Fortinet NSE7_EFW-7.0 Online Practice Questions and Exam Preparation

Fortinet NSE7_EFW-7.0 Online Questions & Answers

• Question 121:

  View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.

  

  The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel. To diagnose, the administrator enters these CLI commands:

  

  However, the IKE real time debug does not show any output. Why?

  A. The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.
  B. The log-filter setting was set incorrectly. The VPN's traffic does not match this filter.
  C. The debug shows only error messages. If there is no output, then the tunnel is operating normally.
  D. The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.
  B. The log-filter setting was set incorrectly. The VPN's traffic does not match this filter.

• Question 122:

  View the exhibit, which contains a session entry, and then answer the question below.

  

  Which statement is correct regarding this session?

  A. It is an ICMP session from 10.1.10.10 to 10.200.1.1.
  B. It is an ICMP session from 10.1.10.10 to 10.200.5.1.
  C. It is a TCP session in ESTABLISHED state from 10.1.10.10 to 10.200.5.1.
  D. It is a TCP session in CLOSE_WAIT state from 10.1.10.10 to 10.200.1.1.
  B. It is an ICMP session from 10.1.10.10 to 10.200.5.1.

• Question 123:

  Examine the following partial output from two system debug commands; then answer the question below.

  

  Which of the following statements are true regarding the above outputs? (Choose two.)

  A. The unit is running a 32-bit FortiOS
  B. The unit is in kernel conserve mode
  C. The Cached value is always the Active value plus the Inactive value
  D. Kernel indirectly accesses the low memory (LowTotal) through memory paging
  A. The unit is running a 32-bit FortiOS
  C. The Cached value is always the Active value plus the Inactive value

• Question 124:

  An administrator added the following Ipsec VPN to a FortiGate configuration: configvpn ipsec phasel -interface edit "RemoteSite" set type dynamic set interface "portl" set mode main set psksecret ENC LCVkCiK2E2PhVUzZe next end config vpn ipsec phase2-interface edit "RemoteSite" set phasel name "RemoteSite" set proposal 3des-sha256 next end However, the phase 1 negotiation is failing. The administrator executed the IKF real time debug while attempting the Ipsec connection. The output is shown in the exhibit.

  

  What is causing the IPsec problem in the phase 1 ?

  A. The incoming IPsec connection is matching the wrong VPN configuration
  B. The phrase-1 mode must be changed to aggressive
  C. The pre-shared key is wrong
  D. NAT-T settings do not match
  C. The pre-shared key is wrong

• Question 125:

  View the exhibit, which contains an entry in the session table, and then answer the question below.

  

  Which one of the following statements is true regarding FortiGate's inspection of this session?

  A. FortiGate applied proxy-based inspection.
  B. FortiGate forwarded this session without any inspection.
  C. FortiGate applied flow-based inspection.
  D. FortiGate applied explicit proxy-based inspection.
  A. FortiGate applied proxy-based inspection.

  ---

  Explanation/Reference:

  https://kb.fortinet.com/kb/viewContent.do?externalId=FD30042

• Question 126:

  Refer to the exhibit, which contains the debug output of diagnose dvm device list.

  

  Which two statements about the output shown in the exhibit are correct? (Choose two.)

  A. ADOMs are disabled on the FortiManager
  B. The FortiGate configuration is in sync with latest running revision history.
  C. There are pending device-level changes yet to be installed on Local-FortiGate.
  D. The policy package has been modified for Local-FortiGate.
  B. The FortiGate configuration is in sync with latest running revision history.
  C. There are pending device-level changes yet to be installed on Local-FortiGate.

• Question 127:

  View the exhibit, which contains the output of a diagnose command, and the answer the question below.

  

  Which statements are true regarding the Weight value?

  A. Its initial value is calculated based on the round trip delay (RTT).
  B. Its initial value is statically set to 10.
  C. Its value is incremented with each packet lost.
  D. It determines which FortiGuard server is used for license validation.
  C. Its value is incremented with each packet lost.

• Question 128:

  Exhibits:

  

  Refer to the exhibits, which contain the network topology and BGP configuration for a hub.

  An administrator is trying to configure ADVPN with a hub-spoke VPN setup using iBGP. All the VPNs are up and connected to the hub. The hub is receiving route information from both spokes over iBGP; however, the spokes are not receiving

  route information from each other.

  What change must the administrator make to the hub BGP configuration so that the routes learned by one spoke are forwarded to the other spokes?

  A. Configure an individual neighbor and remove neighbor-range configuration.
  B. Configure the hub as a route reflector client.
  C. Change the router id to 10.1.0.254.
  D. Make the configuration of remote-as different from the configuration of local-as.
  B. Configure the hub as a route reflector client.

  ---

  Explanation/Reference:

  Source: https://community.fortinet.com/t5/FortiGate/Technical-Tip- Configuring-BGP-route-reflector/ta-p/191503 Source 2: RFC 4456

• Question 129:

  Refer to the exhibit, which contains a screenshot of some phase 1 settings.

  

  The VPN is not up. To diagnose the issue, the administrator enters the following CLI commands to an SSH session on FortiGate: diagnose vpn ike log-filter dst-addr4 10.0.10.1 diagnose debug application ike -1 However, the IKE real-time debug does not show any output. Why?

  A. The administrator must also run the command diagnose debug enable.
  B. The administrator must enable the following real-time debug: diagnose debug application ipsec -1.
  C. The log-filter setting is incorrect. The VPN traffic does not match this filter.
  D. The debug shows only error messages. If there is no output, then the phase 1 and phase 2 configurations match.
  A. The administrator must also run the command diagnose debug enable.

  ---

  Explanation/Reference:

  https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPSec-VPN- Diagnostics-Possible-reasons/ta-p/192006

• Question 130:

  Refer to the exhibit, which contains the partial output of the get vpn ipsec tunnel details command.

  

  Based on the output, which two statements are correct? (Choose two.)

  A. The npu_flag for this tunnel is 03.
  B. Different SPI values are a result of auto-negotiation being disabled for phase 2 selectors.
  C. Anti-replay is enabled.
  D. The npu_flag for this tunnel is 02.
  A. The npu_flag for this tunnel is 03.
  C. Anti-replay is enabled.