Online Access Free FCSS_NST_SE-7.6 Practice Test

Refer to the exhibit.
Partial output of diagnose sys session stat command is shown.

An administrator has noticed unusual behavior from FortiGate. It appears that sessions are randomly removed.
Which two reasons could explain this? (Choose two.)

• A.FortiGate is dropping all TCP sessions with incomplete three-way handshakes.
• B.FortiGate is flushing sessions because of high memory usage.
• C.FortiGate is deleting sessions because the kernel cannot allocate more memory pages
• D.FortiGate is not accepting sessions because the device has been down 10 out of 120 seconds.

Refer to the exhibit.

The output of diagnose sys session list command is shown.
If the HA ID for the primary device is 9, what happens if the primary fails and the secondary becomes the primary?

• A.The session will be removed from the session table of the secondary device because the TCP session is not yet fully established.
• B.The session state is preserved but the kernel will re-evaluate the session because the routing information will be flushed
• C.The session continues to permit traffic on the new primary device after failover. without requiring the client to restart the session with the server.
• D.The session is synchronized with the secondary device, however, because application control is applied.
  the session is marked dirty and has to be reevaluated after failover.

Refer to the exhibit, which shows the partial output of a diagnose command.

Which two conclusions can you draw from the output shown in the exhibit? (Choose two.)

• A.The session is checked against firewall policy ID 25.
• B.Clearing the master session has no impact on the expectation session.
• C.This is a pinhole session to allow traffic for a TCP protocol that dynamically assigns TCP ports.
• D.FortiGate will drop the expected traffic if it does not arrive within 23 seconds.

Which two statements about Security Fabric communications are true? (Choose two.)

• A.FortiTelemetry must be manually enabled on the FortiGate interface.
• B.FortiTelemetry and Neighbor Discovery both operate using TCP.
• C.The default port for Neighbor Discovery can be modified.
• D.By default, the downstream FortiGate establishes a connection with the upstream FortiGate using TCP port 8013.

In a Security Fabric environment which three actions must you take to ensure successful communication among the nodes? (Choose three.)

• A.You must ensure that TCP port 8013 is not blocked along the way.
• B.You must enable FortiTelemetry on the receiving interlace of the upstream FortiGate.
• C.You must authorize the downstream FortiGate on the root FortiGate.
• D.You must configure FortiGate in transparent mode.
• E.You must ensure that the port for Neighbor Discovery has been changed.