FCSS_LED_AR-7.6 Online Practice Questions

Explanation:
From the exhibits:
SSID “Guest”
Security mode:Open
Captive Portal: Enabled, portal typeAuthentication → External
External portal URL: https://fac.trainingad.training.lab/guest (FortiAuthenticator)
Exempt destinations/services:FortiAuthenticator and WindowsAD
Firewall policy
From theGuest interface/zonetoport1 (Internet)
Source user group:guest.portal(authenticated users)
The flow for anexternal captive portalis:
Client associates to theopen Guest SSID.
Client makes an HTTP(S) request.
FortiGate intercepts and redirects the client to theexternal portal.
Client must be able toreach FortiAuthenticator’s IP(and AD if the portal needs it)before authentication.
In this setup:
Theexempt destinationsetting tells the captive portal logicnot to require authenticationfor traffic going to FortiAuthenticator and WindowsAD.
However, there still must be a firewall policy that allows traffic from the Guest SSID subnet to those exempt destinations.
The existing firewall policy uses theguest.portal user groupas a source condition, which only matchesaftersuccessful portal authentication. Before login, the client has no user identity, so:
Traffic from the unauthenticated Guest client → FortiAuthenticator isnot matchedby that policy.
It hits theimplicit deny, so the browser never reaches the login page.
To fix this, the administrator must:
Create or modify a firewall policy thatallows traffic from the Guest SSID subnet/interface to FortiAuthenticator and WindowsAD without requiring user authentication.
That is exactly what optionDdescribes.
Why the others are wrong:
A. Change SSID security mode to WPA2-EnterpriseC External captive portals are normally used withopenSSIDs; WPA2-Enterprise uses 802.1X, not captive portal.
B. Disable HTTPS redirectionC Redirection is required so users are sent to the portal; disabling it doesn’t solve reachability.
C. Exclude FortiAuthenticator and Windows AD from filteringC They’re already listed asexempt destinationsin the SSID configuration; the missing piece is thefirewall policy, not the exemption.

Explanation:
When FortiAPs connect to FortiGate overIPsec tunnels, this is treated similarly to WAN/MPLS deployments.
In these scenarios, FortiGate must know that CAPWAP must traverse anon-L2transport.
FortiAP profiles include:
set mpls-connection enable
This setting is required so that:
FortiGate can encapsulate CAPWAP inside the transport tunnel
Remote FortiAPs can establish CAPWAP even when behind routed/IPsec networks
Without this option, the FortiGate detects the AP but cannot bring CAPWAP UP, leaving the AP in “discovered/unauthorized” or “offline” state.
Why others are wrong
A. Static route→ Discovery already succeeds, so routing is not the issue.
C. Reduce MTU→ Sometimes useful for IPsec, but not required for CAPWAP establishment.
D. Firmware upgrade→ Firmware mismatch would show “Managed (upgrade required),” not CAPWAP tunnel failure.
Therefore, set mpls-connection enableis the required fix.

Explanation:
In this scenario:
FortiGate + FortiAnalyzer are part of theSecurity Fabric
AnAutomation Stitchis configured:
Trigger:Compromised Host C High(IOC from FortiAnalyzer)
Action:Quarantine on FortiSwitch + FortiAP
A test device10.0.2.1visits a malicious website.
FortiAnalyzer logs show the event, butFortiGate does NOT quarantine the device.
This means theautomation did not receive an IOC trigger, OR theFabric did not classify it as a compromise.
Let's evaluate each answer option.
✅ C. The malicious website is not recognized as an indicator of compromise (IOC) by FortiAnalyzer.
✔ Correct.
For FortiGate to quarantine a device:
FortiAnalyzer must classify the event as aCompromised Host → High / Medium / Critical
FortiAnalyzer must generate anIOC event
FortiGate must receive that IOC through the Fabric
Even though the FAZ log shows:
Action = blocked
Category = Malicious Websites
→ That doesNOTautomatically mean an IOC was generated. A blocked website event isnot always an IOCunless:
It is included in theIOC database
FAZ’sAnalytics / UTM / IOCengine marks it as a compromise
Thus, if FAZ only logs a “Malicious Website” event butdoes not classify it as an IOC,

Explanation:
In an SD-Branch deployment (FortiGate + FortiSwitch + FortiAP),FortiAIOps:
Collects telemetry and logs from Fabric devices
Usesmachine-learning / AI analyticsto:
Spot anomalies (latency, packet loss, RF issues, misconfigurations)
Highlight root causes
Proposeoptimization recommendations (e.g., channel changes, power tuning, config fixes)
It doesnot:
Automatically disable devices (Afalse)
Replace SD-WAN config or all routing (Cfalse)
Fixallissues with zero human input (Dis marketing fantasy, not reality)