Free Practice Questions for the Fortinet Certified Solution Specialist FCSS_NST_SE-7.6 Exam (2026 Updated)

The correct answers are A and B .

The exhibit shows:

override: disable

both members are currently in-sync

only port7 appears under HBDEV stats , so it is the active heartbeat interface

the cluster is in HA A-P mode

Why A is correct:

With override disabled , after a failover the new primary keeps that role when the old primary comes back. The FortiOS administration guide states:

“When the primary FortiGate rejoins the cluster the secondary FortiGate continues to operate as the primary FortiGate.”

So if FGVM...649 reboots and FGVM...650 becomes primary, FGVM...650 will remain primary after FGVM...649 rejoins.

Why B is correct:

The study guide states:

“When FortiGate devices configured in an HA cluster lose communication with each other on the heartbeat interface, each FortiGate assumes the role of the primary device.”

The exhibit shows only port7 as the heartbeat device in HBDEV stats

So if port7 is disconnected and heartbeat communication is lost, the cluster can enter a split-brain condition, where both units believe they are primary. The FortiOS administration guide confirms the same behavior: loss of heartbeat communication causes each member to think it is the primary

Why the other options are wrong:

C is wrong because configuration synchronization status is specifically used to detect whether secondary members remain synchronized with the primary. If members are no longer synchronized, the status changes from in-sync to out-of-sync

D is wrong because the study guide explains that during a configuration change, checksums may differ briefly while changes are copied, but it does not describe this as the secondary initiating a “synchronization reset”

So the verified answers are: A, B .

To solve this high CPU usage scenario involving the ipsengine, we must understand the specific functions of the diagnose test application ipsmonitor commands shown in the troubleshooting steps.

Analyze the Situation:

Exhibit: The diagnose sys top output shows the ipsengine process is in a run state (R) consuming 99% CPU.

Previous Action: The administrator already ran diagnose test application ipsmonitor 5.

Result: The CPU usage did not drop.

Understand the Commands:

diagnose test application ipsmonitor 5: This command toggles IPS Bypass Mode. When enabled, the IPS engine lets traffic pass through without inspection.

Implication: If the CPU was high due to traffic volume, enabling bypass would drop the CPU load immediately.

Failure: Since the CPU remained at 99% after bypass, the ipsengine process is likely frozen, stuck, or in an internal infinite loop unrelated to the current traffic flow. The process itself is the problem, not the traffic volume.

Evaluate the Solution (Option B):

diagnose test application ipsmonitor 2: This command toggles the IPS engine ' s Enable/Disable status.

Because the engine is stuck (bypass failed to relieve pressure), the " Immediate action " required is to stop or restart the process entirely.

Running option 2 effectively disables/kills the stuck IPS engine instance, which will immediately drop the CPU usage to near zero. (It can then be toggled again to restart it).

Why other options are incorrect:

A (Reduce signatures): This is a tuning measure for normal operation, not an immediate fix for a stuck process at 99% CPU.

C (Disable IPS on policies): This is a configuration change that takes time and requires a commit; it is not the most immediate diagnostic tool available.

D (Bypass all IPS engines): This describes the action of command 5 (Bypass), which the prompt explicitly states was already performed and failed.

The study guide explicitly explains the FortiGuard flags shown by diagnose debug rating:

D = Default

“IP addresses of servers received from DNS resolution”

It then clarifies even more specifically:

“D = The IP address FortiGate got when resolving the service.fortiguard.net name (usually two or three servers have this flag, if the administrator didn ' t overwrite the FortiGuard FQDN or IP address in the FortiGate configuration)”

In the exhibit, among the answer choices, the IP address marked with the D flag is 208.91.112.194 . Therefore, that is the IP FortiGate got from resolving service.fortiguard.net.

Why the other options are wrong:

B. 209.22.147.36 is not the correct choice because in the exhibit it is not the DNS-resolution entry identified by the D flag

C. 64.26.151.37 has no D flag

D. 96.45.33.65 has no D flag

So the verified answer is: A .

To determine why sessions are being removed, we must interpret the specific counters in the diagnose sys session stat output provided in the exhibit.

Analyze memory_tension_drop (Reason A):

Observation: The output shows memory_tension_drop=4.

This counter specifically increments when the FortiGate kernel attempts to allocate a new memory page for a session but fails due to a lack of available system memory. As a result, the session creation is aborted or an existing session is dropped to free up resources. This confirms that the kernel is struggling to allocate memory pages.

Analyze extreme_low_mem (Reason D):

Observation: The output shows extreme_low_mem=0 (which is good), but we must look at the context of memory_tension_drop.

Context: While the extreme_low_mem counter itself is 0 in this snapshot, the presence of memory_tension_drop indicates the system is under memory pressure. Furthermore, in many Fortinet exam contexts involving this specific exhibit, the focus is on the mechanism of " flushing sessions " to recover memory.

Refinement: Actually, look closer at the exhibit. It shows flush=787.

The flush counter indicates the number of times the system has actively purged (flushed) old or stale sessions from the table to recover memory or due to policy changes. A high flush count combined with memory tension drops strongly suggests the system is aggressively removing sessions to handle high memory usage. Therefore, " FortiGate is flushing sessions because of high memory usage " is the correct interpretation of the flush and memory_tension_drop counters working together.

Why other options are incorrect:

B: There is no counter in this specific output (like tcp_syn_sent drop) that indicates dropping incomplete handshakes. The clash=0 and delete=0 counters are low/zero.

C: The dev_down=16/120 field does not mean the device was down for 10 seconds. It refers to device index pointers or internal kernel interface states, not system uptime/downtime impacting session acceptance in the way described.

The correct answers are A and C .

The study guide describes this exact asymmetric ICMP scenario. It states:

“The server sends an echo request to the PC through port2 of the local router, effectively bypassing FortiGate. When it receives the echo request, the PC responds with an echo reply through its default gateway, 10.1.0.2, which is port1 on FortiGate. Because there is no existing session, the echo reply is dropped. All subsequent echo replies are blocked.”

That means the current problem exists because:

the ICMP request bypasses FortiGate

the ICMP reply goes through FortiGate

FortiGate has no matching session , so it drops the reply

The study guide then shows the exact corrective option:

“Allowing asymmetric routing:”

config system settings

set asymroute enable

end

It further explains:

“After the packet passes through the FortiGate CPU, FortiGate forwards the packet using the FIB, even though there are no session matches. FortiGate forwards all subsequent echo replies using the FIB.”

So A is correct.

The other valid fix is to make the traffic symmetric by changing the laptop’s default gateway so the reply no longer goes through FortiGate. In the exhibit, the alternate gateway is 10.1.0.254 , which is the local router on the same subnet. If the laptop uses 10.1.0.254 instead of 10.1.0.2, the ICMP echo reply follows the same bypass path as the echo request, so the server receives it without involving FortiGate session validation. This makes C correct.

Why the other options are wrong:

B is wrong because this is not an RPF problem. The study guide explains RPF as a reverse path lookup used to validate whether a packet arrived on a legitimate interface, mainly for spoofing protection. The issue in this scenario is a missing session due to asymmetric routing , not a strict-versus-feasible RPF failure

D is wrong because FortiGate already has the specific route 10.4.0.0/24 through port3 in the routing table shown in the exhibit, so adding a default static route to port3 is unnecessary and not the reason the echo reply is being dropped

So the verified answers are: A, C .

The session output includes the flags:

state=redir local may_dirty ...

npu_state=00000000

offload=0/0

The 7.6 study guide explains these flags directly:

local = “Session is to/from local stack”

redir = “Session is being processed by an application layer proxy”

may_dirty = “Session is allowed by a firewall policy”

This makes C correct, because the local flag means the session either originates from FortiGate or terminates on FortiGate . The FortiOS administration guide states the same meaning: “Session is originated from or destined for local stack.”

This also makes A correct. The redir flag means the session is handled by an application-layer proxy . FortiOS documents explain that proxy-based inspection buffers traffic on the FortiGate and inspects it there, and that proxy-based processing is CPU and memory-intensive

Since the session also shows no NPU offload (npu_state=00000000, offload=0/0), this traffic is being handled in software/CPU, not by the NPU.

Why the other options are wrong:

B is wrong because the redir flag proves the session is not passing without inspection; it is being processed by an application-layer proxy

D is wrong because there is no authentication flag in this session. In Fortinet examples of captive portal/authentication-related sessions, the session state includes auth or authed flags. The study guide shows: “Any session for traffic coming from an authenticated user contains the authed flag.” This exhibit does not show auth or authed, so there is no basis to conclude the client was redirected to a captive portal for authentication.

Comprehensive and Detailed Explanation From Exact Extract of Network Security Support Engineer Study Guide (FortiOS 7.6) topics:

The correct answers are A and B . Security Fabric communication uses Fortinet-proprietary protocols, mainly FortiTelemetry and Neighbor Discovery . The study guide states that FortiTelemetry uses TCP port 8013 , and that the connection is always established by the downstream FortiGate toward the upstream FortiGate . This validates option A . The same section also states that FortiTelemetry must be manually enabled . More precisely, the upstream FortiGate interface must have Security Fabric Connection enabled under administrative access so it can accept incoming Security Fabric connection requests. This validates option B .

Option C is wrong because only the FortiTelemetry TCP port 8013 can be changed; Neighbor Discovery uses UDP port 8014 and cannot be changed. Option D is also wrong because Security Fabric communication is not enabled automatically among all Fortinet devices. It requires the correct Security Fabric settings, interface administrative access, and downstream authorization. The study guide’s troubleshooting section confirms that when FortiTelemetry is disabled, the upstream FortiGate receives TCP 8013 SYN packets but does not complete the Security Fabric connection.

The debug flow message iprope_in_check() check failed, drop specifically indicates a failure in the Local-In Policy check. The " iprope " (IP ROouting Policy Enforcement) engine handles policy lookups. The _in_check suffix confirms that the decision is regarding traffic destined to the FortiGate itself (Local-In traffic), rather than traffic passing through it.

D. The packet was dropped because the requested service is not enabled on FortiGate:

This is the most common cause. When a packet arrives destined for the FortiGate ' s interface IP (e.g., an HTTPS or SSH request), the kernel checks if that specific service is enabled in the interface settings (set allowaccess). If the service is not enabled (e.g., trying to Ping an interface where PING access is disabled), the iprope_in_check function fails and drops the packet immediately.

C. The packet was dropped because the trusted host list is misconfigured:

Even if the service (e.g., HTTPS) is enabled on the interface, the FortiGate checks the Administrator settings. If Trusted Hosts are configured, the source IP of the incoming packet is compared against the allowed list. If the IP is not on the list, the Local-In policy check (iprope_in_check) fails, and the packet is dropped to secure the management plane.

Why other options are incorrect:

A: If traffic is dropped by a standard Firewall Policy (traffic passing through the device from one interface to another), the debug message will typically state denied by policy x or no matching policy. It would generally be a forward check (iprope_fwd_check or similar), not an _in_check.

B: If there is no route to the source, the error is a Reverse Path Forwarding (RPF) failure. The debug flow logs this explicitly as reverse path check fail, drop.

The partial output from diagnose hardware sysinfo memory provides details on system RAM allocation. According to Fortinet ' s technical documentation for memory troubleshooting and Linux memory management (which FortiOS is based on):

MemFree is the portion of physical memory not currently allocated to any running process or kernel function. Thus, 708880 kB is available and can be immediately used by user-space programs or system operations.

Inactive refers to pages in the memory cache that were previously in use for I/O or file system buffering but are now not actively referenced. These pages are retained in memory for quick access if needed again, but can be reclaimed for other memory operations if demand increases. The value 98908 kB here represents currently unused cache pages (inactive pages), ready for repurposing or deletion if the system requires more RAM.

Cached represents the total amount of system memory allocated to cache, which includes both active and inactive cache pages. It does not, by itself, represent I/O cache exclusively, nor does " inactive " mean memory “will never be used” as the kernel can re-purpose inactive pages on demand.

The correct answers are A and D .

The debug output shows:

Sent RADIUS req to server ' RadiusServer ' : IP=172.25.188.164 ... user= " student " using CHAP

Result for radius svr ' RadiusServer ' 172.25.188.164(0) is 0

Sending result 0 for req 2

The study guide explains that in RADIUS real-time debug, FortiGate shows the IP address of the RADIUS server it is querying. In the example, it says FortiGate “creates an access request to the RADIUS server at IP address 10.0.13.130” and shows the line Sent radius req to server ... IP=10.0.13.130

So in your exhibit, the queried server is clearly 172.25.188.164 , which makes A correct.

The study guide also states:

“The message fnbamd_comm_send_result-Sending result 0 indicates that the authentication was successful and that FortiGate received the Access-Accept message.”

Since your exhibit also ends with Sending result 0 , that makes D correct.

Why the other options are wrong:

B is wrong because result 0 means authentication successful , not failed

C is wrong because the debug explicitly shows using CHAP , and the study guide lists supported RADIUS schemes as CHAP, PAP, MS-CHAP, and MS-CHAPv2

E is wrong because the study guide says two-factor authentication would involve an Access-Challenge response: “If two-factor authentication is enabled on the server, the response is an Access-Challenge message” Your exhibit shows successful result 0 / Access-Accept , not a challenge.

So the verified answers are: A, D .

The study guide states:

“The kernel memory slabs are collections of objects with a common purpose. The kernel uses them to store information in memory.”

It also gives the exact calculation rule:

“Total slab size = available objects x object size”

From the exhibit:

tcp_session 3 5 1500 ...

So:

available objects = 5

object size = 1500

Therefore:

Total slab size = 5 × 1500 = 7500 kB

That makes D correct, and it is associated with the kernel , not user space.

Why the other options are wrong:

A is wrong because sctp_session 0 0 1600 ... gives 0 × 1600 = 0 , but slabs are associated with the kernel , not user space.

B is wrong because ip_session 1 3 1200 ... gives 3 × 1200 = 3600 , but again slabs are kernel memory, not user space.

C is wrong because ip6_session 0 0 1300 ... gives 0 × 1300 = 0 , not 1300.

The correct answer is D. The inbound IPsec SA was copied to the NPU.

The exhibit shows:

npu_flag=02

dec_npuid=1

enc_npuid=0

The study guide gives the exact meaning of the npu_flag field:

npu_flag=00 = Both IPsec SAs loaded to the kernel

npu_flag=01 = Outbound IPsec SA copied to NPU

npu_flag=02 = Inbound IPsec SA copied to NPU

npu_flag=03 = Both outbound and inbound IPsec SAs copied to NPU

It also explains: “If the first IPsec packet is inbound and can be offloaded, the inbound SA is copied to the NPU and the npu_flag changes to 02. After both SAs are copied to the NPU, the npu_flag changes to 03.”

So with npu_flag=02, only the inbound SA has been copied to the NPU. That makes D correct.

Why the other options are wrong:

A is wrong because outbound-only offload would be npu_flag=01, not 02

C is wrong because both directions offloaded would be npu_flag=03, not 02

B is wrong because dec_npuid=1 identifies the NPU ID used for decryption, but it does not state that the processor is specifically NP6 . The study guide only maps the offload state through the npu_flag values in this context, not the NPU model from this field alone

So the verified answer is: D .

The get router info ospf database brief output on FGT-2 clearly indicates that Area 0.0.0.5 is configured as a [Stub] area.

In OSPF, a Stub Area is specifically designed to reduce the size of the Link State Database (LSDB) on internal routers. The primary behavior of a Stub area is that it does not accept Type 5 (AS External) LSAs .

FGT-3 is the ASBR (Autonomous System Border Router) and is importing static routes, which are generated as Type 5 LSAs in the OSPF domain.

FGT-1 acts as the ABR (Area Border Router). Because Area 0.0.0.5 is a Stub area, FGT-1 blocks these Type 5 LSAs from entering Area 0.0.0.5.

Consequently, FGT-2 will not receive the specific external routes advertised by FGT-3. Instead, the ABR (FGT-1) injects a default route (0.0.0.0/0) into the Stub area to allow connectivity to the external world, which is visible in the database output.

While the question text mentions FGT-3 not receiving routes, the definitive configuration shown in the exhibit is the Stub area setting, which directly corresponds to the blocking of Type 5 LSA propagation (Option A).

From the exhibit, you can observe that the debug output captures an IKEv1 negotiation in aggressive mode. Let ' s break down the supporting details in line with official Fortinet IPsec VPN troubleshooting resources and debug guides:

For Option B:

The very first line of the debug output shows:

comes 10.0.0.2:500- > 10.0.0.1:500, ifindex=7.

This indicates the traffic direction—from the remote IP (10.0.0.2) with port 500 to the local IP (10.0.0.1) with port 500. According to Fortinet ' s documentation, the right side of the arrow always represents the local FortiGate gateway. Thus, 10.0.0.1 is the local gateway IP address.

For Option D:

You see the statement:

negotiation result " remote "

and

received peer identifier FQDNCE88525E7DE7F00D6C2D3C00000000

Official debug documentation describes that the " peer identifier " or peer ID sent by the initiator is displayed here. In the context of IKE/IPsec negotiation, this value is used as the IPsec peer ID for authentication and identification purposes. The initiator is providing " remote " as the peer ID for its connection.

Why Not A or C:

Perfect Forward Secrecy (PFS): The debug does not show any DH group negotiation in phase 2 (no reference to group2, group5, etc., for phase 2), so you cannot deduce the presence of PFS solely from this output.

Phase 2 negotiation: The log focuses on IKE (phase 1) negotiation and establishment; there’s no reference to ESP protocol, Quick Mode, or other identifiers that would show phase 2 SA negotiation and establishment.

This interpretation aligns with the explanation in the FortiOS 7.6.4 Administration Guide ' s VPN section and the official debug command output samples published in Fortinet’s documentation. It demonstrates how to distinguish between local and remote addresses and how to identify the use of peer IDs.

The correct answers are B and D .

The study guide explains that in the SP Login Dump section, FortiGate is acting as the service provider (SP) , and that you should read these fields:

“The IdP SSO URL, from the setting idp-single-sign-on-url in the FortiGate configuration”

“The SP SSO URL, from the setting single-sign-on-url in the FortiGate configuration”

“The IdP Entity ID, from the setting id-entity-id in the FortiGate configuration”

“The SP Entity ID, from the setting entity-id setting in the FortiGate configuration”

In the exhibit:

Destination= " https://10.1.10.2/saml-idp/nst/login/ " → this is the IdP SSO URL

< lasso:RemoteProviderID > http://10.1.10.2/samlidp/nst/metadata/ < /lasso:RemoteProviderID > → this is the IdP Entity ID

AssertionConsumerServiceURL= " https://10.1.10.254:1003/remote/saml/login/ " → this is the SP SSO URL

< saml:Issuer > https://10.1.10.254:1003/remote/saml/metadata/ < /saml:Issuer > → this is the SP Entity ID

The same study-guide example shows this exact mapping pattern, where:

Destination points to the IdP

AssertionConsumerServiceURL and Issuer point to the SP

Therefore:

10.1.10.2 is the IdP → D

10.1.10.254 is the SP → B

So the verified answers are: B, D .

When FortiGate performs SSL certificate inspection with default settings, it checks if the Server Name Indication (SNI) matches either the Common Name (CN) or any Subject Alternative Name (SAN) in the server certificate. If there is no match, FortiGate does not block the connection; instead, it uses the CN value from the certificate ' s subject field to continue web filtering and categorization.

This behavior is described in the official Fortinet 7.6.4 Administration Guide:

“Check the SNI in the hello message with the CN or SAN field in the returned server certificate: Enable: If it is mismatched, use the CN in the server certificate.” This is the default (Enable) mode, which differs from the Strict mode that would block the mismatched connection.

By default, this policy ensures service continuity and prevents disruptions due to certificate mismatches, allowing FortiGate to log and inspect based on the CN even when the requested SNI does not match. It provides a balance between connection reliability and the accuracy of filtering by certificate identity, allowing security policies to remain functional without unnecessary blocks. This approach is recommended by Fortinet to maintain usability for end-users while still supporting granular inspection.

To capture encrypted IPsec phase 2 (ESP) traffic between two FortiGate devices, the correct protocol filter to use is ip proto 50. According to the Fortinet official sniffing and debugging documentation, ESP (Encapsulating Security Payload) is used for encrypted phase 2 payload transfer and always uses IP protocol number 50. Running the command diagnose sniffer packet any ' ip proto 50 '  captures only ESP packets, which represent the encrypted traffic—whether originating or transiting the device.

If there is no NAT device between FortiGates, ESP is not encapsulated in UDP (thus not on UDP port 4500; if NAT-T were required, packets would be UDP-encapsulated, but the scenario explicitly says NAT is not in use). UDP port 500 is for IKE control (negotiation) traffic, and AH (Authentication Header, ip proto 51) is not used for encryption in standard IPsec phase 2 with ESP.

This matches the official CLI reference from Fortinet for VPN and traffic analysis.

**

When the " auxiliary session " setting is enabled (typically via config system npu or implicitly for ECMP on NP6/NP7 processors), the FortiGate alters how it manages sessions to support hardware offloading for traffic that might switch interfaces (like ECMP or SD-WAN).

B. FortiGate accelerates all ECMP traffic to the NP6 processor:

The primary purpose of enabling auxiliary sessions is to ensure that ECMP traffic can be fully offloaded (accelerated) by the NPU. Without auxiliary sessions, if the kernel or routing engine switches a flow to a different outgoing interface (due to load balancing), the NPU might not recognize the flow for that new interface and would send the packet back to the CPU (slow path). Auxiliary sessions prevent this by pre-populating the NPU with the necessary information for all valid paths.

D. FortiGate creates two sessions in case of a routing change:

Technically, the FortiGate creates the primary session (for the currently selected path) and an auxiliary session (for the alternative path). In a standard two-path ECMP scenario, this results in " two sessions " existing in the session table for the same flow. This ensures that if a routing change occurs (e.g., the flow shifts to the second path), the traffic continues to be processed by the NPU without interruption or re-evaluation by the CPU.

The correct answers are C and D .

The study guide states: “SSL certificate inspection relies on extracting the FQDN of the URL from either: TLS extension server name indication (SNI), SSL certificate common name (CN).” It also says: “When using SSL certificate inspection, FortiGate is not decrypting the traffic. It is only inspecting the server digital certificates and the SNI field, which are interchanged before the encryption.”

This proves the second part of the answer:

under SSL certificate inspection , FortiGate does not decrypt the traffic

therefore, if the traffic is allowed , it still passes without decryption

That makes D correct.

For the SNI mismatch behavior, the FortiOS administration guide describes the default Server certificate SNI check behavior as:

“Enable: If it is mismatched use the CN in the server certificate for URL”

So if the SNI does not match the CN or any SAN, FortiGate falls back to using the CN from the Subject field for URL handling under the default setting. That makes C correct.

Why the other options are wrong:

A is wrong because with the default SNI-check behavior, when the SNI mismatches the certificate identity, FortiGate does not continue using the mismatched SNI . Instead, it uses the CN in the server certificate for the URL .

B is not the best answer in this single pair selection . While certificate inspection does not decrypt traffic, the key default behavior the documents explicitly highlight for this mismatch case is:

use the CN when SNI mismatches , and

certificate inspection does not decrypt allowed HTTPS traffic .

So the verified answers are: C, D .

The command on this slide shows a summary of the statuses of all the OSPF neighbors. For each neighbor, it displays the adjacency state and if it is a DR, a BDR, or neither (DROther) Pagina 362 Enterprise_Firewall_7.2_Study. - Point-to-point networks contain only two peers, one at each end of a point-to-point link - Broadcast networks (multi-access) support more than two attached routers. They also support sending messages to multiple recipients (broadcasting). Pagina 365 Enterprise_Firewall_7.2_Study. In any multi-access network there is one DR and one BDR. Pagina 439 Network_Security_Support_Engineer_7.4_Study FULL/- This represents a point-to-point network

The correct answers are A and D .

The Network Security Support Engineer 7.6 Study Guide explains that automation stitches consist of a trigger and one or more actions , and that they can detect events such as high CPU and conserve mode across the Security Fabric

The FortiOS administration guide then gives the exact practical example for A :

“Automation stitches can be created to run a CLI script and send an email message when memory or CPU usage exceeds specified thresholds.”

It also shows examples where the email body contains the script output using:

%%results%%

That directly confirms A .

For D , the FortiOS administration guide states:

“The URI and HTTP body can use parameters from logs or previous action results.”

It also explains the execution model:

“The stitch Action execution can be set to either Sequential or Parallel. In sequential execution actions will execute one after another with a delay (if specified). … In parallel execution all actions will execute immediately when the stitch is triggered.”

A concrete example shows a second action using the output of the first action:

“This string for the body text includes the results from the preceding CLI script action.” with

Body=%%results%%...

That confirms D .

Why the other options are wrong:

B is wrong because automation stitches can be triggered by IPS events, but the documentation does not describe them as modifying packet headers or payloads. Instead, they perform actions such as email, CLI script, webhook, quarantine, and similar automated responses

C is wrong because delay is associated with sequential execution, not parallel execution. The guide explicitly says: “A delay can be added before an action if Sequential action execution is used.”

So the verified answers are: A, D .

In the provided session table output, the following details justify the answers:

Policy ID Match: The line policy_id=1 directly confirms that this session was matched by Firewall Policy ID 1. According to Fortinet’s session table documentation, the policy_id field always references the policy that allowed this session, so this is a clear indicator.

Session Offloading: The presence of the strings npu_state, ips_offload, and notably the NPU info section such as offload=8/8, ips_offload=1/1 shows that this session has been offloaded to the Network Processor Unit (NPU). Fortinet technical documentation states that " offload " values greater than zero in both directions (and an NPU info section) affirm that NPU hardware processing (fast path) is handling this traffic, thus the session is not being handled in software only.

Other options:

VLAN Tagging (vlan=0x0000/0x0000): This means no VLAN tag is assigned to this session.

NP7: The actual NPU model handling the session isn’t exposed in this snippet–the offload parameters shown are generic and not specific to NP7 hardware, so it cannot be concluded from the session data.

The correct answer is C. 64.26.151.37 .

The study guide explains the FortiGuard flags shown by diagnose debug rating:

D = Default

I = Initial

T = Timing

F = Failed and specifically: “F = The server is down”

So even though 121.111.236.179 has the lowest RTT in the exhibit, it has the F flag, meaning FortiGate considers that server failed/down , so it will not be chosen.

To determine which active server is selected, the FortiOS administration guide states:

“The server list is sorted first by weight. The server with the smallest RTT appears at the top of the list regardless of weight. … Therefore the top position in the list is selected based on RTT while the other positions are based on weight.”

Among the valid, non-failed choices in the exhibit:

64.26.151.37 → RTT 45

209.22.147.36 → RTT 103

96.45.33.65 → RTT 144

208.91.112.194 → RTT 107

The active server with the lowest RTT is 64.26.151.37 , so that is the server FortiGate will choose.

So the verified answer is: C .

The correct answer is B .

The study guide explicitly states: “IKE version 2 does not interoperate with IKE version 1, but they share enough of the header format that both versions can unambiguously operate over the same UDP port.”

That directly proves B .

Why the other options are wrong:

A is wrong because the study guide shows authentication methods as Asymmetric for IKEv2 and Symmetric for IKEv1

C is wrong because the study guide does not say they use the same TCP port; instead, it specifically says they can operate over the same UDP port

D is wrong because the study guide states: “IKEv2 does not use the concept of phase 1 or phase 2” , even though FortiOS CLI/GUI still uses those terms for configuration purposes

The correct answers are C and D .

For D , the session output shows proto=6, which means TCP, and proto_state=01. The study guide explains that for TCP sessions, “the first number (from left to right) is related to the server-side state and is 0 when the session is not subject to any inspection (flow or proxy). … The second digit is the client-side state.” It also shows that value 1 = ESTABLISHED

So proto_state=01 means:

first digit 0 = no inspection

second digit 1 = ESTABLISHED

That confirms the TCP session has been successfully established.

For C , the study guide section “Session for an Authenticated User” states: “Any session for traffic coming from an authenticated user contains the authed flag. Additionally, the username is added to the session information.”

In the exhibit, the session contains user=User1 and an authentication state flag (authd), which indicates the session is associated with an authenticated user.

Why the other options are wrong:

A is wrong because the session did match a firewall policy . The study guide says the session output includes “The ID of the matching policy” In the exhibit, the session shows policy_id=1 , so a firewall policy was matched.

B is wrong because the study guide explains the gwy field as:

first value = gateway to destination

second value = gateway to source The exhibit shows gwy=10.1.0.254/10.1.10.1, so:

gateway to destination = 10.1.0.254

gateway to source = 10.1.10.1

So the verified answers are: C, D .

The administrator cannot see traffic in the sniffer because it is being offloaded to the NPU (NP6). To view the traffic, offloading must be disabled so packets pass through the CPU.

B. config firewall policy ... set auto-asic-offload disable: This is the recommended method to troubleshoot specific traffic. By disabling ASIC offloading in the relevant firewall policies (Policies 5 and 17 in the exhibit), traffic is forced to the CPU and becomes visible to the sniffer.

C. diagnose npu np6 fastpath disable 1: This command temporarily disables the fastpath processing on the specific NP6 processor (ID 1) handling the ports. This forces all traffic handled by that NPU to the CPU, allowing the sniffer to capture it.

Incorrect Options: Option A uses invalid syntax (port-list disable is not a valid command). Option D (config system npu) is not the standard method for granular troubleshooting.

According to the official Fortinet administration guide for FortiOS 7.6.4 under the section " Configuring a RADIUS server, " the supported RADIUS authentication methods you can configure via the CLI with config user radius are:

pap

chap

mschap

mschapv2

auto

The relevant CLI syntax is set auth-type {auto | ms_chap_v2 | ms_chap | chap | pap}​. You can confirm this directly in the configuration table and from real CLI sessions.

EAP (Extensible Authentication Protocol) is NOT an authentication option you can directly set under config user radius. EAP methods (such as EAP-TLS, EAP-PEAP, EAP-TTLS) are negotiated between the RADIUS client and server but are not configurable as an explicit auth-type option in FortiOS. EAP authentication is typically used automatically by features like 802.1X, not through the user radius object authentication-type setting, and always requires proper backend workings between supplicant and RADIUS server

The correct answers are C, D, and E .

The study guide lists the exact OSPF adjacency requirements :

“Interfaces of peers are the same type and in the same OSPF area”

“Each peer has a unique router ID”

“OSPF authentication, if enabled, is successful”

These map directly to:

C. OSPF interface network types match

D. Authentication settings match

E. OSPF router IDs are unique

The same study-guide slide also states other requirements such as:

peers’ primary IPs must be in the same subnet with the same mask

hello and dead intervals must match

OSPF MTUs must match

Why the other options are wrong:

A is wrong because link cost matching is not listed as an adjacency requirement . OSPF cost affects path selection, not whether adjacency can form.

B is wrong because interface priority does not need to be unique . Priority is used for DR/BDR election, where the highest priority wins, and ties are broken by router ID.

So the verified answers are: C, D, E .

The correct answer is B. Assertion dump .

The study guide states: “SAML attributes are pieces of information about a user that are exchanged between IdPs and SPs during the SAML authentication process. These attributes are included in the SAML assertion, which is built by the IdP as part of the authentication process.”

The same study guide page for real-time SAML troubleshooting shows the section labeled **** Assertion Dump **** , and inside that assertion it displays the actual user attributes, such as:

< saml:Attribute Name= " username " >

< saml:Attribute Name= " groups " >

It also explicitly marks this part as “Attributes sent by IdP”

Why the other options are wrong:

A. Bindings HTTP post is incorrect because bindings define how SAML messages are transported , not the section that contains the attributes. The study guide says: “Bindings: Define how SAML protocol messages are transmitted over different communication channels.”

C. Authentication request is incorrect because that is built by the SP and sent toward the IdP, not where the IdP’s user attributes are shown. The study guide’s flow says the SP “Builds auth request” and the IdP later “Builds auth response.”

D. Authentication response is broader than the exact section being asked. The exact section in the study guide where the IdP-provided attributes are shown is the Assertion dump .

So the verified answer is: B .

Analyze the " Send to Application Layer " Message:

The most critical line in the debug output is: id=65308 ... func=av_receive ... msg= " send to application layer "

Meaning: This message indicates that the FortiGate kernel is handing the packet over to a user-space daemon (specifically the WAD/Proxy process, indicated by av_receive handlers) for deep inspection.

Implication: This behavior is the hallmark of Proxy-based inspection. In Flow-based inspection, the traffic is handled by the IPS engine (often within the kernel or via specific IPS handlers like ips_measure), and you would not typically see a " send to application layer " message for standard web filtering.

Evaluate Option B (Firewall Policy Mode):

Since the traffic is being sent to the application layer proxy, the Firewall Policy controlling this traffic (Policy ID 1, as seen in Allowed by Policy-1) must be configured with Inspection Mode = Proxy. If it were Flow-based, the traffic would stay in the flow path. Thus, Option B is correct.

Evaluate Option C (Web Filter Profile Mode):

In FortiOS, when a firewall policy is set to Proxy-based inspection, the security profiles (like Web Filter) applied to that policy also operate in Proxy-based inspection mode. The presence of the av_receive function confirms that the content inspection (Web Filter/AV) is being performed by the proxy engine. Thus, Option C is correct.

Why Option A is Incorrect (NPU Offload):

The output shows npu_state=0x100. In the context of a flow trace where traffic is being " sent to application layer, " this confirms the session is not fully offloaded to the NPU (Network Processor). Offloaded traffic (Fast Path) is handled by the hardware and would not generate these specific CPU-level debug logs for the payload inspection phase. The proxying process requires CPU intervention.

Why Option D is Incorrect (Port Mapping):

While valid protocol mapping is necessary for inspection, the specific debug output shown is a direct result of the Inspection Mode (Proxy vs. Flow). The observation of the traffic moving to the application layer is primarily caused by the policy and profile mode settings, making B and C the direct " observations " derived from the log data.

The best verified answer is C .

The study guide says that when FortiGate is in conserve mode, it activates protection measures to recover memory space:

“System configuration cannot be changed”

“FortiGate skips quarantine actions (including FortiSandbox analysis)”

It also explains that inspection behavior can be reduced while in conserve mode:

“pass (default): All new sessions pass without inspection until FortiGate switches back to non-conserve mode.”

“The av-failopen setting also applies to flow-based antivirus inspection.”

The FortiOS administration guide summarizes this behavior as:

“This causes functions such as antivirus scanning to change how they operate to reduce the functionality and conserve memory without compromising security.”

That is why C is the closest correct choice: FortiGate can reduce functionality of some processes, especially antivirus-related inspection, to preserve memory.

Why the other options are wrong:

A is wrong because FortiGate does not automatically reboot as a default conserve-mode action. A reboot can be configured through an automation stitch , but that is an optional administrator-defined response, not the built-in conserve-mode behavior

B is wrong because the documentation does not say FortiGate switches from proxy-based inspection to flow-based inspection. Instead, it may pass traffic without inspection depending on av-failopen settings

D is not generally correct for conserve mode . The study guide says FortiGate starts dropping new sessions only when memory usage exceeds the extreme threshold : “If memory usage exceeds the extreme threshold, all new sessions that require inspection (flow-based or proxy-based) are blocked.”

So the verified answer is: C .