Online Access Free FCSS_NST_SE-7.6 Exam Questions

Refer to the exhibit, which shows one way communication of the downstream FortiGate with the upstream FortiGate within a Security Fabric.

What three actions must you take to ensure successful communication? (Choose three.)

• A.Ensure TCP port 8013 is not blocked along the way.
• B.FortiGate must not be in NAT mode.
• C.Ensure the port for Neighbor Discovery has been changed.
• D.You must enable Security Fabric/Fortitelemetry on the receiving interface of the upstream FortiGate.
• E.You must authorize the downstream FortiGate on the root FortiGate.

Refer to the exhibits, which contain the partial configurations of two VPNs on FortiGate.

An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovers that FortiGate is not matching the user-2 VPN for members of the Users-2 group.
Which two changes must the administrator make to fix the issue? (Choose two.)

• A.Use different pre-shared keys on both VPNs.
• B.Enable XAuth on both VPNs.
• C.Change to aggressive mode on both VPNs.
• D.Set up specific peer IDs on both VPNs.

Refer to the exhibit, which shows the output of diagnose sys session list.

If the HA ID for the primary device is 0, what happens if the primary fails and the secondary becomes the primary?

• A.The session will be removed from the session table of the secondary device because of the presence of allowed error packets, which will force the client to restart the session with the server.
• B.The secondary device has this session synchronized; however, because application control is applied, the session is marked dirty and has to be re-evaluated after failover.
• C.Traffic for this session continues to be permitted on the new primary device after failover, without requiring the client to restart the session with the server.
• D.The session state is preserved but the kernel will need to re-evaluate the session because NAT was applied.

Refer to the exhibits.

An administrator Is expecting to receive advertised route 8.8.8.8/32 from FGT-A. On FGT-B, they confirm that the route is being advertised and received, however, the route is not being injected into the routing table.
What is the most likely cause of this issue?

• A.A batter route to the 8.8.8.8/32 network exists in the routing table.
• B.FGT-B is configured with a prefix list denying the 8.8.8.8/32 network to be injected into the routing table.
• C.FGT-8 is configured with a distribution list denying the 8.8.8.8/32 network to be injected into the routing table.
• D.The administrator has misconfigured redistribution of routes on FGT-A.

Refer to the exhibit.

An IPsec VPN tunnel is dropping, as shown by the debug output.
Analyzing the debug output, what could be causing the tunnel to go down?

• A.The tunnel drops after the timer expires.
• B.The tunnel drops during rekey negotiation.
• C.Phase 2 drops but Phase 1 is up.
• D.Dead Peer Detection is not receiving its acknowledge packet.