Fortinet Updated FCSS_NST_SE-7.6 Exam Questions and Answers by aqsa

The BGP debug output shows session information for peers, including state details. According to official Fortinet BGP documentation, if the session state with a peer does not show "Idle," "Active," or "Connect," but instead shows "Established," "Up," or related counters (e.g., messages sent/received or uptime), it indicates the session is operational. In this scenario, the peer 10.127.0.75 is the only one showing a positive indication of a live, established session. Other options like neighbor-range configuration, AS mismatch, or route-maps blocking prefixes are not supported by evidence provided in a simple BGP session state debug, nor does the output show errors relating to local or remote AS issues.

The correct interpretation comes from Fortinet's BGP troubleshooting guide, which outlines how to read session status and neighbor states in debug and summary outputs.

The debug command diagnose debug application fssod -1 reveals the internal processing of the FortiGate Single Sign-On daemon.

Option D (Agentless Polling): The output shows event_id=4768. Event ID 4768 (Kerberos TGT Request) is a Windows Event Log entry. The presence of specific Event IDs in the fssod debug, rather than a generic logon notification, indicates that the system is reading (polling) the Security Event Logs from the Domain Controller. This is characteristic of Agentless Polling Mode (or Collector Agent Polling Mode), where the FortiGate or Collector scrapes logs. In contrast, DC Agent mode intercepts logon calls directly and would typically provide more complete information, including the workstation name.

Option A (Verification): Crucially, the output shows workstation=,, indicating the workstation name field is empty. In Polling Mode, certain Event IDs (like 4768) often do not contain the source workstation's hostname. Without the workstation name, the FortiGate (or Collector) cannot perform a workstation check (WMI/Registry poll) to verify if the user is still logged in. It essentially has to rely on the "dead entry timeout" because active verification is impossible without the target machine's name.

Option B is incorrect because DC Agents reliably capture workstation names. Option C is incorrect because the system cannot poll a workstation it cannot identify.

To solve this high CPU usage scenario involving the ipsengine, we must understand the specific functions of the diagnose test application ipsmonitor commands shown in the troubleshooting steps.

Analyze the Situation:

Exhibit: The diagnose sys top output shows the ipsengine process is in a run state (R) consuming 99% CPU.

Previous Action: The administrator already ran diagnose test application ipsmonitor 5.

Result: The CPU usage did not drop.

Understand the Commands:

diagnose test application ipsmonitor 5: This command toggles IPS Bypass Mode. When enabled, the IPS engine lets traffic pass through without inspection.

Implication: If the CPU was high due to traffic volume, enabling bypass would drop the CPU load immediately.

Failure: Since the CPU remained at 99% after bypass, the ipsengine process is likely frozen, stuck, or in an internal infinite loop unrelated to the current traffic flow. The process itself is the problem, not the traffic volume.

Evaluate the Solution (Option B):

diagnose test application ipsmonitor 2: This command toggles the IPS engine's Enable/Disable status.

Because the engine is stuck (bypass failed to relieve pressure), the "Immediate action" required is to stop or restart the process entirely.

Running option 2 effectively disables/kills the stuck IPS engine instance, which will immediately drop the CPU usage to near zero. (It can then be toggled again to restart it).

Why other options are incorrect:

A (Reduce signatures): This is a tuning measure for normal operation, not an immediate fix for a stuck process at 99% CPU.

C (Disable IPS on policies): This is a configuration change that takes time and requires a commit; it is not the most immediate diagnostic tool available.

D (Bypass all IPS engines): This describes the action of command 5 (Bypass), which the prompt explicitly states was already performed and failed.