Fortinet NSE6_FWF-6.4 Exam Practice Test Instant Access

Question 1

A tunnel mode wireless network is configured on a FortiGate wireless controller.

Which task must be completed before the wireless network can be used?

AThe wireless network interface must be assigned a Layer 3 address

BSecurity Fabric and HTTPS must be enabled on the wireless network interface

CThe wireless network to Internet firewall policy must be configured

DThe new network must be manually assigned to a FortiAP profile.

Answer : C

A FortiGate unit is an industry leading enterprise firewall. In addition to consolidating all the functions of a network firewall, IPS, anti-malware, VPN, WAN optimization, Web filtering, and application control in a single platform, FortiGate also has an integrated Wi-Fi controller.

Question 2

Refer to the exhibits.

Exhibit A

Exhibit B

A wireless network has been created to support a group of users in a specific area of a building. The wireless network is configured but users are unable to connect to it. The exhibits show the relevant controller configuration for the APs and the wireless network.

Which two configuration changes will resolve the issue? (Choose two.)

AFor both interfaces in the wtp-profile, configure set vaps to be ''Authors''

BDisable intra-vap-privacy for the Authors vap-wireless network

CFor both interfaces in the wtp-profile, configure vap-all to be manual

DIncrease the transmission power of the AP radio interfaces

Answer : A, C

The configuration changes that will resolve the issue are to configure set vaps to be ''Authors'' for both interfaces in the wtp-profile, and to configure vap-all to be manual for both interfaces in the wtp-profile. This is because the current configuration does not assign any VAPs to the AP interfaces, which means that no wireless networks are broadcasted by the APs. The vap-all setting determines whether all VAPs are assigned to an interface or not, and the vaps setting specifies which VAPs are assigned to an interface. By setting vap-all to manual and vaps to ''Authors'', the APs will only broadcast the Authors wireless network on both interfaces. Disabling intra-vap-privacy for the Authors vap-wireless network will not help, as it only affects the communication between clients on the same SSID, not their connection to the AP. Increasing the transmission power of the AP radio interfaces will not help, as it only affects the signal strength and coverage of the APs, not their broadcasting of wireless networks. Reference:wireless-controller vap | FortiGate / FortiOS 6.4.0,Technical Note: How to configure intra-SSID privacy

Question 3

Which factor is the best indicator of wireless client connection quality?

ADownstream link rate, the connection rate for the AP to the client

BThe receive signal strength (RSS) of the client at the AP

CUpstream link rate, the connection rate for the client to the AP

DThe channel utilization of the channel the client is using

Answer : C

Question 4

A tunnel mode SSID is configured on a FortiGate wireless controller.

Which task must be completed before the SSID can be used?

AThe new network must be manually assigned to a FortiAP profile.

BThe wireless network interface must be assigned a Layer 3 address.

CSecurity Fabric and HTTPS must be enabled on the wireless network interface.

DThe wireless network to Internet firewall policy must be configured.

Answer : B

The wireless network interface must be assigned a Layer 3 address because it acts as the gateway for the tunnel mode SSID traffic. The FortiGate wireless controller uses this interface to communicate with the FortiAPs and the wireless clients. Without a valid IP address, the tunnel mode SSID cannot function properly. Reference:Secure Wireless LAN Course Description, page 5; [FortiOS 6.4.0 Handbook - Wireless Controller], page 24.

Question 5

What is the first discovery method used by FortiAP to locate the FortiGate wireless controller in the default configuration?

ADHCP

BStatic

CBroadcast

DMulticast

Answer : B

According to the web search results, the first discovery method used by FortiAP to locate the FortiGate wireless controller in the default configuration is static. This means that the FortiAP sends discovery requests to a preconfigured IP address that the controller owns. This is useful if the FortiAP and the controller are not in the same subnet and other discovery methods will not work. The other discovery methods are used in sequence if the static method fails or is not configured. Reference:Advanced WiFi controller discovery | FortiAP / FortiWiFi 7.4.0

Question 6

Which two configurations are compatible for Wireless Single Sign-On (WSSO)? (Choose two.)

AA VAP configured for captive portal authentication

BA VAP configured for WPA2 or 3 Enterprise

CA VAP configured to authenticate locally on FortiGate

DA VAP configured to authenticate using a radius server

Answer : B, D

In the SSID choose WPA2-Enterprise authentication.

WSSO is RADIUS-based authentication that passes the user's user group memberships to the FortiGate.

Wireless Single Sign-On (WSSO) is a RADIUS-based authentication method that passes the user's user group memberships to the FortiGate for policy enforcement. WSSO can be configured for a VAP that uses WPA2 or WPA3 Enterprise authentication, which requires users to enter their credentials when connecting to the wireless network. WSSO can also be configured for a VAP that authenticates users using a RADIUS server, which returns the user group information in the Fortinet-Group-Name attribute. Reference:FortiOS 6.4.0 Handbook - Wireless Controller, page 57;FortiOS 6.4.0 Handbook - Authentication, page 59.

Question 7

Refer to the exhibits.

Exhibit A

Exhibit B

The exhibits show the diagnose debug log of a station connection taken on the controller CLI.

Which security mode is used by the wireless connection?

AWPA2 Enterprise

BWPA3 Enterprise

CWPA2 Personal and radius MAC filtering

DOpen, with radius MAC filtering

Answer : C

Fortinet NSE6_FWF-6.4 Fortinet NSE 6 - Secure Wireless LAN 6.4 Exam Practice Test