Fortinet FCSS_LED_AR-7.6 Practice Test Questions Answers

In FortiGate captive portal workflows (local or external):

Client connects to SSID / interface that has captive portal enabled.

Client makes an HTTP/HTTPS request.

FortiGate intercepts and redirects to alogin page(local or external URL).

The portal form is submitted viaPOSTback to FortiGate.

To prevent tampering and to tie the POST back to thecorrect user session, FortiGate includes a special hidden parameter in the redirect and expects it in the POST:

The parameter is namedmagic.

The magic value:

Is aunique tokengenerated per captive-portal session.

Encodes/session-links the user’s IP, interface, and session info.

Allows FortiGate to ensure that:

The POST comes from the user who initiated the original request.

The request is not a random or replayed submission.

When troubleshooting:

If the external portal does notpreserve and resendthe magic parameter back to FortiGate exactly as received, authentication fails, and you’ll see errors like “session not found” or “invalid magic”.

Why the other fields are not used for this purpose

A. username– Just the login ID; multiple users can use the same username from different locations, so it can’t uniquely track the browser session.

B. redir– Contains the URL the user originally requested, so they can be sent back there after login. It is not a session integrity token.

D. email– Optional field used in some guest/registration flows; irrelevant to session validation.

The DHCP configuration shows:

set vci-match enable

set vci-string " FortiSwitch " " FortiExtender "

What this means

VCI = Vendor Class Identifier (DHCP option 60)

When vci-match is enabled, the DHCP server will only respond to DHCP requests from clients whose VCI string matches the configured vendor identifiers.

FortiSwitch and FortiExtender both send DHCP option 60 with:

" FortiSwitch "

" FortiExtender "

This is used in FortiLink deployments so only these devices receive IP addresses on the FortiLink network.

Therefore:

C. To connect, devices must match the VCI string; otherwise, they will not receive an IP address.

✔Correct.

This perfectly matches FortiGate FortiLink DHCP behavior.

Summary of incorrect options

A — Ignore FortiSwitch/FortiExtender

❌Opposite behavior.

B — Restrict based on hostname

❌VCI does NOT check hostname.

D — Reserve IPs

❌No reservation occurs; it ' s filtering, not reserving.

The correct answer is D.

The LAN Edge 7.6 Architect study guide explains that when using an external captive portal, configuring the portal URL and exempt destinations on the SSID is not enough by itself. FortiGate must also have a matching firewall policy that allows the unauthenticated client traffic path to the external portal.

The guide states: “If you are using an external captive portal server, you must configure a firewall policy and exempt web traffic to the external captive portal IP address.”

It also states: “Just selecting and applying the address object and selecting the services is not enough to allow the traffic to pass through FortiGate. You must also have a corresponding firewall policy in place that allows the pinhole traffic to pass through FortiGate.”

In the exhibit, the SSID already includes FortiAuthenticator and WindowsAD as exempt destinations/services, so option C is already configured. However, the wireless clients are connecting through the AP on port4, and the visible firewall policy shown is from the guest SSID interface to port1 for internet access. There is no policy shown that permits the required pre-authentication traffic path from the wireless side toward the external portal resources through the relevant source path. Therefore, the missing fix is the firewall policy using port4 as source.

Why the other options are incorrect:

A. Incorrect. External captive portal authentication is designed to work with an open SSID plus captive portal. WPA2-Enterprise is a different authentication model and is not required here

B. Incorrect. The study guide does not identify NAT on that policy as the reason users cannot reach the external captive portal login page. The key requirement is the exempt/pinhole firewall policy, not NAT behavior

C. Incorrect. Those address objects are already present in the SSID configuration under exempt destinations/services, so this is not the missing change.

Final verified conclusion:

Because the exempt destinations are already configured, the missing requirement is the corresponding firewall policy permitting the captive portal pinhole traffic from the wireless source path.

So the correct answer is D.

In an SD-Branch deployment (FortiGate + FortiSwitch + FortiAP),FortiAIOps:

Collects telemetry and logs from Fabric devices

Usesmachine-learning / AI analyticsto:

Spot anomalies (latency, packet loss, RF issues, misconfigurations)

Highlight root causes

Proposeoptimization recommendations(e.g., channel changes, power tuning, config fixes)

It doesnot:

Automatically disable devices (Afalse)

Replace SD-WAN config or all routing (Cfalse)

Fixallissues with zero human input (Dis marketing fantasy, not reality)

Analysis of the VAP Configuration (Image 1): The VAP named " Corporate " has set vlan-pooling wtp-group, which maps directly to the Managed AP Group VLAN pooling method. The study guide states: " The Managed AP Group load balance method assigns VLANs from pools based on AP location. " This means VLAN assignment is NOT load-balanced (no round-robin or hash) — instead, it is determined by which WTP (Wireless Termination Point) group the AP physically belongs to:

APs in wtp-group " Floor_1 " → assigned VLAN 101 (Corp.101)

APs in wtp-group " Office " → assigned VLAN 102 (Corp.102)

Why C is CORRECT: From Image 2, the interface Corp.101 (VLAN 101 — assigned to the Floor_1 AP group) shows an IP address of 0.0.0.0/0.0.0.0, meaning no IP address or DHCP server is configured on that interface. Therefore, clients connecting to APs in the Floor_1 group will be placed on VLAN 101 but will not be able to obtain an IP address — confirming option C.

Why D is CORRECT: The VAP configuration explicitly maps wtp-group " Office " to VLAN 102. The study guide confirms that with the Managed AP Group method, VLANs are assigned based on AP group membership. APs belonging to the " Office " group will have all their clients assigned to VLAN 102 (Corp.102), which has a configured IP of 10.0.20.1/255.255.255.0 — confirming option D.

Why the other options are wrong:

A is incorrect — The wtp-group pooling method does not load balance; it assigns VLANs based on AP group location. Round-robin or hash would be needed for load balancing. Additionally, the subnet 10.0.3.0/24 does not exist anywhere in either exhibit.

B is incorrect — Corp.zone contains both Corp.101 and Corp.102. Since Corp.101 has no IP configured (0.0.0.0/0.0.0.0), clients on Floor_1 APs (VLAN 101) will not receive any IP address, let alone one from the 10.0.20.0/24 subnet. Only Corp.102 clients (Office group) receive addresses from 10.0.20.0/24.