FCSS - Network Security 7.6 Support Engineer Practice Exam

What the FCSS - Network Security 7.6 Support Engineer exam covers

• System Troubleshooting160 questions
• Authentication130 questions
• Security Profiles160 questions
• Routing170 questions
• VPN169 questions

Free FCSS - Network Security 7.6 Support Engineer sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 789.

1. Question 1Authentication

   An administrator needs to create a local firewall user named jsmith who authenticates with a static password stored on the FortiGate. Which CLI path creates this user?

   • Aconfig user local, set type password, set passwdCorrect
   • Bconfig user peer, set ca, set subject
   • Cconfig user radius, set server, set secret
   • Dconfig system admin, set accprofile, set password
   ✓ Correct answer: A

   A local password-authenticated firewall user is created with `config user local`, `edit <name>`, `set type password`, `set passwd <value>`. This is distinct from admin GUI accounts and remote-server user entries.

   Why the other options are wrong

   • Buser peer defines a PKI/certificate-based peer, not a password user.
   • Cuser radius defines a remote RADIUS server object, not a local password user.
   • Dsystem admin creates an administrator GUI login, not a firewall identity user.
2. Question 2Authentication

   The Collector Agent service is stopped on the server hosting it. What is the immediate effect on FSSO?

   • AFortiGate switches automatically to local password authentication for all users
   • BAll existing IPsec tunnels are torn down
   • CDC Agents automatically reinstall themselves on another server
   • DNew logon events cannot reach FortiGate, and existing entries begin to age outCorrect
   ✓ Correct answer: D

   With the Collector Agent service down, DC Agents have nowhere to send new logon events and FortiGate stops receiving updates entirely; entries already learned continue to age based on the Dead Entry Timeout Interval until the service is restored.

   Why the other options are wrong

   • AFortiGate does not automatically fall back to local authentication just because FSSO stops updating.
   • BIPsec tunnels are unrelated to the Collector Agent service state.
   • CDC Agents have no self-relocation capability.
3. Question 3Routing

   A static route's gateway is 192.168.100.1, which is not on a subnet directly attached to any FortiGate interface. The route never appears in `get router info routing-table all`. What is the most likely cause?

   • AThe route's distance is too low
   • BThe destination prefix is a /32
   • CThe interface assigned to the route is a loopback
   • DNo route resolves the recursive gateway 192.168.100.1Correct
   ✓ Correct answer: D

   A static route whose gateway is not directly connected relies on recursive resolution: another route in the table must cover 192.168.100.1. If none exists, FortiOS cannot determine how to reach the next hop, and the route is left out of the FIB.

   Why the other options are wrong

   • AA low distance would make the route more preferred, not prevent its installation.
   • BPrefix length of the destination has no bearing on gateway resolvability.
   • CThe egress interface type (loopback vs physical) is not the described issue here.
4. Question 4RoutingSelect all that apply

   Which three BGP FSM states are associated with the router NOT yet having a fully established TCP connection to the peer (or having just lost it)? (Choose THREE)

   • AIdleCorrect
   • BConnectCorrect
   • CActiveCorrect
   • DOpenSent
   • EOpenConfirm
   ✓ Correct answer: A, B, C

   Idle is the pre-connection state; Connect is while a TCP handshake attempt is in progress; Active is reached after a failed TCP attempt while retrying. Only once TCP succeeds does BGP move on to OpenSent and beyond.

   Why the other options are wrong

   • DOpenSent occurs only after a successful TCP handshake, once the local OPEN message has been sent.
   • EOpenConfirm occurs even later, after both OPEN messages have been exchanged over the established TCP session.
5. Question 5Security Profiles

   A branch FortiGate cannot reach the public FortiGuard servers because of a restrictive upstream firewall, but a FortiManager is available locally. What is the appropriate fix?

   • AConfigure an override server pointing to the FortiManagerCorrect
   • BIncrease the default route's administrative distance
   • CSwitch the firewall policy to flow-based inspection
   • DDisable FortiGuard services entirely
   ✓ Correct answer: A

   By enabling config system autoupdate override and defining the FortiManager as the override server, the branch FortiGate can obtain its updates from the local network instead of needing direct internet access to the public FortiGuard servers.

   Why the other options are wrong

   • BAdministrative distance affects route preference, not FortiGuard reachability.
   • CInspection mode has no bearing on reaching update servers.
   • DDisabling FortiGuard removes protection updates entirely rather than solving reachability.
6. Question 6Security Profiles

   An IPS sensor entry has both action reset and a log-packet setting enabled. Where would the administrator go to review the actual packet capture saved for a matched signature?

   • ANetwork > Packet Capture only
   • BPolicy & Objects > IPv4 Policy hit count column
   • CSystem > FortiGuard > IPS package version
   • DThe packet log attached to that specific IPS log entryCorrect
   ✓ Correct answer: D

   When `packet-log` (log-packet) is enabled on an IPS sensor entry, the FortiGate stores a small pcap alongside the log record. Under Log & Report > Security Events (or Intrusion Prevention), opening the specific log entry shows a Download Packet Log / view packet capture option for that exact match.

   Why the other options are wrong

   • APacket Capture under Network is a separate live-capture tool, not stored per-signature IPS packet logs.
   • BThe policy hit count shows match counters, not packet captures.
   • CThe FortiGuard IPS package version page shows signature database version, not packet logs.
7. Question 7System Troubleshooting

   A downstream FortiGate is confirmed truly offline, but the root FortiGate's fabric topology still shows a stale, connected entry for it. Which action on the root is most appropriate to force the topology to refresh?

   • AClear the FortiGuard cache with `diagnose debug reset`
   • BRun a full `execute factoryreset` on the unit
   • CDisable the entire WAN interface instead
   • DToggle Security Fabric off and on under `config system csf`Correct
   ✓ Correct answer: D

   Toggling `set status disable` then `set status enable` under `config system csf` on the root restarts the CSF process and forces it to re-evaluate current downstream connectivity, clearing a stale topology entry for a unit that is genuinely offline.

   Why the other options are wrong

   • AThis only clears debug buffers, it does not refresh fabric topology state.
   • BA factory reset is destructive and unnecessary to refresh a stale topology entry.
   • CDisabling the WAN interface would drop all traffic, not just refresh the stale fabric entry.
8. Question 8System Troubleshooting

   Which sniffer filter matches traffic on TCP port 22 or TCP port 443 to host 10.1.1.50?

   • A'host 10.1.1.50 and port 22 and port 443'
   • B'host 10.1.1.50, port 22, port 443'
   • C'port 22 or port 443'
   • D'host 10.1.1.50 and (port 22 or port 443)'Correct
   ✓ Correct answer: D

   Parentheses group the two port options together with or, and the whole group is required to match alongside the host condition, correctly capturing either port for that one host.

   Why the other options are wrong

   • Aand requires both port 22 and port 443 to match the same packet at once, which never happens
   • Bcommas are not valid separators in a sniffer filter expression
   • Cthis omits the host qualifier entirely and would also match unrelated hosts
9. Question 9VPNSelect all that apply

   Which two items are part of a phase 1 proposal negotiated between IKE peers? (Choose TWO)

   • AQuick mode selectors (proxy IDs)
   • BEncryption algorithmCorrect
   • CStatic route metric
   • DDiffie-Hellman groupCorrect
   • EFirewall policy action
   ✓ Correct answer: B, D

   A phase1-interface proposal advertises the encryption algorithm, hash/PRF, DH group, and lifetime that must match between peers for the IKE SA to form. Quick mode selectors belong to phase 2, and route metrics or firewall policy actions are unrelated routing/policy constructs.

   Why the other options are wrong

   • ASelectors (proxy IDs) are negotiated in phase 2 (quick mode), not phase 1.
   • CRoute metrics are a routing configuration item, not part of the IKE proposal.
   • EFirewall policy action governs traffic forwarding, not the IKE proposal itself.
10. Question 10VPNSelect all that apply

    Which two settings are used, once mode-config is enabled, to give dial-up IPsec clients an internal IP address and DNS servers? (Choose TWO)

    • Aset ipv4-name <address/pool>Correct
    • Bset ipv4-dns-server1 <ip>Correct
    • Cset dpd on-idle
    • Dset nattraversal enable
    • Eset xauthtype auto
    ✓ Correct answer: A, B

    Once `set mode-cfg enable` is set, `set ipv4-name` references a firewall address object acting as the client IP pool, and `set ipv4-dns-server1` (and server2) supply DNS servers pushed to the client.

    Why the other options are wrong

    • Cdpd on-idle governs dead peer detection timing, unrelated to address or DNS assignment.
    • Dnattraversal deals with NAT devices between peers, not address/DNS push.
    • Exauthtype configures extended user authentication, not mode-config addressing.

Who this FCSS - Network Security 7.6 Support Engineer practice exam is for

This practice set is for anyone preparing for the FCSS - Network Security 7.6 Support Engineer exam at the intermediate level - from first-time candidates building a foundation to experienced Security practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this FCSS - Network Security 7.6 Support Engineer practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real FCSS - Network Security 7.6 Support Engineer exam.

Related Security resources

• FCSS - Network Security 7.6 Support Engineer study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• (ISC)² CISSP practice examRelated
• (ISC)² Certified in Cybersecurity (CC) practice examRelated
• CompTIA Security+ SY0-701 practice examRelated

FCSS - Network Security 7.6 Support Engineer practice exam FAQ