Fortinet NSE7_EFW-7.0 Online Practice Questions and Exam Preparation

Fortinet NSE7_EFW-7.0 Online Questions & Answers

• Question 11:

  A FortiGate is configured as an explicit web proxy. Clients using this web proxy are reposting DNS errors when accessing any website. The administrator executes the following debug commands and observes that the n-dns-timeout counter is increasing:

  

  What should the administrator check to fix the problem?

  A. The connectivity between the FortiGate unit and the DNS server.
  B. The connectivity between the client workstations and the DNS server.
  C. That DNS traffic from client workstations is allowed by the explicit web proxy policies.
  D. That DNS service is enabled in the explicit web proxy interface.
  A. The connectivity between the FortiGate unit and the DNS server.

• Question 12:

  View the following FortiGate configuration.

  

  All traffic to the Internet currently egresses from port1. The exhibit shows partial session information for Internet traffic from a user on the internal network:

  

  If the priority on route ID 1 were changed from 5 to 20, what would happen to traffic matching that user's session?

  A. The session would remain in the session table, and its traffic would still egress from port1.
  B. The session would remain in the session table, but its traffic would now egress from both port1 and port2.
  C. The session would remain in the session table, and its traffic would start to egress from port2.
  D. The session would be deleted, so the client would need to start a new session.
  A. The session would remain in the session table, and its traffic would still egress from port1.

  ---

  Explanation/Reference:

  http://kb.fortinet.com/kb/documentLink.do?externalID=FD40943

• Question 13:

  View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

  

  Why didn't the tunnel come up?

  A. The pre-shared keys do not match.
  B. The remote gateway's phase 2 configuration does not match the local gateway's phase 2 configuration.
  C. The remote gateway's phase 1 configuration does not match the local gateway's phase 1 configuration.
  D. The remote gateway is using aggressive mode and the local gateway is configured to use man mode.
  C. The remote gateway's phase 1 configuration does not match the local gateway's phase 1 configuration.

• Question 14:

  Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)

  A. Installing configuration changes to managed devices
  B. Importing interface mappings from managed devices
  C. Adding devices to FortiManager
  D. Previewing pending configuration changes for managed devices
  A. Installing configuration changes to managed devices
  D. Previewing pending configuration changes for managed devices

  ---

  Explanation/Reference:

  Reference: https://docs.fortinet.com/document/fortimanager/6.2.0/administration- guide/668612/using-the-install-wizard-to-install-device-settings-only

• Question 15:

  Which two statements about OCVPN are true? (Choose two.)

  A. Only root vdom supports OCVPN.
  B. OCVPN supports static and dynamic IPs in WAN interface.
  C. OCVPN offers only Hub-Spoke VPNs.
  D. FortiGate devices under different FortiCare accounts can be used to form OCVPN.
  A. Only root vdom supports OCVPN.
  B. OCVPN supports static and dynamic IPs in WAN interface.

  ---

  Explanation/Reference:

  Reference: https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/977344/one-click-vpn-ocvpn https://docs.fortinet.com/document/fortigate/6.2.9/cookbook/496884/overlay-controller-vpn- ocvpn

• Question 16:

  What is the purpose of an internal segmentation firewall (ISFW)?

  A. It inspects incoming traffic to protect services in the corporate DMZ.
  B. It is the first line of defense at the network perimeter.
  C. It splits the network into multiple security segments to minimize the impact of breaches.
  D. It is an all-in-one security appliance that is placed at remote sites to extend the enterprise network.
  C. It splits the network into multiple security segments to minimize the impact of breaches.

  ---

  Explanation/Reference:

  ISFW splits your network into multiple security segments. They serve as a breach containers from attacks that come from inside.

• Question 17:

  Refer to the exhibit, which contains partial output from an IKE real-time debug.

  

  The administrator does not have access to the remote gateway.

  Based on the debug output, which configuration change can the administrator make to the local gateway to resolve the phase 1 negotiation error?

  A. In the phase 1 network configuration, set the IKE version to 2.
  B. In the phase 1 proposal configuration, add AES128-SHA128 to the list of encryption algorithms.
  C. In the phase 1 proposal configuration, add AESCBC-SHA2 to the list of encryption algorithms.
  D. In the phase 1 proposal configuration, add AES256-SHA256 to the list of encryption algorithms.
  D. In the phase 1 proposal configuration, add AES256-SHA256 to the list of encryption algorithms.

  ---

  Explanation/Reference:

  https://docs.fortinet.com/document/fortigate/7.0.0/administration- guide/238852

• Question 18:

  Examine the output of the 'diagnose debug rating' command shown in the exhibit; then answer the question below.

  

  Which statement are true regarding the output in the exhibit? (Choose two.)

  A. There are three FortiGuard servers that are not responding to the queries sent by the FortiGate.
  B. The TZ value represents the delta between each FortiGuard server's time zone and the FortiGate's time zone.
  C. FortiGate will send the FortiGuard queries to the server with highest weight.
  D. A server's round trip delay (RTT) is not used to calculate its weight.
  B. The TZ value represents the delta between each FortiGuard server's time zone and the FortiGate's time zone.
  C. FortiGate will send the FortiGuard queries to the server with highest weight.

• Question 19:

  Examine the partial output from the IKE real time debug shown in the exhibit; then answer the question below. Why didn't the tunnel come up?

  A. IKE mode configuration is not enabled in the remote IPsec gateway.
  B. The remote gateway's Phase-2 configuration does not match the local gateway's phase- 2 configuration.
  C. The remote gateway's Phase-1 configuration does not match the local gateway's phase- 1 configuration.
  D. One IPsec gateway is using main mode, while the other IPsec gateway is using aggressive mode.
  C. The remote gateway's Phase-1 configuration does not match the local gateway's phase- 1 configuration.

• Question 20:

  What is the diagnose test application ipsmonitor 99 command used for?

  A. To enable IPS bypass mode
  B. To provide information regarding IPS sessions
  C. To disable the IPS engine
  D. To restart all IPS engines and monitors
  D. To restart all IPS engines and monitors