Pass the Fortinet Fortinet Certified Professional Network Security FCSS_EFW_AD-7.6 Questions and answers with CertsForce

In an ADVPN (Auto-Discovery VPN) network, a dynamic VPN tunnel is established on-demand between spokes to optimize traffic flow and reduce latency.

Process:

1. Traffic Initiation:

A client behind Spoke-1 sends traffic to a device behind Spoke-2.

The traffic initially flows through the hub, following the pre-established overlay tunnel.

2. Hub Detection:

The hub detects that Spoke-1 is communicating with Spoke-2 and determines that a direct shortcut tunnel between the spokes can optimize the connection.

3. Shortcut Offer:

The hub sends a " Shortcut Offer " message to Spoke-1, informing it that a direct dynamic tunnel to Spoke-2 is possible.

4. Tunnel Establishment:

Spoke-1 and Spoke-2 then negotiate and establish a direct IPsec tunnel for communication.

Based on the packet capture provided in the exhibit and Fortinet ' s Enterprise Firewall 7.6 inspection standards:

Web Filtering Effectiveness (B): The exhibit shows the Server Name Indication (SNI) extension within the Client Hello, specifically indicating the hostname www.fortinet.com. When a firewall policy is configured for SSL Certificate Inspection , the FortiGate does not decrypt the payload but instead relies on the SNI or the certificate ' s Subject/SAN fields to identify the website. Therefore, a web filtering profile can effectively categorize and block/allow this traffic based on the domain name found in the SNI.

TLS Version Support (D): The supported_versions extension is a feature introduced with TLS 1.3 to negotiate the version of the handshake. In the exhibit, the extension explicitly lists two versions: TLS 1.3 (0x0304) and TLS 1.2 (0x0303) . This tells the FortiGate exactly which protocols the client is capable of using for this session.

Why A is incorrect: Antivirus profiles require Deep SSL Inspection (full decryption) to scan the actual files and payload of the session. Since the policy is using Certificate Inspection , the FortiGate cannot see the cleartext data, rendering the antivirus profile ineffective for this encrypted traffic.

Why C is incorrect: While the Subject Alternative Name (SAN) is a common way to identify a site, it is found in the server ' s certificate. In this specific capture, the SNI (Server Name Indication) is already present in the Client Hello, which allows the FortiGate to apply security profiles even before the server ' s certificate is seen.

Standard certificate inspection (which relies on the SNI) only identifies the destination domain; it does not allow the FortiGate to see the actual content of the encrypted session. As noted in the lab documentation, " certificate inspection on its own does not help HQ-DCFW to see the encrypted traffic " . To identify and block malware hidden within HTTPS traffic, the FortiGate must be configured with full SSL inspection (also known as deep inspection). This process involves the FortiGate acting as a man-in-the-middle to decrypt the packets, scan the payload for threats using the applied security profiles (like Antivirus or IPS), and then re-encrypt the traffic before sending it to the host. Without full decryption, the unit " will not decrypt packets to analyze if there is a possible attack, " allowing malware to bypass security layers.

==============