Fortinet FCP_FWF_AD-7.4 FCP - Secure Wireless LAN 7.4 Administrator Exam Practice Test

WPA3 introduces improvements over WPA2, most notably replacing the PSK (Pre-Shared Key) handshake with the Simultaneous Authentication of Equals (SAE) handshake.

The SAE handshake is resistant to key reinstallation attacks (KRACK) that affected WPA2.

WPA3 also improves security in open networks but does not force enterprise-only mode or universally block all legacy protocols, and 128-bit key size alone isn’t unique to WPA3.

When a client moves out of range, the connection drops.

The normal behavior is for the client to disconnect and then seek out and connect to another AP with a stronger signal.

The AP does not force disconnection or send alerts; the client handles roaming.

Clients do not increase their own radio power substantially in response to poor signals due to hardware limits.

WPA3 improves security over WPA2 by, among other things:

Using robust key establishment (SAE/Dragonfly), which is not vulnerable to KRACK (Key Reinstallation Attack).

WPA3 does not enforce only enterprise mode, nor does it universally prevent all legacy protocols, nor is 128-bit key size unique to WPA3.

Debug Output Review:

The logs show repeated attempts to connect, with multiple msg: WPA ENTERPRISE TRANSITION and WPA NON-ENTERPRISE TRANSITION events.

There are repeated authentication frame exchanges, but several entries show failure messages, including incomplete handshake and RADIUS/authentication failures.

The client is unable to complete the full authentication process—typical indicators of incorrect credentials (failed RADIUS authentication) and failure in the WPA handshake process.

Unsuccessful association—No; the client does associate but fails at authentication/handshake.

C. Client denied after many attempts—No evidence the client itself is denying; it’s failing at the network’s authentication step.

802.1X is the standard for port-based network access control, widely used in enterprise Wi-Fi to:

Authenticate users and devices before granting access to the network.

Authorize network access (optionally placing users into specific VLANs).

It is not for home Wi-Fi (C), does not provide admin privilege (B), and is more complex than open guest Wi-Fi (D).

FortiPresence is Fortinet’s Wi-Fi analytics/cloud presence platform.

FortiAPs can be managed directly by FortiGate or FortiLAN Cloud and connect their analytics/events to the FortiPresence cloud for presence analytics.

FortiSASE and FortiSwitch Manager do not provide FortiPresence integration for APs.

Wireless Intrusion Detection System (WIDS) in Fortinet’s Secure Wireless LAN (SWLAN) platform monitors for threats to the wireless environment and detects a range of attacks and misconfigurations.

The main threats detected by WIDS include:

Rogue access points: These are unauthorized APs plugged into the network, posing a security risk. WIDS scans and identifies any AP that is not part of the authorized network, flagging them as potential rogues.

Unauthorized wireless connections: WIDS can detect clients that connect to unauthorized or suspicious wireless networks, as well as unauthorized wireless devices attempting to connect to the network.

Analysis of Options:

A. Brute-force dictionary attacks:

WIDS does not specifically detect brute-force dictionary attacks against authentication. It focuses more on network topology threats and unauthorized devices.

B. Unauthorized wireless connection:

Correct. WIDS can detect unauthorized wireless connections, such as clients connecting to networks/APs that are not trusted.

C. Rogue access points:

Correct. Detecting rogue APs is a primary function of WIDS.

D. WPA2 authentication vulnerabilities:

WIDS does not specifically scan for cryptographic protocol vulnerabilities. It detects behavioral/network threats.

FortiPresence analytics is a platform for presence analytics—monitoring WiFi user presence, dwell time, and visitor trends in physical spaces.

A: It collects and reports details about on-site guest users, such as visit duration and repeat visits.

C: It enables comparison of current user presence and activity data with historical trends, supporting operational and marketing analysis.

B (reporting potential threats) is not a function of presence analytics.

D (predicting future guest counts) is not a core function; FortiPresence reports on actual and historical data, not predictive analytics.

Understanding the Requirement:The question asks how to find the upstream (client to AP) and downstream (AP to client) link rates for a wireless client connected to a FortiAP. This is often used to diagnose wireless client performance and link quality.

Option Analysis:

A. On the FortiGate GUI using the WiFi Client monitor

The WiFi Client monitor on the FortiGate GUI provides general info about connected clients such as IP address, MAC address, SSID, AP, and signal strength (RSSI/SNR), but it does not display the detailed link rates (upstream/downstream rates) for individual clients.

B. On the FortiAP CLI using the cw_diag ksta command

Correct.

The cw_diag ksta command is executed directly on the FortiAP’s CLI.

It shows detailed wireless client statistics, including both tx rate (downstream/AP to client) and rx rate (upstream/client to AP) for each connected client.

Example output:

FAP# cw_diag ksta

00:11:22:33:44:55 (vlan 0) RSSI:45 SNR:35 RX rate: 433Mbps TX rate: 144Mbps

These rates are the link rates negotiated between the client and the AP in both directions.

C. On the FortiGate CLI using the diagnose wireless-controller wlac -d sta command

This FortiGate CLI command provides some info about clients (e.g., connection state, signal), but does not directly show both upstream and downstream link rates.

D. On the FortiAP CLI using the cw_diag -d sea command

This command (cw_diag -d sea) is used for spectral analysis/debugging and does not provide per-client link rates.

Reference from Official Fortinet Documentation and Guides:

FortiOS Administration Guide (7.4):

The guide states that for detailed wireless client statistics, including negotiated rates, you must SSH into the FortiAP and run the cw_diag ksta command.

This provides a summary of all associated clients, their negotiated rates, and more.

Typical Workflow:

SSH into the FortiAP device.

Enter the command:

cw_diag ksta

Review the output. For each client, you will see RX and TX rates (these correspond to upstream and downstream link rates).

Why Not Other Options?

Only the FortiAP CLI with cw_diag ksta shows the negotiated link rates for each client in both directions.

The FortiGate GUI/CLI provides only summary info or signal statistics, not real-time link rates per client.

Summary:

To find the upstream and downstream link rates of a wireless client connected to a FortiAP, use the FortiAP CLI with the cw_diag ksta command.