FCSS - Enterprise Firewall 7.6 Administrator (FCSS_EFW_AD-7.6) Free Practice Test

Question 1

An administrator is designing an ADVPN network for a large enterprise with spokes that have varying numbers of internet links. They want to avoid a high number of routes and peer connections at the hub.
Which method should be used to simplify routing and peer management?

A. Use a dynamic routing protocol using loopback interfaces to streamline peers and routes.

B. Establish a traditional hub-and-spoke VPN topology with policy routes.

C. Implement static routing over IPsec interfaces for each spoke.

D. Deploy a full-mesh VPN topology to eliminate hub dependency.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

The IT department discovered during the last network migration that all zero phase selectors in phase 2 IPsec configurations impacted network operations.
What are two valid approaches to prevent this during future migrations? (Choose two.)

A. Configure an IPsec-aggregate to create redundancy between each firewall peer.

B. Use routing protocols to specify allowed subnets over the tunnel.

C. Clearly indicate to the VPN which segments will be encrypted in the phase two selectors.

D. Configure an IP address on the IPsec interface of each firewall to establish unique peer connections and avoid impacting network operations.

Correct Answer: B,C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

Refer to the exhibit, which contains a partial VPN configuration.

What can you conclude from this VPN IPsec phase 1 configuration?

A. FortiGate will not add a route to its routing or forwarding information base when the dynamic tunnel is negotiated.

B. This configuration is the best for networks with regular traffic intervals, providing a balance between connectivity assurance and resource utilization.

C. A separate interface is created for each dial-up tunnel, which can be slower and more resource intensive, especially in large networks.

D. Peer IDs are unencrypted and exposed, creating a security risk.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

You must configure a loopback as a BGP source to connect to the ISP.
Which two commands must you use to establish the connection? (Choose two.)

A. ibgp-enforce-multihop

B. ebgp-enforce-multihop

C. update-source

D. recursive-next-hop

Correct Answer: B,C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

A company that acquired multiple branches across different countries needs to install new FortiGate devices on each of those branches. However, the IT staff lacks sufficient knowledge to implement the initial configuration on the FortiGate devices.
Which three approaches can the company take to successfully deploy advanced initial configurations on remote branches? (Choose three.)

A. Use metadata variables to dynamically assign values according to each FortiGate device.

B. Use provisioning templates and install configuration settings at the device layer.

C. Use the Global ADOM to deploy global object configurations to each FortiGate device.

D. Add FortiGate devices on FortiManager as model devices, and use ZTP or LTP to connect to FortiGate devices.

E. Apply Jinja in the FortiManager scripts for large-scale and advanced deployments.

Correct Answer: A,B,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

Refer to the exhibit, which shows the ADVPN network topology and partial BGP configuration.

Which two parameters must an administrator configure in the config neighbor range for spokes shown in the exhibit? (Choose two.)

A. set neighbor-group advpn

B. set max-neighbor-num 2

C. set route-reflector-client enable

D. set prefix 172.16.1.0 255.255.255.0

Correct Answer: A,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

In which two ways does FortiGate utilize the Internet Service Database (ISDB)?

A. Works in proxy mode

B. Limits by URL

C. Blocks IPs and ports

D. Provides predefined IPs and ports

Correct Answer: C,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

Refer to the exhibit.
An HA configuration of an active-active (A-A) cluster with the same HA uptime is shown. You want HQ- NGFW-2 to handle the Core2 VDOM traffic. Which modification must you make to achieve this outcome?
(Choose one answer)

A. Reboot HQ-NGFW-2.

B. Change the priority from 100 to 160 for HQ-NGFW-2.

C. Enable override in virtual cluster 2 for HQ-NGFW-2.

D. Change the priority from 120 to 200 for HQ-NGFW-2.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 9

An administrator must standardize the deployment of FortiGate devices across branches with consistent interface roles and policy packages using FortiManager.
What is the recommended best practice for interface assignment in this scenario?

A. Enable metadata variables to use dynamic configurations in the standard interfaces of FortiManager.

B. Create interfaces using device database scripts to use them on the same policy package of FortiGate devices.

C. Create normalized interface types per-platform to automatically recognize device layer interfaces based on the FortiGate model and interface name.

D. Use the Install On feature in the policy package to automatically assign different interfaces based on the branch.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 10

Refer to the exhibit, which shows an OSPF network.
Which configuration must the administrator apply to optimize the OSPF database?

A. Set an access list in the AS boundary FortiGate.

B. Set a route map in the AS boundary FortiGate.

C. Set the area 0.0.0.1 to the type NSSA in the area border FortiGate.

D. Set the area 0.0.0.1 to the type STUB in the area border FortiGate.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

Fortinet FCSS - Enterprise Firewall 7.6 Administrator (FCSS_EFW_AD-7.6) Free Practice Test