Exam NSE7 topic 1 question 5 discussion

Actual exam question from Fortinet's NSE7

Question #: 4
Topic #: 2

Examine the output from the 'diagnose debug authd fsso list' command; then answer the question below.
# diagnose debug authd fsso list
----FSSO logons----
IP: 192.168.3.1 User: STUDENT Groups: TRAININGAD/USERS Workstation: INTERNAL2. TRAINING. LAB
The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.
What should the administrator check?

A. The IP address recorded in the logon event for the user STUDENT.
B. The DNS name resolution for the workstation name INTERNAL2. TRAINING. LAB.
C. The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2. TRAINING. LAB.
D. The reserve DNS lookup for the IP address 192.168.3.1.

Show Suggested Answer

Suggested Answer: C 🗳️

by Raul_Omar at Oct. 7, 2020, 2:32 a.m.

Comments

Submit Cancel

dsticht

1 year, 8 months ago

The reason B is the right answer is that it is most commonly the root of your problem.

upvoted 1 times

...

dsticht

1 year, 9 months ago

FSSO documentation does not mention reverse DNS, but does mention A records. Checking the source IP from some traffic won't necessarily point you to the problem. DNS is almost certainly the issue, so B.

upvoted 1 times

...