Fortinet NSE7_EFW-6.4 Online Practice Questions and Exam Preparation

Fortinet NSE7_EFW-6.4 Online Questions & Answers

• Question 1:

  When using the SSL certificate inspection method to inspect HTTPS traffic, how does FortiGate filter web requests when the client browser does not provide the server name indication (SNI) extension?

  A. FortiGate uses the requested URL from the user's web browser.
  B. FortiGate uses the CN information from the Subject field in the server certificate.
  C. FortiGate blocks the request without any further inspection.
  D. FortiGate switches to the full SSL inspection method to decrypt the data.
  B. FortiGate uses the CN information from the Subject field in the server certificate.

• Question 2:

  Which two statements about OCVPN are true? (Choose two.)

  A. Only root vdom supports OCVPN.
  B. OCVPN supports static and dynamic IPs in WAN interface.
  C. OCVPN offers only Hub-Spoke VPNs.
  D. FortiGate devices under different FortiCare accounts can be used to form OCVPN.
  A. Only root vdom supports OCVPN.
  B. OCVPN supports static and dynamic IPs in WAN interface.

• Question 3:

  Refer to the exhibit, which contains partial outputs from two routing debug commands.

  

  Why is the port2 default route not in the second command's output?

  A. It has a higher priority value than the default route using port1.
  B. It is disabled in the FortiGate configuration.
  C. It has a lower priority value than the default route using port1.
  D. It has a higher distance than the default route using port1.
  D. It has a higher distance than the default route using port1.

• Question 4:

  A FortiGate is configured as an explicit web proxy. Clients using this web proxy are reposting DNS errors when accessing any website. The administrator executes the following debug commands and observes that the n-dns-timeout counter is increasing:

  

  What should the administrator check to fix the problem?

  A. The connectivity between the FortiGate unit and the DNS server.
  B. The connectivity between the client workstations and the DNS server.
  C. That DNS traffic from client workstations is allowed by the explicit web proxy policies.
  D. That DNS service is enabled in the explicit web proxy interface.
  A. The connectivity between the FortiGate unit and the DNS server.

• Question 5:

  What events are recorded in the crashlogs of a FortiGate device? (Choose two.)

  A. A process crash.
  B. Configuration changes.
  C. Changes in the status of any of the FortiGuard licenses.
  D. System entering to and leaving from the proxy conserve mode.
  A. A process crash.
  D. System entering to and leaving from the proxy conserve mode.

• Question 6:

  What is the purpose of an internal segmentation firewall (ISFW)?

  A. It inspects incoming traffic to protect services in the corporate DMZ.
  B. It is the first line of defense at the network perimeter.
  C. It splits the network into multiple security segments to minimize the impact of breaches.
  D. It is an all-in-one security appliance that is placed at remote sites to extend the enterprise network.
  C. It splits the network into multiple security segments to minimize the impact of breaches.

• Question 7:

  View the exhibit, which contains the output of a debug command, and then answer the question below.

  

  What statement is correct about this FortiGate?

  A. It is currently in system conserve mode because of high CPU usage.
  B. It is currently in FD conserve mode.
  C. It is currently in kernel conserve mode because of high memory usage.
  D. It is currently in system conserve mode because of high memory usage.
  D. It is currently in system conserve mode because of high memory usage.

• Question 8:

  Refer to the exhibit, which shows a FortiGate configuration.

  

  An administrator is troubleshooting a web filter issue on FortiGate. The administrator has configured a web filter profile and applied it to a policy; however, the web filter is not inspecting any traffic that is passing through the policy. What must the administrator change to fix the issue?

  A. The administrator must increase webfilter-timeout.
  B. The administrator must disable webfilter-force-off.
  C. The administrator must change protocol to TCP.
  D. The administrator must enable fortiguard-anycast.
  D. The administrator must enable fortiguard-anycast.

• Question 9:

  View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

  

  Why didn't the tunnel come up?

  A. The pre-shared keys do not match.
  B. The remote gateway's phase 2 configuration does not match the local gateway's phase 2 configuration.
  C. The remote gateway's phase 1 configuration does not match the local gateway's phase 1 configuration.
  D. The remote gateway is using aggressive mode and the local gateway is configured to use man mode.
  C. The remote gateway's phase 1 configuration does not match the local gateway's phase 1 configuration.

• Question 10:

  An administrator cannot connect to the GIU of a FortiGate unit with the IP address 10.0.1.254. The administrator runs the debug flow while attempting the connection using HTTP. The output of the debug flow is shown in the exhibit:

  

  Based on the error displayed by the debug flow, which are valid reasons for this problem? (Choose two.)

  A. HTTP administrative access is disabled in the FortiGate interface with the IP address 10.0.1.254.
  B. Redirection of HTTP to HTTPS administrative access is disabled.
  C. HTTP administrative access is configured with a port number different than 80.
  D. The packet is denied because of reverse path forwarding check.
  A. HTTP administrative access is disabled in the FortiGate interface with the IP address 10.0.1.254.
  C. HTTP administrative access is configured with a port number different than 80.