Fortinet NSE7_EFW-7.0 Online Practice Questions and Exam Preparation

Fortinet NSE7_EFW-7.0 Online Questions & Answers

• Question 1:

  Which the following events can trigger the election of a new primary unit in a HA cluster? (Choose two.)

  A. Primary unit stops sending HA heartbeat keepalives.
  B. The FortiGuard license for the primary unit is updated.
  C. One of the monitored interfaces in the primary unit is disconnected.
  D. A secondary unit is removed from the HA cluster.
  A. Primary unit stops sending HA heartbeat keepalives.
  C. One of the monitored interfaces in the primary unit is disconnected.

• Question 2:

  How does FortiManager handle FortiGuard requests from FortiGate devices, when it is configured as a local FDS?

  A. FortiManager can download and maintain local copies of FortiGuard databases.
  B. FortiManager supports only FortiGuard push to managed devices.
  C. FortiManager will respond to update requests only if they originate from a managed device.
  D. FortiManager does not support rating requests.
  A. FortiManager can download and maintain local copies of FortiGuard databases.

• Question 3:

  What is the purpose of an internal segmentation firewall (ISFW)?

  A. It inspects incoming traffic to protect services in the corporate DMZ.
  B. It is the first line of defense at the network perimeter.
  C. It splits the network into multiple security segments to minimize the impact of breaches.
  D. It is an all-in-one security appliance that is placed at remote sites to extend the enterprise network.
  C. It splits the network into multiple security segments to minimize the impact of breaches.

  ---

  explanation:

  Explanation/Reference:

  ISFW splits your network into multiple security segments. They serve as a breach containers from attacks that come from inside.

• Question 4:

  Refer to the exhibit, which contains the partial output of the get vpn ipsec tunnel details command.

  

  Based on the output, which two statements are correct? (Choose two.)

  A. Phase 2 authentication is set to sha1 on both sides.
  B. Anti-replay is disabled.
  C. Hub2Spoke1 is a policy-based VPN.
  D. Hub2Spoke1 is configured on interface wan2.
  A. Phase 2 authentication is set to sha1 on both sides.
  D. Hub2Spoke1 is configured on interface wan2.

• Question 5:

  Which two statements about bulk configuration changes made using FortiManager CLI scripts are correct? (Choose two.)

  A. When run on the Device Database, you must use the installation wizard to apply the changes to the managed FortiGate device.
  B. When run on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.
  C. When run on the All FortiGate in ADOM, changes are automatically installed without the creation of a new revision history.
  D. When run on the Policy Package, ADOM database, changes are applied directly to the managed FortiGate device.
  A. When run on the Device Database, you must use the installation wizard to apply the changes to the managed FortiGate device.
  B. When run on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.

  ---

  explanation:

  Explanation/Reference:

  Reference: https://docs.fortinet.com/document/fortimanager/6.2.1/administration- guide/71780/cli-scripts

• Question 6:

  Refer to the exhibit, which contains partial output from an IKE real-time debug.

  

  Why did the tunnel not come up?

  A. The local gateway has configured less secure encryption and hashing algorithms compared to the remote gateway.
  B. The Diffie-Hellman group does not match on the local and remote gateways.
  C. The proposal ID does not match between local and remote gateways.
  D. The encapsulation method for phase 2 is set to none on local and remote gateways.
  A. The local gateway has configured less secure encryption and hashing algorithms compared to the remote gateway.

  ---

  explanation:

  Explanation/Reference:

  local gateway: encryption AES-128, hash SHA remote gateway: encryption AES-256, hash SHA-256 So local gateway has less secure settings

• Question 7:

  Which two statements about the Security Fabric are true? (Choose two.)

  A. Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer.
  B. Only the root FortiGate sends logs to FortiAnalyzer.
  C. Only FortiGate devices with fabric-object-unification set to default will receive and synchronize global CMDB objects sent by the root FortiGate.
  D. FortiGate uses FortiTelemetry protocol to communicate with FortiAnalyzer.
  A. Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer.
  C. Only FortiGate devices with fabric-object-unification set to default will receive and synchronize global CMDB objects sent by the root FortiGate.

  ---

  explanation:

  Explanation/Reference:

  FortiGate's to Root uses FortiTelemetry (TCP-8013) FortiTelemetry is also used for FortiClient communication Root Fortigate to FortiAnalyzer uses API (TCP-443)

• Question 8:

  How are bulk configuration changes made using FortiManager CLI scripts? (Choose two.)

  A. When run on the All FortiGate in ADOM, changes are automatically installed without the creation of a new revision history.
  B. When run on the Device Database, changes are applied directly to the managed FortiGate device.
  C. When run on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.
  D. When run on the Policy Package, ADOM database, you must use the installation wizard to apply the changes to the managed FortiGate device
  C. When run on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.
  D. When run on the Policy Package, ADOM database, you must use the installation wizard to apply the changes to the managed FortiGate device

  ---

  explanation:

  Explanation/Reference:

  CLI scripts can be run in three different ways:Device Database: By default, a script is executed on the device database. It is recommend you run the changes on the device database (default setting), as this allows you to check what

  configuration changes you will send to the managed device. Once scripts are run on the device database, you can install these changes to a managed device using the installation wizard.

  Policy Package, ADOM database: If a script contains changes related to ADOM level objects andpolicies, you can change the default selection to run on Policy Package, ADOM database and can then be installed using the installation wizard.

  Remote FortiGate directly (through CLI): A script can be executed directly on the device and you don't need to install these changes using the installation wizard. As the changes are directly installed on the managed device, no option is

  provided to verify and check the configuration changes through FortiManager prior to executing it.

• Question 9:

  Which two statements about application-layer test commands are true? (Choose two.)

  A. Some of them display real-time application debugs.
  B. Some of them can be used to restart an application.
  C. Some of them display statistics and configuration information about a feature or process.
  D. Some of them only display output, after you run the diagnose debug console enable command.
  B. Some of them can be used to restart an application.
  C. Some of them display statistics and configuration information about a feature or process.

• Question 10:

  View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.

  

  The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel. To diagnose, the administrator enters these CLI commands:

  

  However, the IKE real time debug does not show any output. Why?

  A. The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.
  B. The log-filter setting was set incorrectly. The VPN's traffic does not match this filter.
  C. The debug shows only error messages. If there is no output, then the tunnel is operating normally.
  D. The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.
  B. The log-filter setting was set incorrectly. The VPN's traffic does not match this filter.