NSE7_FSN_AR-7.6 Exam Dumps - Fortinet NSE 7 Network Security Architect Questions and Answers

The correct answers are C and D .

For D , the session output shows proto=6, which means TCP, and proto_state=01. The study guide explains that for TCP sessions, “the first number (from left to right) is related to the server-side state and is 0 when the session is not subject to any inspection (flow or proxy). … The second digit is the client-side state.” It also shows that value 1 = ESTABLISHED

So proto_state=01 means:

first digit 0 = no inspection

second digit 1 = ESTABLISHED

That confirms the TCP session has been successfully established.

For C , the study guide section “Session for an Authenticated User” states: “Any session for traffic coming from an authenticated user contains the authed flag. Additionally, the username is added to the session information.”

In the exhibit, the session contains user=User1 and an authentication state flag (authd), which indicates the session is associated with an authenticated user.

Why the other options are wrong:

A is wrong because the session did match a firewall policy . The study guide says the session output includes “The ID of the matching policy” In the exhibit, the session shows policy_id=1 , so a firewall policy was matched.

B is wrong because the study guide explains the gwy field as:

first value = gateway to destination

second value = gateway to source The exhibit shows gwy=10.1.0.254/10.1.10.1, so:

gateway to destination = 10.1.0.254

gateway to source = 10.1.10.1

So the verified answers are: C, D .

The FortiOS 7.6 Administrator Study Guide states: “The only security features you can apply using SSL certificate inspection mode are web filtering and application control.” Certificate inspection does not decrypt the encrypted payload. However, it can extract the destination hostname from the ClientHello’s server name indication (SNI). The exhibit exposes www.sharepoint.com in the server_name extension, enabling FortiGate to identify, categorize, and enforce web-filtering rules for the requested website. Therefore, option B is correct.

Antivirus inspection requires FortiGate to examine files or other application-layer content inside the encrypted payload. Because certificate inspection does not decrypt that content, an antivirus profile cannot be applied effectively; full SSL inspection is required. This eliminates option A.

The SAN field is not mandatory. FortiGate first attempts to obtain the hostname from SNI and can validate it against either the common name (CN) or SAN in the server certificate. Accordingly, option C is incorrect.

The supported_versions extension explicitly lists TLS 1.3 and TLS 1.2 and no other versions. Although the ClientHello’s legacy Version field displays TLS 1.2 (0x0303), TLS 1.3 clients retain this legacy value for compatibility. The extension identifies the versions the client actually supports, making option D correct.

The correct answer is A . This behavior is dictated by the configuration command set snat-route-change enable shown in Exhibit 1 under config system global.

Routing Change: By changing the priority of route ID 2 from 10 to 0, it becomes lower than route ID 1 (priority 5). In FortiOS, a lower priority value indicates a more preferred route. Consequently, the active route for the destination changes from port1 to port2 .

SNAT Implication: The existing session (shown in Exhibit 2) is using Source NAT (SNAT) with the IP address associated with port1 (10.200.1.1). If the traffic were simply switched to port2 , the source IP would be incorrect for that interface and the return traffic would likely fail or be dropped.

snat-route-change enable: This specific setting instructs the FortiGate on how to handle established SNAT sessions when a routing change occurs that alters the preferred outgoing interface. When enabled, if a route change forces an SNAT session to a new interface, FortiGate flushes (deletes) the session from the session table. This is necessary because a live TCP session cannot survive a change in its source IP address. The client must initiate a new session, which will then be created using the new correct route (port2) and the corresponding new SNAT IP.

If this setting were disabled, the session would likely remain " sticky " to the original interface (port1) until it closed, provided the route still existed. However, the explicit configuration forces the deletion.

The Network Security Support Engineer 7.6 Study Guide explicitly explains this debug message:

“iprope_in_check() check failed, drop” means the packet is destined to a FortiGate IP address and one of these conditions applies:

The service is not enabled

The service is using a different TCP port

The source IP address is not included in the trusted host list

The packet matches a local-in policy with action deny

That directly confirms C. Trusted host list misconfiguration .

Why D is the second valid choice:

The FortiOS administration guide explains that:

“IP pools and VIPs are considered local IP addresses if responding to ARP requests on these external IP addresses is enabled … the FortiGate is considered a destination for those IP addresses … once an IP pool or VIP has been configured … the FortiGate considers it as a local address and will not forward traffic based on the routing table.”

Because iprope_in_check() is a local-in/local-destination type failure, a VIP or IP pool misconfiguration can cause traffic to be treated as destined for the FortiGate itself, which can then trigger this drop condition if the matching local service/local-in handling is not valid. So D is the closest supported second answer from the available choices.

Why the other options are wrong:

A is wrong because policy route problems are not the documented meaning of this specific debug message. The study guide instead ties iprope_in_check() check failed, drop to management/local-in conditions.

B is wrong because the study guide says traffic shaping drops appear as: “Denied by quota check”

The study guide states:

“FortiGate categorizes an entry in the session table as an ephemeral session when it is a TCP session that is not fully established (three-way handshake not completed), or when it is a UDP session with only one packet received.”

This directly proves:

A is correct because a UDP session with only one packet received is ephemeral.

C is correct because a TCP session waiting for the SYN/ACK is not fully established , so it is ephemeral. The study guide’s TCP state table shows that the handshake is only completed when the session reaches ESTABLISHED

Why the other options are wrong:

B is wrong because once UDP traffic has been seen in both directions , it is no longer the “single packet received” condition described for ephemeral sessions. The study guide says for UDP: 00 = one way , 01 = both ways

D is wrong because a TCP session waiting for FIN/ACK is already in the closing stage after establishment, not in the “not fully established” stage. The study guide explains that after both sides close the session, FortiGate can keep it briefly in the table in state value 5 for out-of-order packets after FIN/ACK

To identify the reason for the lack of prefixes, we must interpret the State/PfxRcd and Up/Down columns in the get router info bgp summary exhibit.

Analyze Neighbor Status:

Neighbor 10.125.0.60: State is OpenSent. This session is not established. It is stuck in the negotiation phase.

Neighbor 100.64.3.1: State is Active. This session is not established. The router is actively trying to initiate a TCP connection.

Neighbor 10.127.0.75:

Up/Down: 02:45:55. This indicates the BGP session has been Up (Established) for almost 3 hours.

State/PfxRcd: 0. This number represents the count of prefixes received. The session is fully established, but the neighbor has sent zero routes.

Determine the Cause:

Since the session with 10.127.0.75 is established, connectivity and handshakes (Options A, B, C) are not the issue for this neighbor.

The fact that it is Up but sending 0 prefixes strongly implies that the neighbor is configured to filter out its routes before sending them to the local FortiGate.

Option D correctly identifies this as a RIB-OUT (Routing Information Base - Outbound) configuration issue on the neighbor (Router 10.127.0.75), which prevents it from advertising its routes.

To determine the correct reasons for the adjacency failure, we must analyze the standard OSPF real-time debug output (diagnose ip router ospf all enable or diagnose sniffer packet) typically provided in this exam exhibit.

Analyze the Debug Output:

The debug output in this specific question scenario typically displays an incoming Hello packet line: OSPF: RECV[Hello]: ... auth-type 0 ...

" RECV " : Indicates the packet is coming from the Remote peer.

" auth-type 0 " : Indicates the Remote peer is sending " Null " (No) authentication.

Analyze the Failure:

The adjacency fails because the Local FortiGate is rejecting this packet.

If the Local FortiGate accepts " No Authentication " , it would match auth-type 0 and form the adjacency.

Since it is failing (and producing a debug log), the Local FortiGate must be expecting a different authentication type (Type 1 Cleartext or Type 2 MD5).

Evaluate the Options:

A. The remote peer has either OSPF cleartext or MD5 authentication configured.

Incorrect. The debug shows auth-type 0 (No Auth) coming from the remote peer.

B. There is an OSPF authentication configuration mismatch.

Correct. One side is sending " No Auth " (Remote), and the other expects " Auth " (Local). This is a definition of a mismatch.

C. The local FortiGate does not have OSPF authentication configured.

Incorrect. If the Local unit had " No Auth " configured, it would match the Remote ' s auth-type 0, and the adjacency would come up. The failure implies the Local unit does have auth configured.

D. The local FortiGate has either OSPF cleartext or MD5 authentication configured.

Correct. Because the Local unit is rejecting the " No Auth " packet from the remote peer, it confirms that the Local unit has authentication enabled (expecting Type 1 or 2).

Conclusion: The breakdown of the OSPF negotiation shows that the Remote peer is sending no authentication (Type 0), while the Local FortiGate expects authentication, resulting in a mismatch.