FCP_FWF_AD-7.4 FCP - Secure Wireless LAN 7.4 Administrator Question and Answers

Exhibit Review:

The diagnostics panel for FortiAP FP231FTF2001 shows:

Tx bandwidth label: 150.54 Mbps (likely the negotiated or theoretical maximum).

Bandwidth graph (actual traffic): Transmit (Tx) bandwidth peaked at only ~3 Mbps over the last 5 minutes—far below the maximum.

Radio 1 (2.4 GHz) shows 10 interfering SSIDs and 40% channel utilization.

Radio 2 (5 GHz) is not the focus in the current graph.

Interpretation:

The significant difference between the potential (label) and actual (graph) throughput indicates that something is preventing the AP from delivering full speed.

This could be resource overload (e.g., too many clients, too much interference, CPU/memory constraints), leading to overall reduced throughput for all users.

The graph represents real-time/actual usage, not just the theoretical capability.

Option Breakdown:

A. Resources on FortiAP are overloaded which limits speed rates for all users

Correct. Overload (either due to too many clients, high interference, or hardware resources) is a logical reason why actual throughput is far below the possible maximum.

B. Label values are historical and provide average bandwidth

Incorrect. The label reflects the maximum link rate or negotiated data rate, not an average or historical usage value.

C. FortiAP is dual band and is transmitting data faster with a higher frequency band

Not supported by the evidence. The current data is for Radio 1 (2.4 GHz) and does not show high usage on either band.

D. Bandwidth is shared with other SSID signals broadcasting for nearby AP devices

While interference does share airtime, the drastic drop in throughput strongly suggests an overload or other limiting factor on this AP.

Summary:

The large gap between the expected maximum (label) and the actual throughput observed suggests that resource overload is the root cause of poor wireless speeds for all users.

Wireless channels have a defined bandwidth (e.g., 20 MHz, 40 MHz, 80 MHz).

Wider channels can carry more data simultaneously, as there’s more spectral space for transmission.

Modern Wi-Fi standards (802.11n/ac/ax) use channel bonding to increase throughput by widening channels.

The other options are not correct:

Data can be transmitted across multiple bonded channels.

More channels do not necessarily mean higher power use.

Channels are used bidirectionally.

For advanced wireless troubleshooting:

Capturing air traffic (B): This means performing a wireless packet capture (sniffing), usually via the FortiAP's diagnostic tools (e.g., cw_diag sniff), to see low-level association/authentication issues, interference, or protocol errors.

Reviewing event logs (C): Check event logs on the FortiGate and FortiAP to find authentication failures, disconnections, roaming events, or system messages specific to the wireless station.

A (creating/assigning a new profile) is not typically an advanced troubleshooting step; it's more of a configuration or workaround.

D (collecting power management info) is rarely required except for specific power-saving issues, and is not a primary advanced troubleshooting step.

Channels 52 through 144 in the 5 GHz band (shown as UNII-2, UNII-2-Extended, and some adjacent channels) are marked in regulatory domains as DFS (Dynamic Frequency Selection) channels.

DFS channels must be monitored for radar activity (such as weather radar). If radar is detected, the AP must switch channels to avoid interference.

These channels can be used, but only if the AP supports DFS and performs the necessary checks before use.

WIDS can scan these channels but that’s not the defining characteristic.

Regulatory restrictions (B) apply only if DFS is not supported, which is rare on modern equipment.

Radio Resource Provisioning (C) is unrelated to DFS usage.

Scenario Analysis:

The wireless client is redirected to a captive portal for authentication.

The authentication settings (see second exhibit) show:

Captive portal type: FQDN is selected.

Certificate: Fortinet_Factory (the default self-signed certificate).

The browser is reporting a certificate validation error when the redirection to the captive portal occurs.

Certificate Validation and Captive Portals:

When FQDN is used for captive portal redirection, the browser expects the SSLcertificate to be valid for the FQDN (e.g., “captive.company.com”).

If the certificate is self-signed or does not match the FQDN (common when using the Fortinet factory default certificate), the browser will trigger a certificate error.

This is a common issue when FQDN-based portals are used without a publicly trusted certificate matching the FQDN.

Option Analysis:

A. The FortiGate IP address in the POST parameters is using a numerical IP address

Not relevant; the browser validates the page being loaded, not the POST parameters.

B. The external server address is not the FQDN address

In this case, the external captive portal URL is using FQDN, as set in the authentication setting.

C. The used credential is not embedded in the captive portal parameters

Credential handling is not related to certificate errors; it would result in login/authentication failures, not browser SSL warnings.

D. The captive portal setting in the authentication setting is set to use FQDN as the captive portal type

Correct. When FQDN is used, the SSL certificate presented must be trusted and match the FQDN. The factory certificate will not match (it is not publicly trusted), so clients will see a validation error.

Summary:

Certificate validation fails because the captive portal is accessed via FQDN, but the FortiGate presents its self-signed factory certificate, which does not match the FQDN or is not trusted by browsers.

Exhibit Analysis:

Bandwidth: The Tx (2.06 kbps) and Rx (2.09 kbps) are balanced and low, showing steady, light activity.

Signal Strength/Noise: The signal appears to be relatively stable, not showing drops to 0 dB or significant noise spikes.

Transmission Discard/Retry:

Transmission Discard Percentage: 0% (normal; no packets are being discarded).

Transmission Retry Percentage: 25% (abnormally high; typically, values above 10-15% suggest issues).

Option Breakdown:

A. The wireless client has been experiencing high background noise within the last 5 minutes

Incorrect. The Signal Strength/Noise graph is steady and does not indicate abnormal noise.

B. The wireless client has been dropping half of the packets transmitted within the last 5 minutes.

Incorrect in wording: The Discard Percentage is 0%. So, no packets are being dropped, but...

However, the Transmission Retry Percentage is high (25%). This indicates many packets are having to be retransmitted (due to interference, weak signal, or congestion), which is abnormal. If "dropping" is interpreted as "requiring retry," then this fits.

C. The wireless client has been transmitting traffic with all performance metrics within the normal levels

Incorrect. The Retry Percentage is not normal.

D. The wireless client has been switching between available wireless bands within the last 5 minutes

Incorrect. There is no data here to suggest band steering or band switching.

Clarification:

The only abnormal value is Transmission Retry Percentage (25%), which is significantly high. This indicates repeated transmission attempts due to interference, poor signal quality, or congestion.

Best Match:

B. The wireless client has been dropping half of the packets transmitted within the last 5 minutes.

More precisely, it's retransmitting, not dropping, but this is the best answer provided.