FCSS-NST-SE-7.6 Fortinet FCSS - Network Security 7.6 Support Engineer Practice Questions

An Access-Reject is an explicit reply, so the request reached the server and was evaluated. With correct credentials, the reject comes from the server's policy conditions. RADIUS servers such as NPS can require a specific client or NAS-IP-Address; if the FortiGate sources its requests from another IP (see source-ip in config user radius), the policy doesn't match and the server rejects. The other options would give no reply (no route, wrong port) or don't apply to a RADIUS-authenticated admin (local user status). Use diagnose test authserver radius with diagnose debug application fnbamd -1 to confirm (FortiOS 7.6 Administration Guide - RADIUS servers).

True. Policy-based routing is evaluated before the main routing table (FIB). If a packet's source, destination, protocol, or port matches a configured policy route, the FortiGate will use the gateway specified in that policy route to forward the packet, effectively bypassing the standard destination-based lookup in the FIB.

Slab memory is allocated by the FortiOS kernel for its own data structures. Session-table entries, NAT entries and TCP session data are kept in kernel slab caches, so a very large number of concurrent sessions, such as a SYN flood or a scanning host opening huge numbers of connections, makes slab usage grow. diagnose hardware sysinfo slab then shows the session-related caches at the top. The IPS engine (ipsengine) is a user-space daemon, so its memory counts as process memory, not kernel slab. Reference: Fortinet Community 'How to do initial troubleshooting of high memory utilization issues (conserve mode)'.

In the diagnose sniffer packet command, the final optional argument controls timestamp format. The l argument specifically adds local time timestamps to the output, which is useful for correlating the packet capture with log files that also use the FortiGate's local time.

NO_PROPOSAL_CHOSEN is returned when the responder finds no acceptable proposal among the transforms the initiator offered (RFC 7296 §3.10.1, and the same notify in IKEv1 Quick Mode). If phase 1 completes but phase 2 fails with this notify for one user, that client's phase 2 encryption/authentication (or PFS/DH group) proposal does not match any proposal in the FortiGate's phase 2 configuration. Selector (proxy ID) mismatches are signalled differently, for example with TS_UNACCEPTABLE in IKEv2. An exhausted IP pool or a NAT setting on the policy does not produce this notify. Source: RFC 7296; FortiOS 7.6 IPsec diagnose commands.

In FortiOS 7.6 FGCP, with override disabled (the default), primary selection compares connected monitored interfaces first, then HA uptime, then priority, then serial number. An HA uptime difference of more than 300 seconds decides the primary, and a less than 5-minute difference counts as a tie. A unit's HA uptime resets to zero when it restarts or a monitored interface fails. After the original primary recovers, its uptime is lower than the current primary's, so it stays secondary despite its higher priority. Enabling override would make priority be considered before uptime. Session pickup and heartbeat addressing do not affect primary selection. (FortiOS 7.6 Administration Guide: HA primary unit selection criteria.)

The BGP synchronization rule states that a BGP router should not advertise a route learned from an iBGP peer to an eBGP peer unless that route is also present in its Interior Gateway Protocol (IGP) routing table (e.g., learned via OSPF or a static route). This is a loop-prevention mechanism. Since the prefix is learned from iBGP and not being advertised to the eBGP peer (ISP), and no explicit filters are in place, synchronization being enabled is the most likely cause. Modern networks typically disable synchronization as full-mesh iBGP or route reflectors are used.

The error Authentication method not supported from fnbamd during an LDAP authentication attempt typically indicates a mismatch in the authentication or bind method between the FortiGate and the LDAP server. For example, the FortiGate might be configured for Simple bind when the server requires Regular, or vice-versa. An incorrect password would result in a credentials error, and a certificate issue would cause a TLS handshake failure, not this specific message.

False. IPsec VPN tunnel processing is handled by the iked daemon for control plane (IKE negotiations) and the kernel (ksoftirqd) for data plane (encryption/decryption). While diagnose sys top can show high CPU usage from these processes, it does not break down the usage per individual tunnel. To troubleshoot a specific tunnel's performance, you would need to use other tools like diagnose vpn tunnel list and specific debugs, not diagnose sys top for a per-tunnel PID.

In FortiOS 7.6, to improve stability and performance on entry-level models, features like Security Rating and Topology visibility are disabled on FortiGates with 2GB of RAM or less. The FortiGate 60F falls into this category. Therefore, it will not run Security Rating checks or send results to the root FortiGate, explaining the missing data.