Fortinet Fortinet Certifications NSE7 Questions & Answers

• Question 11:

  View these partial outputs from two routing debug commands: Which outbound interface will FortiGate use to route web traffic from internal users to the Internet?

  

  A. Both port1 and port2

  B. port3

  C. port1

  D. port2

  Correct Answer: C

• Question 12:

  Examine the output of the `diagnose sys session list expectation' command shown in the exhibit; than answer the question below.

  

  Which statement is true regarding the session in the exhibit?

  A. It was created by the FortiGate kernel to allow push updates from FotiGuard.

  B. It is for management traffic terminating at the FortiGate.

  C. It is for traffic originated from the FortiGate.

  D. It was created by a session helper or ALG.

  Correct Answer: A

• Question 13:

  An administrator has configured a FortiGate device with two VDOMs: root and internal. The administrator has also created and inter-VDOM link that connects both VDOMs. The objective is to have each VDOM advertise some routes to the other VDOM via OSPF through the inter-VDOM link. What OSPF configuration settings must match in both VDOMs to have the OSPF adjacency successfully forming? (Choose three.)

  A. Router ID.

  B. OSPF interface area.

  C. OSPF interface cost.

  D. OSPF interface MTU.

  E. Interface subnet mask.

  Correct Answer: BDE

• Question 14:

  When does a RADIUS server send an Access-Challenge packet?

  A. The server does not have the user credentials yet.

  B. The server requires more information from the user, such as the token code for two- factor authentication.

  C. The user credentials are wrong.

  D. The user account is not found in the server.

  Correct Answer: B

• Question 15:

  A FortiGate has two default routes: All Internet traffic is currently using port1. The exhibit shows partial information for one sample session of Internet traffic from an internal user:

  

  

  What would happen with the traffic matching the above session if the priority on the first default route (IDd1) were changed from 5 to 20?

  A. Session would remain in the session table and its traffic would keep using port1 as the outgoing interface.

  B. Session would remain in the session table and its traffic would start using port2 as the outgoing interface.

  C. Session would be deleted, so the client would need to start a new session.

  D. Session would remain in the session table and its traffic would be shared between port1 and port2.

  Correct Answer: A

• Question 16:

  Examine the following partial outputs from two routing debug commands; then answer the question below:

  

  Why the default route using port2 is not displayed in the output of the second command?

  A. It has a lower priority than the default route using port1.

  B. It has a higher priority than the default route using port1.

  C. It has a higher distance than the default route using port1.

  D. It is disabled in the FortiGate configuration.

  Correct Answer: A

• Question 17:

  What is the purpose of an internal segmentation firewall (ISFW)?

  A. It inspects incoming traffic to protect services in the corporate DMZ.

  B. It is the first line of defense at the network perimeter.

  C. It splits the network into multiple security segments to minimize the impact of breaches.

  D. It is an all-in-one security appliance that is placed at remote sites to extend the enterprise network.

  Correct Answer: B

• Question 18:

  View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

  ike 0: comes 10.0.0.2:500->10.0.0.1:500, ifindex=7.... ike 0: IKEv1 exchange=Aggressive id=baf47d0988e9237f/2f405ef3952f6fda len=430 ike 0: in

  BAF47D0988E9237F2F405EF3952F6FDA0110040000000000000001AE0400003C00000 00100000001000000300101000 ike 0:RemoteSite:4: initiator: aggressive mode get 1st response... ike 0:RemoteSite:4: VID RFC 3947 4A131c81070358455C5728F20E95452F ike 0:RemoteSite:4: VID DPD AFCAD71368A1F1C96B8696FC77570100 ike 0:RemoteSite:4: VID FORTIGATE 8299031757A36082C6A621DE000502D7 ike 0:RemoteSite:4: peer is FortiGate/Fortios (v5 b727)

  ike 0:RemoteSite:4: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3 ike 0:RemoteSite:4: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3C0000000

  ike 0:RemoteSite:4: received peer identifier FQDN `remore'

  ike 0:RemoteSite:4: negotiation result

  ike 0:RemoteSite:4: proposal id = 1:

  ike 0:RemoteSite:4: protocol id = ISAKMP:

  ike 0:RemoteSite:4: trans_id = KEY_IKE.

  ike 0:RemoteSite:4: encapsulation = IKE/none

  ike 0:RemoteSite:4: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key 璴en=128

  ike 0:RemoteSite:4: type=OAKLEY_HASH_ALG, val=SHA.

  ike 0:RemoteSite:4: type-AUTH_METHOD, val=PRESHARED_KEY.

  ike 0:RemoteSite:4: type=OAKLEY_GROUP, val=MODP1024.

  ike 0:RemoteSite:4: ISAKMP SA lifetime=86400

  ike 0:RemoteSite:4: ISAKMP SA baf47d0988e9237f/2f405ef3952f6fda key 16:

  B25B6C9384D8BDB24E3DA3DC90CF5E73

  ike 0:RemoteSite:4: PSK authentication succeeded

  ike 0:RemoteSite:4: authentication OK

  ike 0:RemoteSite:4: add INITIAL-CONTACT

  ike 0:RemoteSite:4: enc BAF47D0988E9237F405EF3952F6FDA081004010000000000000080140000181F2E48BF D8E9D603F ike 0:RemoteSite:4: out

  BAF47D0988E9237F405EF3952F6FDA08100401000000000000008C2E3FC9BA061816A 396F009A12

  ike 0:RemoteSite:4: sent IKE msg (agg_i2send): 10.0.0.1:500-10.0.0.2:500, len=140, id=baf47d0988e9237f/2 ike 0:RemoteSite:4: established IKE SA baf47d0988e9237f/2f405ef3952f6fda

  Which statements about this debug output are correct? (Choose two.)

  A. The remote gateway IP address is 10.0.0.1.

  B. It shows a phase 1 negotiation.

  C. The negotiation is using AES128 encryption with CBC hash.

  D. The initiator has provided remote as its IPsec peer ID.

  Correct Answer: BD

• Question 19:

  Examine the output of the `diagnose ips anomaly list' command shown in the exhibit; then answer the question below.

  

  Which IP addresses are included in the output of this command?

  A. Those whose traffic matches a DoS policy.

  B. Those whose traffic matches an IPS sensor.

  C. Those whose traffic exceeded a threshold of a matching DoS policy.

  D. Those whose traffic was detected as an anomaly by an IPS sensor.

  Correct Answer: A

• Question 20:

  Examine the following partial output from a sniffer command; then answer the question below.

  

  What is the meaning of the packets dropped counter at the end of the sniffer?

  A. Number of packets that didn't match the sniffer filter.

  B. Number of total packets dropped by the FortiGate.

  C. Number of packets that matched the sniffer filter and were dropped by the FortiGate.

  D. Number of packets that matched the sniffer filter but could not be captured by the sniffer.

  Correct Answer: C