Fortinet Updated NSE7_FSN_AR-7.6 Exam Questions and Answers by myah

The correct answers are C and D .

For D , the session output shows proto=6, which means TCP, and proto_state=01. The study guide explains that for TCP sessions, “the first number (from left to right) is related to the server-side state and is 0 when the session is not subject to any inspection (flow or proxy). … The second digit is the client-side state.” It also shows that value 1 = ESTABLISHED

So proto_state=01 means:

first digit 0 = no inspection

second digit 1 = ESTABLISHED

That confirms the TCP session has been successfully established.

For C , the study guide section “Session for an Authenticated User” states: “Any session for traffic coming from an authenticated user contains the authed flag. Additionally, the username is added to the session information.”

In the exhibit, the session contains user=User1 and an authentication state flag (authd), which indicates the session is associated with an authenticated user.

Why the other options are wrong:

A is wrong because the session did match a firewall policy . The study guide says the session output includes “The ID of the matching policy” In the exhibit, the session shows policy_id=1 , so a firewall policy was matched.

B is wrong because the study guide explains the gwy field as:

first value = gateway to destination

second value = gateway to source The exhibit shows gwy=10.1.0.254/10.1.10.1, so:

gateway to destination = 10.1.0.254

gateway to source = 10.1.10.1

So the verified answers are: C, D .

The get router info bgp summary output lists BGP neighbor status:

Prefix Reception: The " State/PfxRcd " column shows the number of prefixes received from the neighbor—neighbor 100.64.1.254 has " 1 " , confirming option A.

Received Message Count: Under " MsgRcvd " , 18 packets have been received from neighbor 100.64.1.254. This matches option C.

The second neighbor 100.64.2.254 is in " Active " state and has received/sent 0 packets, indicating that its TCP connection is NOT established, disproving option B.

There is no indication anywhere that the router is " still calculating " prefixes; " Active " just means no session is established, so option D is incorrect.

The FortiOS 7.6 Administrator Study Guide states: “The only security features you can apply using SSL certificate inspection mode are web filtering and application control.” Certificate inspection does not decrypt the encrypted payload. However, it can extract the destination hostname from the ClientHello’s server name indication (SNI). The exhibit exposes www.sharepoint.com in the server_name extension, enabling FortiGate to identify, categorize, and enforce web-filtering rules for the requested website. Therefore, option B is correct.

Antivirus inspection requires FortiGate to examine files or other application-layer content inside the encrypted payload. Because certificate inspection does not decrypt that content, an antivirus profile cannot be applied effectively; full SSL inspection is required. This eliminates option A.

The SAN field is not mandatory. FortiGate first attempts to obtain the hostname from SNI and can validate it against either the common name (CN) or SAN in the server certificate. Accordingly, option C is incorrect.

The supported_versions extension explicitly lists TLS 1.3 and TLS 1.2 and no other versions. Although the ClientHello’s legacy Version field displays TLS 1.2 (0x0303), TLS 1.3 clients retain this legacy value for compatibility. The extension identifies the versions the client actually supports, making option D correct.

The correct answers are A and C .

The study guide describes this exact asymmetric ICMP scenario. It states:

“The server sends an echo request to the PC through port2 of the local router, effectively bypassing FortiGate. When it receives the echo request, the PC responds with an echo reply through its default gateway, 10.1.0.2, which is port1 on FortiGate. Because there is no existing session, the echo reply is dropped. All subsequent echo replies are blocked.”

That means the current problem exists because:

the ICMP request bypasses FortiGate

the ICMP reply goes through FortiGate

FortiGate has no matching session , so it drops the reply

The study guide then shows the exact corrective option:

“Allowing asymmetric routing:”

config system settings

set asymroute enable

end

It further explains:

“After the packet passes through the FortiGate CPU, FortiGate forwards the packet using the FIB, even though there are no session matches. FortiGate forwards all subsequent echo replies using the FIB.”

So A is correct.

The other valid fix is to make the traffic symmetric by changing the laptop’s default gateway so the reply no longer goes through FortiGate. In the exhibit, the alternate gateway is 10.1.0.254 , which is the local router on the same subnet. If the laptop uses 10.1.0.254 instead of 10.1.0.2, the ICMP echo reply follows the same bypass path as the echo request, so the server receives it without involving FortiGate session validation. This makes C correct.

Why the other options are wrong:

B is wrong because this is not an RPF problem. The study guide explains RPF as a reverse path lookup used to validate whether a packet arrived on a legitimate interface, mainly for spoofing protection. The issue in this scenario is a missing session due to asymmetric routing , not a strict-versus-feasible RPF failure

D is wrong because FortiGate already has the specific route 10.4.0.0/24 through port3 in the routing table shown in the exhibit, so adding a default static route to port3 is unnecessary and not the reason the echo reply is being dropped

So the verified answers are: A, C .