Download Latest NSE7_FSN_AR-7.6 Questions

The administrator cannot see traffic in the sniffer because it is being offloaded to the NPU (NP6). To view the traffic, offloading must be disabled so packets pass through the CPU.

B. config firewall policy ... set auto-asic-offload disable: This is the recommended method to troubleshoot specific traffic. By disabling ASIC offloading in the relevant firewall policies (Policies 5 and 17 in the exhibit), traffic is forced to the CPU and becomes visible to the sniffer.

C. diagnose npu np6 fastpath disable 1: This command temporarily disables the fastpath processing on the specific NP6 processor (ID 1) handling the ports. This forces all traffic handled by that NPU to the CPU, allowing the sniffer to capture it.

Incorrect Options: Option A uses invalid syntax (port-list disable is not a valid command). Option D (config system npu) is not the standard method for granular troubleshooting.

The correct answers are C and D .

The study guide states: “SSL certificate inspection relies on extracting the FQDN of the URL from either: TLS extension server name indication (SNI), SSL certificate common name (CN).” It also says: “When using SSL certificate inspection, FortiGate is not decrypting the traffic. It is only inspecting the server digital certificates and the SNI field, which are interchanged before the encryption.”

This proves the second part of the answer:

under SSL certificate inspection , FortiGate does not decrypt the traffic

therefore, if the traffic is allowed , it still passes without decryption

That makes D correct.

For the SNI mismatch behavior, the FortiOS administration guide describes the default Server certificate SNI check behavior as:

“Enable: If it is mismatched use the CN in the server certificate for URL”

So if the SNI does not match the CN or any SAN, FortiGate falls back to using the CN from the Subject field for URL handling under the default setting. That makes C correct.

Why the other options are wrong:

A is wrong because with the default SNI-check behavior, when the SNI mismatches the certificate identity, FortiGate does not continue using the mismatched SNI . Instead, it uses the CN in the server certificate for the URL .

B is not the best answer in this single pair selection . While certificate inspection does not decrypt traffic, the key default behavior the documents explicitly highlight for this mismatch case is:

use the CN when SNI mismatches , and

certificate inspection does not decrypt allowed HTTPS traffic .

So the verified answers are: C, D .

Comprehensive and Detailed Explanation From Exact Extract of Network Security Support Engineer Study Guide (FortiOS 7.6) topics:

The correct answers are A and B . Security Fabric communication uses Fortinet-proprietary protocols, mainly FortiTelemetry and Neighbor Discovery . The study guide states that FortiTelemetry uses TCP port 8013 , and that the connection is always established by the downstream FortiGate toward the upstream FortiGate . This validates option A . The same section also states that FortiTelemetry must be manually enabled . More precisely, the upstream FortiGate interface must have Security Fabric Connection enabled under administrative access so it can accept incoming Security Fabric connection requests. This validates option B .

Option C is wrong because only the FortiTelemetry TCP port 8013 can be changed; Neighbor Discovery uses UDP port 8014 and cannot be changed. Option D is also wrong because Security Fabric communication is not enabled automatically among all Fortinet devices. It requires the correct Security Fabric settings, interface administrative access, and downstream authorization. The study guide’s troubleshooting section confirms that when FortiTelemetry is disabled, the upstream FortiGate receives TCP 8013 SYN packets but does not complete the Security Fabric connection.

The correct answer is A .

The debug flow shows:

traffic is going to TCP port 211

FortiGate logs run helper-ftp(dir=original)

The study guide explains exactly what that message means:

“In this example, the run helper-ftp message indicates that the FTP session helper is being used.”

Under normal proxy-based inspection, protocol handling is controlled by Protocol Options . The FortiOS administration guide states:

“Protocol port mapping only works with proxy-based inspection.” and “The ports can be modified to inspect any port with flowing traffic.”

So if the policy is configured for proxy-based inspection but the debug still shows the FTP session helper on port 211, the most likely explanation is that the FTP protocol mapping in Protocol Options is broad enough to match unexpectedly, such as being mapped to Any . That would cause FortiGate to identify the traffic as FTP and invoke the helper.

Why the other options are wrong:

B is wrong because SSL deep inspection is unrelated to this debug. The traffic shown is plain TCP/211 , and the key message is about the FTP helper , not SSL decryption.

C is wrong because if FTP had not been mapped to port 211, FortiGate would be less likely to treat this traffic as FTP. The observed run helper-ftp indicates FTP handling is being triggered.

D is wrong because low-memory conserve behavior would typically cause inspection bypass or blocking behavior, not specifically the run helper-ftp message. The study guide’s helper example ties this message to session-helper use, not memory shortage.

So the verified answer is: A .