Fortinet FCSS - Enterprise Firewall 7.6 Administrator - FCSS_EFW_AD-7.6 FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

In which two ways does FortiGate utlize the Internet Service Database (ISDB) within firewall policies and SD-WAN rules? (Choose two.)

A. The ISDB limits access by URL and domain. B. The ISDB works in proxy mode, allowing the analysis of packets in layers 3 and 4 of the OSI model. C. The ISDB blocks the IP addresses and ports of an application predefined by FortiGuard. D. FortiGate has a predefined list of all IP addresses and ports for specific applications downloaded from FortiGuard.

Discussion 0

Correct Answer: C,D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 2

The IT department discovered during the last network migration that all zero phase selectors in phase 2 IPsec configurations impacted network operations. What are two valid approaches to prevent this during future migrations? (Choose two.)

A. Clearly indicate to the VPN which segments will be encrypted in the phase two selectors. B. Configure an IPsec-aggregate to create redundancy between each firewall peer. C. Configure an IP address on the IPsec interface of each firewall to establish unique peer connections and avoid impacting network operations. D. Use routing protocols to specify allowed subnets over the tunnel.

Discussion 0

Correct Answer: A,D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 3

How do you resolve object conflicts when importing a policy package?

A. Non-default B. FortiManager accept C. Rename D. Retrieve config

Discussion 0

Correct Answer: B Vote an answer

Question 4

A company's guest internet policy, operating in proxy mode, blocks access to Artificial Intelligence Technology sites using FortiGuard. However, a guest user accessed a page in this category using port 8443.
Which configuration changes are required for FortiGate to analyze HTTPS traffic on nonstandard ports like 8443 when full SSL inspection is active in the guest policy?

A. To analyze nonstandard ports in web filter profiles, use TLSv1.3 in the SSL/SSH Inspection Profile. B. In the Protocol Port Mapping section of the SSL/SSH Inspection Profile, enter 443, 8443 to analyze both standard (443) and non-standard (8443) HTTPS ports. C. Administrators can block traffic on nonstandard ports by enabling the SNI check in the SSL/SSH Inspection Profile. D. Add a URL wildcard domain to the website CA certificate and use it in the SSL/SSH Inspection Profile.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 5

A user reports that their computer was infected with malware after accessing a secured HTTPS website. However, when the administrator checks the FortiGate logs, they do not see that the website was detected as insecure despite having an SSL certificate and correct profiles applied on the policy.
How can an administrator ensure that FortiGate can analyze encrypted HTTPS traffic on a website?

A. The administrator must enable URL extraction from SNI on the SSL certificate inspection to ensure the TLS three-way handshake is correctly analyzed by FortiGate. B. The administrator must enable reputable websites to allow only SSL/TLS websites rated by FortiGuard web filter. C. The administrator must enable DNS over TLS to protect against fake Server Name Indication (SNI) that cannot be analyzed in common DNS requests on HTTPS websites. D. The administrator must enable full SSL inspection in the SSL/SSH Inspection Profile to decrypt packets and ensure they are analyzed as expected.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 6

Refer to the exhibit. The routing tables of FortiGate_A and FortiGate_B are shown. FortiGate_A and FortiGate_B are in the same autonomous system.

The administrator wants to dynamically add only route 172.16.1.248/30 on FortiGate_A.
What must the administrator configure?

A. The prefix 172.16.1.248/30 in the BGP Networks section on FortiGate_B B. A BGP route map in for 172.16.1.248/30 on FortiGate_A C. Enable Redistribute Connected in the BGP section on FortiGate_B. D. A BGP route map out for 172.16.1.248/30 on FortiGate_B

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 7

Which statement about meta fields is true?

A. Meta fields are useful for creating multiple objects with the same logical name but different values. B. Meta fields can be used as variables in scripts or provisioning templates. C. Meta fields must be set to required. D. Meta field changes are applied only at the ADOM level.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 8

Which two statements about the LAN interface connection are correct?

A. SD-WAN B. 802.3ad C. Enable STP D. FortiLink

Discussion 0

Correct Answer: B,D Vote an answer

Question 9

Why is the web filter database version not shown in the FortiGuard Security Services dashboard?

A. Flow mode disables the database B. The database failed to update C. The web filter database is cloud hosted D. FortiGate does not support web filtering

Discussion 0

Correct Answer: C Vote an answer

Question 10

Which two configurations are mandatory for an auto-discovery VPN (ADVPN) implementation on a hub? (Choose two.)

A. The remote-ip must be on a different IP address from the overlay subnet. B. An overlay IP address with a mask of /32 must be assigned to the IPsec virtual interface. C. set net-device must be disabled to avoid dynamic interface creation. D. set add-route must be enabled to add routes.

Discussion 0

Correct Answer: B,C Vote an answer

Question 11

You need an internal segmentation firewall (ISFW) FortiGate for a campus with an ultralow latency interface. Which FortiGate should you select?

A. FortiGate with only one NP6. B. FortiGate with ports X5 to X8. C. FortiGate with ports connected to a SP5. D. FortiGate with ports connected to a CP10.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 12

Why do the firewall policy and reinstall preview show different address names during installation?

A. Policy conflict B. Object corruption C. Address mismatch D. Per-device mapping

Discussion 0

Correct Answer: D Vote an answer