Fortinet Fortinet Certifications NSE7_EFW-7.2 Questions & Answers

• Question 31:

  Which statement about network processor (NP) offloading is true?

  A. For TCP traffic FortiGate CPU offloads the first packets of SYN/ACK and ACK of the three-way handshake to NP

  B. The NP provides IPS signature matching

  C. You can disable the NP for each firewall policy using the command np-acceleration st to loose.

  D. The NP checks the session key or IPSec SA

  Correct Answer: B

  Network processors (NPs) are specialized hardware within FortiGate devices that accelerate certain security functions. One of the primary functions of NPs is to provide IPS signature matching (B), allowing for high-speed inspection of traffic against a database of known threat signatures.

• Question 32:

  You created a VPN community using VPN Manager on FortiManager. You also added gateways to the VPN community. Now you are trying to create firewall policies to permit traffic over the tunnel however, the VPN interfaces do not appear as available options.

  A. Create interface mappings for the IPsec VPN interfaces before you use them in a policy.

  B. Refresh the device status using the Device Manager so that FortiGate populates the IPSec interfaces

  C. Configure the phase 1 settings in the VPN community that you didnt initially configure. FortiGate automatically generates the interfaces after you configure the required settings

  D. install the VPN community and gateway configuration on the fortiGate devices so that the VPN interfaces appear on the Policy Objects on fortiManager.

  Correct Answer: D

  To use the VPN interfaces in a policy, you need to install the VPN community and gateway configuration on the FortiGate devices first. This will create the VPN interfaces on the FortiGate and sync them with FortiManager. References: Creating IPsec VPN communities VPN | FortiGate / FortiOS 7.2.0

• Question 33:

  Exhibit.

  

  Refer to exhibit, which shows a central management configuration

  Which server will FortiGate choose for web filler rating requests if 10.0.1.240 is experiencing an outage?

  A. Public FortiGuard servers

  B. 10.0.1.242

  C. 10.0.1.244

  D. 10.0.1.243

  Correct Answer: C

  In the event of an outage at 10.0.1.240, the FortiGate will choose the next server in the sequence for web filter rating requests, which is 10.0.1.244 according to the configuration shown in the exhibit. This is because the server list is ordered by priority, and the server with the lowest priority number is chosen first. If that server is unavailable, the next server with the next lowest priority number is chosen, and so on. The public FortiGuard servers are only used if the include-defaultservers option is enabled and all the custom servers are unavailable. References := Fortinet Enterprise Firewall Study Guide for FortiOS 7.2, page 132.

• Question 34:

  Exhibit.

  

  Refer to the exhibit, which shows an ADVPN network.

  The client behind Spoke-1 generates traffic to the device located behind Spoke-2.

  Which first message floes the hub send to Spoke-110 bring up the dynamic tunnel?

  A. Shortcut query

  B. Shortcut reply

  C. Shortcut offer

  D. Shortcut forward

  Correct Answer: A

  In an ADVPN scenario, when traffic is initiated from a client behind one spoke to another spoke, the hub sends a shortcut query to the initiating spoke. This query is used to determine if there is a more direct path for the traffic, which can then trigger the establishment of a dynamic tunnel between the spokes.

• Question 35:

  Refer to the exhibit, which contains a partial BGP combination.

  

  You want to configure a loopback as the OGP source.

  Which two parameters must you set in the BGP configuration? (Choose two)

  A. ebgp-enforce-multihop

  B. recursive-next-hop

  C. ibgp-enfoce-multihop

  D. update-source

  Correct Answer: AD

  To configure a loopback as the BGP source, you need to set the "ebgp- enforce-multihop" and "update-source" parameters in the BGP configuration. The "ebgp- enforce-multihop" allows EBGP connections to neighbor routers that are not directly connected, while "update-source" specifies the IP address that should be used for the BGP session1. References := BGP on loopback, Loopback interface, Technical Tip: Configuring EBGP Multihop Load-Balancing, Technical Tip: BGP routes are not installed in routing table with loopback as update source

• Question 36:

  Refer to the exhibit, which shows a routing table.

  

  What two options can you configure in OSPF to block the advertisement of the 10.1.10.0 prefix? (Choose two.)

  A. Remove the 16.1.10.C prefix from the OSPF network

  B. Configure a distribute-list-out

  C. Configure a route-map out

  D. Disable Redistribute Connected

  Correct Answer: BC

  To block the advertisement of the 10.1.10.0 prefix in OSPF, you can configure a distribute-list-out or a route-map out. A distribute-list-out is used to filter outgoing routing updates from being advertised to OSPF neighbors1. A route-map out can also be used for filtering and is applied to outbound routing updates2. References := Technical Tip: Inbound route filtering in OSPF usi ... - Fortinet Community, OSPF | FortiGate / FortiOS 7.2.2 - Fortinet Documentation

• Question 37:

  Which, three conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three.)

  A. OSPF interface network types match

  B. OSPF router IDs are unique

  C. OSPF interface priority settings are unique

  D. OSPF link costs match

  E. Authentication settings match

  Correct Answer: ABE

  Option A is correct because the OSPF interface network types determine how the routers form adjacencies and exchange LSAs on a network segment. The network types must match for the routers to become neighbors1. Option B is correct because the OSPF router IDs are used to identify each router in the OSPF domain and to establish adjacencies. The router IDs must be unique for the routers to become neighbors2. Option E is correct because the authentication settings control how the routers authenticate each other before exchanging OSPF packets. The authentication settings must match for the routers to become neighbors3. Option C is incorrect because the OSPF interface priority settings are used to elect the designated router (DR) and the backup designated router (BDR) on a broadcast or non-broadcast multi-access network. The priority settings do not have to be unique for the routers to become neighbors, but they affect the DR/BDR election process4. Option D is incorrect because the OSPF link costs are used to calculate the shortest path to a destination network based on the bandwidth of the links. The link costs do not have to match for the routers to become neighbors, but they affect the routing decisions5. References: =

  1: OSPF network types

  2: OSPF router ID

  3: OSPF authentication

  4: OSPF interface priority

  5: OSPF link cost

• Question 38:

  Refer to the exhibit, which shows config system central-management information.

  

  Which setting must you configure for the web filtering feature to function?

  A. Add server. fortiguard. net to the server list.

  B. Configure securewf.fortiguard. net on the default servers.

  C. Set update-server-location to automatic.

  D. Configure server-type with the rating option.

  Correct Answer: D

  For the web filtering feature to function effectively, the FortiGate device needs to have a server configured for rating services. The rating option in the server-type setting specifies that the server is used for URL rating lookup, which is essential for web filtering. The displayed configuration does not list any FortiGuard web filtering servers, which would be necessary for web filtering. The setting set include-default-servers disable indicates that the default FortiGuard servers are not being used, and hence, a specific server for web filtering (like securewf.fortiguard.net) needs to be configured.

• Question 39:

  Which FortiGate in a Security I auric sends togs to FortiAnalyzer?

  A. Only the root FortiGate.

  B. Each FortiGate in the Security fabric.

  C. The FortiGate devices performing network address translation (NAT) or unified threat management (UTM). if configured.

  D. Only the last FortiGate that handled a session in the Security Fabric

  Correct Answer: B

  Option B is correct because each FortiGate in the Security Fabric can send logs to FortiAnalyzer for centralized logging and analysis12. This allows you to monitor and manage the entire Security Fabric from a single console and view

  aggregated reports and dashboards.

  Option A is incorrect because the root FortiGate is not the only device that can send logs to FortiAnalyzer. The root FortiGate is the device that initiates the Security Fabric and acts as the central point of contact for other FortiGate devices3.

  However, it does not have to be the only log source for FortiAnalyzer. Option C is incorrect because the FortiGate devices performing NAT or UTM are not the only devices that can send logs to FortiAnalyzer. These devices can perform

  additional security functions on the traffic that passes through them, such as firewall, antivirus, web filtering, etc4. However, they are not the only devices that generate logs in the Security Fabric.

  Option D is incorrect because the last FortiGate that handled a session in the Security Fabric is not the only device that can send logs to FortiAnalyzer. The last FortiGate is the device that terminates the session and applies the final security

  policy5. However, it does not have to be the only device that reports the session information to FortiAnalyzer. References: =

  1: Security Fabric - Fortinet Documentation1

  2: FortiAnalyzer Demo6

  3: Security Fabric topology

  4: Security Fabric UTM features

  5: Security Fabric session handling

• Question 40:

  Exhibit.

  

  Refer to the exhibit, which contains a partial policy configuration.

  Which setting must you configure to allow SSH?

  A. Specify SSH in the Service field

  B. Configure pot 22 in the Protocol Options field.

  C. Include SSH in the Application field

  D. Select an application control profile corresponding to SSH in the Security Profiles section

  Correct Answer: A

  Option A is correct because to allow SSH, you need to specify SSH in the Service field of the policy configuration. This is because the Service field determines which types of traffic are allowed by the policy1. By default, the Service field is set to App Default, which means that the policy will use the default ports defined by the applications. However, SSH is not one of the default applications, so you need to specify it manually or create a custom service for it2. Option B is incorrect because configuring port 22 in the Protocol Options field is not enough to allow SSH. The Protocol Options field allows you to customize the protocol inspection and anomaly protection settings for the policy3. However, this field does not override the Service field, which still needs to match the traffic type. Option C is incorrect because including SSH in the Application field is not enough to allow SSH. The Application field allows you to filter the traffic based on the application signatures and categories4. However, this field does not override the Service field, which still needs to match the traffic type. Option D is incorrect because selecting an application control profile corresponding to SSH in the Security Profiles section is not enough to allow SSH. The Security Profiles section allows you to apply various security features to the traffic, such as antivirus, web filtering, IPS, etc. However, this section does not override the Service field, which still needs to match the traffic type. References: =

  1: Firewall policies

  2: Services

  3: Protocol options profiles

  4: Application control