Refer to the exhibit, which shows the packet capture output of a three-way handshake between FortiGate and FortiManager Cloud.What two conclusions can you draw from the exhibit? (Choose two.)
Answer(s): A,D
Refer to the exhibit, which shows a LAN interface connected from FortiGate to two FortiSwitch devices.What two conclusions can you draw from the corresponding LAN interface? (Choose two.)
Answer(s): B,C
The diagram shows a FortiGate connected to two FortiSwitches, which suggests the use of FortiLink, Fortinet's protocol for managing switches directly from a FortiGate. Since multiple connections are being used, the LAN interface must be set to 802.3ad (LAG) mode to aggregate the links for redundancy and load balancing.This setup allows FortiGate to handle VLAN assignments dynamically, as seen with VLAN 10 (192.168.15.1/24). FortiLink ensures seamless integration between FortiGate and FortiSwitches, making STP unnecessary because Fortinet's MCLAG prevents loops at Layer 2. SD-WAN, on the other hand, is used for WAN interfaces and does not apply to switch connectivity in this scenario.
Refer to the exhibit, which shows the HA status of an active-passive cluster.An administrator wants FortiGate_B to handle the Core2 VDOM traffic.Which modification must the administrator apply to achieve this?
Answer(s): D
The exhibit shows an active-passive HA (high availability) cluster with two virtual clusters, where FortiGate_A is the primary device for both Core1 and Core2. If the goal is to have FortiGate_B take over Core2 traffic, its priority must be higher than FortiGate_A for Virtual Cluster 2.Currently, FortiGate_A has a priority of 150 for Core2, while FortiGate_B has 128. Increasing FortiGate_B’s priority to 200 ensures it becomes the primary for Virtual Cluster 2, taking over the Core2 VDOM traffic while keeping Core1 traffic on FortiGate_A.Disabling override would prevent forced failovers but wouldn’t change the role distribution. Adjusting the load-balancing method is irrelevant in an active-passive setup, as it only applies to active-active configurations.
During the maintenance window, an administrator must sniff all the traffic going through a specific firewall policy, which is handled by NP6 interfaces. The output of the sniffer trace provides just a few packets.Why is the output of sniffer trace limited?
Answer(s): B
FortiGate devices with NP6 (Network Processor 6) acceleration offload traffic directly to hardware, bypassing the CPU for improved performance. When auto-asic-offload is enabled in a firewall policy, most of the traffic does not reach the CPU, which means it won't be captured by the standard sniffer trace command.Since NP6-accelerated traffic is handled entirely in hardware, only a small portion of initial packets (such as session setup packets or exceptions) might be seen in the sniffer output. To capture all packets, the administrator must disable hardware offloading using:config firewall policy edit <policy_ID>set auto-asic-offload disable endDisabling ASIC offload forces traffic to be processed by the CPU, allowing the sniffer tool to capture all packets.
Refer to the exhibit, which shows a network diagram.An administrator would like to modify the MED value advertised from FortiGate_1 to a BGP neighbor in the autonomous system 30.What must the administrator configure on FortiGate_1 to implement this?
Answer(s): A
The Multi-Exit Discriminator (MED) is a BGP attribute used to influence the preferred path for incoming traffic from an external autonomous system (AS). The diagram shows that FortiGate_1 advertises MED 200, while FortiGate_2 advertises MED 300, meaning the ISP will prefer the route through FortiGate_1 because a lower MED is preferred in BGP.To modify the MED value on FortiGate_1 for routes advertised to AS 30, the administrator must configure a route-map-out. A route map can match specific routes and set the MED value before sending them to the BGP neighbor.
Post your Comments and Discuss Fortinet FCSS_EFW_AD-7.6 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the FCSS_EFW_AD-7.6 content, but please register or login to continue.