Fortinet NSE7_EFW-7.0 Online Practice Questions and Exam Preparation

Fortinet NSE7_EFW-7.0 Online Questions & Answers

• Question 111:

  When does a RADIUS server send an Access-Challenge packet?

  A. The server does not have the user credentials yet.
  B. The server requires more information from the user, such as the token code for two- factor authentication.
  C. The user credentials are wrong.
  D. The user account is not found in the server.
  B. The server requires more information from the user, such as the token code for two- factor authentication.

• Question 112:

  How are bulk configuration changes made using FortiManager CLI scripts? (Choose two.)

  A. When run on the All FortiGate in ADOM, changes are automatically installed without the creation of a new revision history.
  B. When run on the Device Database, changes are applied directly to the managed FortiGate device.
  C. When run on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.
  D. When run on the Policy Package, ADOM database, you must use the installation wizard to apply the changes to the managed FortiGate device
  C. When run on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.
  D. When run on the Policy Package, ADOM database, you must use the installation wizard to apply the changes to the managed FortiGate device

  ---

  Explanation/Reference:

  CLI scripts can be run in three different ways:Device Database: By default, a script is executed on the device database. It is recommend you run the changes on the device database (default setting), as this allows you to check what

  configuration changes you will send to the managed device. Once scripts are run on the device database, you can install these changes to a managed device using the installation wizard.

  Policy Package, ADOM database: If a script contains changes related to ADOM level objects andpolicies, you can change the default selection to run on Policy Package, ADOM database and can then be installed using the installation wizard.

  Remote FortiGate directly (through CLI): A script can be executed directly on the device and you don't need to install these changes using the installation wizard. As the changes are directly installed on the managed device, no option is

  provided to verify and check the configuration changes through FortiManager prior to executing it.

• Question 113:

  Refer to the exhibits.

  

  Which contain the partial configurations of two VPNs on FortiGate.

  An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovered that FortiGate is not

  matching the user-2 VPN for members of the Users-2 group.

  Which two changes must administrator make to fix the issue? (Choose two.)

  A. Use different pre-shared keys on both VPNs
  B. Enable Mode Config on both VPNs.
  C. Set up specific peer IDs on both VPNs.
  D. Change to aggressive mode on both VPNs.
  C. Set up specific peer IDs on both VPNs.
  D. Change to aggressive mode on both VPNs.

  ---

  Explanation/Reference:

  To set peer-id, the VPN must be set in aggressive mode - https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-Peer-IDs-to-select- an-IPSec-dialup/ta-p/192292

• Question 114:

  Which statement is true regarding File description (FD) conserve mode?

  A. IPS inspection is affected when FortiGate enters FD conserve mode.
  B. A FortiGate enters FD conserve mode when the amount of available description is less than 5%.
  C. FD conserve mode affects all daemons running on the device.
  D. Restarting the WAD process is required to leave FD conserve mode.
  B. A FortiGate enters FD conserve mode when the amount of available description is less than 5%.

• Question 115:

  Examine the output of the `diagnose sys session list expectation' command shown in the exhibit; than answer the question below.

  

  Which statement is true regarding the session in the exhibit?

  A. It was created by the FortiGate kernel to allow push updates from FotiGuard.
  B. It is for management traffic terminating at the FortiGate.
  C. It is for traffic originated from the FortiGate.
  D. It was created by a session helper or ALG.
  D. It was created by a session helper or ALG.

• Question 116:

  An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device. The administrator decides to enable the setting link- failed-signal to fix the problem.

  Which statement about this setting is true?

  A. It sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.
  B. It sends a link failed signal to all connected devices.
  C. It disabled all the non-heartbeat interfaces in all HA members for two seconds after a failover.
  D. It forces the former primary device to shut down all its non-heartbeat interfaces for one second, while the failover occurs.
  D. It forces the former primary device to shut down all its non-heartbeat interfaces for one second, while the failover occurs.

  ---

  Explanation/Reference:

  Reference: https://kb.fortinet.com/kb/viewContent.do?externalId=FD40860andsliceId=1

• Question 117:

  An administrator cannot connect to the GIU of a FortiGate unit with the IP address 10.0.1.254. The administrator runs the debug flow while attempting the connection using HTTP. The output of the debug flow is shown in the exhibit:

  

  Based on the error displayed by the debug flow, which are valid reasons for this problem? (Choose two.)

  A. HTTP administrative access is disabled in the FortiGate interface with the IP address 10.0.1.254.
  B. Redirection of HTTP to HTTPS administrative access is disabled.
  C. HTTP administrative access is configured with a port number different than 80.
  D. The packet is denied because of reverse path forwarding check.
  A. HTTP administrative access is disabled in the FortiGate interface with the IP address 10.0.1.254.
  C. HTTP administrative access is configured with a port number different than 80.

• Question 118:

  Refer to the exhibit, which shows partial outputs from two routing debug commands.

  

  Why is the port2 default route not in the second command output?

  A. The port2 interface is disabled in the FortiGate configuration.
  B. The port1 default route has a lower distance than the default route using port2.
  C. The port1 default route has a higher priority value than the default route using port2.
  D. The port1 default route has a lower priority value than the default route using port2.
  B. The port1 default route has a lower distance than the default route using port2.

• Question 119:

  Which configuration can be used to reduce the number of BGP sessions in an IBGP network?

  A. Neighbor range
  B. Route reflector
  C. Next-hop-self
  D. Neighbor group
  B. Route reflector

  ---

  Explanation/Reference:

  Route reflectors help to reduce the number of IBGP sessions inside an AS. A route reflector forwards the routers learned from one peer to the other peers. If you configure route reflectors, you dont' need to create a full mesh IBGP network. All clients in a cluster only talck to route reflector to get sync routing updates. Route reflectors pass the routing updates to other route reflectors and border routers within the AS.

• Question 120:

  A FortiGate device has the following LDAP configuration:

  

  The LDAP user student cannot authenticate. The exhibit shows the output of the authentication real time debug while testing the student account:

  

  Based on the above output, what FortiGate LDAP settings must the administer check? (Choose two.)

  A. cnid.
  B. username.
  C. password.
  D. dn.
  B. username.
  C. password.

  ---

  Explanation/Reference:

  https://kb.fortinet.com/kb/viewContent.do?externalId=13141