Free Fortinet FCSS_EFW_AD-7.6 Exam Questions

Question 1

How does configuring tcp-mss-sender and tcp-mss-receiver affect TCP packets?

A : Header

B : Payload

C : Allow

D : Fragment

Answer: B

Question 2

Refer to the exhibit, which shows a partial troubleshooting command output.An administrator is extensively using IPsec on FortiGate. Many tunnels show information similar to the output shown in the exhibit. What can the administrator conclude?

A : IPsec SAs cannot be offloaded.

B : The two IPsec SAs, inbound and outbound, are copied to the NPU.

C : Only the outbound IPsec SA is copied to the NPU.

D : Only the inbound IPsec SA is copied to the NPU.

Answer: B

Question 3

Refer to the exhibit, which shows a partial troubleshooting command output.An administrator is extensively using IPsec on FortiGate. Many tunnels show information similar to the output shown in the exhibit. What can the administrator conclude?

A : IPsec SAs cannot be offloaded.

B : The two IPsec SAs, inbound and outbound, are copied to the NPU.

C : Only the outbound IPsec SA is copied to the NPU.

D : Only the inbound IPsec SA is copied to the NPU.

Answer: B

Question 4

Which hardware improves VXLAN performance?

A : CPU

B : NTurbo

C : CP10

D : NPU7

Answer: D

Question 5

A user reports that their computer was infected with malware after accessing a secured HTTPS website. However, when the administrator checks the FortiGate logs, they do not see that the website was detected as insecure despite having an SSL certificate and correct profiles applied on the policy. How can an administrator ensure that FortiGate can analyze encrypted HTTPS traffic on a website?

A : The administrator must enable reputable websites to allow only SSL/TLS websites rated by FortiGuard web filter.

B : The administrator must enable URL extraction from SNI on the SSL certificate inspection to ensure the TLS three-way handshake is correctly analyzed by FortiGate.

C : The administrator must enable DNS over TLS to protect against fake Server Name Indication (SNI) that cannot be analyzed in common DNS requests on HTTPS websites.

D : The administrator must enable full SSL inspection in the SSL/SSH Inspection Profile to decrypt packets and ensure they are analyzed as expected.

Answer: D