Fortinet Fortinet Certifications NSE7 Questions & Answers

• Question 61:

  A FortiGate device has the following LDAP configuration: The LDAP user student cannot authenticate. The exhibit shows the output of the authentication real time debug while testing the student account:

  

  

  Based on the above output, what FortiGate LDAP settings must the administer check? (Choose two.)

  A. cnid.

  B. username.

  C. password.

  D. dn.

  Correct Answer: BC

• Question 62:

  Examine the IPsec configuration shown in the exhibit; then answer the question below.

  

  An administrator wants to monitor the VPN by enabling the IKE real time debug using these commands: diagnose vpn ike log-filter src-addr4 10.0.10.1 diagnose debug application ike -1 diagnose debug enable The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are being interchanged

  between both IPsec gateways. However, the IKE real time debug does NOT show any output. Why isn't there any output?

  A. The IKE real time shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.

  B. The log-filter setting is set incorrectly. The VPN's traffic does not match this filter.

  C. The IKE real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.

  D. The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.

  Correct Answer: A

• Question 63:

  Which of the following statements is true regarding a FortiGate configured as an explicit web proxy?

  A. FortiGate limits the number of simultaneous sessions per explicit web proxy user. This limit CANNOT be modified by the administrator.

  B. FortiGate limits the total number of simultaneous explicit web proxy users.

  C. FortiGate limits the number of simultaneous sessions per explicit web proxy user. The limit CAN be modified by the administrator.

  D. FortiGate limits the number of workstations that authenticate using the same web proxy user credentials. This limit CANNOT be modified by the administrator.

  Correct Answer: C

• Question 64:

  Examine the output of the 'diagnose debug rating' command shown in the exhibit; then answer the question below.

  

  Which statement are true regarding the output in the exhibit? (Choose two.)

  A. There are three FortiGuard servers that are not responding to the queries sent by the FortiGate.

  B. The TZ value represents the delta between each FortiGuard server's time zone and the FortiGate's time zone.

  C. FortiGate will send the FortiGuard queries to the server with highest weight.

  D. A server's round trip delay (RTT) is not used to calculate its weight.

  Correct Answer: BC

• Question 65:

  The logs in a FSSO collector agent (CA) are showing the following error:

  failed to connect to registry: PIKA1026 (192.168.12.232)

  What can be the reason for this error?

  A. The CA cannot resolve the name of the workstation.

  B. The FortiGate cannot resolve the name of the workstation.

  C. The remote registry service is not running in the workstation 192.168.12.232.

  D. The CA cannot reach the FortiGate with the IP address 192.168.12.232.

  Correct Answer: C

• Question 66:

  View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

  

  Why didn't the tunnel come up?

  A. The pre-shared keys do not match.

  B. The remote gateway's phase 2 configuration does not match the local gateway's phase 2 configuration.

  C. The remote gateway's phase 1 configuration does not match the local gateway's phase 1 configuration.

  D. The remote gateway is using aggressive mode and the local gateway is configured to use man mode.

  Correct Answer: C

• Question 67:

  An administrator added the following Ipsec VPN to a FortiGate configuration: configvpn ipsec phasel -interface

  edit "RemoteSite" set type dynamic set interface "portl" set mode main set psksecret ENC LCVkCiK2E2PhVUzZe next end config vpn ipsec phase2-interface edit "RemoteSite" set phasel name "RemoteSite" set proposal 3des-sha256 next end However, the phase 1 negotiation is failing. The administrator executed the IKF real time debug while

  attempting the Ipsec connection. The output is shown in the exhibit.

  

  

  What is causing the IPsec problem in the phase 1 ?

  A. The incoming IPsec connection is matching the wrong VPN configuration

  B. The phrase-1 mode must be changed to aggressive

  C. The pre-shared key is wrong

  D. NAT-T settings do not match

  Correct Answer: C

• Question 68:

  An administrator has enabled HA session synchronization in a HA cluster with two members. Which flag is added to a primary unit's session to indicate that it has been synchronized to the secondary unit?

  A. redir.

  B. dirty.

  C. synced

  D. nds.

  Correct Answer: C

• Question 69:

  View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.

  

  The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel. To diagnose, the administrator enters these CLI commands:

  

  However, the IKE real time debug does not show any output. Why?

  A. The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.

  B. The log-filter setting was set incorrectly. The VPN's traffic does not match this filter.

  C. The debug shows only error messages. If there is no output, then the tunnel is operating normally.

  D. The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.

  Correct Answer: D

• Question 70:

  View the central management configuration shown in the exhibit, and then answer the question below.

  

  Which server will FortiGate choose for antivirus and IPS updates if 10.0.1.243 is experiencing an outage?

  A. 10.0.1.240

  B. One of the public FortiGuard distribution servers

  C. 10.0.1.244

  D. 10.0.1.242

  Correct Answer: B