Important Fortinet FCSS_LED_AR-7.6 Exam Questions

Answer: A

Explanation:

When a device'sMAC address is quarantinedon a FortiSwitch (via FortiLink NAC, fabric automation, or manual quarantine), FortiSwitch enforces quarantine using thequarantine VLAN, also called theaccess VLANinside FortiSwitch NAC operations.

FortiSwitch behavior is defined in LAN Edge documentation:

Quarantined devices are moved into an'access VLAN' reserved for isolation.

This VLAN isstatically defined on the FortiGate NAC policy, and switch ports dynamically reassign the quarantined MAC into that VLAN.

All egress traffic from the quarantined MAC is forced into this VLAN, preventing access to the production network.

Thus, the correct description is:

Traffic is sent to an access VLAN.

Options B, C, and D are incorrect because:

Quarantine doesnotreassign to native VLAN.

It doesnotsend untagged traffic arbitrarily.

It doesnotforward traffic to allowed VLANs

Answer: C, D

Explanation:

The VAP configuration clearly showsVLAN pooling using WTP-groups:

set vlan-pooling wtp-group

config vlan-pool

edit 101

set wtp-group 'Floor_1'

edit 102

set wtp-group 'Office'

How VLAN assignment works in this mode

VLAN-pooling with wtp-group modemeans:

Each AP group (WTP group) is tied to exactly one VLAN in the pool.

The FortiGate doesnot load balanceVLANs.

Instead, VLANs are mappedper AP group, not per client.

Now verify each answer option:

A . FortiGate will load balance clients using VLAN 101 and 102...

Incorrect.

FortiGatedoes NOT load-balance clientswhen vlan-pooling is set towtp-group.

Each AP group receivesonly the VLAN mapped to it.

B . All clients in the Corp zone get IPs from 10.0.20.0/24

Incorrect.

In the Wi-Fi zone table, onlyCorp.102has an IP subnet:

Corp.101 0.0.0.0/0.0.0.0(no IP assigned clients get no DHCP)

Corp.102 10.0.20.1/255.255.255.0

Thus, clients associated to VLAN 101cannotget IPs.

C . Clients connecting to APs in the Floor_1 group cannot receive an IP address

Correct.

Reason:

Floor_1 WTP-group VLAN101

VLAN 101 hasno IPin the Wi-Fi table 0.0.0.0/0.0.0.0

No DHCP =Clients receive no IP address

D . Clients connecting to APs in the Office group will be assigned to VLAN 102

Correct.

Reason:

Office WTP-group maps to VLAN102

VLAN 102 has subnet10.0.20.0/24

So Office group clients get an IP in that range

Answer: C

Explanation:

From the exhibits:

The AP profile shows:

SSIDs: Tunnel | Bridge | Manual

The current setting isBridge, not Manual.

WhenBridgeorTunnelis selected, the AP profiledoes NOT automatically broadcast SSIDsunless the corresponding VAPs were explicitly mapped in the AP profile.

FortiManager SSID profiles are created, but unless these are explicitly applied underManual SSIDs selection, the AP will not broadcast any SSID.

Fortinet documentation states:

''To control which SSIDs an AP broadcasts, the AP Profile must have SSIDs set toManual, and the desired SSIDs must be selected.''

Therefore, to make the AP broadcast the intended SSIDs:

You must switch the SSIDs setting to Manual, and manually select the SSIDs (CompanyPrinters, Student01, Guest-CorpPort, PSK).

Why the other options are incorrect:

A . Adjust AP profile to avoid mixing bridge/tunnelMixed modes ARE supported. Not the issue.

B . Change platformThe platform (FAP231F) already supports all listed SSIDs.

D . Set transmit power mode to autoPower settings have nothing to do with SSID broadcasting.

Answer: D

Explanation:

WithAD machine authenticationvia FortiAuthenticator:

When a machine successfully authenticates, FortiAuthenticator records:

Machine account / identity

MAC addressof the device

Associated IP and session info

To handle sleep/hibernation:

FortiAuthenticator keeps acache of authenticated MAC addressesfor a configured timeout.

When the device wakes up and sends traffic again, FortiAuthenticator/FSSO can still treat it as authenticated as long as its MAC is in cache, so access is maintained without forcing a full machine re-auth immediately.

This matches optionD.

A(guest VLAN) is not the standard behavior here.

B(WoL) is unrelated.

C(IP-based) would break as IPs can change; MAC-based caching is what's used.

Answer: A

Explanation:

In this design, FortiAuthenticator receivesRADIUS accounting (RSSO) messages, looks up the user in LDAP to get group information, theninjects FSSO logon eventstoward all FortiGate devices.

From the exhibits we know:

FortiAuthenticatoris receiving RADIUS accountingfrom the RADIUS server.

LDAP queries are successful and return group membership.

But FortiGatedoes not receive FSSO logons, so identity-based policies are not applied.

For FortiAuthenticator to create an FSSO logon, the RADIUS accounting record must be correctlyparsed into at least:

Username

Client IP address

These are mapped from the RADIUS attributes in theRADIUS Accounting SSO clientconfiguration (for example, User-Name and Framed-IP-Address). If these are not defined or mapped incorrectly, FortiAuthenticator can see the accounting packet butcannot build a valid FSSO session, so no update is sent to FortiGate.

Thus the most likely root cause is:

The RADIUS Username and Client IPv4 attributes are not correctly definedfor that RADIUS Accounting SSO client (optionA).

Other options conflict with the scenario:

B-- LDAP is already successfully returning groups.

C-- FSSO user group attribute is separate; even without it, FSSO logons would still be created (just without group mapping).

D-- The interfaceisreceiving RADIUS accounting, so it is clearly enabled.