Free FCSS-NST-SE-7.6 sample questions

Correct answer: With override disabled, HA uptime is evaluated before priority, and the recovered unit's HA uptime was reset, so the current primary keeps its role.

In FortiOS 7.6 FGCP, with `override` disabled (the default), primary selection compares connected monitored interfaces first, then HA uptime, then priority, then serial number. An HA uptime difference of more than 300 seconds decides the primary, and a less than 5-minute difference counts as a tie. A unit's HA uptime resets to zero when it restarts or a monitored interface fails. After the original primary recovers, its uptime is lower than the current primary's, so it stays secondary despite its higher priority. Enabling `override` would make priority be considered before uptime. Session pickup and heartbeat addressing do not affect primary selection. (FortiOS 7.6 Administration Guide: HA primary unit selection criteria.)

Correct answer: The BGP synchronization rule is enabled and the prefix is not in the IGP.

The BGP synchronization rule states that a BGP router should not advertise a route learned from an iBGP peer to an eBGP peer unless that route is also present in its Interior Gateway Protocol (IGP) routing table (e.g., learned via OSPF or a static route). This is a loop-prevention mechanism. Since the prefix is learned from iBGP and not being advertised to the eBGP peer (ISP), and no explicit filters are in place, synchronization being enabled is the most likely cause. Modern networks typically disable synchronization as full-mesh iBGP or route reflectors are used.

Correct answer: The configured Bind Type on the FortiGate's LDAP settings is incorrect for the LDAP server.

The error `Authentication method not supported` from `fnbamd` during an LDAP authentication attempt typically indicates a mismatch in the authentication or bind method between the FortiGate and the LDAP server. For example, the FortiGate might be configured for `Simple` bind when the server requires `Regular`, or vice-versa. An incorrect password would result in a credentials error, and a certificate issue would cause a TLS handshake failure, not this specific message.

Correct answer: False

False. IPsec VPN tunnel processing is handled by the `iked` daemon for control plane (IKE negotiations) and the kernel (`ksoftirqd`) for data plane (encryption/decryption). While `diagnose sys top` can show high CPU usage from these processes, it does not break down the usage per individual tunnel. To troubleshoot a specific tunnel's performance, you would need to use other tools like `diagnose vpn tunnel list` and specific debugs, not `diagnose sys top` for a per-tunnel PID.

Correct answer: The Security Rating feature is disabled by default on FortiGate models with 2GB of RAM or less in FortiOS 7.6.

In FortiOS 7.6, to improve stability and performance on entry-level models, features like Security Rating and Topology visibility are disabled on FortiGates with 2GB of RAM or less. The FortiGate 60F falls into this category. Therefore, it will not run Security Rating checks or send results to the root FortiGate, explaining the missing data.

Correct answer: SSL inspection is not enabled, and the FortiGate is blocking the site based on the category of the SNI in the TLS handshake.

Without deep inspection, the FortiGate cannot see the HTTPS URL. For flow-based web filtering it rates the hostname from the SNI in the TLS Client Hello, or the server certificate's CN when there is no SNI. If the site is served under a hostname (for example a CDN or shared hosting name) whose FortiGuard category differs from the category the administrator checked, the session is blocked by that other category. The log's category field shows which one. If 'Rate URLs by domain and IP address' is enabled, the IP rating can also override the domain rating by weight. Checking the category in the log, adding a local rating or URL filter exemption, or using deep inspection so the full URL is rated resolves the discrepancy. (FortiOS 7.6 Administration Guide: Configuring a web filter profile; Rating options.)

Correct answers: diagnose ip arp list; execute ping

If a static route is in the routing table but traffic is not forwarded, check whether the next hop is actually reachable at Layer 2 and Layer 3. `diagnose ip arp list` shows whether the FortiGate has resolved the gateway's MAC address; an incomplete or missing entry points to a Layer 2 or addressing problem. `execute ping ` tests Layer 3 reachability of the gateway directly. `get router info routing-table all` only confirms what is already known (the route is present). `get system performance status` shows resource usage, and `diagnose debug flow` traces a packet's policy and route decisions rather than gateway reachability.

If a static route is in the routing table but traffic is not forwarded, check whether the next hop is actually reachable at Layer 2 and Layer 3. `diagnose ip arp list` shows whether the FortiGate has resolved the gateway's MAC address; an incomplete or missing entry points to a Layer 2 or addressing problem. `execute ping ` tests Layer 3 reachability of the gateway directly. `get router info routing-table all` only confirms what is already known (the route is present). `get system performance status` shows resource usage, and `diagnose debug flow` traces a packet's policy and route decisions rather than gateway reachability.

Correct answer: diagnose test application autod 3

`diagnose test application autod 3` displays statistics for all automation stitches: how many times each stitch was triggered (local hit), the last trigger time, and each action's `done`/`drop` counters. It shows which stitches ran and whether their actions succeeded or failed. `diagnose automation stitch-history`, `diagnose automation stitch-trace` and `diagnose sys csf-log` aren't FortiOS commands, and `get system automation stitch` doesn't show execution history. Reference: FortiOS 7.6 Administration Guide, Diagnosing automation stitches.

Correct answer: Dead Peer Detection (DPD) is disabled on one side but enabled as 'On Idle' on the other.

When Dead Peer Detection (DPD) is configured as 'On Idle' on one FortiGate, it will only send DPD probes when there is no outbound traffic to send. If the other side has DPD disabled, it will not respond to these probes. After a few failed probes, the 'On Idle' FortiGate will tear down the tunnel, assuming the peer is dead. If there is periodic keep-alive or monitoring traffic, the tunnel will re-establish, creating a flapping cycle. A DPD timer mismatch would not typically cause this issue, and Phase 2 lifetime expiry would be on a much longer interval (usually hours).

Correct answer: A mismatch in the interface MTU settings.

The `ExStart` state is where OSPF routers decide which router will be the master for exchanging Database Descriptor (DBD) packets. If the routers have different interface MTU values, the larger DBD packets from the router with the higher MTU will be dropped by the router with the lower MTU. This prevents the DBD exchange from completing, causing the adjacency to be stuck in `ExStart`. Timer mismatches would prevent the state from even reaching `2-Way`, and area ID or authentication mismatches would also cause earlier failures.