Fortinet Fortinet Certifications NSE7_EFW-7.0 Questions & Answers

• Question 11:

  Refer to the exhibit, which contains a TCL script configuration on FortiManager.

  An administrator has configured the TCL script on FortiManager, but the TCL script failed to apply any changes to the managed device after being run.

  

  Why did the TCL script fail to make any changes to the managed device?

  A. The TCL command run_cmd has not been created.

  B. The TCL script must start with tinclude <>.

  C. Incomplete commands are ignored in TCL scripts.

  D. Changes to an interface configuration can be made only by a CLI script.

  Correct Answer: A

  https://docs.fortinet.com/document/fortimanager/7.2.2/administration-guide/914165/tcl- scripts

• Question 12:

  Which statement about the designated router (DR) and backup designated router (BDR) in an OSPF multi-access network is true?

  A. FortiGate first checks the OSPF ID to elect a DR.

  B. Non-DR and non-BDR routers will form full adjacencies to DR and BDR only.

  C. BDR is responsible for forwarding link state information from one router to another.

  D. Only the DR receives link state information from non-DR routers.

  Correct Answer: B

• Question 13:

  An administrator has enabled HA session synchronization in a HA cluster with two members. Which flag is added to a primary unit's session to indicate that it has been synchronized to the secondary unit?

  A. redir.

  B. dirty.

  C. synced

  D. nds.

  Correct Answer: C

  The synced sessions have the `synced' flag. The command `diag sys session list' can be used to see the sessions on the member, with the associated flags.

• Question 14:

  Examine the partial output from the IKE real time debug shown in the exhibit; then answer the question below. Why didn't the tunnel come up?

  A. IKE mode configuration is not enabled in the remote IPsec gateway.

  B. The remote gateway's Phase-2 configuration does not match the local gateway's phase- 2 configuration.

  C. The remote gateway's Phase-1 configuration does not match the local gateway's phase- 1 configuration.

  D. One IPsec gateway is using main mode, while the other IPsec gateway is using aggressive mode.

  Correct Answer: C

• Question 15:

  An administrator has configured two FortiGate devices for an HA cluster. While testing the HA failover, the administrator noticed that some of the switches in the network continue to send traffic to the former primary unit. The administrator decides to enable the setting link- failed-signal to fix the problem. Which statement is correct regarding this command?

  A. Forces the former primary device to shut down all its non-heartbeat interfaces for one second while the failover occurs.

  B. Sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.

  C. Sends a link failed signal to all connected devices.

  D. Disables all the non-heartbeat interfaces in all the HA members for two seconds after a failover.

  Correct Answer: A

• Question 16:

  Refer to the exhibits.

  

  Which contain the partial configurations of two VPNs on FortiGate.

  An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovered that FortiGate is not

  matching the user-2 VPN for members of the Users-2 group.

  Which two changes must administrator make to fix the issue? (Choose two.)

  A. Use different pre-shared keys on both VPNs

  B. Enable Mode Config on both VPNs.

  C. Set up specific peer IDs on both VPNs.

  D. Change to aggressive mode on both VPNs.

  Correct Answer: CD

  Explanation: To set peer-id, the VPN must be set in aggressive mode - https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-Peer-IDs-to-select- an-IPSec-dialup/ta-p/192292

• Question 17:

  A FortiGate has two default routes:

  

  All Internet traffic is currently using port1. The exhibit shows partial information for one sample session of Internet traffic from an internal user:

  

  What would happen with the traffic matching the above session if the priority on the first default route (IDd1) were changed from 5 to 20?

  A. The session would be deleted, and the client would need to start a new session.

  B. The session would remain in the session table, and its traffic would start to egress from port2.

  C. The session would remain in the session table, but its traffic would now egress from both port1 and port2.

  D. The session would remain in the session table, and its traffic would still egress from port1.

  Correct Answer: D

• Question 18:

  Refer to the exhibit, which shows a session entry. Which statement about this session is true?

  

  A. It is an ICMP session from 10.1.10.10 to 10.200.5. 1.

  B. It is a TCP session in close_wait state, from 10. l. 10.10 to 10.200.1.1.

  C. It is an ICMP session from 10.1.10.10 to 10.200.1.1.

  D. It is a TCP session in the established state, from 10.1.10.10 to 10.200.5.1.

  Correct Answer: A

  Explanation: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiGate- session-table-information/ta-p/196988?externalId=FD30042

• Question 19:

  Refer to the exhibit, which shows the output of get system ha status. NGFW-1 and NGFW- 2 have been up for a week.

  

  Which two statements about the output are true? (Choose two.)

  A. If FGVM...649 is rebooted, FGVM...650 will become the primary and retain that role, even after FGVM...649 rejoins the cluster.

  B. If no action is taken, the primary FortiGate will leave the cluster due to the current sync status.

  C. If port7 becomes disconnected on the secondary, both FortiGate devices will elect itself the primary.

  D. If a configuration change is made to the primary FortiGate at this time, the secondary will initiate a synchronization reset.

  Correct Answer: AC

  Explanation: A. If FGVM...649 is rebooted, FGVM...650 will become the primary that is normal since it will be the only active firewall and retain that role since override is disabled. Even after FGVM...649 rejoins the cluster, 650 will not fail over as slave. C. If port7 (heartbeat port) becomes disconnected on the secondary, both FortiGate devices will elect itself the primary because when heartbeat communication fails, all cluster members think they are the primary unit (condition referred to as Split Brain) https://docs.fortinet.com/document/fortigate/6.4.0/best-practices/493254/heartbeat- interfaces

• Question 20:

  Refer to the exhibit, which shows a partial web filter profile configuration.

  

  Which action will FortiGate take if a user attempts to access www.dropbox.com, which is categorized as File Sharing and Storage?

  A. FortiGate will block the connection, based on the FortiGuard category based filter configuration.

  B. FortiGate will block the connection as an invalid URL.

  C. FortiGate will exempt the connection, based on the Web Content Filter configuration.

  D. FortiGate will allow the connection, based on the URL Filter configuration.

  Correct Answer: A

  Explanation: Enterprise_Firewall_7.0_Study_Guide-Online.pdf p 351 url filter -> FortiGuard Web Filter -> Web Content Filter -> Advanced Filter Options Allow -> Block