Fortinet NSE7_EFW-7.0 Online Practice Questions and Exam Preparation

Fortinet NSE7_EFW-7.0 Online Questions & Answers

• Question 31:

  An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage. However, after the changes, one network application started to have problems. During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets, and before the arrival of the SYN/ACKs. When the SYN/ACK packets arrive to the FortiGate, the unit has already deleted the respective sessions. Which TCP session timer must be increased to fix this problem?

  A. TCP half open.
  B. TCP half close.
  C. TCP time wait.
  D. TCP session time to live.
  A. TCP half open.

  ---

  Explanation/Reference:

  http://docslegacy.fortinet.com/fos40hlp/43prev/wwhelp/wwhimpl/common/html/wwhelp.htm?context=f gtandfile=CLI_get_Commands.58.25.html

  The tcp-halfopen-timer controls for how long, after a SYN packet, a session without SYN/ACKremains in the table.

  The tcp-halfclose-timer controls for how long, after a FIN packet, a session without FIN/ACKremains in the table.

  The tcp-timewait-timer controls for how long, after a FIN/ACK packet, a session remains in thetable. A closed session remains in the session table for a few seconds more to allow any out-of-sequence packet.

• Question 32:

  Refer to the exhibit, which contains a CLI script configuration on FortiManager.

  

  An administrator configured the CLI script on FortiManager, but the script failed to apply any changes to the managed device after being executed. What are two reasons why the script did not make any changes to the managed device? (Choose two.)

  A. Static routes can be added using only TCL scripts.
  B. The commands that start with the # sign did not run.
  C. CLI scripts must start with #!.
  D. Incomplete commands can cause CLI scripts to fail.
  B. The commands that start with the # sign did not run.
  D. Incomplete commands can cause CLI scripts to fail.

  ---

  Explanation/Reference:

  ref CLI scripts do not include Tool Command Language (Tcl) commands, and the first line of the script is not "#!" as it is for Tcl scripts. https://help.fortinet.com/fmgr/50hlp/56/5-6- 1/FortiManager_Admin_Guide/1000_Device% 20Manager/2400_Scripts/1000_Script%20sa mples/0200_CLI%20scripts+.htm

• Question 33:

  View the exhibit, which contains the output of a diagnose command, and then answer the question below.

  

  Which statements are true regarding the output in the exhibit? (Choose two.)

  A. FortiGate will probe 121.111.236.179 every fifteen minutes for a response.
  B. Servers with the D flag are considered to be down.
  C. Servers with a negative TZ value are experiencing a service outage.
  D. FortiGate used 209.222.147.3 as the initial server to validate its contract.
  A. FortiGate will probe 121.111.236.179 every fifteen minutes for a response.
  D. FortiGate used 209.222.147.3 as the initial server to validate its contract.

  ---

  Explanation/Reference:

  A ?because flag is Failed so fortigate will check if server is available every 15 minD- state is I , contact to validate contract info

• Question 34:

  View the exhibit, which contains the output of a debug command, and then answer the question below.

  

  Which of the following statements about the exhibit are true? (Choose two.)

  A. In the network on port4, two OSPF routers are down.
  B. Port4 is connected to the OSPF backbone area.
  C. The local FortiGate's OSPF router ID is 0.0.0.4
  D. The local FortiGate has been elected as the OSPF backup designated router.
  B. Port4 is connected to the OSPF backbone area.
  C. The local FortiGate's OSPF router ID is 0.0.0.4

• Question 35:

  View the exhibit, which contains a partial routing table, and then answer the question below.

  

  Assuming all the appropriate firewall policies are configured, which of the following pings will FortiGate route? (Choose two.)

  A. Source IP address 10.1.0.24, Destination IP address 10.72.3.20.
  B. Source IP address 10.72.3.27, Destination IP address 10.1.0.52.
  C. Source IP address 10.72.3.52, Destination IP address 10.1.0.254.
  D. Source IP address 10.73.9.10, Destination IP address 10.72.3.15.
  B. Source IP address 10.72.3.27, Destination IP address 10.1.0.52.
  C. Source IP address 10.72.3.52, Destination IP address 10.1.0.254.

• Question 36:

  Refer to the exhibit, which contains partial output from an IKE real-time debug.

  

  Which two statements about this debug output are correct? (Choose two.)

  A. The remote gateway IP address is 10.0.0.1.
  B. The initiator provided remote as its IPsec peer ID.
  C. It shows a phase 1 negotiation.
  D. The negotiation is using AES128 encryption with CBC hash.
  B. The initiator provided remote as its IPsec peer ID.
  C. It shows a phase 1 negotiation.

• Question 37:

  Examine the output from the BGP real time debug shown in the exhibit, then the answer the question below: Which statements are true regarding the output in the exhibit? (Choose two.)

  

  A. BGP peers have successfully interchanged Open and Keepalive messages.
  B. Local BGP peer received a prefix for a default route.
  C. The state of the remote BGP peer is OpenConfirm.
  D. The state of the remote BGP peer will go to Connect after it confirms the received prefixes.
  A. BGP peers have successfully interchanged Open and Keepalive messages.
  B. Local BGP peer received a prefix for a default route.

• Question 38:

  What does the dirty flag mean in a FortiGate session configured for NGFW policy mode?

  A. The existing session table entry has been updated with the app_id and the firewall policy table needs to be checked for a match.
  B. The application or URL category is unknown and needs to be rescanned by the IPS engine to try to identify the Layer 7 details.
  C. The URL category for this session has been updated by FortiGuard and the session needs to be checked against the policy again to ensure proper web filtering is applied.
  D. Traffic has been identified as coming from an application that is not allowed and the relevant replacement message needs to be displayed to the user, if configured.
  A. The existing session table entry has been updated with the app_id and the firewall policy table needs to be checked for a match.

  ---

  Explanation/Reference:

  Enterprise_Firewall_7.0_Study_Guide-Online.pdf p 99

• Question 39:

  Which three conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three.)

  A. OSPF interface network types match.
  B. OSPF router IDs are unique.
  C. OSPF interface priority settings are unique.
  D. Authentication settings match.
  E. OSPF link costs match.
  A. OSPF interface network types match.
  B. OSPF router IDs are unique.
  D. Authentication settings match.

  ---

  Explanation/Reference:

  Enterprise_Firewall_7.0_Study_Guide-Online.pdf p 280

• Question 40:

  Refer to the exhibit, which shows a partial routing table.

  

  Assuming all the appropriate firewall policies are configured, which two pings will FortiGate route? (Choose two.)

  A. Source IP address: 10.1.0.10. Destination IP address: 10.64.1.52
  B. Source IPaddress: 10.72.3.52. Destination IP address: 10.1.0.254
  C. Source IPaddress: 10.10.4.24, Destination IPaddress: 10.72.3.20
  D. Source IPaddress: 10.73.9.10, Destination IPaddress: 10.72.3.15
  A. Source IP address: 10.1.0.10. Destination IP address: 10.64.1.52
  B. Source IPaddress: 10.72.3.52. Destination IP address: 10.1.0.254