Free FCSS – Network Security 7.4 Support Engineer Exam FCSS_NST_SE-7.4 Exam Practice Test

Consider the scenario where the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate.Which action will FortiGate take when using the default settings for SSL certificate inspection?

• FortiGate uses the SNI from the user's web browser.
• FortiGate closes the connection because this represents an invalid SSL/TLS configuration.
• FortiGate uses the first entry listed in the SAN field in the server certificate.
• FortiGate uses the ZN information from the Subject field in the server certificate.

Which authentication option can you not configure under config user radius on FortiOS?

• mschap
• pap
• mschap2
• eap

In which two slates is a given session categorized as ephemeral? (Choose two.)

• A UDP session with only one packet received
• A UOP session with packets sent and received
• A TCP session waiting for the SYN ACK
• A TCP session waiting for FIN ACK

In IKEv2, which exchange establishes the first CHILD_SA?

• IKE_SA_INIT
• INFORMATIONAL
• CREATE_CHILD_SA
• IKE_Auth

Which statement about protocol options is true?

• Protocol options allow administrators to configure a maximum number of sessions for each configured protocol.
• Protocol options give administrators a streamlined method to instruct FortiGate to block all sessions corresponding to disabled protocols.
• Protocol options allow administrators to configure the Any setting for all enabled protocols, which provides the most efficient use of system resources.
• Protocol options allow administrators to configure which Layer 4 port numbers map to upper-layer protocols, such as HTTP, SMTP, FTP, and so on.

What are two reasons you might see iprope_in_check() check failed, drop when using the debug flow? (Choose two.)

• Packet was dropped because of policy route misconfiguration.
• Packet was dropped because of traffic shaping.
• Trusted host list misconfiguration.
• VIP or IP pool misconfiguration.

Which two statements about an auxiliary session ate true? (Choose two.)

• With the auxiliary session selling disabled, only auxiliary sessions are ofloaded.
• With the auxiliary session setting enabled. ECMP traffic is accelerated to the NP6 processor.
• With the auxiliary session setting enabled. Iwo sessions are created in case of routing change.
• With the auxiliary session setting disabled, for each traffic path. FortiGate uses the same auxiliary session.

An administrator wants to capture encrypted phase 2 traffic between two FotiGate devices using the built-in sniffer.If the administrator knows that there Is no NAT device located between both FortiGate devices, which command should the administrator run?

• diagnose sniffer packet any 'udp port 500'
• diagnose sniffer packet any 'lp proto 50'
• diagnose sniffer packet any 'udp port 4500'
• diagnose sniffer packet any 'ah'

Which exchange lakes care of DoS protection in IKEv2?

• Create_CHILD_SA
• IKE_Auth
• IKE_Req_INIT
• IKE_SA_NIT

Which two statements are true regarding heartbeat messages sent from an FSSO collector agent to FortiGate? (Choose two.)

• The heartbeat messages can be seen using the command diagnose debug authd fsso list.
• The heartbeat messages can be seen in the collector agent logs.
• The heartbeat messages can be seen on FortiGate using the real-lime FSSO debug.
• The heartbeat messages must be manually enabled on FortiGate.