Fortinet Updated FCSS_NST_SE-7.6 Exam Questions and Answers by haleema

The correct answer is A .

The debug output is for an HTTPS request and shows a hostname value. The study guide explains that with SSL certificate inspection, FortiGate extracts the FQDN from either:

“TLS extension server name indication (SNI)”

“SSL certificate common name (CN)”

So the hostname shown in the real-time web-filter debug can be derived from the SNI in the client request or, if needed, from the CN in the server certificate. That makes A correct.

Why the other options are wrong:

B is wrong because the study-guide example for web-filter real-time debug explicitly says: “This slide shows an example of real-time debug output when the URL to categorize isn ' t in the FortiGuard cache.” In these debugs, cat=255 appears before the final lookup result, so this does not indicate a local-cache hit.

C is wrong because ftgd-allow is the action , not the profile name. The debug line shows the action as action=9 (ftgd-allow) while the profile shown is profile= ' default ' . FortiOS web-filter logs also use the profile field separately from the action field

D is wrong because the final category shown is url_cat=52 , not 255. The study guide’s example shows the same pattern: an initial cat=255 in the request line, followed by the resolved result cat=52 url_cat=52

So the verified answer is: A .

The correct answer is D .

In the exhibit, get router info routing-table database shows both static default routes:

0.0.0.0/0 [20/0] via 100.64.2.254, port2

0.0.0.0/0 [10/0] via 100.64.1.254, port1

But get router info routing-table all shows only:

0.0.0.0/0 [10/0] via 100.64.1.254, port1

The study guide explains that get router info routing-table all displays the routes that make it to the FIB — the best active routes . It also says that this command doesn’t show standby or inactive routes , which can remain only in the routing table database. It gives the exact rule: “when two static routes to the same destination subnet have different distances, the one with the lower distance is installed in the routing table, and the one with the higher distance is installed in the routing table database.”

The study guide also shows the route selection process:

Most specific route

Lowest distance

Lowest metric (dynamic routes)

Lowest priority (static routes)

ECMP

So the port2 default route is absent from the second output because its distance is 20 , while the port1 default route has distance 10 . The lower-distance route is installed in the active routing table/FIB.

Why the other options are wrong:

A is wrong because the exhibit does not indicate port2 is down or disabled.

B and C are wrong because priority is checked only after distance for static routes. Here, the routes already differ by distance , so priority is not the deciding factor.

So the verified answer is: D .

The study guide explicitly explains the FortiGuard flags shown by diagnose debug rating:

D = Default

“IP addresses of servers received from DNS resolution”

It then clarifies even more specifically:

“D = The IP address FortiGate got when resolving the service.fortiguard.net name (usually two or three servers have this flag, if the administrator didn ' t overwrite the FortiGuard FQDN or IP address in the FortiGate configuration)”

In the exhibit, among the answer choices, the IP address marked with the D flag is 208.91.112.194 . Therefore, that is the IP FortiGate got from resolving service.fortiguard.net.

Why the other options are wrong:

B. 209.22.147.36 is not the correct choice because in the exhibit it is not the DNS-resolution entry identified by the D flag

C. 64.26.151.37 has no D flag

D. 96.45.33.65 has no D flag

So the verified answer is: A .

FortiOS Admin Guide: Static Routing, SNAT Route Change Feature