Fortinet Fortinet Certifications NSE7_EFW-7.0 Questions & Answers

• Question 91:

  Exhibits:

  

  Refer to the exhibits, which contain the network topology and BGP configuration for a hub.

  An administrator is trying to configure ADVPN with a hub-spoke VPN setup using iBGP. All the VPNs are up and connected to the hub. The hub is receiving route information from both spokes over iBGP; however, the spokes are not receiving

  route information from each other.

  What change must the administrator make to the hub BGP configuration so that the routes learned by one spoke are forwarded to the other spokes?

  A. Configure an individual neighbor and remove neighbor-range configuration.

  B. Configure the hub as a route reflector client.

  C. Change the router id to 10.1.0.254.

  D. Make the configuration of remote-as different from the configuration of local-as.

  Correct Answer: B

  Explanation: Source: https://community.fortinet.com/t5/FortiGate/Technical-Tip- Configuring-BGP-route-reflector/ta-p/191503 Source 2: RFC 4456

• Question 92:

  Refer to the exhibit, which contains partial output from an IKE real-time debug.

  

  Based on the debug output, which phase 1 setting is enabled in the configuration of this VPN?

  A. auto-discovery-shortcut

  B. auto-discovery-forwarder

  C. auto-discovery-sender

  D. auto-discovery-receiver

  Correct Answer: D

  Reference: https://docs.fortinet.com/document/fortigate/6.0.0/handbook/320160/example- advpn-configuration

  First the Spoke receives SHORTCUT_OFFER, it respondes with sending shortcut-query. AT the end it receives SHORTCUT_REPLY and creates new dynamic tunnel (H2S_0_0).

• Question 93:

  Refer to the exhibit, which shows partial outputs from two routing debug commands.

  

  Which change must an administrator make on FortiGate to route web traffic from internal users to the internet, using ECMP?

  A. Set the priority of the static default route using port1 to 10. Most Voted

  B. Set the priority of the static default route using port2 to 1.

  C. Set preserve-session-route to enable.

  D. Set snat-route-change to enable.

  Correct Answer: A

  Explanation: ECMP pre-requisite is "routes must have the same destination and costs. In the case of static routes, costs include distance and priority". In this case traffic is routed through port 1 because of the lower priority. If we raise priority on port 1 to the value of 10 the traffic should be routed through both ports 1 and 2. https://docs.fortinet.com/document/fortigate/7.0.1/administration-guide/25967/equal-cost- multi-path

• Question 94:

  Examine the output of the 'diagnose debug rating' command shown in the exhibit; then answer the question below.

  

  Which statement are true regarding the output in the exhibit? (Choose two.)

  A. There are three FortiGuard servers that are not responding to the queries sent by the FortiGate.

  B. The TZ value represents the delta between each FortiGuard server's time zone and the FortiGate's time zone.

  C. FortiGate will send the FortiGuard queries to the server with highest weight.

  D. A server's round trip delay (RTT) is not used to calculate its weight.

  Correct Answer: BC

• Question 95:

  View the exhibit, which contains the output of get sys ha status, and then answer the question below.

  

  Which statements are correct regarding the output? (Choose two.)

  A. The slave configuration is not synchronized with the master.

  B. The HA management IP is 169.254.0.2.

  C. Master is selected because it is the only device in the cluster.

  D. port 7 is used the HA heartbeat on all devices in the cluster.

  Correct Answer: AD

• Question 96:

  View the exhibit, which contains the partial output of a diagnose command, and then answer the question below.

  

  Based on the output, which of the following statements is correct?

  A. Anti-reply is enabled.

  B. DPD is disabled.

  C. Quick mode selectors are disabled.

  D. Remote gateway IP is 10.200.5.1.

  Correct Answer: A

• Question 97:

  View the exhibit, which contains the output of a diagnose command, and the answer the question below.

  

  Which statements are true regarding the Weight value?

  A. Its initial value is calculated based on the round trip delay (RTT).

  B. Its initial value is statically set to 10.

  C. Its value is incremented with each packet lost.

  D. It determines which FortiGuard server is used for license validation.

  Correct Answer: C

• Question 98:

  View the exhibit, which contains the output of a debug command, and then answer the question below.

  

  Which one of the following statements about this FortiGate is correct?

  A. It is currently in system conserve mode because of high CPU usage.

  B. It is currently in extreme conserve mode because of high memory usage.

  C. It is currently in proxy conserve mode because of high memory usage.

  D. It is currently in memory conserve mode because of high memory usage.

  Correct Answer: D

• Question 99:

  Which real time debug should an administrator enable to troubleshoot RADIUS authentication problems?

  A. Diagnose debug application radius -1.

  B. Diagnose debug application fnbamd -1.

  C. Diagnose authd console 璴og enable.

  D. Diagnose radius console 璴og enable.

  Correct Answer: B

  https://kb.fortinet.com/kb/documentLink.do?externalID=FD32838

• Question 100:

  View the exhibit, which contains a partial output of an IKE real-time debug, and then answer the question below.

  

  Based on the debug output, which phase-1 setting is enabled in the configuration of this VPN?

  A. auto-discovery-sender

  B. auto-discovery-forwarder

  C. auto-discovery-shortcut

  D. auto-discovery-receiver

  Correct Answer: B