Free Fortinet NSE6_FWF-6.4 Practice Exam with Questions & Answers

Security profiles are a feature that allows FortiAP devices to apply various security functions to the wireless traffic, such as antivirus, web filter, application control, intrusion prevention, and botnet scanning. Security profiles can be enabled on both tunnel-mode and bridge-mode SSIDs, and can be applied either through the wireless controller configuration or through firewall policies on the FortiGate device. Security profiles can also inspect encrypted wireless traffic, as long as the FortiAP device has access to the encryption keys.

Security profiles on FortiAP devices can use FortiGate subscription services to inspect the traffic, such as FortiGuard Antivirus, FortiGuard Web Filter, FortiGuard Application Control, and FortiGuard IPS. This means that the FortiAP device can leverage the latest threat intelligence and updates from Fortinet to protect the wireless network from malicious or unwanted content.

Therefore, the correct answer is D. Security profiles on FortiAP devices can use FortiGate subscription to inspect the traffic.

References:

• FortiAP-S and FortiAP-U bridge mode security profiles
• Configuring security | FortiAP / FortiWiFi 6.4.2
• Security profiles - Fortinet Document Library

The FortiPlanner site survey reading is a tool that shows the predicted signal strength of the wireless network based on the floor plan, the placement of the APs, and the propagation model. The signal strength is measured in decibels (dB), which is a logarithmic scale that indicates how much power the signal has. The higher the dB value, the stronger the signal.

The site survey reading allows the user to set a threshold value for the signal strength, which is -68 dB by default. This means that any area with a signal strength equal or stronger than -68 dB is considered to have adequate coverage for most wireless applications. These areas are highlighted in green circles on the floor plan. Any area with a signal strength weaker than -68 dB is considered to have poor coverage or no coverage at all. These areas are shown with different colors, such as yellow, orange, red, or black, depending on how weak the signal is.

Therefore, the correct answer is D. Areas with the signal strength equal or stronger than -68 dB are highlighted in green circles.

References:

• FortiPlanner 2.0 User Guide, page 28
• FortiPlanner Data Sheet, page 2
• FortiPlanner 2.2 User Guide, page 19

The ARRP (Automatic Radio Resource Provisioning) profile improves upon DARRP (Distributed Automatic Radio Resource Provisioning) by allowing more factors to be considered to optimize channel selection among FortiAPs. DARRP uses the neighbor APs channels and signal strength collected from the background scan for channel selection.

According to the web search results, FortiPresence supports social networks authentication and short message service authentication as public authentication services for guest Wi-Fi access. Social networks authentication allows visitors to log in using their existing social media accounts, such as Facebook, Twitter, LinkedIn, Google, and Instagram. Short message service authentication allows visitors to receive a one-time password via SMS to their mobile phone number. These authentication methods are convenient and secure for visitors and provide valuable data for businesses. Software security token authentication and hardware security token authentication are not supported by FortiPresence as public authentication services for guest Wi-Fi access. References: Configuring Captive Portal | FortiPresence 1.2.0, Configuring Captive Portal | FortiPresence 22.4.0

According to the web search results, the first discovery method used by FortiAP to locate the FortiGate wireless controller in the default configuration is static. This means that the FortiAP sends discovery requests to a preconfigured IP address that the controller owns. This is useful if the FortiAP and the controller are not in the same subnet and other discovery methods will not work. The other discovery methods are used in sequence if the static method fails or is not configured. References: Advanced WiFi controller discovery | FortiAP / FortiWiFi 7.4.0

The configuration changes that will resolve the issue are to configure set vaps to be “Authors” for both interfaces in the wtp-profile, and to configure vap-all to be manual for both interfaces in the wtp-profile. This is because the current configuration does not assign any VAPs to the AP interfaces, which means that no wireless networks are broadcasted by the APs. The vap-all setting determines whether all VAPs are assigned to an interface or not, and the vaps setting specifies which VAPs are assigned to an interface. By setting vap-all to manual and vaps to “Authors”, the APs will only broadcast the Authors wireless network on both interfaces. Disabling intra-vap-privacy for the Authors vap-wireless network will not help, as it only affects the communication between clients on the same SSID, not their connection to the AP. Increasing the transmission power of the AP radio interfaces will not help, as it only affects the signal strength and coverage of the APs, not their broadcasting of wireless networks. References: wireless-controller vap | FortiGate / FortiOS 6.4.0, Technical Note: How to configure intra-SSID privacy

https://docs.fortinet.com/document/fortipresence-vm/1.2.0/administration-guide/546812/introduction