Passing exam with FCSS_LED_AR-7.6 latest training materials

APs have been manually configured to connect to FortiGate over an IPsec network, and FortiGate successfully detects and authorizes them. However, the APs remain unmanaged because FortiGate is unable to establish a CAPWAP tunnel with them. What configuration change can resolve this issue and enable FortiGate to establish the CAPWAP tunnel over the IPsec connection?

• A. Decrease the CAPWAP tunnel MTU size for APs to prevent fragmentation.
• B. Configure a static route on FortiGate to reach the APs over the IPsec tunnel.
• C. Upgrade the FortiAP firmware image to ensure compatibility with the FortiOS version.
• D. Assign a custom AP profile for the remote APs with the set mpls-connection option enabled.

Refer to the exhibits.


A company has multiple FortiGate devices deployed and wants to centralize user authentication and authorization. The administrator decides to use FortiAuthenticator to convert RSSO messages to FSSO, allowing all FortiGate devices to receive user authentication updates.
After configuring FortiAuthenticator to receive RADIUS accounting messages, users can authenticate, but FortiGate does not enforce the correct policies based on user groups. Upon investigation, the administrator discovers that FortiAuthenticator is receiving RADIUS accounting messages from the RADIUS server and successfully queries LDAP for user group information.
But, FSSO updates are not being sent to FortiGate devices and FortiGate firewall policies based on FSSO user groups are not being applied.
What is the most likely reason FortiGate is not receiving FSSO updates?

• A. FortiAuthenticator is missing the FSSO user group attribute in the configuration.
• B. The LDAP server is not configured to retrieve group memberships for RSSO users.
• C. The RADIUS Username and Client IPv4 attributes are not defined on FortiAuthenticator.
• D. The FortiAuthenticator interface is not enabled to receive RADIUS accounting messages.

Refer to the exhibit.

You've configured the FortiLink interface, and the DHCP server is enabled by default. The resulting DHCP server settings are shown in the exhibit.
What is the role of the vci-string setting in this configuration?

• A. To reserve IP addresses for FortiSwitch and FortiExtender devices.
• B. To restrict the IP address assignment to devices that have FortiSwitch or FortiExtender as their hostname.
• C. To connect, devices must match the VCI string; otherwise, they will not receive an IP address.
• D. To ignore DHCP requests coming from FortiSwitch and FortiExtender devices.

Refer to the exhibit.

FortiGate has been added to FortiAIOps for management.
Which step must be performed on FortiAIOps to add a FortiSwitch device connected to the recently added FortiGate?

• A. FortiAIOps requires that the FortiSwitch IP address is submitted.
• B. FortiSwitch is added automatically.
• C. Configure the FortiSwitch IP address, user ID, and password.
• D. Add the FortiSwitch device by submitting its serial number.

Refer to the exhibits which show the FortiSwitch and FortiGate interface configurations.
FortiSwitch VLAN configuration

Port2 interface configuration

Which two statements describe how port2 handles tagged and untagged traffic? (Choose two.)

• A. Port2 accepts ingress tagged traffic for VLAN IDs 4091 and 4093 only.
• B. Port2 tags egress traffic for VLAN 100.
• C. Port2 accepts ingress untagged traffic for VLAN IDs 100, 4091, and 4093 only.
• D. Port2 assigns ingress untagged traffic to VLAN 100.