Free Fortinet NSE7_FSN_AR-7.6 Practice Exam with Questions & Answers | Set: 5

The correct answer is C.

The exhibit shows:

562 in ESTABLISHED state

27 in CLOSE state

memory_tension_drop=0

ephemeral=0/131072

According to the study guide, for TCP sessions: “The protocol state in the session table is a two-digit number. For TCP, the first number (from left to right) is related to the server-side state and is 0 when the session is not subject to any inspection (flow or proxy)… The second digit is the client-side state.” The same page also shows that value 1 = ESTABLISHED

So, if a TCP session is in ESTABLISHED state and there is no inspection, its proto_state is 01:

first digit 0 = no inspection

second digit 1 = ESTABLISHED

That makes C correct. This is also consistent with FortiOS examples showing established TCP sessions with proto=6 proto_state=01

Why the other options are wrong:

A is wrong because the field that indicates sessions dropped due to low free memory is memory_tension_drop, and in the exhibit it is 0, not 113. The study guide states: “If there is a lack of free memory, the kernel deletes the oldest sessions. The command shown on this slide displays the number of sessions the kernel deleted because of this mechanism.”So 113 is the clash value, not memory-tension drops.

B is wrong because ephemeral=0/131072 does not mean 131072 ephemeral sessions were recorded. The study guide explains that FortiGate “sets a hard limit on the maximum number of ephemeral sessions that can exist at the same time in the session table.”Therefore:

0 = current ephemeral sessions

131072 = maximum allowed ephemeral sessions for that model/context

D is wrong because the study guide says the temporary retention for possible out-of-order packets happens in state value 5 (TIME_WAIT): “When a session is closed by both the sender and receiver, FortiGate keeps that session in the session table for a few seconds, to allow for any out-of-order packets that might arrive after the FIN/ACK packet. This is the state value 5.”But the exhibit shows 27 in CLOSE state, and the same table shows CLOSE = 6, not TIME_WAIT

So the verified answer is C.

The debug flow message iprope_in_check() check failed, drop specifically indicates a failure in the Local-In Policy check. The " iprope " (IP ROouting Policy Enforcement) engine handles policy lookups. The _in_check suffix confirms that the decision is regarding traffic destined to the FortiGate itself (Local-In traffic), rather than traffic passing through it.

D. The packet was dropped because the requested service is not enabled on FortiGate:

This is the most common cause. When a packet arrives destined for the FortiGate ' s interface IP (e.g., an HTTPS or SSH request), the kernel checks if that specific service is enabled in the interface settings (set allowaccess). If the service is not enabled (e.g., trying to Ping an interface where PING access is disabled), the iprope_in_check function fails and drops the packet immediately.

C. The packet was dropped because the trusted host list is misconfigured:

Even if the service (e.g., HTTPS) is enabled on the interface, the FortiGate checks the Administrator settings. If Trusted Hosts are configured, the source IP of the incoming packet is compared against the allowed list. If the IP is not on the list, the Local-In policy check (iprope_in_check) fails, and the packet is dropped to secure the management plane.

Why other options are incorrect:

A: If traffic is dropped by a standard Firewall Policy (traffic passing through the device from one interface to another), the debug message will typically state denied by policy x or no matching policy. It would generally be a forward check (iprope_fwd_check or similar), not an _in_check.

B: If there is no route to the source, the error is a Reverse Path Forwarding (RPF) failure. The debug flow logs this explicitly as reverse path check fail, drop.

Analyze the " Send to Application Layer " Message:

The most critical line in the debug output is: id=65308 ... func=av_receive ... msg= " send to application layer "

Meaning: This message indicates that the FortiGate kernel is handing the packet over to a user-space daemon (specifically the WAD/Proxy process, indicated by av_receive handlers) for deep inspection.

Implication: This behavior is the hallmark of Proxy-based inspection. In Flow-based inspection, the traffic is handled by the IPS engine (often within the kernel or via specific IPS handlers like ips_measure), and you would not typically see a " send to application layer " message for standard web filtering.

Evaluate Option B (Firewall Policy Mode):

Since the traffic is being sent to the application layer proxy, the Firewall Policy controlling this traffic (Policy ID 1, as seen in Allowed by Policy-1) must be configured with Inspection Mode = Proxy. If it were Flow-based, the traffic would stay in the flow path. Thus, Option B is correct.

Evaluate Option C (Web Filter Profile Mode):

In FortiOS, when a firewall policy is set to Proxy-based inspection, the security profiles (like Web Filter) applied to that policy also operate in Proxy-based inspection mode. The presence of the av_receive function confirms that the content inspection (Web Filter/AV) is being performed by the proxy engine. Thus, Option C is correct.

Why Option A is Incorrect (NPU Offload):

The output shows npu_state=0x100. In the context of a flow trace where traffic is being " sent to application layer, " this confirms the session is not fully offloaded to the NPU (Network Processor). Offloaded traffic (Fast Path) is handled by the hardware and would not generate these specific CPU-level debug logs for the payload inspection phase. The proxying process requires CPU intervention.

Why Option D is Incorrect (Port Mapping):

While valid protocol mapping is necessary for inspection, the specific debug output shown is a direct result of the Inspection Mode (Proxy vs. Flow). The observation of the traffic moving to the application layer is primarily caused by the policy and profile mode settings, making B and C the direct " observations " derived from the log data.

Comprehensive and Detailed 100 to 150 words of Explanation From Secure Networking Architect Study Guides topics:

FortiManager creates configuration revisions following several events, including installations, explicit configuration retrievals, automatic updates, and scripts executed directly on managed FortiGate devices. The FortiManager 7.6 Administrator Study Guide specifically explains that scripts run using Remote FortiGate Directly (via CLI) can cause an automatic update and create a new revision-history entry.

This accounts for the script_manager process and subsequent retrieve activity visible in the exhibit. script_manager represents FortiManager ' s script-processing mechanism; it is not an FDN API administrator, eliminating D. The Configuration and Installation widget belongs to FortiManager ' s device-management interface rather than being something the administrator must inspect directly on FortiGate, eliminating B. The revision history itself identifies which administrator or process generated a revision, so the proposed system-log filtering in C is unnecessary and incorrectly specified.

================

To understand why Type 5 LSAs (AS External LSAs) are missing from the Link-State Database (LSDB), we must look at how OSPF generates and propagates them:

A. There is no autonomous system border router (ASBR) in the network:

Reason: Type 5 LSAs are exclusively generated by an ASBR to advertise routes redistributed from other protocols (like Static, BGP, or RIP) into the OSPF domain. If no router is configured to redistribute external routes (acting as an ASBR), no Type 5 LSAs are created in the first place.

C. The local router is located in a stub area:

Reason: By definition, a Stub Area (and a Totally Stubby Area) prevents Type 5 LSAs from entering. The Area Border Router (ABR) connecting the stub area to the backbone filters out all Type 5 LSAs to reduce the size of the LSDB and routing table for routers inside that area. Instead, a default route is usually injected.

Why other options are incorrect:

B: While database filtering exists, standard prefix-list filtering typically affects the routing table (RIB) generation, not the underlying LSDB propagation of Type 5 LSAs, or it is less common than the architectural reasons (Stub/No ASBR).

D: IP Protocol 89 is the transport for OSPF itself. If this were blocked, the OSPF adjacency would not form at all, meaning the router would receive no LSAs (Type 1, 2, etc.), not specifically just Type 5.

The correct answers are A and C.

The exhibit shows that preserve-session-route is enabled on port1:

config system interface

edit " port1 "

set preserve-session-route enable

next

end

The study guide explains the effect of this setting exactly:

“enable: FortiGate marks existing session routing information as persistent, and applies only the modified routes to new sessions”

It also states:

“The current route must still be present in the FIB. Otherwise, FortiGate flags the session as dirty and reevaluates it”

And the same page further clarifies:

“If you enable this setting, sessions passing through that interface continue to pass without being affected by the routing changes. The routing changes apply only to new sessions. If the route is removed from the FIB, then FortiGate must flag the session as dirty, flush its gateway information, and reevaluate the session.”

This proves:

A is correct because with preserve-session-route enable, existing sessions are normally preserved and routing changes apply only to new sessions.

C is correct because the session remains unchanged unless the current route is removed from the FIB/routing table, in which case FortiGate dirties and reevaluates the session.

Why the other options are wrong:

B is wrong because when the active route is removed, FortiGate does not simply mark the session dirty and stop there. The study guide says it “flags the session as dirty and reevaluates it”, which means route lookup happens again.

D is wrong because the session does change if the active route is removed. FortiGate flushes gateway information and reevaluates the session.

So the verified answers are: A, C.

The SD-WAN 7.6 Enterprise Administrator Study Guide explicitly states: “Firewall policies for SD-WAN traffic must reference SD-WAN zones and not individual members.”

In the exhibit, HUB1-VPN1 is an individual member of the HUB1 SD-WAN zone. However, policy 3 incorrectly uses HUB1-VPN1 as its outgoing interface. FortiManager cannot compile and commit that policy because an SD-WAN member cannot be referenced directly by an SD-WAN firewall policy. The administrator must change the policy’s To interface from HUB1-VPN1 to its parent zone, HUB1.

Option C is incorrect because the guide specifically explains that an IPsec interface does not require normalization when it is used as an SD-WAN member: “SD-WAN members don’t use normalized interfaces.” The normalized LAN interface shown in the policy is appropriate because it maps the local interface for each managed FortiGate, but the overlay side must reference the HUB1 zone.

Option D remains invalid because it still references individual SD-WAN members. Option A does not correct the invalid outgoing-interface reference; policy 3 already uses the policy package installation targets.