Fortinet NSE7_EFW-6.4 Online Practice Questions and Exam Preparation

Fortinet NSE7_EFW-6.4 Online Questions & Answers

• Question 61:

  Refer to the exhibit, which contains the output of a BGP debug command.

  

  Which statement about the exhibit is true?

  A. The local router has received a total of three BGP prefixes from all peers.
  B. The local router has not established a TCP session with 100.64.3.1.
  C. Since the counters were last reset, the 10.200.3.1 peer has never been down.
  D. The local router BGP state is OpenConfirm with the 10.127.0.75 peer.
  B. The local router has not established a TCP session with 100.64.3.1.

• Question 62:

  What conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three.)

  A. IP addresses are in the same subnet.
  B. Hello and dead intervals match.
  C. OSPF IP MTUs match.
  D. OSPF peer IDs match.
  E. OSPF costs match.
  A. IP addresses are in the same subnet.
  B. Hello and dead intervals match.
  C. OSPF IP MTUs match.

• Question 63:

  An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage. However, after the changes, one network application started to have problems. During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets, and before the arrival of the SYN/ACKs. When the SYN/ACK packets arrive to the FortiGate, the unit has already deleted the respective sessions. Which TCP session timer must be increased to fix this problem?

  A. TCP half open.
  B. TCP half close.
  C. TCP time wait.
  D. TCP session time to live.
  A. TCP half open.

• Question 64:

  Examine the output of the `diagnose sys session list expectation' command shown in the exhibit; than answer the question below.

  

  Which statement is true regarding the session in the exhibit?

  A. It was created by the FortiGate kernel to allow push updates from FotiGuard.
  B. It is for management traffic terminating at the FortiGate.
  C. It is for traffic originated from the FortiGate.
  D. It was created by a session helper or ALG.
  D. It was created by a session helper or ALG.

• Question 65:

  Examine the partial output from the IKE real time debug shown in the exhibit; then answer the question below. Why didn't the tunnel come up?

  A. IKE mode configuration is not enabled in the remote IPsec gateway.
  B. The remote gateway's Phase-2 configuration does not match the local gateway's phase- 2 configuration.
  C. The remote gateway's Phase-1 configuration does not match the local gateway's phase- 1 configuration.
  D. One IPsec gateway is using main mode, while the other IPsec gateway is using aggressive mode.
  C. The remote gateway's Phase-1 configuration does not match the local gateway's phase- 1 configuration.

• Question 66:

  Examine the output from the 'diagnose debug authd fsso list' command; then answer the question below.

  # diagnose debug authd fsso list --FSSO logons-IP: 192.168.3.1 User: STUDENT Groups: TRAININGAD/USERS Workstation: INTERNAL2. TRAINING. LAB The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2.

  TRAINING.

  LAB.

  What should the administrator check?

  A. The IP address recorded in the logon event for the user STUDENT.
  B. The DNS name resolution for the workstation name INTERNAL2. TRAINING. LAB.
  C. The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2. TRAINING. LAB.
  D. The reserve DNS lookup forthe IP address 192.168.3.1.
  C. The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2. TRAINING. LAB.

• Question 67:

  A corporate network allows Internet Access to FSSO users only. The FSSO user student does not have Internet access after successfully logged into the Windows AD network. The output of the `diagnose debug authd fsso list' command does not show student as an active FSSO user. Other FSSO users can access the Internet without problems. What should the administrator check? (Choose two.)

  A. The user student must not be listed in the CA's ignore user list.
  B. The user student must belong to one or more of the monitored user groups.
  C. The student workstation's IP subnet must be listed in the CA's trusted list.
  D. At least one of the student's user groups must be allowed by a FortiGate firewall policy.
  A. The user student must not be listed in the CA's ignore user list.
  D. At least one of the student's user groups must be allowed by a FortiGate firewall policy.

• Question 68:

  A FortiGate has two default routes:

  

  All Internet traffic is currently using port1. The exhibit shows partial information for one sample session of Internet traffic from an internal user:

  

  What would happen with the traffic matching the above session if the priority on the first default route (IDd1) were changed from 5 to 20?

  A. The session would be deleted, and the client would need to start a new session.
  B. The session would remain in the session table, and its traffic would start to egress from port2.
  C. The session would remain in the session table, but its traffic would now egress from both port1 and port2.
  D. The session would remain in the session table, and its traffic would still egress from port1.
  D. The session would remain in the session table, and its traffic would still egress from port1.

• Question 69:

  View the exhibit, which contains the output of a real-time debug, Which statement about this output is true?

  

  Which of the following statements is true regarding this output?

  A. The requested URL belongs to category ID 255.
  B. The server hostname Is training, fortinet.com.
  C. FortiGate found the requested URL in its local cache.
  D. This web request was inspected using the ftgd-allow web filler profile.
  C. FortiGate found the requested URL in its local cache.

• Question 70:

  What configuration changes can reduce the memory utilization in a FortiGate? (Choose two.)

  A. Reduce the session time to live.
  B. Increase the TCP session timers.
  C. Increase the FortiGuard cache time to live.
  D. Reduce the maximum file size to inspect.
  A. Reduce the session time to live.
  D. Reduce the maximum file size to inspect.