FCSS_LED_AR-7-6 Practice Questions

FortiAIOps is designed to enhance network operations by applying artificial intelligence and machine learning to telemetry data collected from the SD-Branch environment, including FortiGate, FortiSwitch, and FortiAP devices. It analyzes this data to establish performance baselines, detect anomalies, and identify the root cause of network issues. Based on this AI-driven analysis, FortiAIOps provides actionable insights and specific recommendations to network administrators, enabling them to proactively optimize network performance and resolve potential problems before they impact users.

A. FortiAIOps provides recommendations for remediation; it does not autonomously disable network hardware, as this would be a disruptive and potentially service-impacting action.

C. FortiAIOps complements and provides insights for SD-WAN; it does not replace the need for foundational SD-WAN policies and routing configurations, which must still be defined by an administrator.

D. While FortiAIOps aims to be predictive and can automate some responses, it does not resolve all network issues without any human intervention. It primarily serves to assist administrators with recommendations.

1. Fortinet. (2023). FortiAIOps Datasheet.

Page 1: "FortiAIOps provides AI-based network assurance and management for Fortinet’s Secure SD-WAN, SD-Branch, and Connected LAN solutions... It provides network operators with anomaly detection, root cause analysis (RCA), and predictive maintenance to reduce problem resolution time and increase user satisfaction." This supports the core function of using AI for analysis and issue identification.

2. Fortinet. (2024). FortiAIOps 1.3.0 Administration Guide.

Section: "Dashboard > Overview" (Page 10): The guide describes how FortiAIOps uses machine learning to model the network and identify anomalies. It details widgets that show "Network Health," "Impacted Sites," and "Top Recommendations," confirming its role in identifying issues and providing optimization suggestions.

3. Fortinet Product Page. FortiAIOps - AI for IT Operations.

Under the "Features and Benefits" section, it states: "Receive actionable recommendations to optimize network performance." and "Leverage AI/ML to get ahead of network issues with predictive insights and proactive remediation." This directly validates that its purpose is to use AI to provide recommendations for optimization.

The core issue is the incompatibility between the MSCHAPv2 authentication protocol and the FortiAuthenticator's LDAP server configuration. MSCHAPv2 is a challenge-response protocol and does not transmit the user's clear-text password. The exhibit shows the FortiAuthenticator's LDAP connection to Active Directory is configured with Authentication type: Simple. A simple LDAP bind requires the clear-text password to authenticate the user, which explains why PAP authentication succeeds. To support MSCHAPv2 against an Active Directory backend, FortiAuthenticator must use a method that can handle challenge-response authentication. Enabling Windows Active Directory Domain Authentication allows FortiAuthenticator to properly communicate with the domain controller to validate the MSCHAPv2 credentials.

A. Changing the RADIUS authentication protocol to CHAP will not resolve the issue, as CHAP is also a challenge-response protocol and is incompatible with a Simple LDAP bind.

C. Manually adding users to the local database is a workaround that bypasses the intended authentication against Active Directory and is not the correct solution.

D. RADIUS attributes are used for authorization policies after a user has been successfully authenticated; they cannot fix a failure in the authentication process itself.

1. FortiAuthenticator 7.2 Administration Guide, Page 118, Section: "Authentication > Remote Auth. Servers > LDAP". The guide describes the LDAP server settings. It explains that a Simple bind uses the user's credentials to bind to the LDAP server, which implies clear-text password availability. For challenge-response protocols like MSCHAPv2, a different mechanism is required. The guide states, "For MS-CHAP-V2 authentication, the FortiAuthenticator must join the AD domain," which is facilitated by the Windows Active Directory Domain Authentication setting.

2. Fortinet Cookbook - FortiAuthenticator, Recipe ID: FD53008, "Technical Tip: How to configure FortiAuthenticator as a RADIUS server for 802.1X wireless authentication". This document outlines the configuration steps. In the section for configuring the remote LDAP server, it specifies that to support MSCHAPv2 for wireless clients authenticating against Active Directory, the FortiAuthenticator must be configured to properly interact with the domain, which is not possible with a Simple bind.

FortiGate's integration with an LDAP server for user authentication relies on performing a simple bind operation. This process involves sending the user's distinguished name (DN) and password to the LDAP server for verification. MSCHAPv2, however, is a challenge-response authentication protocol that does not transmit the password directly. Instead, it uses a series of challenges and responses based on password hashes. The standard LDAP protocol does not support the MSCHAPv2 mechanism. Therefore, when a wireless client attempts to authenticate using an EAP method that relies on MSCHAPv2 (like PEAP-MSCHAPv2), the FortiGate cannot process this request against its configured LDAP server, leading to authentication failure.

A. A firewall policy is missing an LDAP authentication rule.

This would likely cause a complete failure to communicate with the LDAP server for any authentication attempt, not a failure specific to the MSCHAPv2 protocol.

B. The Windows AD server requires LDAPS (LDAP over SSL) for authentication.

While best practice, the absence of LDAPS would affect all LDAP bind attempts, not just those initiated by an MSCHAPv2 request. The failure would be due to security policy, not protocol incompatibility.

C. The FortiGate LDAP configuration is missing the correct Bind DN.

An incorrect Bind DN would prevent FortiGate from successfully querying the LDAP directory in the first place, causing all user lookups and authentications to fail, not just MSCHAPv2.

1. Fortinet Training Institute, NSE 6 FortiAuthenticator 7.2 Study Guide, p. 103: "FortiGate does not support MSCHAPv2 for LDAP authentication. FortiGate uses the LDAP simple bind method to authenticate users, which is not compatible with the MSCHAPv2 protocol." (Note: This principle is consistent across FortiOS versions, including 7.6).

2. Fortinet Training Institute, FortiOS 7.6 WiFi Controller Study Guide, p. 31: Under the "WPA2-Enterprise Authentication" section, it is stated: "When using an external LDAP server for authentication, FortiGate supports only EAP-GTC and EAP-TTLS/PAP." This explicitly confirms that EAP methods requiring MSCHAPv2 are not supported with an LDAP backend.

3. Fortinet FortiOS 7.6.0 Administration Guide, "LDAP" section: The documentation describes the authentication process as a "bind" request to the LDAP server using the provided credentials. This confirms the mechanism is a simple bind, which is incompatible with the MSCHAPv2 challenge-response handshake.

Zero-touch provisioning (ZTP) for FortiGate devices relies on the ability of a new, factory-default device to automatically contact and register with a FortiManager instance. This communication occurs over the FortiGate-FortiManager protocol (FGFM). The default and standard port for this protocol is TCP port 541. If there is a firewall, access control list, or routing issue preventing the FortiGate from reaching the FortiManager's IP address on this specific port, the management tunnel cannot be established, and the ZTP registration process will fail.

A. The core principle of ZTP is to eliminate the need for manual intervention on the device itself. The process is designed to be fully automated from the FortiGate's perspective.

B. ZTP is a network-based provisioning method that requires WAN or LAN connectivity. A console cable is used for direct, local configuration, which is contrary to the ZTP concept.

C. ZTP is specifically designed for devices in a factory-default state. The objective is for FortiManager to push the initial configuration, not for the device to have a preloaded file.

1. FortiManager Administration Guide 7.6.0

Section: Device Manager > Adding devices > Adding a device with the Add Device wizard > Zero-touch provisioning for FortiGate devices

Content: The guide outlines the prerequisites for ZTP, stating, "Ensure the FortiGate can connect to the FortiManager on port 541." This confirms that reachability on TCP port 541 is a critical requirement for the process to succeed.

2. Fortinet Cookbook

Document: Zero Touch Provisioning for FortiGate (fortinet.com)

Section: Prerequisites

Content: This official deployment guide explicitly lists as a prerequisite: "The FortiGate must be able to reach the FortiManager on TCP port 541." This directly supports the correct answer by identifying port 541 connectivity as a mandatory condition.

3. FortiOS Administration Guide 7.6.0

Section: System > Central Management

Content: This section describes the configuration for connecting a FortiGate to a FortiManager. It details the set fmg command, which specifies the FortiManager's IP address. The underlying protocol, FGFM, uses TCP port 541 by default for this communication, which is essential for both manual and automated (ZTP) registration.

When a device's MAC address is quarantined on a FortiSwitch, the switch isolates the device by directing all its traffic to a specially designated quarantine VLAN. This VLAN effectively becomes the new access VLAN for the quarantined device's traffic. This action is a core part of Fortinet's Security Fabric automation, allowing for the isolation of potentially compromised endpoints from the production network while potentially granting them limited access to remediation services within the quarantine segment.

B. The native VLAN is specifically for handling untagged traffic on an 802.1Q trunk port, not for isolating a specific quarantined device.

C. The switch receives untagged traffic from the endpoint, but its action is to tag and assign this traffic to the specific quarantine VLAN.

D. This term is too general. "Allowed VLAN" typically refers to the list of VLANs permitted on a trunk port, not the specific isolation VLAN used for quarantine.

1. FortiSwitch™ Managed by FortiGate 7.6.0 Administration Guide, Page 110, Section: "Quarantine".

The document states: "When a host is quarantined, the MAC address of the host is moved to the quarantine VLAN. The quarantine VLAN is a special VLAN that you create to isolate compromised or unknown devices from the rest of the network." This confirms the traffic is moved to a specific VLAN, which functions as an access VLAN for the device.

2. FortiSwitch™ Manager 7.6.0 Administration Guide, Page 101, Section: "Configuring security policies".

This guide corroborates the mechanism: "When a host is quarantined, the MAC address of the host is moved to the quarantine VLAN." This reassignment to a single, specific VLAN is functionally equivalent to placing the device's traffic into an access VLAN.

The information contained within a Certificate Signing Request (CSR) is critical for the Certificate Authority's (CA) validation process. The CA's role is to verify that the entity requesting the certificate is who they claim to be and, for domain-validated certificates, that they control the specified domain. Fields such as Common Name (CN), Organization (O), and Locality (L) must be accurate. If the CA's validation process finds discrepancies or missing information, it cannot confirm the requester's identity or authority. As a result, the request will be rejected, and the certificate will not be issued, leading to necessary corrections and resubmissions, which cause delays.

B: A CA will not knowingly issue a certificate with incorrect key fields, as this would violate the trust model and validation requirements they must adhere to.

C: CSR fields define the public identity of the certificate's subject for relying parties to verify, not just for internal recordkeeping by the requester.

D: CAs are responsible for validating, not correcting, the information provided in a CSR. An incorrect submission must be fixed and resubmitted by the applicant.

1. FortiOS 7.6.0 Administration Guide: In the "Certificates" chapter, under the procedure for generating a CSR, the guide specifies the required fields (Common Name, Organization, etc.) and notes, "The information you enter when generating the CSR must be accurate and match your organization's legal information, as the CA will verify it." This implies that failure to provide accurate information will lead to verification failure. (Reference: FortiOS Administration Guide 7.6, Certificates > Generate a CSR).

2. CA/Browser Forum Baseline Requirements: This is the industry standard governing the issuance of publicly trusted certificates. Section 3.2, "Validation of Domain Authorization or Control," and its subsections detail the rigorous verification CAs must perform on the applicant's information provided in the CSR. A failure in this validation process due to inaccurate data prevents certificate issuance. (Reference: CA/Browser Forum, Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates, Version 2.0.2, Section 3.2).

The automation stitch is configured to trigger on a Compromised Host event from FortiAnalyzer. This event is generated by the Indicators of Compromise (IOC) feature, which actively scans logs for threat patterns. The provided exhibit shows a standard web filter log, which by itself is not a Compromised Host event.

For the automation to work, two key conditions must be met:

1. FortiAnalyzer must have a valid Threat Detection Service license to enable the IOC scanning engine.

2. The specific activity logged must match a known threat pattern in the FortiGuard IOC database, causing FortiAnalyzer to flag the log and generate the Compromised Host event.

The device was not quarantined because this event was never generated, which could be due to a missing license or the specific web traffic not being recognized as an IOC.

A. The configured action is already FortiSwitch Quarantine. The problem lies with the trigger not firing, not the action's configuration.

B. SSL inspection is not a mandatory prerequisite. The web filter log was successfully generated, which is the necessary input for the IOC engine.

1. FortiAnalyzer 7.6 Administration Guide, Page 398, "Indicators of Compromise": "The Indicators of Compromise (IOC) feature is a licensed feature that uses the FortiGuard IOC service to automatically scan logs from FortiGate devices and identify suspicious usage." This statement confirms that a specific license is required for the IOC feature to function (supports option D).

2. FortiAnalyzer 7.6 Administration Guide, Page 398, "Indicators of Compromise": "When a threat is found, FortiAnalyzer flags the log and displays the information in the FortiView > Threats > Indicators of Compromise summary." This explains that the log must be actively identified and flagged as a threat (an IOC) to generate the necessary event, which supports option C.

3. FortiGate 7.6 Security Fabric Administration Guide, Page 115, "Example: Automatically quarantining a compromised host": The example configuration for this exact scenario specifies the trigger as FortiAnalyzer Event Handler and the event as Compromised Host. This confirms the entire workflow is dependent on FortiAnalyzer successfully identifying an IOC and sending the corresponding event to FortiGate.

The user is on the GuestSSID network, which is a separate interface on the FortiGate. The FortiAuthenticator (captive portal) and Windows AD servers are on a different network connected to port3. For an unauthenticated user on the GuestSSID to reach the captive portal page hosted on the FortiAuthenticator, there must be a firewall policy that explicitly permits this traffic flow between the GuestSSID interface and the port3 interface. The existing firewall policy only allows traffic from GuestSSID to port1 (the internet) and is intended for users who have already authenticated. Without a policy allowing access to the authentication servers, the user cannot load the login page.

A. Changing the security mode to WPA2-Enterprise is a completely different authentication method and does not resolve the issue with the existing captive portal setup.

B. The captive portal is configured to use HTTPS (https://10.0.3.254:1003/). Disabling HTTPS redirection would not fix the fundamental lack of network connectivity to the server.

C. The exemption list in the SSID settings allows specific destinations to bypass the captive portal mechanism, but it does not replace the need for a firewall policy to permit traffic between interfaces.

1. FortiOS Administration Guide 7.6 > User & Device > Authentication > Guest users > WiFi guest user captive portal: "You must create two security policies: one for unauthenticated traffic and one for authenticated traffic. The unauthenticated policy must be configured to allow the required traffic, such as DNS and DHCP, and it must be placed above the authenticated policy in the policy list." This guide explicitly states the need for a pre-authentication policy to allow access to necessary services like the external portal.

2. FortiOS Administration Guide 7.6 > Firewall & DoS > Firewall policies > Policies: "Firewall policies control all traffic that attempts to pass through the FortiGate unit between network interfaces, zones, and VLAN sub-interfaces." This confirms that any traffic between the GuestSSID virtual interface and the port3 physical interface requires a firewall policy to be permitted. The exhibits show no such policy exists.

For a FortiGate to discover and manage a FortiAP, the interface on which the FortiAP communicates must be configured to allow CAPWAP traffic. In the FortiOS GUI, this is enabled via the Security Fabric Connection option under Administrative Access on the interface settings. The exhibit clearly shows that for the VLAN AP interface, while other access methods like HTTPS and PING are enabled, Security Fabric Connection is disabled. This prevents the FortiGate's wireless controller from processing the FortiAP's discovery requests on this VLAN, making detection and management impossible.

B. The FortiAP firmware is incompatible with the FortiGate firmware version.

This is a potential issue in general, but there is no information in the provided exhibits to support this conclusion; it is purely speculative.

C. The VLAN is not tagged correctly on the FortiSwitch uplink port.

The scenario states the FortiSwitch is already successfully managed by the FortiGate, which implies the FortiLink (uplink) is configured and functioning correctly.

D. The CAPWAP ports (UDP 5246 and 5247) are not open on FortiGate.

The CAPWAP service is enabled by default on FortiGate. The issue is not that the ports are closed globally, but that the service is not enabled on the specific VLAN AP interface.

1. FortiOS 7.6.0 Administration Guide:

In the "Interfaces" chapter, under the "Interface settings" section, the Security Fabric Connection option is described. It states, "Enable to allow this interface to be used for a Security Fabric connection with other Fortinet devices." This includes FortiAPs, which are integral components of the Security Fabric. (Reference based on general structure of FortiOS Administration Guides).

2. FortiWiFi and FortiAP 7.6.0 Configuration Guide:

Page 21, "Basic FortiAP deployment > Configuring the FortiGate unit". Step 3 details configuring the FortiAP-facing interface. It explicitly states: "In Administrative Access, enable CAPWAP." In modern FortiOS versions, enabling Security Fabric Connection is the standard method to enable CAPWAP and other necessary fabric-related protocols.

3. FortiOS 7.6.0 Handbook - FortiSwitch Manager:

In the "Configuring a FortiGate-managed FortiSwitch" chapter, the section on "Configuring the FortiAP VLAN" details the required steps. It specifies that the VLAN interface on the FortiGate must have administrative access enabled for CAPWAP to allow FortiAP management. The CLI command shown is set allowaccess capwap, which corresponds to the Security Fabric Connection GUI option.

Maintaining Network Time Protocol (NTP) synchronization between a FortiGate and its managed FortiSwitches is critical for network operations and security. Accurate, synchronized timestamps are essential for system logs, which are fundamental for troubleshooting, security forensics, and auditing. Furthermore, many authentication mechanisms, such as 802.1X with RADIUS or certificate-based authentication, are time-sensitive and can fail if there is a significant time skew between devices. Synchronized time also enables accurate event correlation across the Security Fabric, allowing administrators to build a coherent timeline of events during an incident investigation.

A. To facilitate synchronization of firmware updates across devices: Firmware updates are managed and pushed by the FortiGate. The update process itself is not critically dependent on precise time synchronization to function.

B. To allow FortiSwitch to communicate with other FortiSwitche devices in the network: Inter-switch communication is managed by the FortiLink protocol and standard networking protocols, which do not rely on NTP for basic operation.

D. To allow FortiSwitch to function in standalone mode if FortiGate becomes unavailable: A FortiSwitch in standalone mode operates on its last known configuration. Its core forwarding function does not depend on time synchronization with the unavailable FortiGate.

1. FortiOS 7.6.0 Administration Guide: In the "System > Settings" section, the documentation states, "It is important to keep the FortiGate unit’s time accurate for logging, certificate validation, scheduling, and other functions." This principle extends to all devices within the Security Fabric, including managed FortiSwitches. (Reference: FortiOS 7.6.0 Administration Guide, "System > Settings" chapter).

2. FortiSwitch Managed by FortiOS 7.6.0 Administration Guide: The guide explains that when FortiLink is enabled, the FortiGate automatically acts as the NTP server for the managed FortiSwitches. This highlights the intended design for centralized and synchronized time management, which is crucial for the functions mentioned in the correct answer. (Reference: FortiSwitch Managed by FortiOS 7.6.0 Administration Guide, "FortiLink configuration" chapter, section on "Configuring FortiLink settings").

3. FortiOS 7.6.0 Logging and Reporting Guide: This guide implicitly underscores the need for accurate time by detailing how logs are generated, stored, and analyzed. Without synchronized time, correlating log entries from a FortiGate and a FortiSwitch to trace an event (e.g., a user connecting to a switch port and accessing the internet) would be impossible. (Reference: FortiOS 7.6.0 Logging and Reporting Guide, "Log messages" chapter).