Fortinet Fortinet Certifications NSE7_EFW-6.2 Questions & Answers

• Question 71:

  Examine the output of the `diagnose ips anomaly list' command shown in the exhibit; then answer the question below.

  

  Which IP addresses are included in the output of this command?

  A. Those whose traffic matches a DoS policy.

  B. Those whose traffic matches an IPS sensor.

  C. Those whose traffic exceeded a threshold of a matching DoS policy.

  D. Those whose traffic was detected as an anomaly by an IPS sensor.

  Correct Answer: A

• Question 72:

  Examine the partial output from the IKE real time debug shown in the exhibit; then answer the question

  below.

  Why didn't the tunnel come up?

  A. IKE mode configuration is not enabled in the remote IPsec gateway.

  B. The remote gateway's Phase-2 configuration does not match the local gateway's phase-2 configuration.

  C. The remote gateway's Phase-1 configuration does not match the local gateway's phase-1 configuration.

  D. One IPsec gateway is using main mode, while the other IPsec gateway is using aggressive mode.

  Correct Answer: C

• Question 73:

  A FortiGate device has the following LDAP configuration:

  

  The LDAP user student cannot authenticate. The exhibit shows the output of the authentication real time debug while testing the student account:

  

  Based on the above output, what FortiGate LDAP settings must the administer check? (Choose two.)

  A. cnid.

  B. username.

  C. password.

  D. dn.

  Correct Answer: BC

  https://kb.fortinet.com/kb/viewContent.do?externalId=13141

• Question 74:

  Examine the output from the `diagnose vpn tunnel list' command shown in the exhibit; then answer the question below.

  

  Which command can be used to sniffer the ESP traffic for the VPN DialUP_0?

  A. diagnose sniffer packet any `port 500'

  B. diagnose sniffer packet any `esp'

  C. diagnose sniffer packet any `host 10.0.10.10'

  D. diagnose sniffer packet any `port 4500'

  Correct Answer: D

  NAT-T is enabled. natt: mode=silent

  Protocol ESP is used. ESP is encapsulated in UDP port 4500 when NAT-T is enabled.

• Question 75:

  View the central management configuration shown in the exhibit, and then answer the question below.

  

  Which server will FortiGate choose for antivirus and IPS updates if 10.0.1.243 is experiencing an outage?

  A. 10.0.1.240

  B. One of the public FortiGuard distribution servers

  C. 10.0.1.244

  D. 10.0.1.242

  Correct Answer: B

• Question 76:

  View the exhibit, which contains the output of diagnose sys session stat, and then answer the question below.

  

  Which statements are correct regarding the output shown? (Choose two.)

  A. There are 0 ephemeral sessions.

  B. All the sessions in the session table are TCP sessions.

  C. No sessions have been deleted because of memory pages exhaustion.

  D. There are 166 TCP sessions waiting to complete the three-way handshake.

  Correct Answer: AC

  https://kb.fortinet.com/kb/documentLink.do?externalID=FD40578

• Question 77:

  View the exhibit, which contains the output of a debug command, and then answer the question below.

  

  What statement is correct about this FortiGate?

  A. It is currently in system conserve mode because of high CPU usage.

  B. It is currently in FD conserve mode.

  C. It is currently in kernel conserve mode because of high memory usage.

  D. It is currently in system conserve mode because of high memory usage.

  Correct Answer: D

• Question 78:

  Examine the output of the `get router info bgp summary' command shown in the exhibit; then answer the question below.

  

  Which statement can explain why the state of the remote BGP peer 10.200.3.1 is Connect?

  A. The local peer is receiving the BGP keepalives from the remote peer but it has not received any BGP prefix yet.

  B. The TCP session for the BGP connection to 10.200.3.1 is down.

  C. The local peer has received the BGP prefixed from the remote peer.

  D. The local peer is receiving the BGP keepalives from the remote peer but it has not received the OpenConfirm yet.

  Correct Answer: B

  http://www.ciscopress.com/articles/article.asp?p=2756480andseqNum=4

• Question 79:

  A FortiGate is rebooting unexpectedly without any apparent reason. What troubleshooting tools could an administrator use to get more information about the problem? (Choose two.)

  A. Firewall monitor.

  B. Policy monitor.

  C. Logs.

  D. Crashlogs.

  Correct Answer: CD

• Question 80:

  An administrator has enabled HA session synchronization in a HA cluster with two members. Which flag is added to a primary unit's session to indicate that it has been synchronized to the secondary unit?

  A. redir.

  B. dirty.

  C. synced

  D. nds.

  Correct Answer: C

  The synced sessions have the `synced' flag. The command `diag sys session list' can be used to see the sessions on the member, with the associated flags.