[Sep-2025] FCSS_EFW_AD-7.6 Exam Dumps - Free Demo & 365 Day Updates
Free Sales Ending Soon - Use Real FCSS_EFW_AD-7.6 PDF Questions
NEW QUESTION # 27
How will configuring set tcp-mss-sender and set tcp-mss-receiver in a firewall policy affect the size and handling of TCP packets in the network?
- A. The administrator must consider the payload size of the packet and the size of the IP header to configure a correct value in the firewall policy.
- B. Applying commands in a firewall policy determines the largest payload a device can handle in a single TCP segment.
- C. The maximum segment size permitted in the firewall policy determines whether TCP packets are allowed or denied.
- D. The TCP packet modifies the packet size only if the size of the packet is less than the one the administrator configured in the firewall policy.
Answer: B
Explanation:
The set tcp-mss-sender and set tcp-mss-receiver commands in a firewall policy allow an administrator to adjust the Maximum Segment Size (MSS) of TCP packets.
This setting controls the largest payload size that a device can handle in a single TCP segment, ensuring that packets do not exceed the allowed MTU (Maximum Transmission Unit) along the network path.
# set tcp-mss-sender adjusts the MSS value for outgoing TCP traffic.
# set tcp-mss-receiver adjusts the MSS value for incoming TCP traffic.
This helps prevent issues with fragmentation and MTU mismatches, improving network performance and avoiding retransmissions.
NEW QUESTION # 28
An administrator must minimize CPU and RAM use on a FortiGate firewall while also enabling essential security features, such as web filtering and application control for HTTPS traffic.
Which SSL inspection setting helps reduce system load while also enabling security features, such as web filtering and application control for encrypted HTTPS traffic?
- A. Disable SSL inspection entirely to conserve resources.
- B. Configure SSL inspection to handle HTTPS traffic efficiently.
- C. Use full SSL inspection to thoroughly inspect encrypted payloads.
- D. Enable SSL certificate inspection mode to perform basic checks without decrypting traffic.
Answer: D
Explanation:
To minimize CPU and RAM usage while still enforcing security features like web filtering and application control, SSL certificate inspection mode is the best choice.
# SSL certificate inspection allows FortiGate to inspect only the SSL/TLS handshake, including the Server Name Indication (SNI) and certificate details, without decrypting the full encrypted payload.
# This enables features like web filtering and application control because FortiGate can determine the destination website or application based on SNI and certificate information.
# It significantly reduces system load compared to full SSL inspection, which requires full decryption and re-encryption of traffic.
NEW QUESTION # 29
Refer to the exhibits. The exhibits show a network topology, a firewall policy, and an SSL/SSH inspection profile configuration.
Why is FortiGate unable to detect HTTPS attacks on firewall policy ID 3 targeting the Linux server?
- A. The administrator must enable HTTPS in the protocol port mapping of the deep- inspection SSL/SSH inspection profile.
- B. The administrator must enable cipher suites in the SSL/SSH inspection profile to decrypt the message.
- C. The administrator must enable SSL inspection of the SSL server and upload the certificate of the Linux server website to the SSL/SSH inspection profile.
- D. The administrator must set the policy to inspection mode to analyze the HTTPS packets as expected.
Answer: C
Explanation:
The FortiGate SSL/SSH inspection profile is configured for Full SSL Inspection, which is necessary to analyze encrypted HTTPS traffic. However, the firewall policy is protecting an SSL server (the Linux server hosting the website), and currently, the SSL/SSH profile only applies to client-side SSL inspection.
To detect HTTPS-based attacks targeting the Linux server:
# FortiGate must act as an SSL intermediary to inspect encrypted traffic destined for the web server.
# The administrator must upload the SSL certificate of the Linux web server to FortiGate so that the server-side SSL inspection can decrypt incoming HTTPS traffic before analyzing it.
NEW QUESTION # 30
A FortiGate device with UTM profiles is reaching the resource limits, and the administrator expects the traffic in the enterprise network to increase.
The administrator has received an additional FortiGate of the same model.
Which two protocols should the administrator use to integrate the additional FortiGate device into this enterprise network? (Choose two.)
- A. VRRP with switches
- B. FGCP in active-passive mode and with VDOM disabled
- C. FGCP in active-active mode and with switches
- D. FGSP with external load balancers
Answer: C,D
Explanation:
When adding an additional FortiGate to an enterprise network that is already reaching its resource limits, the goal is to distribute traffic efficiently and ensure high availability.
FGSP (FortiGate Session Life Support Protocol) with external load balancers FGSP allows session-aware load balancing between multiple FortiGate units without requiring them to be in an HA (High Availability) cluster.
With external load balancers, incoming traffic is evenly distributed across multiple FortiGate devices.
This approach is useful for scaling out traffic handling capacity while ensuring that sessions remain synchronized between firewalls.
FGSP is effective when stateful failover is required but without the constraints of traditional HA.
FGCP (FortiGate Clustering Protocol) in active-active mode and with switches FGCP active-active mode enables multiple FortiGate devices to share traffic loads, increasing throughput and efficiency.
Active-active mode is suitable for balancing UTM processing across multiple FortiGates, making it ideal when resource limits are a concern.
Using switches ensures redundancy and avoids single points of failure in the network.
This mode is commonly used in enterprise networks where both scalability and redundancy are required.
NEW QUESTION # 31
Refer to the exhibit, which shows the ADVPN network topology and partial BGP configuration.
Which two parameters must an administrator configure in the config neighbor range for spokes shown in the exhibit? (Choose two.)
- A. set route-reflector-client enable
- B. set max-neighbor-num 2
- C. set neighbor-group advpn
- D. set prefix 172.16.1.0 255.255.255.0
Answer: C,D
Explanation:
In the given ADVPN (Auto-Discovery VPN) topology, BGP is being used to dynamically establish routes between spokes. The neighbor-range configuration is crucial for simplifying BGP peer setup by automatically assigning neighbors based on their IP range.
set neighbor-group advpn
# The neighbor-group parameter is used to apply pre-defined settings (such as AS number) to dynamically discovered BGP neighbors.
# The advpn neighbor-group is already defined in the configuration, and assigning it to the neighbor-range ensures consistent BGP settings for all spoke neighbors.
set prefix 172.16.1.0 255.255.255.0
# This command allows dynamic BGP peer discovery by defining a range of potential neighbor IPs (172.16.1.1 - 172.16.1.255).
# Since each spoke has a unique /32 IP within this subnet, this ensures that any spoke within the 172.16.1.0
/24 range can automatically establish a BGP session with the hub.
NEW QUESTION # 32
Refer to the exhibit, which shows an enterprise network connected to an internet service provider.
An administrator must configure a loopback as a BGP source to connect to the ISP.
Which two commands are required to establish the connection? (Choose two.)
- A. update-source
- B. recursive-next-hop
- C. ibgp-enforce-multihop
- D. ebgp-enforce-multihop
Answer: A,D
Explanation:
When configuring a loopback interface as the BGP source for connecting to an ISP, two important settings must be applied:
1. Enable EBGP Multihop (ebgp-enforce-multihop)
BGP normally expects directly connected neighbors, but since the ISP and FortiGate A are using loopback interfaces, packets will not be sent directly between their physical interfaces.
The ebgp-enforce-multihop command allows BGP to form an eBGP peering over multiple hops.
2. Set the Update Source (update-source)
Since FortiGate is using a loopback interface as the source, the update-source command ensures that BGP updates originate from the loopback interface rather than a physical interface.
This is essential because BGP peers must match the source IP with the configured neighbor address.
NEW QUESTION # 33
Refer to the exhibit, which shows a partial enterprise network.
An administrator would like the area 0.0.0.0 to detect the external network.
What must the administrator configure?
- A. Configure a virtual link between FortiGate A and B.
- B. Enable RIP redistribution on FortiGate B.
- C. Configure a distribute-route-map-in on FortiGate B.
- D. Set the area 0.0.0.l type to stub on FortiGate A and B.
Answer: B
Explanation:
The diagram shows a multi-area OSPF network where:
# FortiGate A is in OSPF Area 0 (Backbone area).
# FortiGate B is in OSPF Area 0.0.0.1 and is connected to an RIP network.
To ensure that OSPF Area 0 (0.0.0.0) learns routes from the external RIP network, FortiGate B must redistribute RIP routes into OSPF.
Steps to achieve this:
1. Enable route redistribution on FortiGate B to inject RIP-learned routes into OSPF.
2. This allows OSPF Area 0.0.0.1 to forward RIP routes to OSPF Area 0 (0.0.0.0), making the external network visible.
NEW QUESTION # 34
A vulnerability scan report has revealed that a user has generated traffic to the website example.com (10.10.10.10) using a weak SSL/TLS version supported by the HTTPS web server.
What can the firewall administrator do to block all outdated SSL/TLS versions on any HTTPS web server to prevent possible attacks on user traffic?
- A. Install the required certificate in the client's browser or use Active Directory policies to block specific websites as defined in the SSL/SSH inspection profile.
- B. Use the latest certificate, Fortinet_SSL_ECDSA256, and replace the CA certificate in the SSL/SSH inspection profile.
- C. Enable auto-detection of outdated SSL/TLS versions in the SSL/SSH inspection profile to block vulnerable websites.
- D. Configure the unsupported SSL version and set the minimum allowed SSL version in the HTTPS settings of the SSL/SSH inspection profile.
Answer: D
Explanation:
The best way to block outdated SSL/TLS versions is to configure the SSL/SSH inspection profile to enforce a minimum SSL/TLS version and disable weak SSL versions.
By setting the minimum allowed SSL version in the HTTPS settings of the SSL/SSH inspection profile, FortiGate will:
# Block any connection using outdated SSL/TLS versions (such as SSLv3, TLS 1.0, or TLS 1.1).
# Enforce secure communication using only strong SSL/TLS versions (such as TLS 1.2 or TLS 1.3).
# Protect users from man-in-the-middle (MITM) and downgrade attacks that exploit weak encryption.
NEW QUESTION # 35
Refer to the exhibit, which shows a LAN interface connected from FortiGate to two FortiSwitch devices.
What two conclusions can you draw from the corresponding LAN interface? (Choose two.)
- A. You must enable STP or RSTP on FortiGate and FortiSwitch to avoid layer 2 loopbacks.
- B. FortiGate is using an SD-WAN-type interface to connect to a FortiSwitch device with MCLAG.
- C. This connection is using a FortiLInk to manage VLANs on FortiGate.
- D. The LAN interface must use a 802.3ad type interface.
Answer: C,D
Explanation:
The diagram shows a FortiGate connected to two FortiSwitches, which suggests the use of FortiLink, Fortinet's protocol for managing switches directly from a FortiGate. Since multiple connections are being used, the LAN interface must be set to 802.3ad (LAG) mode to aggregate the links for redundancy and load balancing.
This setup allows FortiGate to handle VLAN assignments dynamically, as seen with VLAN 10 (192.168.15.1
/24). FortiLink ensures seamless integration between FortiGate and FortiSwitches, making STP unnecessary because Fortinet's MCLAG prevents loops at Layer 2. SD-WAN, on the other hand, is used for WAN interfaces and does not apply to switch connectivity in this scenario.
NEW QUESTION # 36
Refer to the exhibit.
The routing tables of FortiGate_A and FortiGate_B are shown. FortiGate_A and FortiGate_B are in the same autonomous system.
The administrator wants to dynamically add only route 172.16.1.248/30 on FortiGate_A.
What must the administrator configure?
- A. A BGP route map in for 172.16.1.248/30 on FortiGate_A
- B. The prefix 172.16.1.248/30 in the BGP Networks section on FortiGate_B
- C. Enable Redistribute Connected in the BGP section on FortiGate_B.
- D. A BGP route map out for 172.16.1.248/30 on FortiGate_B
Answer: D
Explanation:
FortiGate_A and FortiGate_B are in the same autonomous system (AS), and FortiGate_A does not currently have route 172.16.1.248/30 in its routing table. However, FortiGate_B has this route as a connected route.
To dynamically advertise only 172.16.1.248/30 from FortiGate_B to FortiGate_A, the administrator must configure a BGP route map out on FortiGate_B that specifically permits only this prefix.
A BGP route map out on FortiGate_B controls which routes FortiGate_B advertises to FortiGate_A. If no filtering is applied, FortiGate_B might advertise all BGP-learned and connected routes, which is not what the administrator wants. The route map should include a prefix-list that explicitly allows only 172.16.1.248/30 and denies everything else.
NEW QUESTION # 37
An administrator is extensively using VXLAN on FortiGate.
Which specialized acceleration hardware does FortiGate need to improve its performance?
- A. ##9
- B. NTurbo
- C. NP7
- D. SP5
Answer: C
Explanation:
VXLAN (Virtual Extensible LAN) is an overlay network technology that extends Layer 2 networks over Layer 3 infrastructure. When VXLAN is used extensively on FortiGate, hardware acceleration is crucial for maintaining performance.
# NP7 (Network Processor 7) is Fortinet's latest network processor designed to accelerate high-performance networking features, including:
# VXLAN encapsulation/decapsulation
# IPsec VPN offloading
# Firewall policy enforcement
# Advanced threat protection at wire speed
NP7 significantly reduces latency and improves throughput when handling VXLAN traffic, making it the best choice for large-scale VXLAN deployments.
NEW QUESTION # 38
Refer to the exhibit, which contains a partial VPN configuration.
What can you conclude from this VPN IPsec phase 1 configuration?
- A. FortiGate will not add a route to its routing or forwarding information base when the dynamic tunnel is negotiated.
- B. A separate interface is created for each dial-up tunnel, which can be slower and more resource intensive, especially in large networks.
- C. Peer IDs are unencrypted and exposed, creating a security risk.
- D. This configuration is the best for networks with regular traffic intervals, providing a balance between connectivity assurance and resource utilization.
Answer: D
Explanation:
This IPsec Phase 1 configuration defines a dynamic VPN tunnel that can accept connections from multiple peers. The settings chosen here suggest a configuration optimized for networks with intermittent traffic patterns while ensuring resources are used efficiently.
Key configurations and their impact:
# set type dynamic # This allows multiple peers to establish connections dynamically without needing predefined IP addresses.
# set ike-version 2 # Uses IKEv2, which is more efficient and supports features like EAP authentication and reduced rekeying overhead.
# set dpd on-idle # Dead Peer Detection (DPD) is triggered only when the tunnel is idle, reducing unnecessary keep-alive packets and improving resource utilization.
# set add-route enable # FortiGate automatically adds the route to the routing table when the tunnel is established, ensuring connectivity when needed.
# set proposal aes128-sha256 aes256-sha256 # Uses strong encryption and hashing algorithms, ensuring a secure connection.
# set keylife 28800 # Sets a longer key lifetime (8 hours), reducing the frequency of rekeying, which is beneficial for stable connections.
Because DPD is set to on-idle, the tunnel will not constantly send keep-alive messages but will still ensure connectivity when traffic is detected. This makes the configuration ideal for networks with regular but non- continuous traffic, balancing security and resource efficiency.
NEW QUESTION # 39
A company that acquired multiple branches across different countries needs to install new FortiGate devices on each of those branches. However, the IT staff lacks sufficient knowledge to implement the initial configuration on the FortiGate devices.
Which three approaches can the company take to successfully deploy advanced initial configurations on remote branches? (Choose three.)
- A. Add FortiGate devices on FortiManager as model devices, and use ZTP or LTP to connect to FortiGate devices.
- B. Use the Global ADOM to deploy global object configurations to each FortiGate device.
- C. Apply Jinja in the FortiManager scripts for large-scale and advanced deployments.
- D. Use metadata variables to dynamically assign values according to each FortiGate device.
- E. Use provisioning templates and install configuration settings at the device layer.
Answer: A,D,E
Explanation:
Use metadata variables to dynamically assign values according to each FortiGate device:
Metadata variables in FortiManager allow device-specific configurations to be dynamically assigned without manually configuring each FortiGate. This is especially useful when deploying multiple devices with similar base configurations.
Use provisioning templates and install configuration settings at the device layer:
Provisioning templates in FortiManager provide a structured way to configure FortiGate devices. These templates can define interfaces, policies, and settings, ensuring that each device is correctly configured upon deployment.
Add FortiGate devices on FortiManager as model devices, and use ZTP or LTP to connect to FortiGate devices:
Zero-Touch Provisioning (ZTP) and Local Touch Provisioning (LTP) help automate the deployment of FortiGate devices. By adding devices as model devices in FortiManager, configurations can be pushed automatically when devices connect for the first time, reducing manual effort.
NEW QUESTION # 40
A user reports that their computer was infected with malware after accessing a secured HTTPS website.
However, when the administrator checks the FortiGate logs, they do not see that the website was detected as insecure despite having an SSL certificate and correct profiles applied on the policy.
How can an administrator ensure that FortiGate can analyze encrypted HTTPS traffic on a website?
- A. The administrator must enable DNS over TLS to protect against fake Server Name Indication (SNI) that cannot be analyzed in common DNS requests on HTTPS websites.
- B. The administrator must enable URL extraction from SNI on the SSL certificate inspection to ensure the TLS three-way handshake is correctly analyzed by FortiGate.
- C. The administrator must enable reputable websites to allow only SSL/TLS websites rated by FortiGuard web filter.
- D. The administrator must enable full SSL inspection in the SSL/SSH Inspection Profile to decrypt packets and ensure they are analyzed as expected.
Answer: D
Explanation:
FortiGate, like other security appliances, cannot analyze encrypted HTTPS traffic unless it decrypts it first. If only certificate inspection is enabled, FortiGate can see the certificate details (such as the domain and issuer) but cannot inspect the actual web content.
To fully analyze the traffic and detect potential malware threats:
# Full SSL inspection (Deep Packet Inspection) must be enabled in the SSL/SSH Inspection Profile.
# This allows FortiGate to decrypt the HTTPS traffic, inspect the content, and then re-encrypt it before forwarding it to the user.
# Without full SSL inspection, threats embedded in encrypted traffic may go undetected.
NEW QUESTION # 41
An administrator must standardize the deployment of FortiGate devices across branches with consistent interface roles and policy packages using FortiManager.
What is the recommended best practice for interface assignment in this scenario?
- A. Create interfaces using device database scripts to use them on the same policy package of FortiGate devices.
- B. Use the Install On feature in the policy package to automatically assign different interfaces based on the branch.
- C. Enable metadata variables to use dynamic configurations in the standard interfaces of FortiManager.
- D. Create normalized interface types per-platform to automatically recognize device layer interfaces based on the FortiGate model and interface name.
Answer: C
Explanation:
When standardizing the deployment of FortiGate devices across branches using FortiManager, the best practice is to use metadata variables. This allows for dynamic interface configuration while maintaining a single, consistent policy package for all branches.
# Metadata variables in FortiManager enable interface roles and configurations to be dynamically assigned based on the specific FortiGate device.
# This ensures scalability and consistent security policy enforcement across all branches without manually adjusting interface settings for each device.
# When a new branch FortiGate is deployed, metadata variables automatically map to the correct physical interfaces, reducing manual configuration errors.
NEW QUESTION # 42
An administrator configured the FortiGate devices in an enterprise network to join the Fortinet Security Fabric. The administrator has a list of IP addresses that must be blocked by the data center firewall. This list is updated daily.
How can the administrator automate a firewall policy with the daily updated list?
- A. With FortiAnalyzer
- B. With an external connector from Threat Feeds
- C. With a Security Fabric automation
- D. With FortiNAC
Answer: B
Explanation:
The best way to automate a firewall policy using a daily updated list of IP addresses is by using an external connector from Threat Feeds. This allows FortiGate to dynamically retrieve real-time threat intelligence from external sources and apply it directly to security policies.
By configuring Threat Feeds, the administrator can:
# Automatically update firewall policies with the latest malicious IPs daily.
# Block traffic from those IPs in real-time without manual intervention.
# Integrate with FortiGuard, third-party threat intelligence sources, or custom feeds (CSV, STIX
/TAXII, etc.).
NEW QUESTION # 43
Refer to the exhibits.
The configuration of a user's Windows PC, which has a default MTU of 1500 bytes, along with FortiGate interfaces set to an MTU of 1000 bytes, and the results of PC1 pinging server 172.16.0.254 are shown.
Why is the user in Windows PC1 unable to ping server 172.16.0.254 and is seeing the message: Packet needs to be fragmented but DF set?
- A. FortiGate honors the do not fragment bit and the packets are dropped. The user has to adjust the ping MTU to 972 to succeed.
- B. The user must trigger different traffic because path MTU discovery techniques do not recognize ICMP payloads.
- C. Option ip.flags.mf must be set to enable on FortiGate. The user has to adjust the ping MTU to 1000 to succeed.
- D. Fragmented packets must be encrypted. To connect any application successfully, the user must install the Fortinet_CA certificate in the Microsoft Management Console.
Answer: A
Explanation:
The issue occurs because FortiGate enforces the "do not fragment" (DF) bit in the packet, and the packet size exceeds the MTU of the network path. When the Windows PC1 (with an MTU of 1500 bytes) attempts to send a 1400-byte packet, the FortiGate interface (with an MTU of 1000 bytes) needs to fragment it. However, since the DF bit is set, FortiGate drops the packet instead of fragmenting it.
To resolve this, the user should adjust the ping packet size to fit within the path MTU. In this case, reducing the packet size to 972 bytes (1000 bytes MTU minus 28 bytes for the IP and ICMP headers) should allow successful transmission.
NEW QUESTION # 44
An administrator applied a block-all IPS profile for client and server targets to secure the server, but the database team reported the application stopped working immediately after.
How can an administrator apply IPS in a way that ensures it does not disrupt existing applications in the network?
- A. Select flow mode in the IPS profile to accurately analyze application patterns.
- B. Limit the IPS profile to server targets only to avoid blocking connections from the server to clients.
- C. Set the IPS profile signature action to default to discard all possible false positives.
- D. Use an IPS profile with all signatures in monitor mode and verify patterns before blocking.
Answer: D
Explanation:
Applying an aggressive IPS profile without prior testing can disrupt legitimate applications by incorrectly identifying normal traffic as malicious. To prevent disruptions while still monitoring for threats:
# Enable IPS in "Monitor Mode" first:
# This allows FortiGate to log and analyze potential threats without actively blocking traffic.
# Administrators can review logs and fine-tune IPS signatures to minimize false positives before switching to blocking mode.
# Verify and adjust signature patterns:
# Some signatures might trigger unnecessary blocks for legitimate application traffic.
# By analyzing logs, administrators can disable or modify specific rules causing false positives.
NEW QUESTION # 45
Refer to the exhibit, which shows an ADVPN network.
The client behind Spoke-1 generates traffic to the device located behind Spoke-2.
What is the first message that the hub sends to Spoke-1 to bring up the dynamic tunnel?
- A. Shortcut forward
- B. Shortcut reply
- C. Shortcut offer
- D. Shortcut query
Answer: C
Explanation:
In an ADVPN (Auto-Discovery VPN) network, a dynamic VPN tunnel is established on-demand between spokes to optimize traffic flow and reduce latency.
Process:
1. Traffic Initiation:
A client behind Spoke-1 sends traffic to a device behind Spoke-2.
The traffic initially flows through the hub, following the pre-established overlay tunnel.
2. Hub Detection:
The hub detects that Spoke-1 is communicating with Spoke-2 and determines that a direct shortcut tunnel between the spokes can optimize the connection.
3. Shortcut Offer:
The hub sends a "Shortcut Offer" message to Spoke-1, informing it that a direct dynamic tunnel to Spoke-
2 is possible.
4. Tunnel Establishment:
Spoke-1 and Spoke-2 then negotiate and establish a direct IPsec tunnel for communication.
NEW QUESTION # 46
Refer to the exhibit, which shows a command output.
FortiGate_A and FortiGate_B are members of an FGSP cluster in an enterprise network.
While testing the cluster using the ping command, the administrator monitors packet loss and found that the session output on FortiGate_B is as shown in the exhibit.
What could be the cause of this output on FortiGate_B?
- A. The session synchronization is encrypted.
- B. FortiGate_A and FortiGate_B have the same standalone-group-id value.
- C. FortiGate_B is configured in passive mode.
- D. session-pickup-connectionless is set to disable on FortiGate_B.
Answer: D
Explanation:
The Fortinet FGSP (FortiGate Session Life Support Protocol) cluster allows session synchronization between two FortiGate devices to provide seamless failover. However, ICMP (ping) is a connectionless protocol, and by default, FortiGate does not synchronize connectionless sessions unless explicitly enabled.
In the exhibit:
# The command get system session list | grep icmp on FortiGate_B returns no output, meaning that ICMP sessions are not being synchronized from FortiGate_A.
# If session-pickup-connectionless is disabled, FortiGate_B will not receive ICMP sessions, causing packet loss during failover.
NEW QUESTION # 47
Refer to the exhibits.
The Administrators section of a root FortiGate device and the Security Fabric Settings section of a downstream FortiGate device are shown.
When prompted to sign in with Security Fabric in the downstream FortiGate device, a user enters the AdminSSO credentials.
What is the next status for the user?
- A. The user accesses the downstream FortiGate with super_admin privileges.
- B. The user accesses the downstream FortiGate with super_admin_readonly privileges.
- C. The user receives an authentication failure message.
- D. The user is prompted to create an SSO administrator account for AdminSSO.
Answer: B
Explanation:
From the Root FortiGate - System Administrator Configuration exhibit:
# The AdminSSO account has the super_admin_readonly role.
From the Downstream FortiGate - Security Fabric Settings exhibit:
# The Security Fabric role is set to Join Existing Fabric, meaning it will authenticate with the root FortiGate.
# SAML Single Sign-On (SSO) is enabled, and the default admin profile is set to super_admin_readonly.
When the AdminSSO user logs into the downstream FortiGate using SSO, the authentication request is sent to the root FortiGate, where AdminSSO has super_admin_readonly permissions. Since the downstream FortiGate inherits this permission through the Security Fabric configuration, the user will be granted super_admin_readonly access.
NEW QUESTION # 48
......
FCSS_EFW_AD-7.6 Dumps - Pass Your Certification Exam: https://realtest.free4torrent.com/FCSS_EFW_AD-7.6-valid-dumps-torrent.html