Fortinet Fortinet Certifications NSE7 Questions & Answers

• Question 71:

  An administrator is running the following sniffer in a FortiGate:

  diagnose sniffer packet any "host 10.0.2.10" 2

  What information is included in the output of the sniffer? (Choose two.)

  A. Ethernet headers.

  B. IP payload.

  C. IP headers.

  D. Port names.

  Correct Answer: BC

• Question 72:

  What conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three.)

  A. IP addresses are in the same subnet.

  B. Hello and dead intervals match.

  C. OSPF IP MTUs match.

  D. OSPF peer IDs match.

  E. OSPF costs match.

  Correct Answer: ABD

• Question 73:

  Which real time debug should an administrator enable to troubleshoot RADIUS authentication problems?

  A. Diagnose debug application radius -1.

  B. Diagnose debug application fnbamd -1.

  C. Diagnose authd console –log enable.

  D. Diagnose radius console –log enable.

  Correct Answer: A

• Question 74:

  Which of the following statements are correct regarding application layer test commands? (Choose two.)

  A. They are used to filter real-time debugs.

  B. They display real-time application debugs.

  C. Some of them display statistics and configuration information about a feature or process.

  D. Some of them can be used to restart an application.

  Correct Answer: BC

• Question 75:

  Which of the following statements are true about FortiManager when it is deployed as a local FDS? (Choose two.)

  A. Caches available firmware updates for unmanaged devices.

  B. Can be configured as an update server, or a rating server, but not both.

  C. Supports rating requests from both managed and unmanaged devices.

  D. Provides VM license validation services.

  Correct Answer: AD

• Question 76:

  Which statement is true regarding File description (FD) conserve mode?

  A. IPS inspection is affected when FortiGate enters FD conserve mode.

  B. A FortiGate enters FD conserve mode when the amount of available description is less than 5%.

  C. FD conserve mode affects all daemons running on the device.

  D. Restarting the WAD process is required to leave FD conserve mode.

  Correct Answer: B

• Question 77:

  When using the SSL certificate inspection method for HTTPS traffic, how does FortiGate filter web requests when the browser client does not provide the server name indication (SNI)?

  A. FortiGate uses the Issued To: field in the server's certificate.

  B. FortiGate switches to the full SSL inspection method to decrypt the data.

  C. FortiGate blocks the request without any further inspection.

  D. FortiGate uses the requested URL from the user's web browser.

  Correct Answer: D

• Question 78:

  View the global IPS configuration, and then answer the question below.

  

  Which of the following statements is true regarding this configuration?

  A. IPS will scan every byte in every session.

  B. FortiGate will spawn IPS engine instances based on the system load.

  C. New packets will be passed through without inspection if the IPS socket buffer runs out of memory.

  D. IPS will use the faster matching algorithm which is only available for units with more than 4 GB memory.

  Correct Answer: A

• Question 79:

  Examine the output of the `get router info bgp summary' command shown in the exhibit; then answer the question below.

  

  Which statements are true regarding the output in the exhibit? (Choose two.)

  A. BGP state of the peer 10.125.0.60 is Established.

  B. BGP peer 10.200.3.1 has never been down since the BGP counters were cleared.

  C. Local BGP peer has not received an OpenConfirm from 10.200.3.1.

  D. The local BGP peer has received a total of 3 BGP prefixes.

  Correct Answer: AC

• Question 80:

  An administrator cannot connect to the GIU of a FortiGate unit with the IP address 10.0.1.254. The administrator runs the debug flow while attempting the connection using HTTP. The output of the debug flow is shown in the exhibit:

  

  Based on the error displayed by the debug flow, which are valid reasons for this problem? (Choose two.)

  A. HTTP administrative access is disabled in the FortiGate interface with the IP address 10.0.1.254.

  B. Redirection of HTTP to HTTPS administrative access is disabled.

  C. HTTP administrative access is configured with a port number different than 80.

  D. The packet is denied because of reverse path forwarding check.

  Correct Answer: AC