Fortinet NSE7_EFW-7.0 Online Practice Questions and Exam Preparation

Fortinet NSE7_EFW-7.0 Online Questions & Answers

• Question 101:

  Refer to the exhibit, which shows a session entry. Which statement about this session is true?

  

  A. It is an ICMP session from 10.1.10.10 to 10.200.5. 1.
  B. It is a TCP session in close_wait state, from 10. l. 10.10 to 10.200.1.1.
  C. It is an ICMP session from 10.1.10.10 to 10.200.1.1.
  D. It is a TCP session in the established state, from 10.1.10.10 to 10.200.5.1.
  A. It is an ICMP session from 10.1.10.10 to 10.200.5. 1.

  ---

  Explanation/Reference:

  https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiGate- session-table-information/ta-p/196988?externalId=FD30042

• Question 102:

  An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device. What can the administrator do to fix this problem?

  A. Configure remote link monitoring to detect an issue in the forwarding path.
  B. Configure set send-garp-on-failover enable under config system ha on both cluster members.
  C. Verify that the speed and duplex settings match between the FortiGate interfaces and the connected switch ports.
  D. Configure set link-failed-signal enable under config system ha on both cluster members.
  D. Configure set link-failed-signal enable under config system ha on both cluster members.

  ---

  Explanation/Reference:

  Virtual MAC Address and Failover - The new primary broadcasts Gratuitous ARP packets to notify the network that each virtual MAC is now reachable through a different switch port.

  - Some high-end switches might not clear their MAC table correctly after a failover - Solution: Force former primary to shut down all its interfaces for one second when the failover happens (excluding heartbeat and reserved management interfaces): #Config system ha set link-failed-signal enable end - This simulates a link failure that clears the related entries from MAC table of the switches.

• Question 103:

  Examine the output of the `get router info bgp summary' command shown in the exhibit; then answer the question below.

  

  Which statements are true regarding the output in the exhibit? (Choose two.)

  A. BGP state of the peer 10.125.0.60 is Established.
  B. BGP peer 10.200.3.1 has never been down since the BGP counters were cleared.
  C. Local BGP peer has not received an OpenConfirm from 10.200.3.1.
  D. The local BGP peer has received a total of 3 BGP prefixes.
  A. BGP state of the peer 10.125.0.60 is Established.
  C. Local BGP peer has not received an OpenConfirm from 10.200.3.1.

• Question 104:

  What does the dirty flag mean in a FortiGate session?

  A. Traffic has been blocked by the antivirus inspection.
  B. The next packet must be re-evaluated against the firewall policies.
  C. The session must be removed from the former primary unit after an HA failover.
  D. Traffic has been identified as from an application that is not allowed.
  B. The next packet must be re-evaluated against the firewall policies.

  ---

  Explanation/Reference:

  https://kb.fortinet.com/kb/viewContent.do?externalId=FD40119andsliceId=1

• Question 105:

  Refer to the exhibit, which shows the output of diagnose sys session stat.

  

  Which statement about the output shown in the exhibit is correct?

  A. There are two sessions that have not been removed in case of any out-of-order packets that arrive.
  B. There are 166 TCP sessions waiting to complete the three-way handshake.
  C. 162 sessions have been deleted because of memory page exhaustion.
  D. All the sessions in the session table are TCP sessions.
  A. There are two sessions that have not been removed in case of any out-of-order packets that arrive.

• Question 106:

  Refer to the exhibit, which contains the partial output of a diagnose command.

  

  Based on the output, which two statements are correct? (Choose two.)

  A. Anti-replay is enabled.
  B. DPD is disabled.
  C. Remote gateway IP is 10.200.4.1.
  D. Quick mode selectors are disabled.
  A. Anti-replay is enabled.
  C. Remote gateway IP is 10.200.4.1.

• Question 107:

  Refer to the exhibit, which contains the output of diagnose sys session list.

  

  If the HA ID for the primary unit is zero (0), which statement about the output is true?

  A. This session cannot be synced with the slave unit.
  B. The inspection of this session has been offloaded to the slave unit.
  C. The master unit is processing this traffic.
  D. This session is for HA heartbeat traffic.
  C. The master unit is processing this traffic.

• Question 108:

  Examine the output of the `get router info ospf neighbor' command shown in the exhibit; then answer the question below.

  

  Which statements are true regarding the output in the exhibit? (Choose two.) Refer to the exhibit, which shows the output of a debug command. Which statement about the output is true?

  A. TheOSPF routers with the IDs 0.0.0.69 and 0.0.0.117 are both designated routers for the war. l network.
  B. The OSPF router with the ID 0.0.0.2 is the designated router for the ToRemote network.
  C. The local FortiGate is the designated router for the wan1 network.
  D. The interface ToRemote is a point-to-point OSPF network.
  D. The interface ToRemote is a point-to-point OSPF network.

  ---

  Explanation/Reference:

  https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/13685-13.html

• Question 109:

  View the exhibit, which contains the output of diagnose sys session stat, and then answer the question below.

  

  Which statements are correct regarding the output shown? (Choose two.)

  A. There are 0 ephemeral sessions.
  B. All the sessions in the session table are TCP sessions.
  C. No sessions have been deleted because of memory pages exhaustion.
  D. There are 166 TCP sessions waiting to complete the three-way handshake.
  A. There are 0 ephemeral sessions.
  C. No sessions have been deleted because of memory pages exhaustion.

  ---

  Explanation/Reference:

  https://kb.fortinet.com/kb/documentLink.do?externalID=FD40578

• Question 110:

  An administrator has created a VPN community within VPN Manager on FortiManager. They also added gateways to the VPN community and are now trying to create firewall policies to permit traffic over the tunnel; however, the VPN interfaces are not listed as available options.

  What step must the administrator take to resolve this issue?

  A. Install the VPN community and gateway configuration to the FortiGate devices, in order for the interfaces to be displayed within Policy and Objects on FortiManager
  B. Set up all of the phase 1 settings in the VPN community that they neglected to set up initially. The interfaces will be automatically generated after the administrator configures all of the required settings.
  C. Refresh the device status from the Device Manager so that FortiGate will populate the IPsec interfaces.
  D. Create interface mappings for the IPsec VPN interfaces, before they can be used in a policy.
  A. Install the VPN community and gateway configuration to the FortiGate devices, in order for the interfaces to be displayed within Policy and Objects on FortiManager

  ---

  Explanation/Reference:

  1- Create a VPN Community 2- Install VPN Configuration 3- Add IPsec Firewall Policies 4- Install the Policies