Free FCSS-NST-SE-7.6 sample questions

Correct answer: The configured Bind Type on the FortiGate's LDAP settings is incorrect for the LDAP server.

The error `Authentication method not supported` from `fnbamd` during an LDAP authentication attempt typically indicates a mismatch in the authentication or bind method between the FortiGate and the LDAP server. For example, the FortiGate might be configured for `Simple` bind when the server requires `Regular`, or vice-versa. An incorrect password would result in a credentials error, and a certificate issue would cause a TLS handshake failure, not this specific message.

Correct answer: False

False. IPsec VPN tunnel processing is handled by the `iked` daemon for control plane (IKE negotiations) and the kernel (`ksoftirqd`) for data plane (encryption/decryption). While `diagnose sys top` can show high CPU usage from these processes, it does not break down the usage per individual tunnel. To troubleshoot a specific tunnel's performance, you would need to use other tools like `diagnose vpn tunnel list` and specific debugs, not `diagnose sys top` for a per-tunnel PID.

Correct answer: The Security Rating feature is disabled by default on FortiGate models with 2GB of RAM or less in FortiOS 7.6.

In FortiOS 7.6, to improve stability and performance on entry-level models, features like Security Rating and Topology visibility are disabled on FortiGates with 2GB of RAM or less. The FortiGate 60F falls into this category. Therefore, it will not run Security Rating checks or send results to the root FortiGate, explaining the missing data.

Correct answer: SSL inspection is not enabled, and the FortiGate is blocking the site based on the category of the SNI in the TLS handshake.

Without deep inspection, the FortiGate cannot see the HTTPS URL. For flow-based web filtering it rates the hostname from the SNI in the TLS Client Hello, or the server certificate's CN when there is no SNI. If the site is served under a hostname (for example a CDN or shared hosting name) whose FortiGuard category differs from the category the administrator checked, the session is blocked by that other category. The log's category field shows which one. If 'Rate URLs by domain and IP address' is enabled, the IP rating can also override the domain rating by weight. Checking the category in the log, adding a local rating or URL filter exemption, or using deep inspection so the full URL is rated resolves the discrepancy. (FortiOS 7.6 Administration Guide: Configuring a web filter profile; Rating options.)

Correct answers: diagnose ip arp list; execute ping

If a static route is in the routing table but traffic is not forwarded, check whether the next hop is actually reachable at Layer 2 and Layer 3. `diagnose ip arp list` shows whether the FortiGate has resolved the gateway's MAC address; an incomplete or missing entry points to a Layer 2 or addressing problem. `execute ping ` tests Layer 3 reachability of the gateway directly. `get router info routing-table all` only confirms what is already known (the route is present). `get system performance status` shows resource usage, and `diagnose debug flow` traces a packet's policy and route decisions rather than gateway reachability.

If a static route is in the routing table but traffic is not forwarded, check whether the next hop is actually reachable at Layer 2 and Layer 3. `diagnose ip arp list` shows whether the FortiGate has resolved the gateway's MAC address; an incomplete or missing entry points to a Layer 2 or addressing problem. `execute ping ` tests Layer 3 reachability of the gateway directly. `get router info routing-table all` only confirms what is already known (the route is present). `get system performance status` shows resource usage, and `diagnose debug flow` traces a packet's policy and route decisions rather than gateway reachability.

Correct answer: diagnose test application autod 3

`diagnose test application autod 3` displays statistics for all automation stitches: how many times each stitch was triggered (local hit), the last trigger time, and each action's `done`/`drop` counters. It shows which stitches ran and whether their actions succeeded or failed. `diagnose automation stitch-history`, `diagnose automation stitch-trace` and `diagnose sys csf-log` aren't FortiOS commands, and `get system automation stitch` doesn't show execution history. Reference: FortiOS 7.6 Administration Guide, Diagnosing automation stitches.

Correct answer: Dead Peer Detection (DPD) is disabled on one side but enabled as 'On Idle' on the other.

When Dead Peer Detection (DPD) is configured as 'On Idle' on one FortiGate, it will only send DPD probes when there is no outbound traffic to send. If the other side has DPD disabled, it will not respond to these probes. After a few failed probes, the 'On Idle' FortiGate will tear down the tunnel, assuming the peer is dead. If there is periodic keep-alive or monitoring traffic, the tunnel will re-establish, creating a flapping cycle. A DPD timer mismatch would not typically cause this issue, and Phase 2 lifetime expiry would be on a much longer interval (usually hours).

Correct answer: A mismatch in the interface MTU settings.

The `ExStart` state is where OSPF routers decide which router will be the master for exchanging Database Descriptor (DBD) packets. If the routers have different interface MTU values, the larger DBD packets from the router with the higher MTU will be dropped by the router with the lower MTU. This prevents the DBD exchange from completing, causing the adjacency to be stuck in `ExStart`. Timer mismatches would prevent the state from even reaching `2-Way`, and area ID or authentication mismatches would also cause earlier failures.

Correct answer: `diagnose test application ipsmonitor 5`

The ipsmonitor test menu offers: 1 = display IPS engine information, 2 = toggle IPS engine enable/disable status, 3 = display restart log, 4 = clear restart log, 5 = toggle bypass status, 97/98/99 = start/stop/restart all IPS engines. `diagnose test application ipsmonitor 5` therefore toggles IPS bypass. It is a quick, reversible way to confirm whether the IPS engine is behind the CPU load and latency, and it leaves the policy configuration unchanged. Option 99 restarts all IPS engines, which the Fortinet Community article on IPS memory optimization uses after changing IPS global settings. Option 1 only shows engine information, and option 3 shows the restart log. Run the same command again to leave bypass mode.

Correct answer: The 'Sales_Users' group is not included in the 'Monitored Groups' list on the FSSO Collector Agent.

The Collector Agent can apply a group filter (Set Group Filters > Monitored groups) per FortiGate. Once a filter is configured, logon events for users who are not in a monitored group are received from the DC Agent but not forwarded to that FortiGate. If the filter lists 'Domain Admins' but not 'Sales_Users', only the Domain Admins users appear. With no filter configured, all groups are forwarded. The fix is to add 'Sales_Users' to the monitored groups (Fortinet Community: Configure FSSO in DC Agent mode / FSSO Group Filter configured on Collector Agent).