FCSS_NST_SE-7.4 Study Guide Brilliant FCSS_NST_SE-7.4 Exam Dumps PDF [Q33-Q48]

4.7/5 - (4 votes)

FCSS_NST_SE-7.4 Study Guide Brilliant FCSS_NST_SE-7.4 Exam Dumps PDF

View FCSS_NST_SE-7.4 Exam Question Dumps With Latest Demo

Fortinet FCSS_NST_SE-7.4 Exam Syllabus Topics:

Topic	Details
Topic 1	System Troubleshooting: This part of the exam assesses the ability of Fortinet network and security professionals to diagnose and fix typical system-related problems within Fortinet solutions. It involves troubleshooting FortiGate-to-FortiGate Security Fabric issues, addressing automation stitch concerns, and detecting resource-related problems using integrated tools.
Topic 2	Routing: This part of the exam examines the expertise of Fortinet network and security professionals, in routing enterprise traffic effectively.
Topic 3	Authentication: This section evaluates the proficiency of Fortinet network and security professionals in resolving both local and remote authentication issues.
Topic 4	VPN: This section tests the knowledge of IT professionals, such as system engineers in diagnosing and resolving VPN-related issues. It emphasizes troubleshooting IPsec IKE versions 1 and 2 to ensure secure and reliable communication between networks or remote users.
Topic 5	Security Profiles: This segment of the exam tests the skills of IT professionals, such as network administrators in handling and troubleshooting security profile-related challenges.

Q33. Exhibit.

Refer to the exhibit, which shows the output of diagnose automation test.
What can you observe from the output? (Choose two.)

The automation stitch test is not being logged.

The automation stitch test failed but the HA failover was successful.

An HA failover occurred.

The test was unsuccessful.

Q34. Refer to the exhibit, which shows partial outputs from two routing debug commands.

Which change must an administrator make on FortiGate to route web traffic from internal users to the internet, using ECMP?

Set snat-route-change to enable.

Set the priority of the static default route using port2 to 1.

Set preserve-session-route to enable.

Set the priority of the static default route using port1 to 10.

Q35. Refer to the exhibit, which shows the partial output of command diagnose debug rating.

In this exhibit, which FDS server will the FortiGate algorithm choose?

66.117.56.37

208.91.112.194

209.22.147.36

64.26.151.37

The FortiGate will pick 64.26.151.37, since it ties for the lowest weight (10) and has the lowest RTT (45 ms) of all the weight 10 servers.

Q36. Refer to the exhibit showing a debug output.

An administrator deployed FSSO in DC Agent Mode but FSSO is failing on FortiGate. Pinging FortiGate from where the collector agent is deployed is successful. The administrator then produces the debug output shown in the exhibit.
What could be causing this error message?

The TCP port 445 is blocked between FortiGate and collector agent.

The collector agent preshared password is mismatched.

The FortiGate cannot resolve the active directory server name.

The FortiGate and the collector agent are using different TCP ports.

The log shows FortiGate attempting to connect to 127.0.0.1:8000 and immediately getting
“Connection refused,” which means no process is listening on that port. In DC Agent mode both sides must match on the same TCP port (default 8000), so a port mismatch will cause exactly this error.

Q37. In IKEv2, which exchange establishes the first CHILD_SA?

IKE_SA_INIT

INFORMATIONAL

CREATE_CHILD_SA

IKE_Auth

Q38. Refer to the exhibit, which shows the omitted output of a session table entry.

Which two statements are true? (Choose two.)

The traffic has been tagged for VLAN 0000.

NP7 is handling offloading of this session.

The traffic matches Policy ID 1.

The session has been offloaded.

Q39. Refer to the exhibit, which shows the output of a BGP debug command.

What is the reason that the local FortiGate is not receiving any prefixes from its neighbors?

The RIB-OUT configuration for router 10.127.0.75prevents any route advertisement to the local router.

The router 100.64.3.1needs to update the local AS number to 65060to become adjacent with the local router.

The local router is waiting for the keepalive message from the router 10.125.0.60.

None of the three neighbors have successfully established the TCP three-way handshake with the local router.

Since none of the peers are in the Established state (two remain in Active/OpenSent and the one
“0” in the PfxRcd column actually indicates no adjacency), there is no session over which to receive any routes.

Q40. Refer to the exhibit, which shows the modified output of the routing kernel.

Which statement is true?

The egress interface associated with static route 8.8.8.8/32 is administratively up.

The default static route through 10.200.1.254 is not in the forwarding information base.

The default static route through port2 is in the forwarding information base.

The BGP route to 10.0.4.0/24 is not in the forwarding information base.

Q41. Refer to the exhibits, which contain the partial configurations of two VPNs on FortiGate.

An administrator has configured two VPNs for two different user groups. Users who are in the Users- 2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovers that FortiGate is not matching the user-2 VPN for members of the Users-
2 group. Which two changes must the administrator make to fix the issue? (Choose two.)

Change to aggressive mode on both VPNs.

Enable XAuth on both VPNs.

Use different pre-shared keys on both VPNs.

Set up specific peer IDs on both VPNs.

Change both tunnels to aggressive mode so FortiGate can match dynamic peers by identity.
Configure a unique peer ID on each phase1-interface so the correct VPN is selected for Users 1 vs. Users 2.

Q42. Refer to the exhibit, which shows the output o! the BGP database.

Which two statements are correct? (Choose two.)

The advertised prefix of 10.20.30.0’24 was configured using the network command.

The first four prefixes are being advertised using a legacy route advertisement.

The advertised prefix of 10.20.30.0’24 is being advertised through the redistribution of another routing protocol.

The output shows all prefixes advertised by all neighbors as well as the local router.

get router info bgp network lists the BGP routing table – the valid (*) and best (>) prefixes learned from neighbors as well as those originated locally.
The 10.20.30.0/24 entry shows origin code i (IGP), which indicates it was injected with the network command, not via redistribution.

Q43. Refer to the exhibit, which contains partial output from an IKE real-time debug. Which two statements about this debug output are correct? (Choose two.)

Perfect Forward Secrecy (PFS) is enabled in the configuration.

The local gateway IP address is 10.0.0.1.

It shows a phase 2 negotiation.

The initiator provided remote as its IPsec peer ID.

Q44. Refer to the exhibit, which shows two entries that were generated in the FSSO collector agent logs. What three conclusions can you draw from these log entries? (Choose three.)

Remote registry is not running on the workstation.

The user’s status shows as “not verified” in the collector agent.

DNS resolution is unable to resolve the workstation name.

The FortiGate firmware version is not compatible with that of the collector agent.

A firewall is blocking traffic to port 139 and 445.

Because the collector can’t reach the workstation’s registry, that host will remain in a “not verified” state in the FSSO collector agent.
A failure to connect to the remote registry almost always means the Remote Registry service on the Windows box is stopped or disabled.
Alternatively (or additionally), a host based or network firewall blocking SMB/RPC ports 139 or 445 will produce exactly this “failed to connect” error.

Q45. Refer to the exhibit, which shows the output of a policy route table entry.

Which type of policy route does the output show?

An ISDB route

A regular policy route

A regular policy route, which is associated with an active static route in the FIB

AnSD-WAN rule

Q46. Refer to the exhibit.

An IPsec VPN tunnel is dropping, as shown by the debug output.
Analyzing the debug output, what could be causing the tunnel to go down?

Phase 2 drops but Phase 1 is up.

Dead Peer Detection is not receiving its acknowledge packet.

The tunnel drops during rekey negotiation.

The tunnel drops after the timer expires.

Q47. Refer to the exhibit, which shows a partial output of the fssod daemon real-time debug command.

What two conclusions can you draw from the output? (Choose two.)

Fortinet Single Sign-On (FSSO) is using DC Agent mode to detect logon events.

FortiGate is frequently polling the workstation, in case the user has logged off.

The collector agent cannot verify if the user is still logged in.

FortiGate polled this event through TCP port 8000.

FSSO is using agentless polling mode to detect logon events.

The collector agent cannot verify if the user is still logged in.
In agentless polling mode FSSO only reads Kerberos TGT events (e.g. 4768) from the DC’s security log, and there’s no corresponding “logoff” event – so it cannot confirm when a user logs off.
FSSO is using agentless polling mode to detect logon events.
The blank workstation= field and the use of event ID 4768 indicate that fssod is polling the domain controller’s event log rather than receiving pushed events from a DC or collector agent.

Q48. What are two functions of automation stitches? (Choose two.)

You can configure automation stitches on any FortiGate device in a Security Fabric environment.

You can configure automation stitches to execute actions sequentially by taking parameters from previous actions as input for the current action.

You can set an automation stitch configured to execute actions in parallel to insert a specific delay between actions.

You can create automation stitches to run diagnostic commands and attach the results to an email message when CPU or memory usage exceeds specified thresholds.

Automation stitches can run actions in sequence, passing output from one action as input to the next.
They can be set to run diagnostics (e.g., CPU/memory checks) and email the results when thresholds are exceeded.

Loading …