Fortinet FCSS_NST_SE-7.6 Exam Practice Test Instant Access

Question 1

Which exchange lakes care of DoS protection in IKEv2?

ACreate_CHILD_SA

BIKE_Auth

CIKE_Req_INIT

DIKE_SA_NIT

Answer : C

TheIKE_SA_INITexchange in IKEv2 is responsible for DoS protection measures. During IKE_SA_INIT, before authentication and further exchange, the responder can use cookie challenges (per RFC 7296 and Fortinet VPN documentation). If a DoS attack is suspected (many requests from the same source), the responder replies with a cookie. Only after the initiator returns the correct cookie does the exchange proceed, protecting the responder from state exhaustion and certain forms of DoS traffic at the handshake stage.

FortiOS VPN Manual: IKEv2 Exchange Process and DoS Protections

IKEv2 RFC 7296: Description of IKE_SA_INIT and DoS Cookie Mechanism

Question 2

Refer to the exhibit, which shows a partial output of a real-time LDAP debug.

What two conclusions can you draw from the output? (Choose two.)

AThe user was found in the LDAP tree, whose root is TAC.ottawa.fortinet.com.

BFortiOS performs a bind to the LDAP server using the user's credentials.

CFortiOS collects the user group information.

DFortiOS is performing the second step (Search Request) in the LDAP authentication process.

Answer : A, D

Question 3

Refer to the exhibits.

An administrator is attempting to advertise the network configured on port3. However, FGT-A is not receiving the prefix.

Which two actions can the administrator take to fix this problem? (Choose two.)

AModify the prefix using the network command from 172.16.0.0/16 to 172.16.54.0/24.

BManually add the BGP route on FGT-A.

CRestart BGP using a soft reset to force both peers to exchange their complete BGP routing tables.

DUse the set network-import-check disable command.

Answer : A, D

Question 4

Refer to the exhibit, which shows a partial output from the get router info routing-table database command.

The administrator wants to configure a default static route for port3 and assign a distance of 50 and a priority of 0.

What will happen to the port1 and port2 default static routes after the port3 default static route is created?

AThe port2 default static route will be injected into the forwarding information base (FIB).

BThe port1 default static route will be injected into the FIB.

CNeither of the routes shown in the output will be injected into the FIB.

DBoth default static routes shown in the output will be injected into the FIB.

Answer : A

Question 5

Which statement about parallel path processing is correct (PPP)?

APPP chooses from a group of parallel options lo identity the optimal path tor processing a packet.

BOnly FortiGate hardware configurations affect the path that a packet takes.

CPPP does not apply to packets that are part of an already established session.

DSoftware configuration has no impact on PPP.

Answer : A

Parallel Path Processing (PPP) in FortiOS refers to the system's ability to evaluate and select among multiple processing paths---often involving dedicated network processors, content processors, or CPU-based workflows---to optimally process packets. The official documentation highlights that the PPP engine dynamically selects which hardware or software path to use for each session based on session characteristics, policy configuration, and traffic type. This dynamic selection results in optimal throughput and resource utilization.

The document specifies that PPP assesses several processing paths in parallel, using decision logic to determine whether a session should be offloaded to specialist hardware (like NP6, CP9, etc.) or stay in the CPU path, ensuring that each packet is handled by the most efficient available method under current load and policy. Hardware and software configurations both influence this outcome, but it is the PPP engine's decision-making that defines the optimal path per session.

Fortinet FortiGate Handbook: Parallel Path Processing

Fortinet FortiOS Technical Documentation: Packet Flow and Path Selection

Question 6

Refer to the exhibit, which shows a truncated output of a real-time LDAP debug.

What two conclusions can you draw from the output? (Choose two.)

AThe name of the configured LDAP server is Lab.

BThe user is authenticating using CN=John Smith.

CFortiOS is able to locate the user in step 3 (Bind Request) of the LDAP authentication process.

DFortiOS is performing the second step (Search Request) in the LDAP authentication process.

Answer : B, D

According toFortinet's LDAP authentication workflow as described in the FortiOS Administration Guide and the official LDAP debug log interpretation, each authentication attempt is split into several key steps: Bind Request, Search Request, and then, if successful, a Bind as the found user DN. In the provided debug output, we see 'start search_dn-base' with a filter 'sAMAccountName=jsmith' and the log line 'Going to SEARCH state,' confirming that FortiOS is in the second step---the Search Request (Option D). Official documentation highlights this exact phrase 'SEARCH state' as indicative of Step 2 within the LDAP process (''Bind Search Bind'').

Additionally, the last line ''Found DN 1: CN=John Smith, CN=Users, DC=TAC, DC=ottawa, DC=fortinet, DC=com'' verifies that the system has successfully mapped the username to the Distinguished Name (DN) and this user is ''John Smith.'' The authentication will now proceed using this mapped user (Option B). Fortinet's logs record the found DN after a successful search, which is a strong confirmation that the user's credentials can be validated against the found DN.

Options A and C are not supported directly by the debug output shown:

The server name 'Lab' is referenced as part of the request, but not explicitly as the LDAP server's configured name in this output.

Step 3 (Bind Request) would follow finding the DN, but the log here demonstrates the Search and DN found---per Fortinet, this precedes the actual Bind/validation step.

FortiOS Administration Guide: LDAP Authentication Process and Debug Logs

Fortinet Official KB: LDAP Integration Workflow and Log Interpretation

Question 7

In which two slates is a given session categorized as ephemeral? (Choose two.)

AA UDP session with only one packet received

BA UOP session with packets sent and received

CA TCP session waiting for the SYN ACK

DA TCP session waiting for FIN ACK

Answer : A, C

Fortinet FCSS - Network Security 7.6 Support Engineer FCSS_NST_SE-7.6 Exam Practice Test