Free FCSS-EFW-AD-7-4 sample questions

Correct answer: False

This statement is false. While session pickup synchronizes TCP sessions, it does not synchronize connectionless sessions like UDP and ICMP by default. These sessions will be dropped and must be re-established after a failover. For some specific protocols like SIP, session helpers can assist, but it is not a universal guarantee for all session types.

Correct answer: Add the FQDNs of the healthcare services to the 'Exempt from SSL Inspection' list within the specific SSL/SSH Inspection profile.

The correct and most direct method is to add the fully qualified domain names (FQDNs) of the problematic services to the exemption list within the SSL/SSH Inspection profile itself. This allows the firewall policy to remain simple while giving granular control over which destinations are bypassed by the deep inspection engine.

Correct answer: It will only use Route 1 because it has the lower priority value.

In FortiOS, when two static routes have the same destination and administrative distance, the route with the lower priority value is considered superior and will be installed as the active route in the routing table. The higher priority route will only be used if the lower priority route becomes inactive.

Correct answer: Assign a specific NP7 processor to the 'Guest-WiFi' VDOM using the `vdom-npu-affinity` command.

On FortiGate models with multiple NP7 processors, you can dedicate specific processors to particular VDOMs. By using the `config global` and `config system npu` CLI commands to set `vdom-npu-affinity`, the administrator can bind the 'Guest-WiFi' VDOM to a specific NP7, ensuring its traffic is prioritized for hardware acceleration by that processor.

Correct answer: The administrator's profile is missing the 'Script Management' permission in their assigned access profile.

In FortiManager, permissions are granular. Even with Super_User rights within an ADOM, the administrator's overall access profile must explicitly grant permissions for 'Script Management'. Without this specific permission, the administrator cannot create, edit, or run scripts, resulting in a 'permission denied' error.

Correct answer: The `auto-negotiate` setting is disabled in the Phase 2 configuration.

When `auto-negotiate` is disabled, the FortiGate will not attempt to bring the tunnel up automatically after it goes down (for example, due to lifetime expiration). It will wait for interesting traffic to trigger the negotiation. Since the disconnection happens overnight when traffic is low, the tunnel remains down. Enabling `auto-negotiate` ensures the FortiGate proactively re-establishes the tunnel.

Correct answer: In FortiAnalyzer, create an event handler to mark these specific events as acknowledged upon arrival.

The best approach is to use a FortiAnalyzer event handler. An event handler can be configured to automatically process incoming logs that match specific criteria (like the IPS signature ID). It can then perform an action, such as marking the event as acknowledged or changing its severity, which effectively hides it from the default alert views without deleting the log data. This preserves visibility for forensic purposes while cleaning up the active monitoring console.

Correct answers: Configure an Inter-VDOM link (NPV/NPU VDOM link).; Physically connect two interfaces of the FortiGate with an Ethernet cable, assigning one to each VDOM.

Traffic between VDOMs on the same device can be routed either virtually using an inter-VDOM link (a software or hardware-accelerated connection) or physically by connecting two ports with a cable and assigning each port to a different VDOM. The inter-VDOM link is the more common and efficient method.

Correct answer: To store device-specific information like IP addresses or hostnames that can be referenced in a generic template.

Metadata variables act as placeholders in a provisioning template. They allow you to create a single, generic configuration template that can be applied to many devices, while the variables are dynamically replaced with unique values (such as IP address, hostname, location) defined for each specific device in FortiManager.

Correct answer: A firewall or upstream router is blocking UDP port 500 or 4500.

The IKE_SA_INIT message is the very first packet in the IKEv2 exchange, sent over UDP port 500. If the remote peer does not respond at all, it almost always indicates a connectivity issue. The most common cause is a firewall policy on the local or remote side, or an upstream network device (like an ISP router), blocking the IKE (UDP 500) or NAT-T (UDP 4500) ports.