Fortinet Fortinet Certifications NSE7_EFW-7.0 Questions & Answers

• Question 101:

  Which statement is true regarding File description (FD) conserve mode?

  A. IPS inspection is affected when FortiGate enters FD conserve mode.

  B. A FortiGate enters FD conserve mode when the amount of available description is less than 5%.

  C. FD conserve mode affects all daemons running on the device.

  D. Restarting the WAD process is required to leave FD conserve mode.

  Correct Answer: B

• Question 102:

  Refer to the exhibit, which contains the output of diagnose sys session list.

  

  If the HA ID for the primary unit is zero (0), which statement about the output is true?

  A. This session cannot be synced with the slave unit.

  B. The inspection of this session has been offloaded to the slave unit.

  C. The master unit is processing this traffic.

  D. This session is for HA heartbeat traffic.

  Correct Answer: C

• Question 103:

  What does the dirty flag mean in a FortiGate session configured for NGFW policy mode?

  A. The existing session table entry has been updated with the app_id and the firewall policy table needs to be checked for a match.

  B. The application or URL category is unknown and needs to be rescanned by the IPS engine to try to identify the Layer 7 details.

  C. The URL category for this session has been updated by FortiGuard and the session needs to be checked against the policy again to ensure proper web filtering is applied.

  D. Traffic has been identified as coming from an application that is not allowed and the relevant replacement message needs to be displayed to the user, if configured.

  Correct Answer: A

  Explanation: Enterprise_Firewall_7.0_Study_Guide-Online.pdf p 99

• Question 104:

  View the exhibit, which contains the output of a diagnose command, and then answer the question below.

  

  Which statements are true regarding the output in the exhibit? (Choose two.)

  A. FortiGate will probe 121.111.236.179 every fifteen minutes for a response.

  B. Servers with the D flag are considered to be down.

  C. Servers with a negative TZ value are experiencing a service outage.

  D. FortiGate used 209.222.147.3 as the initial server to validate its contract.

  Correct Answer: AD

  A ?because flag is Failed so fortigate will check if server is available every 15 minD- state is I , contact to validate contract info

• Question 105:

  Refer to the exhibit, which contains the partial output of a diagnose command.

  

  Based on the output, which two statements are correct? (Choose two.)

  A. The remote gateway has quick mode selectors containing a destination subnet of 10.1.2.0/24.

  B. The remote gateway IP is 10.200.5.1.

  C. DPD is disabled.

  D. Anti-replay is enabled.

  Correct Answer: AD

  Explanation: Enterprise_Firewall_7.0_Study_Guide-Online.pdf p 427, 444 Since the local subnet is 10.1.2.0/24, the remote gateway has the destination subnet as 10.1.2.0. The remote gateway IP is 10.200.4.1. DPD is enabled (dpd-link=on)

• Question 106:

  Which two tasks are automated using the Import Configuration wizard on FortiManager? (Choose two.)

  A. Importing firewall address objects from managed devices

  B. Importing interface mappings from managed devices

  C. Importing static and dynamic route configurations from managed devices

  D. Importing devices to FortiManager

  Correct Answer: AB

  https://docs.fortinet.com/document/fortimanager/7.0.5/administration-guide/337348

• Question 107:

  Refer to the exhibit, which contains a CLI script configuration on FortiManager.

  

  An administrator configured the CLI script on FortiManager, but the script failed to apply any changes to the managed device after being executed. What are two reasons why the script did not make any changes to the managed device? (Choose two.)

  A. Static routes can be added using only TCL scripts.

  B. The commands that start with the # sign did not run.

  C. CLI scripts must start with #!.

  D. Incomplete commands can cause CLI scripts to fail.

  Correct Answer: BD

  ref CLI scripts do not include Tool Command Language (Tcl) commands, and the first line of the script is not "#!" as it is for Tcl scripts. https://help.fortinet.com/fmgr/50hlp/56/5-6- 1/FortiManager_Admin_Guide/1000_Device% 20Manager/2400_Scripts/1000_Script%20sa mples/0200_CLI%20scripts+.htm

• Question 108:

  View the global IPS configuration, and then answer the question below.

  

  Which of the following statements is true regarding this configuration?

  A. IPS will scan every byte in every session.

  B. FortiGate will spawn IPS engine instances based on the system load.

  C. New packets will be passed through without inspection if the IPS socket buffer runs out of memory.

  D. IPS will use the faster matching algorithm which is only available for units with more than 4 GB memory.

  Correct Answer: A

• Question 109:

  In which two states is a given session categorized as ephemeral? (Choose two.)

  A. A TCP session waiting for FIN ACK

  B. A UDP session with packets sent and received

  C. A UDP session with only one packet received

  D. A TCP session waiting for the SYN ACK

  Correct Answer: CD

• Question 110:

  Refer to exhibit, which contains the output of a BGP debug command.

  

  Which statement explains why the state of the 10.200.3.1 peer is Connect?

  A. The local router is receiving BGP keepalives from the remote peer, but the local peer has not received the OpenConfirm yet.

  B. The TCP session to 10.200.3.1 has not completed the three-way handshake.

  C. The local router is receiving the BGP keepalives from the peer, but it has not received a BGP prefix yet.

  D. The local router has received the BGP prefixes from the remote peer.

  Correct Answer: B