Fortinet Fortinet Certifications NSE7_EFW-6.2 Questions & Answers

• Question 51:

  What global configuration setting changes the behavior for content-inspected traffic while FortiGate is in system conserve mode?

  A. av-failopen

  B. mem-failopen

  C. utm-failopen

  D. ips-failopen

  Correct Answer: A

  https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-security-profiles- 54/ Other_Profile_Considerations/Conserve%20mode.htm

• Question 52:

  When using the SSL certificate inspection method for HTTPS traffic, how does FortiGate filter web requests when the browser client does not provide the server name indication (SNI) extension?

  A. FortiGate uses CN information from the Subject field in the server's certificate.

  B. FortiGate switches to the full SSL inspection method to decrypt the data.

  C. FortiGate blocks the request without any further inspection.

  D. FortiGate uses the requested URL from the user's web browser.

  Correct Answer: A

• Question 53:

  View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

  

  Which statements about this debug output are correct? (Choose two.)

  A. The remote gateway IP address is 10.0.0.1.

  B. It shows a phase 1 negotiation.

  C. The negotiation is using AES128 encryption with CBC hash.

  D. The initiator has provided remote as its IPsec peer ID.

  Correct Answer: BD

• Question 54:

  Which of the following statements are correct regarding application layer test commands? (Choose two.)

  A. They are used to filter real-time debugs.

  B. They display real-time application debugs.

  C. Some of them display statistics and configuration information about a feature or process.

  D. Some of them can be used to restart an application.

  Correct Answer: CD

  Application layer test commands don't display info in real time, but they do show statistics and configuration info about a feature or process. You can also use some of these commands to restart a process or execute a change in its operation.

• Question 55:

  What is the purpose of an internal segmentation firewall (ISFW)?

  A. It inspects incoming traffic to protect services in the corporate DMZ.

  B. It is the first line of defense at the network perimeter.

  C. It splits the network into multiple security segments to minimize the impact of breaches.

  D. It is an all-in-one security appliance that is placed at remote sites to extend the enterprise network.

  Correct Answer: C

  ISFW splits your network into multiple security segments. They serve as a breach containers from attacks that come from inside.

• Question 56:

  View the exhibit, which contains the output of a real-time debug, and then answer the question below.

  

  Which of the following statements is true regarding this output? (Choose two.)

  A. This web request was inspected using the root web filter profile.

  B. FortiGate found the requested URL in its local cache.

  C. The requested URL belongs to category ID 52.

  D. The web request was allowed by FortiGate.

  Correct Answer: BC

• Question 57:

  How does FortiManager handle FortiGuard requests from FortiGate devices, when it is configured as a local FDS?

  A. FortiManager can download and maintain local copies of FortiGuard databases.

  B. FortiManager supports only FortiGuard push to managed devices.

  C. FortiManager will respond to update requests only if they originate from a managed device.

  D. FortiManager does not support rating requests.

  Correct Answer: A

• Question 58:

  View the exhibit, which contains the output of a debug command, and then answer the question below.

  

  Which of the following statements about the exhibit are true? (Choose two.)

  A. In the network on port4, two OSPF routers are down.

  B. Port4 is connected to the OSPF backbone area.

  C. The local FortiGate's OSPF router ID is 0.0.0.4

  D. The local FortiGate has been elected as the OSPF backup designated router.

  Correct Answer: BC

• Question 59:

  View the exhibit, which contains an entry in the session table, and then answer the question below.

  

  Which one of the following statements is true regarding FortiGate's inspection of this session?

  A. FortiGate applied proxy-based inspection.

  B. FortiGate forwarded this session without any inspection.

  C. FortiGate applied flow-based inspection.

  D. FortiGate applied explicit proxy-based inspection.

  Correct Answer: A

  https://kb.fortinet.com/kb/viewContent.do?externalId=FD30042

• Question 60:

  An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer. If the administrator knows that there is no NAT device located between both FortiGates, what command should the administrator execute?

  A. diagnose sniffer packet any `udp port 500'

  B. diagnose sniffer packet any `udp port 4500'

  C. diagnose sniffer packet any `esp'

  D. diagnose sniffer packet any `udp port 500 or udp port 4500'

  Correct Answer: C

  Capture IKE Traffic without NAT:

  diagnose sniffer packet `host and udp port 500'

  --------------------------------------------------------------------------- Capture ESP Traffic without NAT:

  diagnose sniffer packet any `host and esp'

  --------------------------------------------------------------------------- Capture IKE and ESP with NAT-T:

  diagnose sniffer packet any `host and (udp port 500 or udp port 4500)'