Fortinet NSE6_FWF-6.4 Exam Practice Test Instant Access

Question 1

Which statement is correct about security profiles on FortiAP devices?

ASecurity profiles are only supported on Bridge-mode SSIDs.

BSecurity profiles can only be applied via firewall policies on the FortiGate.

CSecurity profiles can only be applied to unencrypted wireless traffic.

DSecurity profiles on FortiAP devices can use FortiGate subscription to inspect the traffic.

Answer : D

Security profiles are a feature that allows FortiAP devices to apply various security functions to the wireless traffic, such as antivirus, web filter, application control, intrusion prevention, and botnet scanning. Security profiles can be enabled on both tunnel-mode and bridge-mode SSIDs, and can be applied either through the wireless controller configuration or through firewall policies on the FortiGate device. Security profiles can also inspect encrypted wireless traffic, as long as the FortiAP device has access to the encryption keys.

Security profiles on FortiAP devices can use FortiGate subscription services to inspect the traffic, such as FortiGuard Antivirus, FortiGuard Web Filter, FortiGuard Application Control, and FortiGuard IPS. This means that the FortiAP device can leverage the latest threat intelligence and updates from Fortinet to protect the wireless network from malicious or unwanted content.

Therefore, the correct answer is D. Security profiles on FortiAP devices can use FortiGate subscription to inspect the traffic.

FortiAP-S and FortiAP-U bridge mode security profiles

Configuring security | FortiAP / FortiWiFi 6.4.2

Security profiles - Fortinet Document Library

Question 2

Which statement is correct about security profiles on FortiAP devices?

ASecurity profiles can only be applied to unencrypted wireless traffic.

BSecurity profiles can only be applied via firewall policies on the FortiGate.

CSecurity profiles are only supported on Bridge-mode SSIDs.

DSecurity profiles on FortiAP devices can use FortiGate subscription to inspect the traffic.

Answer : D

Security profiles on FortiAP devices can use FortiGate subscription to inspect the traffic, such as antivirus, web filtering, application control, and IPS. This feature is called local bridging and it allows the FortiAP to forward traffic to the FortiGate for security inspection before sending it to the destination network. This reduces the bandwidth consumption and latency of tunnel mode SSIDs. Reference:Secure Wireless LAN Course Description, page 9; [FortiOS 6.4.0 Handbook - Wireless Controller], page 46.

Question 3

Which statement is correct about security profiles on FortiAP devices?

ASecurity profiles on FortiAP devices can use FortiGate subscription to inspect the traffic

BOnly bridge mode SSIDs can apply the security profiles

CDisable DTLS on FortiAP

DFortiGate performs inspection the wireless traffic

Answer : B

If a bridge mode SSID is configured for a managed FortiAP, you can add a security profile group to the wireless controller, if the FortiAP model supports the security profile. This is supported only in bridge mode.

Question 4

When using FortiPresence as a captive portal, which two types of public authentication services can be used to access guest Wi-Fi? (Choose two.)

ASocial networks authentication

BSoftware security token authentication

CShort message service authentication

DHardware security token authentication

Answer : A, C

According to the web search results, FortiPresence supports social networks authentication and short message service authentication as public authentication services for guest Wi-Fi access. Social networks authentication allows visitors to log in using their existing social media accounts, such as Facebook, Twitter, LinkedIn, Google, and Instagram. Short message service authentication allows visitors to receive a one-time password via SMS to their mobile phone number. These authentication methods are convenient and secure for visitors and provide valuable data for businesses. Software security token authentication and hardware security token authentication are not supported by FortiPresence as public authentication services for guest Wi-Fi access. Reference:Configuring Captive Portal | FortiPresence 1.2.0,Configuring Captive Portal | FortiPresence 22.4.0

Question 5

Refer to the exhibit.

What does the asterisk (*) symbol beside the channel mean?

AIndicates channels that can be used only when Radio Resource Provisioning is enabled

BIndicates channels that cannot be used because of regulatory channel restrictions

CIndicates channels that will be scanned by the Wireless Intrusion Detection System (WIDS)

DIndicates channels that are subject to dynamic frequency selection (DFS) regulations

Answer : D

This frequencies are also used by other licensed applications, wireless LANs have to use a specific method to gain access to certain higher frequencies and this method is known as DFS.

Question 6

Where in the controller interface can you find a wireless client's upstream and downstream link rates?

AOn the AP CLI, using the cw_diag ksta command

BOn the controller CLI, using the diag wireless-controller wlac -d sta command

COn the AP CLI, using the cw_diag -d sta command

DOn the controller CLI, using the WiFi Client monitor

Answer : A

Question 7

Which two statements about background rogue scanning are correct? (Choose two.)

AA dedicated radio configured for background scanning can support the connection of wireless clients

BWhen detecting rogue APs, a dedicated radio configured for background scanning can suppress the rogue AP

CBackground rogue scanning requires DARRP to be enabled on the AP instance

DA dedicated radio configured for background scanning can detect rogue devices on all other channels in its configured frequency band

Answer : A, C

Fortinet NSE6_FWF-6.4 Fortinet NSE 6 - Secure Wireless LAN 6.4 Exam Practice Test