Fortinet FCSS_NST_SE-7.4 Exam Practice Test Instant Access

Question 1

Which two statements are true regarding heartbeat messages sent from an FSSO collector agent to FortiGate? (Choose two.)

AThe heartbeat messages can be seen using the command diagnose debug authd fsso list.

BThe heartbeat messages can be seen in the collector agent logs.

CThe heartbeat messages can be seen on FortiGate using the real-lime FSSO debug.

DThe heartbeat messages must be manually enabled on FortiGate.

Answer : B, C

Question 2

Exhibit.

Refer to the exhibit, which contains a screenshot of some phase 1 settings.

The VPN is not up. To diagnose the issue, the administrator enters the following CLI commands on an SSH session on FortiGate:

However, the IKE real-time debug does not show any output. Why?

AThe administrator must also run the command diagnose debug enable.

BThe debug shows only error messages. If there is no output, then the phase 1 and phase 2 configurations match.

CThe log-filter setting is incorrect. The VPN traffic does not match this filter.

DReplace diagnose debug application ike -1 with diagnose debug application ipsec -1.

Answer : A

Question 3

Which two statements about an auxiliary session ate true? (Choose two.)

AWith the auxiliary session selling disabled, only auxiliary sessions are offloaded.

BWith the auxiliary session setting enabled. ECMP traffic is accelerated to the NP6 processor.

CWith the auxiliary session setting enabled. Iwo sessions are created in case of routing change.

DWith the auxiliary session setting disabled, for each traffic path. FortiGate uses the same auxiliary session.

Answer : B, C

Question 4

Refer to the exhibit, which shows the output of a BGP debug command.

What can you conclude about the router in this scenario?

AThe router 100.64.3.1 needs to update the local AS number in its BGP configuration in order to bring up the 8GP session with the local router.

BAn inbound route-map on local router is blocking the prefixes from neighbor 100.64.3.1.

CAll of the neighbors displayed are part of a single BGP configuration on the local router with the neighbor-range set to a value of 4.

DThe BGP session with peer 10.127.0.75 is up.

Answer : D

Question 5

Refer to the exhibits.

An administrator Is expecting to receive advertised route 8.8.8.8/32 from FGT-

AOn FGT-B, they confirm that the route is being advertised and received, however, the route is not being injected into the routing table. What is the most likely cause of this issue?

AA batter route to the 8.8.8.8/32 network exists in the routing table.

BFGT-B is configured with a prefix list denying the 8.8.8.8/32 network to be injected into the routing table.

CThe administrator has misconfigured redistribution of routes on FGT-A.

DFGT-8 is configured with a distribution list denying the 8.8.8.8/32 network to be injected into the routing table.

Answer : B

Question 6

An administrator wants to capture encrypted phase 2 traffic between two FotiGate devices using the built-in sniffer.

If the administrator knows that there Is no NAT device located between both FortiGate devices, which command should the administrator run?

Adiagnose sniffer packet any 'udp port 500'

Bdiagnose sniffer packet any 'lp proto 50'

Cdiagnose sniffer packet any 'udp port 4500'

Ddiagnose sniffer packet any 'ah'

Answer : B

Question 7

Refer to the exhibit, which shows a partial output of the fssod daemon real-time debug command.

What two conclusions can you draw Itom the output? (Choose two.)

AThe workstation with IP 10.124.2.90 will be polled frequently using TCP port 445 to see if the user is still logged on.

BThe logon event can be seen on the collector agent installed on Windows.

CFSSO is using DC agent mode to detect logon events.

DFSSO is using agentless polling mode to detect logon events.

Answer : A, D

Fortinet FCSS_NST_SE-7.4 FCSS - Network Security 7.4 Support Engineer Exam Practice Test