Fortinet Fortinet Certifications NSE7_EFW-7.0 Questions & Answers

• Question 141:

  Which two conditions must be met for a statistic route to be active in the routing table? (Choose two.)

  A. The link health monitor (if configured) is up.

  B. There is no other route, to the same destination, with a higher distance.

  C. The outgoing interface is up.

  D. The next-hop IP address is up.

  Correct Answer: AC

• Question 142:

  Examine the output from the BGP real time debug shown in the exhibit, then the answer the question below: Which statements are true regarding the output in the exhibit? (Choose two.)

  

  A. BGP peers have successfully interchanged Open and Keepalive messages.

  B. Local BGP peer received a prefix for a default route.

  C. The state of the remote BGP peer is OpenConfirm.

  D. The state of the remote BGP peer will go to Connect after it confirms the received prefixes.

  Correct Answer: AB

• Question 143:

  View the exhibit, which contains the output of a BGP debug command, and then answer the question below.

  

  Which of the following statements about the exhibit are true? (Choose two.)

  A. For the peer 10.125.0.60, the BGP state of is Established.

  B. The local BGP peer has received a total of three BGP prefixes.

  C. Since the BGP counters were last reset, the BGP peer 10.200.3.1 has never been down.

  D. The local BGP peer has not established a TCP session to the BGP peer 10.200.3.1.

  Correct Answer: AD

• Question 144:

  View the exhibit, which contains the output of a debug command, and then answer the question below.

  

  What statement is correct about this FortiGate?

  A. It is currently in system conserve mode because of high CPU usage.

  B. It is currently in FD conserve mode.

  C. It is currently in kernel conserve mode because of high memory usage.

  D. It is currently in system conserve mode because of high memory usage.

  Correct Answer: D

• Question 145:

  Refer to the exhibit, which shows the output of a debug command.

  

  Which two statements about the output are true? (Choose two.)

  A. In the network connected to port 4, two OSPF routers are down.

  B. Based on the network type of port 4, OSPF hello packets will be sent to 224.0.0.5.

  C. Based on the network type of port 4, OSPF hello packets will be sent to 224.0.0.6.

  D. There are a total of 5 OSPF routers attached to the Port4 network segment.

  Correct Answer: BD

• Question 146:

  Examine the output of the `get router info bgp summary' command shown in the exhibit; then answer the question below.

  

  Which statement can explain why the state of the remote BGP peer 10.200.3.1 is Connect?

  A. The local peer is receiving the BGP keepalives from the remote peer but it has not received any BGP prefix yet.

  B. The TCP session for the BGP connection to 10.200.3.1 is down.

  C. The local peer has received the BGP prefixed from the remote peer.

  D. The local peer is receiving the BGP keepalives from the remote peer but it has not received the OpenConfirm yet.

  Correct Answer: B

  http://www.ciscopress.com/articles/article.asp?p=2756480andseqNum=4

• Question 147:

  Examine the output of the `get router info ospf interface' command shown in the exhibit; then answer the question below.

  

  Which statements are true regarding the above output? (Choose two.)

  A. The port4 interface is connected to the OSPF backbone area.

  B. The local FortiGate has been elected as the OSPF backup designated router.

  C. There are at least 5 OSPF routers connected to the port4 network.

  D. Two OSPF routers are down in the port4 network.

  Correct Answer: AC

  on BROADCAST network there are 4 neighbors, among which 1*DR +1*BDR. So our FG has 4 neighbors, but create adjacency only with 2 (with DR and BDR). 2 neighbors DRother (not down).

• Question 148:

  What is the diagnose test application ipsmonitor 99 command used for?

  A. To enable IPS bypass mode

  B. To provide information regarding IPS sessions

  C. To disable the IPS engine

  D. To restart all IPS engines and monitors

  Correct Answer: D

• Question 149:

  When using the SSL certificate inspection method for HTTPS traffic, how does FortiGate filter web requests when the browser client does not provide the server name indication (SNI) extension?

  A. FortiGate uses CN information from the Subject field in the server's certificate.

  B. FortiGate switches to the full SSL inspection method to decrypt the data.

  C. FortiGate blocks the request without any further inspection.

  D. FortiGate uses the requested URL from the user's web browser.

  Correct Answer: A

• Question 150:

  Which two configuration settings change the behavior for content-inspected traffic while FortiGate is in conserve mode? (Choose two.)

  A. IPS failopen

  B. mem failopen

  C. AV failopen D. UTM failopen

  Correct Answer: AC