Fortinet NSE7_EFW-6.2 Online Practice Questions and Exam Preparation

Fortinet NSE7_EFW-6.2 Online Questions & Answers

• Question 51:

  Which two conditions must be met for a statistic route to be active in the routing table? (Choose two.)

  A. The link health monitor (if configured) is up.
  B. There is no other route, to the same destination, with a higher distance.
  C. The outgoing interface is up.
  D. The next-hop IP address is up.
  A. The link health monitor (if configured) is up.
  C. The outgoing interface is up.

• Question 52:

  An administrator added the following Ipsec VPN to a FortiGate configuration: configvpn ipsec phasel -interface edit "RemoteSite" set type dynamic set interface "portl" set mode main set psksecret ENC LCVkCiK2E2PhVUzZe next end config vpn ipsec phase2-interface edit "RemoteSite" set phasel name "RemoteSite" set proposal 3des-sha256 next end However, the phase 1 negotiation is failing. The administrator executed the IKF real time debug while attempting the Ipsec connection. The output is shown in the exhibit.

  

  What is causing the IPsec problem in the phase 1 ?

  A. The incoming IPsec connection is matching the wrong VPN configuration
  B. The phrase-1 mode must be changed to aggressive
  C. The pre-shared key is wrong
  D. NAT-T settings do not match
  C. The pre-shared key is wrong

• Question 53:

  What is the diagnose test application ipsmonitor 99 command used for?

  A. To enable IPS bypass mode
  B. To provide information regarding IPS sessions
  C. To disable the IPS engine
  D. To restart all IPS engines and monitors
  D. To restart all IPS engines and monitors

• Question 54:

  View the exhibit, which contains a session entry, and then answer the question below.

  

  Which statement is correct regarding this session?

  A. It is an ICMP session from 10.1.10.10 to 10.200.1.1.
  B. It is an ICMP session from 10.1.10.10 to 10.200.5.1.
  C. It is a TCP session in ESTABLISHED state from 10.1.10.10 to 10.200.5.1.
  D. It is a TCP session in CLOSE_WAIT state from 10.1.10.10 to 10.200.1.1.
  B. It is an ICMP session from 10.1.10.10 to 10.200.5.1.

• Question 55:

  A corporate network allows Internet Access to FSSO users only. The FSSO user student does not have Internet access after successfully logged into the Windows AD network. The output of the `diagnose debug authd fsso list' command does not show student as an active FSSO user. Other FSSO users can access the Internet without problems. What should the administrator check? (Choose two.)

  A. The user student must not be listed in the CA's ignore user list.
  B. The user student must belong to one or more of the monitored user groups.
  C. The student workstation's IP subnet must be listed in the CA's trusted list.
  D. At least one of the student's user groups must be allowed by a FortiGate firewall policy.
  A. The user student must not be listed in the CA's ignore user list.
  D. At least one of the student's user groups must be allowed by a FortiGate firewall policy.

  ---

  https://kb.fortinet.com/kb/documentLink.do?externalID=FD38828

• Question 56:

  Which real time debug should an administrator enable to troubleshoot RADIUS authentication problems?

  A. Diagnose debug application radius -1.
  B. Diagnose debug application fnbamd -1.
  C. Diagnose authd console -log enable.
  D. Diagnose radius console -log enable.
  B. Diagnose debug application fnbamd -1.

  ---

  https://kb.fortinet.com/kb/documentLink.do?externalID=FD32838

• Question 57:

  An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer. If the administrator knows that there is no NAT device located between both FortiGates, what command should the administrator execute?

  A. diagnose sniffer packet any `udp port 500'
  B. diagnose sniffer packet any `udp port 4500'
  C. diagnose sniffer packet any `esp'
  D. diagnose sniffer packet any `udp port 500 or udp port 4500'
  C. diagnose sniffer packet any `esp'

  ---

  Capture IKE Traffic without NAT:

  diagnose sniffer packet `host and udp port 500'

  --------------------------------------------------------------------------- Capture ESP Traffic without NAT:

  diagnose sniffer packet any `host and esp'

  --------------------------------------------------------------------------- Capture IKE and ESP with NAT-T:

  diagnose sniffer packet any `host and (udp port 500 or udp port 4500)'

• Question 58:

  When using the SSL certificate inspection method for HTTPS traffic, how does FortiGate filter web requests when the browser client does not provide the server name indication (SNI) extension?

  A. FortiGate uses CN information from the Subject field in the server's certificate.
  B. FortiGate switches to the full SSL inspection method to decrypt the data.
  C. FortiGate blocks the request without any further inspection.
  D. FortiGate uses the requested URL from the user's web browser.
  A. FortiGate uses CN information from the Subject field in the server's certificate.

• Question 59:

  A FortiGate device has the following LDAP configuration:

  

  The LDAP user student cannot authenticate. The exhibit shows the output of the authentication real time debug while testing the student account:

  

  Based on the above output, what FortiGate LDAP settings must the administer check? (Choose two.)

  A. cnid.
  B. username.
  C. password.
  D. dn.
  B. username.
  C. password.

  ---

  https://kb.fortinet.com/kb/viewContent.do?externalId=13141

• Question 60:

  Examine the output from the `diagnose vpn tunnel list' command shown in the exhibit; then answer the question below.

  

  Which command can be used to sniffer the ESP traffic for the VPN DialUP_0?

  A. diagnose sniffer packet any `port 500'
  B. diagnose sniffer packet any `esp'
  C. diagnose sniffer packet any `host 10.0.10.10'
  D. diagnose sniffer packet any `port 4500'
  D. diagnose sniffer packet any `port 4500'

  ---

  NAT-T is enabled. natt: mode=silent

  Protocol ESP is used. ESP is encapsulated in UDP port 4500 when NAT-T is enabled.