Fortinet NSE7_EFW-7.0 Online Practice Questions and Exam Preparation

Fortinet NSE7_EFW-7.0 Online Questions & Answers

• Question 61:

  The CLI command set intelligent-mode controls the IPS engine's adaptive scanning behavior. Which of the following statements describes IPS adaptive scanning?

  A. Determines the optimal number of IPS engines required based on system load.
  B. Downloads signatures on demand from FDS based on scanning requirements.
  C. Determines when it is secure enough to stop scanning session traffic.
  D. Choose a matching algorithm based on available memory and the type of inspection being performed.
  C. Determines when it is secure enough to stop scanning session traffic.

  ---

  Explanation/Reference:

  Configuring IPS intelligenceStarting with FortiOS 5.2, intelligent-mode is a new adaptive detection method. This command is enabled the default and it means that the IPS engine will perform adaptive scanning so that, for some traffic, the FortiGate can quickly finish scanning and offload the traffic to NPU or kernel. It is a balanced method which could cover all known exploits. When disabled, the IPS engine scans every single byte. config ips globalset intelligent-mode {enable|disable}end

• Question 62:

  Which two statements about application-layer test commands are true? (Choose two.)

  A. Some of them display real-time application debugs.
  B. Some of them can be used to restart an application.
  C. Some of them display statistics and configuration information about a feature or process.
  D. Some of them only display output, after you run the diagnose debug console enable command.
  B. Some of them can be used to restart an application.
  C. Some of them display statistics and configuration information about a feature or process.

• Question 63:

  When using the SSL certificate inspection method for HTTPS traffic, how does FortiGate filter web requests when the browser client does not provide the server name indication (SNI) extension?

  A. FortiGate uses CN information from the Subject field in the server's certificate.
  B. FortiGate switches to the full SSL inspection method to decrypt the data.
  C. FortiGate blocks the request without any further inspection.
  D. FortiGate uses the requested URL from the user's web browser.
  A. FortiGate uses CN information from the Subject field in the server's certificate.

• Question 64:

  The logs in a FSSO collector agent (CA) are showing the following error:

  failed to connect to registry: PIKA1026 (192.168.12.232)

  What can be the reason for this error?

  A. The CA cannot resolve the name of the workstation.
  B. The FortiGate cannot resolve the name of the workstation.
  C. The remote registry service is not running in the workstation 192.168.12.232.
  D. The CA cannot reach the FortiGate with the IP address 192.168.12.232.
  C. The remote registry service is not running in the workstation 192.168.12.232.

  ---

  Explanation/Reference:

  https://kb.fortinet.com/kb/documentLink.do?externalID=FD30548

• Question 65:

  Examine the output of the `get router info ospf interface' command shown in the exhibit; then answer the question below.

  

  Which statements are true regarding the above output? (Choose two.)

  A. The port4 interface is connected to the OSPF backbone area.
  B. The local FortiGate has been elected as the OSPF backup designated router.
  C. There are at least 5 OSPF routers connected to the port4 network.
  D. Two OSPF routers are down in the port4 network.
  A. The port4 interface is connected to the OSPF backbone area.
  C. There are at least 5 OSPF routers connected to the port4 network.

  ---

  Explanation/Reference:

  on BROADCAST network there are 4 neighbors, among which 1*DR +1*BDR. So our FG has 4 neighbors, but create adjacency only with 2 (with DR and BDR). 2 neighbors DRother (not down).

• Question 66:

  Four FortiGate devices configured for OSPF connected to the same broadcast domain. The first unit is elected as the designated router The second unit is elected as the backup designated router Under normal operation, how many OSPF full adjacencies are formed to each of the other two units?

  A. 1
  B. 2
  C. 3
  D. 4
  B. 2

• Question 67:

  Which two conditions would prevent a static route from being added to the routing table? (Choose two.)

  A. There is another other route to the same destination, with a lower distance.
  B. The route has a lower priority value than another route to the same destination.
  C. The next-hop IP address is unreachable.
  D. The interface specified in the route configuration is down
  A. There is another other route to the same destination, with a lower distance.
  D. The interface specified in the route configuration is down

  ---

  Explanation/Reference:

  The routing table contains only the static route with the lowest distance https://community.fortinet.com/t5/FortiGate/Technical-Note-Routing-behavior-depending- on-distance-and/ta-p/198221

• Question 68:

  Which two statements about the Security Fabric are true? (Choose two.)

  A. Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer.
  B. Only the root FortiGate sends logs to FortiAnalyzer.
  C. Only FortiGate devices with fabric-object-unification set to default will receive and synchronize global CMDB objects sent by the root FortiGate.
  D. FortiGate uses FortiTelemetry protocol to communicate with FortiAnalyzer.
  A. Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer.
  C. Only FortiGate devices with fabric-object-unification set to default will receive and synchronize global CMDB objects sent by the root FortiGate.

  ---

  Explanation/Reference:

  FortiGate's to Root uses FortiTelemetry (TCP-8013) FortiTelemetry is also used for FortiClient communication Root Fortigate to FortiAnalyzer uses API (TCP-443)

• Question 69:

  An administrator has configured two FortiGate devices for an HA cluster. While testing the HA failover, the administrator noticed that some of the switches in the network continue to send traffic to the former primary unit. The administrator decides to enable the setting link- failed-signal to fix the problem. Which statement is correct regarding this command?

  A. Forces the former primary device to shut down all its non-heartbeat interfaces for one second while the failover occurs.
  B. Sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.
  C. Sends a link failed signal to all connected devices.
  D. Disables all the non-heartbeat interfaces in all the HA members for two seconds after a failover.
  A. Forces the former primary device to shut down all its non-heartbeat interfaces for one second while the failover occurs.

• Question 70:

  View the exhibit, which contains the output of a web diagnose command, and then answer the question below.

  

  Which one of the following statements explains why the cache statistics are all zeros?

  A. The administrator has reallocated the cache memory to a separate process.
  B. There are no users making web requests.
  C. The FortiGuard web filter cache is disabled in the FortiGate's configuration.
  D. FortiGate is using a flow-based web filter and the cache applies only to proxy-based inspection.
  C. The FortiGuard web filter cache is disabled in the FortiGate's configuration.