Free FCSS_NST_SE-7.6: FCSS - Network Security 7.6 Support Engineer Exam Questions and Answers

An administrator creates an automation stitch with an Event Log trigger for configuration changes and an Email action. The action has Minimum interval set to 3600 seconds. During a maintenance window, the administrator changes the configuration every 10 minutes for 90 minutes, but the mailbox receives only two emails. The email server settings on the FortiGate are correct and the stitch is enabled. What explains this result?

• AA. The email server rejects repeated messages with the same subject line sent within one hour.
• BB. FortiOS disables the stitch after two consecutive executions until an administrator enables it again.
• CC. The minimum interval prevents the action from running again until 3600 seconds after its last execution.
• DD. The Event Log trigger fires once for each administrator login session, regardless of the number of changes.

A FortiGate 200F intermittently enters conserve mode. During the next event, the administrator wants to see the overall memory usage percentage and identify which processes consume the most memory. Which two commands should the administrator run? (Choose two.)

Select 2 answers.

• AA. diagnose sys session stat
• BB. diagnose debug crashlog read
• CC. get system performance status
• DD. diagnose sys top-mem

A new eBGP neighbor on FGT-A does not come up. The administrator collects the following output. Exhibit: FGT-A # get router info bgp summary VRF 0 BGP router identifier 10.255.1.1, local AS number 65001 BGP table version is 1 1 BGP AS-PATH entries 0 BGP community entries Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 10.1.1.2 4 65002 0 0 0 0 0 never Active Total number of neighbors 1 FGT-A # diagnose sniffer packet port2 'tcp port 179' 4 2.114 port2 out 10.1.1.1.52341 -> 10.1.1.2.179: syn 3481829010 2.115 port2 in 10.1.1.2.179 -> 10.1.1.1.52341: rst 0 ack 3481829011 What can you conclude from the output?

• AA. A firewall policy on the peer silently drops the TCP SYN packets sent by FGT-A.
• BB. The peers disagree on the MD5 password, so the peer resets the session after the OPEN message.
• CC. The eBGP packets expire before they reach the peer because the default TTL is too low.
• DD. The peer is reachable but rejects the TCP session on port 179, so it has no matching neighbor or listener.

A collector agent in advanced mode reports logons to FortiGate, but the user jsmith at 10.20.5.41 does not match the firewall policy that uses the user group Sales-FSSO. The group contains the FSSO group CORP/SALES, which was added manually. Refer to the exhibit. Exhibit: FGT-A # diagnose debug authd fsso list ----FSSO logons---- IP: 10.20.5.41 User: jsmith Groups: CN=SALES,OU=Groups,DC=corp,DC=example,DC=com Workstation: WS-0141.corp.example.com Total number of logons listed: 1, filtered: 0 Why does the traffic from 10.20.5.41 not match the policy?

• AA. The logon reports the group in LDAP format, but the policy group uses the NetBIOS format.
• BB. The workstation check failed, so FortiGate marked the logon as not verified.
• CC. The collector agent heartbeat to FortiGate timed out, so the logon entry is stale.
• DD. The collector agent filtered out the logon because the user belongs to an ignored group.

Refer to the exhibit. FGT-Edge # show router static config router static edit 1 set gateway 203.0.113.1 set device "port1" set priority 20 next edit 2 set gateway 198.51.100.1 set device "port2" set priority 5 next end Both routes use the default administrative distance. Both interfaces are up and the gateways are reachable. Which interface does FortiGate use for new sessions to the internet?

• AA. port1, because the route with the higher priority value is preferred
• BB. Both port1 and port2, because the routes have equal distance and ECMP applies
• CC. port2, because the route with the lower priority value is preferred
• DD. port1, because the route with the lower sequence ID is preferred

Refer to the exhibit, which shows an IKE real-time debug collected on the FortiGate at 198.51.100.2 while a remote peer tries to bring up the tunnel. ike 0: comes 203.0.113.9:500->198.51.100.2:500,ifindex=3,vrf=0.... ike 0: IKEv1 exchange=Identity Protection id=a1b2c3d4e5f60718/0000000000000000 len=324 ike 0:Branch-HQ:41: responder: main mode get 1st message... ike 0:Branch-HQ:41: responder: main mode get 2nd message... ike 0:Branch-HQ:41: responder: main mode get 3rd message... ike 0:Branch-HQ:41: PSK auth failed: probable pre-shared secret mismatch ike 0:Branch-HQ:41: negotiation failure Which action resolves the problem?

• AA. Change the phase 1 mode to aggressive on both FortiGate devices.
• BB. Configure the same pre-shared key on both FortiGate devices.
• CC. Enable NAT traversal on both FortiGate devices.
• DD. Match the Diffie-Hellman group in the phase 1 proposals on both devices.

Refer to the exhibits. Exhibit A: FGT # diagnose test authserver radius RADIUS-1 pap jsmith ******** authenticate 'jsmith' against 'pap' succeeded, server=primary assigned_rad_session_id=1814229441 session_timeout=0 secs idle_timeout=0 secs Group membership(s) - Engineering Exhibit B: config user group edit "Staff-VPN" set member "RADIUS-1" config match edit 1 set server-name "RADIUS-1" set group-name "Staff" next end next end An administrator tests the RADIUS server and authentication succeeds. However, when the user jsmith connects, FortiGate does not match the user to the firewall policy that uses the Staff-VPN group. What is the reason?

• AA. The RADIUS server rejects the PAP authentication method, so FortiGate falls back to the local user database
• BB. The group name returned by the RADIUS server does not match the group name configured in the match entry
• CC. The shared secret on the RADIUS server entry does not match the secret configured on the RADIUS server
• DD. The Staff-VPN group sends the request to a secondary RADIUS server that does not know the user jsmith

Refer to the exhibit. FGT # diagnose sniffer packet any 'host 10.10.5.20 and udp port 1812' 4 interfaces=[any] 3.114420 port3 out 10.1.1.1.37213 -> 10.10.5.20.1812: udp 120 8.114851 port3 out 10.1.1.1.37213 -> 10.10.5.20.1812: udp 120 13.115230 port3 out 10.1.1.1.37213 -> 10.10.5.20.1812: udp 120 Administrator logins that use the RADIUS server 10.10.5.20 time out. The RADIUS server logs show no entries for these requests. The server accepts requests only from the client address 10.200.1.1, which is the loopback interface of the FortiGate. Which change fixes the issue?

• AA. Set the source-ip of the RADIUS server entry to 10.200.1.1
• BB. Change the authentication method of the RADIUS server entry from the default to CHAP
• CC. Increase the timeout value of the RADIUS server entry to 15 seconds
• DD. Set the RADIUS server port to 1645 on the RADIUS server entry

A FortiGate 100F shows sustained high CPU usage. The administrator wants to see how CPU time is divided between user, system and softirq, and to identify the processes that use the most CPU. Which two commands should the administrator run? (Choose two.)

Select 2 answers.

• AA. diagnose hardware sysinfo memory
• BB. diagnose sys session stat
• CC. diagnose sys top 2 30
• DD. get system performance status

Which setting in config ips global allows traffic to pass without IPS inspection when the IPS engine is overloaded or fails?

• AA. set sync-session-ttl enable
• BB. set fail-open enable
• CC. set database regular
• DD. set engine-count 0