NSE7_LED-7-0 Practice Questions

According to the exhibit, the DHCP server scope for the FortiLink interface has a vci-string setting

with the value “Cisco AP c2700”. This setting is used to match the vendor class identifier (VCI) of the

DHCP clients that request an IP address from the DHCP server. The VCI is a text string that uniquely

identifies a type of vendor device. Therefore, option C is true because the vci-string setting restricts

the IP address assignment to FortiSwitch and FortiExtender devices, which use the VCI “Cisco AP

c2700”. Option A is false because the vci-string setting does not ignore DHCP requests coming from

FortiSwitch and FortiExtender devices, but rather accepts them. Option B is false because the vci-

string setting does not reserve IP addresses for FortiSwitch and FortiExtender devices, but rather

assigns them dynamically. Option D is false because the vci-string setting does not restrict the IP

address assignment to devices that have FortiSwitch or FortiExtender as their hostname, but rather

to devices that have “Cisco AP c2700” as their VCI.

According to the exhibit, the debug output shows that the device connected to port2 on FortiSwitch

is sending an EAPOL-Start message, which is the first step of the 802.1X authentication process.

However, the output also shows that the device is not sending any EAP-Response messages, which

are required to complete the authentication process. Therefore, option A is true because the device

is not configured for 802.1X authentication, which means that it does not have the correct

credentials or settings to authenticate with the RADIUS server. Option D is also true because the

device does not support 802.1X authentication, which means that it does not have the capability or

software to perform 802.1X authentication. Option B is false because the device has not been

quarantined for 3600 seconds, but rather has a session timeout of 3600 seconds, which is the default

value for 802.1X sessions. Option C is false because the device has not been assigned the guest

VLAN, but rather has been assigned the default VLAN, which is VLAN 1.

According to the FortiAuthenticator Administration Guide2, “The guest portal provides pre and post-

log in services for users (such as password reset and token registration abilities), and rules and

replacement messages can be configured.” Therefore, option C is true. The same guide also states

that “Administrators can use one or more incoming parameters to configure a mapping rule for the

guest portal.” Therefore, option D is true. Option A is false because remote users can sponsor any

number of guest accounts, as long as they do not exceed the maximum number of guest accounts

allowed by the license. Option B is false because administrators can choose to approve or reject

guest accounts, or enable auto-approval.

According to the FortiSwitch Administration Guide, “If a device does not support 802.1X

authentication, you can configure the switch to assign the device to an onboarding VLAN. The

onboarding VLAN is a separate VLAN that you can use to provide limited network access to non-

802.1X devices.” Therefore, option C is true because it describes the behavior of FortiSwitch when

the security profile shown in the exhibit is assigned to all ports. Option A is false because FortiSwitch

can authenticate multiple devices connected to the same port using MAC-based or MAB-EAP modes.

Option B is false because FortiSwitch will not try to authenticate non-802.1X devices using the device

MAC address as the username and password, but rather use MAC authentication bypass (MAB) or

EAP pass-through modes. Option D is false because all EAP messages will be terminated on

FortiGate, not FortiSwitch, when using 802.1X authentication.

According to the exhibit, the RADIUS server configuration on FortiGate points to FortiAuthenticator,

which is acting as an authentication proxy and is configured to relay all authentication requests to a

remote Windows AD server using LDAP. However, LDAP does not support MSCHAP2 authentication,

which is required for RADIUS. Therefore, option A is true because on FortiAuthenticator, enabling

Windows Active Directory Domain Authentication will add FortiAuthenticator to the Windows

domain and allow it to use MSCHAP2 authentication with the AD server. Option C is also true

because on FortiAuthenticator, changing the back-end authentication server from LDAP to RADIUS

will allow it to use MSCHAP2 authentication with the AD server. Option B is false because on

FortiGate, configuring the NAS IP setting on the RADIUS server will not affect the MSCHAP2

authentication, but rather the source IP address of the RADIUS packets. Option D is false because on

FortiGate, updating the Secret setting on the RADIUS server will not affect the MSCHAP2

authentication, but rather the shared secret between FortiGate and FortiAuthenticator.