Fortinet Fortinet Certifications NSE7_EFW-7.0 Questions & Answers

• Question 31:

  Refer to the exhibit, which contains the output of the diagnose vpn tunnel list. Which command will capture ESP traffic for the VPN named DialUp_0?

  

  A. diagnose sniffer packet any `esp and host 10.200.3.2'

  B. diagnose sniffer packet any `ip proto 50'

  C. diagnose sniffer packet any `host 10.0.10.10'

  D. diagnose sniffer packet any `port 4500'

  Correct Answer: D

• Question 32:

  Which statement about IKE and IKE NAT-T is true?

  A. IKE is used to encapsulate ESP traffic in some situations, and IKE NAT-T is used only when the local FortiGate is using NAT on the IPsec interface.

  B. IKE is the standard implementation for IKEv1 and IKE NAT-T is an extension added in IKEv2.

  C. They both use UDP as their transport protocol and the port number is configurable.

  D. They each use their own IP protocol number.

  Correct Answer: C

  Explanation: IKE without NAT-T runs over UDP port 500. IKE with NAT-T runs over UDP port 4500. It can be configurable - https://docs.fortinet.com/document/fortigate/7.0.0/new- features/33578/configurable-ike-port

• Question 33:

  Which configuration can be used to reduce the number of BGP sessions in an IBGP network?

  A. route-reflector enable

  B. route-reflector-server enable

  C. route-reflector-client enable

  D. route-reflector-peer enable

  Correct Answer: C

  https://docs.fortinet.com/document/fortigate/7.0.11/cli-reference/572620/config-router-bgp set route-reflector-client [enable|disable]

• Question 34:

  Refer to the exhibit, which contains a TCL script configuration on FortiManager.

  

  An administrator has configured the TCL script on FortiManager, but failed to apply any changes to the managed device after being executed. Why did the TCL script fail to make any changes to the managed device?

  A. Changes in an interface configuration can only be done by CLI script.

  B. The TCL script must start with #include <>.

  C. Incomplete commands are ignored in TCL scripts.

  D. The TCL command run_cmd has not been created.

  Correct Answer: D

• Question 35:

  Refer to the exhibit, which contains partial output from an IKE real-time debug.

  

  The administrator does not have access to the remote gateway.

  Based on the debug output, which configuration change can the administrator make to the local gateway to resolve the phase 1 negotiation error?

  A. In the phase 1 network configuration, set the IKE version to 2.

  B. In the phase 1 proposal configuration, add AES128-SHA128 to the list of encryption algorithms.

  C. In the phase 1 proposal configuration, add AESCBC-SHA2 to the list of encryption algorithms.

  D. In the phase 1 proposal configuration, add AES256-SHA256 to the list of encryption algorithms.

  Correct Answer: D

  Explanation: https://docs.fortinet.com/document/fortigate/7.0.0/administration- guide/238852

• Question 36:

  Refer to the exhibit, which contains partial output from an IKE real-time debug.

  

  Which two statements about this debug output are correct? (Choose two.)

  A. The initiator provided remote as its IPsec peer ID.

  B. It shows a phase 2 negotiation.

  C. Perfect Forward Secrecy (PFS) is enabled in the configuration.

  D. The local gateway IP address is 10.0.0.1.

  Correct Answer: AD

  Explanation: A because : received peer identifier FQDN 'remote' D because : ike 0: comes 10.0.0.2:500 -> 10.0.0.1:500

• Question 37:

  View the exhibit, which contains the output of a debug command, and then answer the question below.

  

  Which of the following statements about the exhibit are true? (Choose two.)

  A. In the network on port4, two OSPF routers are down.

  B. Port4 is connected to the OSPF backbone area.

  C. The local FortiGate's OSPF router ID is 0.0.0.4

  D. The local FortiGate has been elected as the OSPF backup designated router.

  Correct Answer: BC

• Question 38:

  View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

  

  The administrator does not have access to the remote gateway. Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?

  A. Change phase 1 encryption to 3DES and authentication to SHA128.

  B. Change phase 1 encryption to AES128 and authentication to SHA512.

  C. Change phase 1 encryption to AESCBC and authentication to SHA2.

  D. Change phase 1 encryption to AES256 and authentication to SHA256.

  Correct Answer: D

• Question 39:

  The logs in a FSSO collector agent (CA) are showing the following error:

  failed to connect to registry: PIKA1026 (192.168.12.232)

  What can be the reason for this error?

  A. The CA cannot resolve the name of the workstation.

  B. The FortiGate cannot resolve the name of the workstation.

  C. The remote registry service is not running in the workstation 192.168.12.232.

  D. The CA cannot reach the FortiGate with the IP address 192.168.12.232.

  Correct Answer: C

  https://kb.fortinet.com/kb/documentLink.do?externalID=FD30548

• Question 40:

  Refer to the exhibit, which shows the output of a diagnose command.

  

  What can you conclude from the output shown in the exhibit? (Choose two.)

  A. This is a pinhole session created to allow traffic for a protocol that requires additional sessions to operate through FortiGate.

  B. This is an expected session created by the IPS engine.

  C. Traffic in the original direction (coming from the IP address 10.171.121.38) will be routed to the next-hop IP address 10.200.1.1.

  D. Traffic in the original direction (coming from the IP address 10.171.121.38) will be routed to the next-hop IP address 10.0.1.10.

  Correct Answer: AD

  Explanation: Enterprise_Firewall_7.0_Study_Guide-Online.pdf p 110, 111, 115