Fortinet Fortinet Certifications NSE7_EFW-6.2 Questions & Answers

• Question 21:

  Which statement about memory conserve mode is true?

  A. A FortiGate exits conserve mode when the configured memory use threshold reaches yellow.

  B. A FortiGate starts dropping all the new and old sessions when the configured memory use threshold reaches extreme.

  C. A FortiGate starts dropping new sessions when the configured memory use threshold reaches red

  D. A FortiGate enters conserve mode when the configured memory use threshold reaches red

  Correct Answer: C

• Question 22:

  Refer to exhibit, which contains the output of a BGP debug command.

  

  Which statement explains why the state of the 10.200.3.1 peer is Connect?

  A. The local router is receiving BGP keepalives from the remote peer, but the local peer has not received the OpenConfirm yet.

  B. The TCP session to 10.200.3.1 has not completed the 3-way handshake.

  C. The local router is receiving the BGP keepalives from the peer, but it has not received a BGP prefix yet.

  D. The local router has received the BGP prefixes from the remote peer.

  Correct Answer: B

  BGP neighbor states and how they change: Idle: Initial state Connect: Waiting for a successful three-way TCP connection Active: Unable to establish the TCP session OpenSent: Waiting for an OPEN message from the peer OpenConfirm: Waiting for the keepalive message from the peer Established: Peers have successfully exchanged OPEN and keepalive messages

• Question 23:

  An administrator added the following Ipsec VPN to a FortiGate configuration: configvpn ipsec phasel -interface

  edit "RemoteSite" set type dynamic set interface "portl" set mode main set psksecret ENC LCVkCiK2E2PhVUzZe next end config vpn ipsec phase2-interface edit "RemoteSite" set phasel name "RemoteSite" set proposal 3des-sha256 next end However, the phase 1 negotiation is failing. The administrator executed the IKF real time debug while attempting the Ipsec connection. The output is shown in the exhibit.

  

  What is causing the IPsec problem in the phase 1 ?

  A. The incoming IPsec connection is matching the wrong VPN configuration

  B. The phrase-1 mode must be changed to aggressive

  C. The pre-shared key is wrong

  D. NAT-T settings do not match

  Correct Answer: C

• Question 24:

  Examine the output from the BGP real time debug shown in the exhibit, then the answer the question below: Which statements are true regarding the output in the exhibit? (Choose two.)

  

  A. BGP peers have successfully interchanged Open and Keepalive messages.

  B. Local BGP peer received a prefix for a default route.

  C. The state of the remote BGP peer is OpenConfirm.

  D. The state of the remote BGP peer will go to Connect after it confirms the received prefixes.

  Correct Answer: AB

• Question 25:

  Which of the following statements is true regarding a FortiGate configured as an explicit web proxy?

  A. FortiGate limits the number of simultaneous sessions per explicit web proxy user. This limit CANNOT be modified by the administrator.

  B. FortiGate limits the total number of simultaneous explicit web proxy users.

  C. FortiGate limits the number of simultaneous sessions per explicit web proxy user The limit CAN be modified by the administrator

  D. FortiGate limits the number of workstations that authenticate using the same web proxy user credentials. This limit CANNOT be modified by the administrator.

  Correct Answer: B

  https://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-WAN-opt- 52/web_proxy.htm#Explicit2 The explicit proxy does not limit the number of active sessions for each user. As a result the actual explicit proxy session count is usually much higher than the number of explicit web proxy users. If an excessive number of explicit web proxy sessions is compromising system performance you can limit the amount of users if the FortiGate unit is operating with multiple VDOMs.

• Question 26:

  Which the following events can trigger the election of a new primary unit in a HA cluster? (Choose two.)

  A. Primary unit stops sending HA heartbeat keepalives.

  B. The FortiGuard license for the primary unit is updated.

  C. One of the monitored interfaces in the primary unit is disconnected.

  D. A secondary unit is removed from the HA cluster.

  Correct Answer: AC

• Question 27:

  Examine the output of the 'diagnose debug rating' command shown in the exhibit; then answer the question below.

  

  Which statement are true regarding the output in the exhibit? (Choose two.)

  A. There are three FortiGuard servers that are not responding to the queries sent by the FortiGate.

  B. The TZ value represents the delta between each FortiGuard server's time zone and the FortiGate's time zone.

  C. FortiGate will send the FortiGuard queries to the server with highest weight.

  D. A server's round trip delay (RTT) is not used to calculate its weight.

  Correct Answer: BC

• Question 28:

  Four FortiGate devices configured for OSPF connected to the same broadcast domain. The first unit is elected as the designated router The second unit is elected as the backup designated router Under normal operation, how many OSPF full adjacencies are formed to each of the other two units?

  A. 1

  B. 2

  C. 3

  D. 4

  Correct Answer: B

• Question 29:

  What configuration changes can reduce the memory utilization in a FortiGate? (Choose two.)

  A. Reduce the session time to live.

  B. Increase the TCP session timers.

  C. Increase the FortiGuard cache time to live.

  D. Reduce the maximum file size to inspect.

  Correct Answer: AD

• Question 30:

  Which statement is true regarding File description (FD) conserve mode?

  A. IPS inspection is affected when FortiGate enters FD conserve mode.

  B. A FortiGate enters FD conserve mode when the amount of available description is less than 5%.

  C. FD conserve mode affects all daemons running on the device.

  D. Restarting the WAD process is required to leave FD conserve mode.

  Correct Answer: B