Fortinet Fortinet Certifications NSE7 Questions & Answers

• Question 51:

  Examine the following partial output from two system debug commands; then answer the question below.

  

  Which of the following statements are true regarding the above outputs? (Choose two.)

  A. The unit is running a 32-bit FortiOS

  B. The unit is in kernel conserve mode

  C. The Cached value is always the Active value plus the Inactive value

  D. Kernel indirectly accesses the low memory (LowTotal) through memory paging

  Correct Answer: AC

• Question 52:

  A FortiGate device has the following LDAP configuration:

  

  The administrator executed the `dsquery' command in the Windows LDAp server 10.0.1.10, and got the following output:

  >dsquery user –samid administrator

  "CN=Administrator, CN=Users, DC=trainingAD, DC=training, DC=lab"

  Based on the output, what FortiGate LDAP setting is configured incorrectly?

  A. cnid.

  B. username.

  C. password.

  D. dn.

  Correct Answer: A

• Question 53:

  Examine the output from the `diagnose vpn tunnel list' command shown in the exhibit; then answer the question below.

  

  Which command can be used to sniffer the ESP traffic for the VPN DialUP_0?

  A. diagnose sniffer packet any `port 500'

  B. diagnose sniffer packet any `esp'

  C. diagnose sniffer packet any `host 10.0.10.10'

  D. diagnose sniffer packet any `port 4500'

  Correct Answer: B

• Question 54:

  View the following FortiGate configuration.

  

  All traffic to the Internet currently egresses from port1. The exhibit shows partial session information for Internet traffic from a user on the internal network:

  

  If the priority on route ID 1 were changed from 5 to 20, what would happen to traffic matching that user's session?

  A. The session would remain in the session table, and its traffic would still egress from port1.

  B. The session would remain in the session table, but its traffic would now egress from both port1 and port2.

  C. The session would remain in the session table, and its traffic would start to egress from port2.

  D. The session would be deleted, so the client would need to start a new session.

  Correct Answer: D

• Question 55:

  An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer. If the administrator knows that there is no NAT device located between both FortiGates, what command should the administrator execute?

  A. diagnose sniffer packet any `udp port 500'

  B. diagnose sniffer packet any `udp port 4500'

  C. diagnose sniffer packet any `esp'

  D. diagnose sniffer packet any `udp port 500 or udp port 4500'

  Correct Answer: C

• Question 56:

  Which the following events can trigger the election of a new primary unit in a HA cluster? (Choose two.)

  A. Primary unit stops sending HA heartbeat keepalives.

  B. The FortiGuard license for the primary unit is updated.

  C. One of the monitored interfaces in the primary unit is disconnected.

  D. A secondary unit is removed from the HA cluster.

  Correct Answer: AB

• Question 57:

  Examine the output from the BGP real time debug shown in the exhibit, then the answer the question below:

  

  Which statements are true regarding the output in the exhibit? (Choose two.)

  A. BGP peers have successfully interchanged Open and Keepalive messages.

  B. Local BGP peer received a prefix for a default route.

  C. The state of the remote BGP peer is OpenConfirm.

  D. The state of the remote BGP peer will go to Connect after it confirms the received prefixes.

  Correct Answer: AB

• Question 58:

  View the exhibit, which contains the output of a debug command, and then answer the question below.

  

  Which of the following statements about the exhibit are true? (Choose two.)

  A. In the network on port4, two OSPF routers are down.

  B. Port4 is connected to the OSPF backbone area.

  C. The local FortiGate's OSPF router ID is 0.0.0.4

  D. The local FortiGate has been elected as the OSPF backup designated router.

  Correct Answer: BC

• Question 59:

  View the exhibit, which contains the output of diagnose sys session list, and then answer the question below.

  

  If the HA ID for the primary unit is zero (0), which statement is correct regarding the output?

  A. This session is for HA heartbeat traffic.

  B. This session is synced with the slave unit.

  C. The inspection of this session has been offloaded to the slave unit.

  D. This session cannot be synced with the slave unit.

  Correct Answer: B

• Question 60:

  Which of the following statements are true regarding the SIP session helper and the SIP application layer gateway (ALG)? (Choose three.)

  A. SIP session helper runs in the kernel; SIP ALG runs as a user space process.

  B. SIP ALG supports SIP HA failover; SIP helper does not.

  C. SIP ALG supports SIP over IPv6; SIP helper does not.

  D. SIP ALG can create expected sessions for media traffic; SIP helper does not.

  E. SIP helper supports SIP over TCP and UDP; SIP ALG supports only SIP over UDP.

  Correct Answer: BCD