Free Practice Questions for Fortinet FCSS_EFW_AD-7.6 Exam

In FortiManager, pre-run CLI templates are used in Zero-Touch Provisioning (ZTP) and Low-Touch Provisioning (LTP) to configure a FortiGate device before it is fully managed by FortiManager.

These templates apply configurations when a device is initially provisioned. Once the pre-run CLI template is executed, FortiManager automatically unassigns it from the device because it is not meant to persist like other policy configurations. This prevents conflicts and ensures that the FortiGate configuration is not repeatedly applied after the initial setup.

The excessive DNS log requests with random subdomains suggest a DNS exfiltration attack, where attackers encode and transmit data via DNS queries. Since this technique can use both UDP and TLS (DoH - DNS over HTTPS), a comprehensive security approach is needed.

Using an IPS profile with DNS exfiltration-specific signatures allows FortiGate to:

● Detect and block abnormal DNS query patterns often used in exfiltration.

● Inspect encrypted DNS (DoH, DoT) traffic if SSL inspection is enabled.

● Identify known exfiltration domains and techniques based on FortiGuard threat intelligence.

Applying an aggressive IPS profile without prior testing can disrupt legitimate applications by incorrectly identifying normal traffic as malicious. To prevent disruptions while still monitoring for threats:

● Enable IPS in " Monitor Mode " first:

● This allows FortiGate to log and analyze potential threats without actively blocking traffic.

● Administrators can review logs and fine-tune IPS signatures to minimize false positives before switching to blocking mode.

● Verify and adjust signature patterns:

● Some signatures might trigger unnecessary blocks for legitimate application traffic.

● By analyzing logs, administrators can disable or modify specific rules causing false positives.

Comprehensive and Detailed Explanation From Exact Extract documents and Knowledge:

When importing a policy package from a FortiGate into a FortiManager ADOM, the Import Wizard compares the objects on the FortiGate with the objects already existing in the FortiManager ADOM database. If an object (e.g., an Address Object) has the same name but different values, a conflict occurs.

To resolve this, the administrator must choose which version to keep. Choosing FortiManager accept (or " Use FortiManager value " ) resolves the conflict by keeping the existing object in the FortiManager database and applying its settings to the imported policy. This maintains global consistency across the ADOM.

==============

Comprehensive and Detailed Explanation From Exact Extract documents and Knowledge:

OSPF external routes (Type 5 LSAs) can be learned from multiple paths. For a FortiGate to install multiple equal-cost paths into the routing table—a feature known as ECMP (Equal-Cost Multi-Path) —the OSPF process must have ECMP enabled and the maximum path count must be set to a value greater than one. If ECMP is disabled or the limit is set to 1, the FortiGate will select only the single best path (based on cost and RFC 1583/2328 selection rules) to install in the routing table, even if multiple valid advertisements exist.

The issue occurs because FortiGate enforces the " do not fragment " (DF) bit in the packet, and the packet size exceeds the MTU of the network path. When the Windows PC1 (with an MTU of 1500 bytes) attempts to send a 1400-byte packet, the FortiGate interface (with an MTU of 1000 bytes) needs to fragment it. However, since the DF bit is set, FortiGate drops the packet instead of fragmenting it.

To resolve this, the user should adjust the ping packet size to fit within the path MTU. In this case, reducing the packet size to 972 bytes (1000 bytes MTU minus 28 bytes for the IP and ICMP headers) should allow successful transmission.

Comprehensive and Detailed Explanation From Exact Extract documents and Knowledge:

When troubleshooting IPsec tunnels using the command diagnose vpn tunnel list, the npu_flag field provides the status of hardware acceleration (offloading) to the Network Processor (NPU).

While npu_flag=03 is common for older NP6 units to show both directions are offloaded, in newer hardware architectures (like NP7) or specific FortiOS 7.6 diagnostic views, various hex/bitmask flags indicate the offload status.

In the context of standard exam logic and the provided options, npu_flag=20 (or similar non-zero flags like 03) indicates that the tunnel is successfully offloaded to the hardware for Both SAs (Security Associations)—meaning both inbound and outbound traffic are being processed by the NPU rather than the CPU.

==============

Comprehensive and Detailed Explanation From Exact Extract documents and Knowledge:

In an OSPF status output (typically retrieved via get router info ospf status), the unit identifies its role within the OSPF autonomous system. If the output indicates that the device is an ASBR (Autonomous System Boundary Router) , it means the FortiGate is redistributing routes from another protocol (like BGP, RIP, or static routes) into OSPF. The status will explicitly state " This router is an ASBR " if redistribution is active. This role is critical for providing connectivity between OSPF and external networks.

==============

Comprehensive and Detailed Explanation From Exact Extract documents and Knowledge:

VXLAN (Virtual Extensible LAN) is an encapsulation protocol that adds significant overhead due to the addition of outer Ethernet, IP, and UDP headers. Handling this encapsulation and decapsulation in software can lead to high CPU utilization and performance bottlenecks.

The latest generations of Fortinet ' s network processors, specifically the NPU7 , include dedicated hardware support for VXLAN offloading . Hardware acceleration via NPU7 allows the FortiGate to perform VXLAN encapsulation and decapsulation at wire speed within the network processor hardware. This drastically improves performance compared to processing the packets in the CPU (Option A). CP10 (Option C) is a content processor designed for offloading UTM and SSL tasks, while NTurbo (Option B) is a software optimization for offloading flow-based IPS, neither of which are designed for VXLAN header processing.

Use metadata variables to dynamically assign values according to each FortiGate device:

Metadata variables in FortiManager allow device-specific configurations to be dynamically assigned without manually configuring each FortiGate. This is especially useful when deploying multiple devices with similar base configurations.

Use provisioning templates and install configuration settings at the device layer:

Provisioning templates in FortiManager provide a structured way to configure FortiGate devices. These templates can define interfaces, policies, and settings, ensuring that each device is correctly configured upon deployment.

Add FortiGate devices on FortiManager as model devices, and use ZTP or LTP to connect to FortiGate devices:

Zero-Touch Provisioning (ZTP) and Local Touch Provisioning (LTP) help automate the deployment of FortiGate devices. By adding devices as model devices in FortiManager, configurations can be pushed automatically when devices connect for the first time, reducing manual effort.