug flow trace start 5 id=20085 trace_id=14 func=print_pkt_detail line=5895 msg="vd-root:0 received a packet(proto=1, 172.16.5.10:1->10.0.1.20:2048) from port3. type=8, code=0, id=1, seq=1." id=20085 trace_id=14 func=init_ip_session_common line=6076 msg="allocate a new session-00031a4e" id=20085 trace_id=14 func=ip_route_input_slow line=2194 msg="reverse path check fail, drop" Hosts in 172.16.5.0/24 are reachable through the router 10.0.3.2 that is connected to port3. Pings from 172.16.5.10 to 10.0.1.20 fail. What should the administrator do to fix the problem?

• AA. Lower the administrative distance of the 172.16.0.0/16 static route so that it is preferred.
• BB. Add a static route to 172.16.5.0/24 through gateway 10.0.3.2 on port3.
• CC. Add a firewall policy from port3 to port1 that permits ICMP from 172.16.5.0/24.
• DD. Add a blackhole route for 172.16.0.0/16 with a lower priority value than the existing route.

Refer to the exhibit. FGT # diagnose debug application fnbamd -1 FGT # diagnose debug enable FGT # diagnose test authserver ldap CORP-LDAP jsmith Pa$$w0rd [__ldap_build_dn_search_req] Search filter is: cn=jsmith [__ldap_build_dn_search_req] Search base is: dc=corp,dc=example,dc=com [fnbamd_ldap_search_result-1017] Search found 0 entries authenticate 'jsmith' against 'CORP-LDAP' failed! The LDAP server connection and the bind with the service account succeed. In Active Directory, the user jsmith has the sAMAccountName jsmith and the cn value John Smith. What should the administrator change to fix the problem?

• AA. Change the bind type from simple to regular and supply the credentials of an administrator.
• BB. Enable LDAPS on the server entry and import the CA certificate of the domain controller.
• CC. Change the common name identifier on the LDAP server entry from cn to sAMAccountName.
• DD. Increase the search timeout and the connection retry interval on the LDAP server entry.

A FortiGate has a valid FortiGuard web filtering license, but all rating requests time out and users see unrated websites. The FortiGate currently uses UDP port 8888 for rating requests. The upstream firewall permits only outbound TCP port 443 to the internet. Which configuration change allows the FortiGate to retrieve website ratings?

• AA. Set webfilter-cache-ttl to 3600 under config system fortiguard
• BB. Enable error-allow in the FortiGuard category based filter options of the web filter profile
• CC. Set protocol to https and port to 443 under config system fortiguard
• DD. Set update-server-location to usa under config system fortiguard

Which command displays CPU usage, memory usage, and average network usage of a FortiGate in a single summary?

• AA. diagnose hardware sysinfo conserve
• BB. diagnose sys session stat
• CC. diagnose sys top
• DD. get system performance status

Refer to the exhibit, which shows partial output of an IKE real-time debug on a FortiGate that is the responder for the Branch-1 tunnel. Exhibit: ike 0:Branch-1:5: responder: main mode get 1st message... ike 0:Branch-1:5: incoming proposal: ike 0:Branch-1:5: proposal id = 1: ike 0:Branch-1:5: protocol id = ISAKMP: ike 0:Branch-1:5: trans_id = KEY_IKE. ike 0:Branch-1:5: encapsulation = IKE/none ike 0:Branch-1:5: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=256 ike 0:Branch-1:5: type=OAKLEY_HASH_ALG, val=SHA2_256. ike 0:Branch-1:5: type=AUTH_METHOD, val=PRESHARED_KEY. ike 0:Branch-1:5: type=OAKLEY_GROUP, val=MODP2048. ike 0:Branch-1:5: ISAKMP SA lifetime=86400 ike 0:Branch-1:5: my proposal, gw Branch-1: ike 0:Branch-1:5: proposal id = 1: ike 0:Branch-1:5: protocol id = ISAKMP: ike 0:Branch-1:5: trans_id = KEY_IKE. ike 0:Branch-1:5: encapsulation = IKE/none ike 0:Branch-1:5: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=256 ike 0:Branch-1:5: type=OAKLEY_HASH_ALG, val=SHA2_256. ike 0:Branch-1:5: type=AUTH_METHOD, val=PRESHARED_KEY. ike 0:Branch-1:5: type=OAKLEY_GROUP, val=MODP1536. ike 0:Branch-1:5: ISAKMP SA lifetime=86400 ike 0:Branch-1:5: no proposal chosen What is causing the phase 1 negotiation to fail?

• AA. The local phase 1 proposal does not include the Diffie-Hellman group that the remote peer offers.
• BB. The ISAKMP SA lifetime offered by the remote peer exceeds the maximum lifetime the local gateway allows.
• CC. The remote peer initiated main mode while the local gateway accepts only aggressive mode negotiations.
• DD. The pre-shared key configured on the local gateway does not match the key configured on the remote peer.

A server at 10.50.1.10 accepts ICMP only from the 10.1.1.0/24 subnet. Hosts in that subnet can ping the server, but execute ping 10.50.1.10 on the FortiGate fails because the packets use the egress interface IP address as the source. The internal interface port3 has the IP address 10.1.1.1/24. Which command should the administrator run before the ping to test the path with a source address that the server accepts?

• AA. execute ping-options ttl 64
• BB. execute ping-options source 10.1.1.1
• CC. execute ping-options df-bit yes
• DD. execute ping-options repeat-count 10