Fortinet FCSS - Network Security 7.6 Support Engineer Free Sample Questions

In FortiOS 7.6 FGCP, with override disabled (the default), primary selection compares connected monitored interfaces first, then HA uptime, then priority, then serial number. An HA uptime difference of more than 300 seconds decides the primary, and a less than 5-minute difference counts as a tie. A unit's HA uptime resets to zero when it restarts or a monitored interface fails. After the original primary recovers, its uptime is lower than the current primary's, so it stays secondary despite its higher priority. Enabling override would make priority be considered before uptime. Session pickup and heartbeat addressing do not affect primary selection. (FortiOS 7.6 Administration Guide: HA primary unit selection criteria.)

The BGP synchronization rule states that a BGP router should not advertise a route learned from an iBGP peer to an eBGP peer unless that route is also present in its Interior Gateway Protocol (IGP) routing table (e.g., learned via OSPF or a static route). This is a loop-prevention mechanism. Since the prefix is learned from iBGP and not being advertised to the eBGP peer (ISP), and no explicit filters are in place, synchronization being enabled is the most likely cause. Modern networks typically disable synchronization as full-mesh iBGP or route reflectors are used.

The error Authentication method not supported from fnbamd during an LDAP authentication attempt typically indicates a mismatch in the authentication or bind method between the FortiGate and the LDAP server. For example, the FortiGate might be configured for Simple bind when the server requires Regular, or vice-versa. An incorrect password would result in a credentials error, and a certificate issue would cause a TLS handshake failure, not this specific message.

False. IPsec VPN tunnel processing is handled by the iked daemon for control plane (IKE negotiations) and the kernel (ksoftirqd) for data plane (encryption/decryption). While diagnose sys top can show high CPU usage from these processes, it does not break down the usage per individual tunnel. To troubleshoot a specific tunnel's performance, you would need to use other tools like diagnose vpn tunnel list and specific debugs, not diagnose sys top for a per-tunnel PID.

In FortiOS 7.6, to improve stability and performance on entry-level models, features like Security Rating and Topology visibility are disabled on FortiGates with 2GB of RAM or less. The FortiGate 60F falls into this category. Therefore, it will not run Security Rating checks or send results to the root FortiGate, explaining the missing data.

Without deep inspection, the FortiGate cannot see the HTTPS URL. For flow-based web filtering it rates the hostname from the SNI in the TLS Client Hello, or the server certificate's CN when there is no SNI. If the site is served under a hostname (for example a CDN or shared hosting name) whose FortiGuard category differs from the category the administrator checked, the session is blocked by that other category. The log's category field shows which one. If 'Rate URLs by domain and IP address' is enabled, the IP rating can also override the domain rating by weight. Checking the category in the log, adding a local rating or URL filter exemption, or using deep inspection so the full URL is rated resolves the discrepancy. (FortiOS 7.6 Administration Guide: Configuring a web filter profile; Rating options.)

If a static route is in the routing table but traffic is not forwarded, check whether the next hop is actually reachable at Layer 2 and Layer 3. diagnose ip arp list shows whether the FortiGate has resolved the gateway's MAC address; an incomplete or missing entry points to a Layer 2 or addressing problem. execute ping tests Layer 3 reachability of the gateway directly. get router info routing-table all only confirms what is already known (the route is present). get system performance status shows resource usage, and diagnose debug flow traces a packet's policy and route decisions rather than gateway reachability.

diagnose test application autod 3 displays statistics for all automation stitches: how many times each stitch was triggered (local hit), the last trigger time, and each action's done/drop counters. It shows which stitches ran and whether their actions succeeded or failed. diagnose automation stitch-history, diagnose automation stitch-trace and diagnose sys csf-log aren't FortiOS commands, and get system automation stitch doesn't show execution history. Reference: FortiOS 7.6 Administration Guide, Diagnosing automation stitches.

When Dead Peer Detection (DPD) is configured as 'On Idle' on one FortiGate, it will only send DPD probes when there is no outbound traffic to send. If the other side has DPD disabled, it will not respond to these probes. After a few failed probes, the 'On Idle' FortiGate will tear down the tunnel, assuming the peer is dead. If there is periodic keep-alive or monitoring traffic, the tunnel will re-establish, creating a flapping cycle. A DPD timer mismatch would not typically cause this issue, and Phase 2 lifetime expiry would be on a much longer interval (usually hours).

The ExStart state is where OSPF routers decide which router will be the master for exchanging Database Descriptor (DBD) packets. If the routers have different interface MTU values, the larger DBD packets from the router with the higher MTU will be dropped by the router with the lower MTU. This prevents the DBD exchange from completing, causing the adjacency to be stuck in ExStart. Timer mismatches would prevent the state from even reaching 2-Way, and area ID or authentication mismatches would also cause earlier failures.