Fortinet Fortinet Certifications NSE7_EFW-6.4 Questions & Answers

• Question 31:

  What does the dirty flag mean in a FortiGate session?

  A. Traffic has been blocked by the antivirus inspection.

  B. The next packet must be re-evaluated against the firewall policies.

  C. The session must be removed from the former primary unit after an HA failover.

  D. Traffic has been identified as from an application that is not allowed.

  Correct Answer: B

  https://kb.fortinet.com/kb/viewContent.do?externalId=FD40119andsliceId=1

• Question 32:

  Refer to the exhibit, which contains a TCL script configuration on FortiManager.

  

  An administrator has configured the TCL script on FortiManager, but failed to apply any changes to the managed device after being executed.

  Why did the TCL script fail to make any changes to the managed device?

  A. Changes in an interface configuration can only be done by CLI script.

  B. The TCL script must start with #include <>.

  C. Incomplete commands are ignored in TCL scripts.

  D. The TCL command run_cmd has not been created.

  Correct Answer: D

• Question 33:

  A FortiGate is configured as an explicit web proxy. Clients using this web proxy are reposting DNS errors when accessing any website. The administrator executes the following debug commands and observes that the n-dns-timeout counter is increasing:

  

  What should the administrator check to fix the problem?

  A. The connectivity between the FortiGate unit and the DNS server.

  B. The connectivity between the client workstations and the DNS server.

  C. That DNS traffic from client workstations is allowed by the explicit web proxy policies.

  D. That DNS service is enabled in the explicit web proxy interface.

  Correct Answer: A

• Question 34:

  View the exhibit, which contains a partial output of an IKE real-time debug, and then answer the question below.

  

  Based on the debug output, which phase-1 setting is enabled in the configuration of this VPN?

  A. auto-discovery-sender

  B. auto-discovery-forwarder

  C. auto-discovery-shortcut

  D. auto-discovery-receiver

  Correct Answer: B

• Question 35:

  Refer to the exhibit, which contains a TCL script configuration on FortiManager.

  An administrator has configured the TCL script on FortiManager, but the TCL script failed to apply any changes to the managed device after being run.

  

  Why did the TCL script fail to make any changes to the managed device?

  A. The TCL command run_cmd has not been created.

  B. The TCL script must start with tinclude <>.

  C. Incomplete commands are ignored in TCL scripts.

  D. Changes to an interface configuration can be made only by a CLI script.

  Correct Answer: A

• Question 36:

  Examine the following routing table and BGP configuration; then answer the question below.

  

  TheBGP connection is up, but the local peer is NOT advertising the prefix 192.168.1.0/24. Which configuration change will make the local peer advertise this prefix?

  A. Enable the redistribution of connected routers into BGP.

  B. Enable the redistribution of static routers into BGP.

  C. Disable the setting network-import-check.

  D. Enable the setting ebgp-multipath.

  Correct Answer: C

• Question 37:

  View the exhibit, which contains the output of a BGP debug command, and then answer the question below.

  

  Which of the following statements about the exhibit are true? (Choose two.)

  A. The local router's BGP state is Established with the 10.125.0.60 peer.

  B. Since the counters were last reset; the 10.200.3.1 peer has never been down.

  C. The local router has received a total of three BGP prefixes from all peers.

  D. The local router has not established a TCP session with 100.64.3.1.

  Correct Answer: AD

• Question 38:

  View the exhibit, which contains the output of diagnose sys session stat, and then answer the question below.

  

  Which statements are correct regarding the output shown? (Choose two.)

  A. There are 0 ephemeral sessions.

  B. All the sessions in the session table are TCP sessions.

  C. No sessions have been deleted because of memory pages exhaustion.

  D. There are 166 TCP sessions waiting to complete the three-way handshake.

  Correct Answer: AC

  https://kb.fortinet.com/kb/documentLink.do?externalID=FD40578

• Question 39:

  Refer to the exhibit, which contains the partial output of the get vpn ipsec tunnel details command.

  

  Based on the output, which two statements are correct? (Choose two.)

  A. Phase 2 authentication is set to sha1 on both sides.

  B. Anti-replay is disabled.

  C. Hub2Spoke1 is a policy-based VPN.

  D. Hub2Spoke1 is configured on interface wan2.

  Correct Answer: AD

• Question 40:

  What global configuration setting changes the behavior for content-inspected traffic while FortiGate is in system conserve mode?

  A. av-failopen

  B. mem-failopen

  C. utm-failopen

  D. ips-failopen

  Correct Answer: A

  https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-security-profiles- 54/ Other_Profile_Considerations/Conserve%20mode.htm