Fortinet NSE7_FSN_AR-7.6 - Fortinet NSE 7 - Secure Networking 7.6 Architect

The correct answer is D .

The exhibit shows:

session_count=591

clash=162

memory_tension_drop=0

TCP sessions:

166 in NONE state

1 in ESTABLISHED state

3 in SYN_SENT state

2 in TIME_WAIT state

The study guide explains the TCP protocol states and states explicitly:

“When a session is closed by both the sender and receiver, FortiGate keeps that session in the session table for a few seconds, to allow for any out-of-order packets that might arrive after the FIN/ACK packet. This is the state value 5.”

In diagnose sys session stat, the exhibit shows 2 in TIME_WAIT state . Since TIME_WAIT = state value 5 , those are the sessions being kept briefly for possible out-of-order packets. That makes D correct.

Why the other options are wrong:

A is wrong because session_count=591 is the total number of sessions, while the TCP sessions shown add up to only 172 (166 + 1 + 3 + 2). So not all sessions in the table are TCP sessions.

B is wrong because the study guide says the number of sessions deleted because of low free memory is shown by memory_tension_drop , and in the exhibit it is 0 , not 162.

C is wrong because the study guide defines ephemeral/open TCP sessions as those not fully established , but the exhibit does not say all 166 in NONE state are specifically “waiting to complete the three-way handshake.” The clearest directly supported statement from the displayed states is the 2 TIME_WAIT sessions retained for out-of-order packets.

So the verified answer is: D .

The correct answers are A and D .

The study guide states:

“Application layer test commands do not display information in real time. They display statistics and configuration information about a feature or process. You can also use some of these commands to restart a process or execute a change in its operation.”

This directly proves:

A is correct because they can display statistics and configuration information

D is correct because some of them can restart a process/application

Why the other options are wrong:

B is wrong because the study guide explicitly says application-layer test commands do not display information in real time . Real-time output is done with diagnose debug application ... commands instead.

C is wrong because diagnose debug console enable is related to debug output behavior, not a requirement for application-layer test commands to display output. The study guide does not describe test commands that way.

====

The exhibit identifies the root VDOM as the management VDOM, indicated by the green check mark. The Enterprise Firewall 7.6 Administrator Study Guide explains that the management VDOM handles FortiGuard database downloads, license validation, and FortiGuard rating connectivity on behalf of the entire FortiGate system. It states that FortiGuard updates obtained through the management VDOM “will affect all VDOMs.”

Consequently, the root VDOM must reach either a public Fortinet Distribution Network server or a FortiManager configured as a FortiGuard Distribution Server in an isolated environment. The guide specifically identifies connectivity to “a FortiManager serving as a FortiGuard Distribution Server (FDS) in a closed network” as the alternative to public FortiGuard access. Loss of both paths prevents Core1 and Core2 from using current FortiGuard web-filtering information. Therefore, options A and B are correct.

Core1 and Core2 do not need to become management VDOMs; FortiGate uses one designated management VDOM for these system-level services. A VDOM link is used to route user traffic between VDOMs and is not required for distributing FortiGuard services, eliminating option D.

The correct answer is D .

The study guide explains that IKEv2 has two initial exchanges:

IKE_SA_INIT

IKE_AUTH

and then later exchanges such as:

CREATE_CHILD_SA

It also states the roles of those exchanges:

IKE_SA_INIT negotiates the security settings for IKE traffic

IKE_AUTH performs mutual authentication and sets up the piggyback child SA

CREATE_CHILD_SA creates a new child SA or rekeys an existing child SA

Most importantly, the study guide explicitly says:

“By IKEv2 design, no Diffie-Hellman public key is exchanged during an IKE_AUTH exchange. Consequently, any phase 2 Diffie-Hellman group configuration mismatch between FortiGate and the peer is experienced only during the first rekey (CREATE_CHILD_SA exchange) of the child SA created during IKE_AUTH.”

This proves the key idea behind the question: an IKEv2 tunnel can come up successfully first, then fail later during a CREATE_CHILD_SA rekey/renegotiation event because of a phase 2 mismatch. Among the provided options, the matching later-stage cause is mismatched quick-mode selectors during CREATE_CHILD_SA .

Why the other options are wrong:

A is wrong because if the proposal mismatch were in the initial negotiation path, the tunnel would fail during establishment, not after it was already up. The study guide places initial tunnel establishment in IKE_SA_INIT and IKE_AUTH

B is wrong because a mismatch in IKE_SA_INIT affects the initial establishment stage, not a tunnel that was already brought up successfully

C is wrong because a pre-shared key mismatch is part of authentication during IKE_AUTH , so the tunnel would not come up successfully in the first place

Comprehensive and Detailed Explanation From Exact Extract of Network Security Support Engineer Study Guide (FortiOS 7.6) topics:

The correct answers are A and B . Security Fabric communication uses Fortinet-proprietary protocols, mainly FortiTelemetry and Neighbor Discovery . The study guide states that FortiTelemetry uses TCP port 8013 , and that the connection is always established by the downstream FortiGate toward the upstream FortiGate . This validates option A . The same section also states that FortiTelemetry must be manually enabled . More precisely, the upstream FortiGate interface must have Security Fabric Connection enabled under administrative access so it can accept incoming Security Fabric connection requests. This validates option B .

Option C is wrong because only the FortiTelemetry TCP port 8013 can be changed; Neighbor Discovery uses UDP port 8014 and cannot be changed. Option D is also wrong because Security Fabric communication is not enabled automatically among all Fortinet devices. It requires the correct Security Fabric settings, interface administrative access, and downstream authorization. The study guide’s troubleshooting section confirms that when FortiTelemetry is disabled, the upstream FortiGate receives TCP 8013 SYN packets but does not complete the Security Fabric connection.

The correct answers are C and D .

The key clue is the command itself:

diagnose debug application fssod -1

The study guide explicitly states: “There is a specific FortiGate daemon that handles the polling mode. It is the fssod daemon. To enable agentless polling mode real-time debug use the command: diagnose debug application fssod -1.”

That directly proves D. FSSO is using agentless polling mode to detect logon events .

The study guide also states: “In agentless polling mode, FortiGate frequently polls all workstations (as a standalone collector agent does) to check which users are still logged in. You can sniffer this traffic on port 445.”

That directly proves C. FortiGate is frequently polling the workstation in case the user has logged out .

Why the other options are wrong:

A is wrong because the “cannot verify if the user is still logged in” / Not Verified condition is described for the collector agent workstation status, not as a conclusion from this FortiGate fssod debug line. The study guide says: “A user goes to not verified status when they log out, or when there is a problem in the polling done by the collector agent to the workstation.”

B is wrong because DC Agent mode is part of agent-based FSSO , where DC agents send events to a collector agent. This output is from the fssod daemon, which the study guide ties to agentless polling mode , not DC Agent mode.

E is wrong because TCP port 8000 is used for communication between the collector agent and FortiGate , while in agentless polling mode FortiGate polls workstations and that traffic can be sniffed on TCP port 445 .

So the verified answers are: C, D .

The study guide identifies this exact output as an expectation session created by the FTP session helper :

“run helper-ftp” indicates the FTP helper is in use.

“FortiGate created an expectation session and opened the pinhole port for the expected return traffic”

It also explains why this exists:

“Another important function of the session helper is to temporarily create an expected session (or pinhole) for the data channel connection that comes from the server.”

“The session helper automatically creates the session and opens the door for the incoming connection.”

“These incoming TCP sessions use random TCP port numbers.”

That directly proves C is correct.

For A , the exhibit shows expire=23. The study guide explains the expire field as the length of time until the session expires if no matching traffic arrives, and the FortiOS guide states for expectation sessions:

“Expectation sessions usually have a timeout value of 30 seconds. If the communication from the server is not initiated within 30 seconds the expectation session times out and traffic will be denied.”

So with expire=23, FortiGate will allow that expected traffic only for the remaining 23 seconds; after that, it times out and the traffic is denied. That makes A correct.

Why the other options are wrong:

B is not supported . The study guide describes expectation sessions as being created by the session helper from the control-session negotiation, not as independent objects unaffected by the master session.

D is wrong as stated. Even though the output contains policy_id=25, the study guide explicitly says the incoming expected connection is allowed by the expected session itself, “even when no firewall policy allows it.”