Fortinet NSE7_EFW-7.2 Online Practice Questions and Exam Preparation

Fortinet NSE7_EFW-7.2 Online Questions & Answers

• Question 51:

  Which statement about ADVPN is true?

  A. lt only uses BGP for dynamic routing
  B. It requires all the devices must be on the same AS for inter-region ADVPN topology
  C. lt is a combination of hub-and spoke and full-mesh topologies
  D. It supports only on single hub-and spoke architecture
  C. lt is a combination of hub-and spoke and full-mesh topologies

• Question 52:

  Exhibit.

  

  Refer to exhibit, which shows a central management configuration

  Which server will FortiGate choose for web filler rating requests if 10.0.1.240 is experiencing an outage?

  A. Public FortiGuard servers
  B. 10.0.1.242
  C. 10.0.1.244
  D. 10.0.1.243
  C. 10.0.1.244

  ---

  In the event of an outage at 10.0.1.240, the FortiGate will choose the next server in the sequence for web filter rating requests, which is 10.0.1.244 according to the configuration shown in the exhibit. This is because the server list is ordered by priority, and the server with the lowest priority number is chosen first. If that server is unavailable, the next server with the next lowest priority number is chosen, and so on. The public FortiGuard servers are only used if the include-defaultservers option is enabled and all the custom servers are unavailable. References: Fortinet Enterprise Firewall Study Guide for FortiOS 7.2, page 132.

• Question 53:

  In which two ways does FortiManager function when it is deployed as a local FDS? (Choose two.)

  A. It caches available firmware updates for both managed and unmanaged devices
  B. It can be configured as an update server a rating server or both
  C. It functions as rating server only for web filtering and antispam services
  D. It downloads license information for registered and unregistered devices
  B. It can be configured as an update server a rating server or both
  C. It functions as rating server only for web filtering and antispam services

• Question 54:

  Exhibit.

  

  Refer to the exhibit, which shows a partial touting table What two concisions can you draw from the corresponding FortiGate configuration? (Choose two.)

  A. IPSec Tunnel aggregation is configured
  B. net-device is enabled in the tunnel IPSec phase 1 configuration
  C. OSPI is configured to run over IPSec.
  D. add-route is disabled in the tunnel IPSec phase 1 configuration.
  B. net-device is enabled in the tunnel IPSec phase 1 configuration
  D. add-route is disabled in the tunnel IPSec phase 1 configuration.

  ---

  Option B is correct because the routing table shows that the tunnel interfaces have a netmask of 255.255.255.255, which indicates that net-device is enabled in the phase 1 configuration. This option allows the FortiGate to use the tunnel interface as a next-hop for routing, without adding a route to the phase 2 destination. Option D is correct because the routing table does not show any routes to the phase 2 destination networks, which indicates that add-route is disabled in the phase 1 configuration. This option controls whether the FortiGate adds a static route to the phase 2 destination network using the tunnel interface as the gateway. Option A is incorrect because IPSec tunnel aggregation is a feature that allows multiple phase 2 selectors to share a single phase 1 tunnel, reducing the number of tunnels and improving performance3. This feature is not related to the routing table or the phase 1 configuration. Option C is incorrect because OSPF is a dynamic routing protocol that can run over IPSec tunnels, but it requires additional configuration on the FortiGate and the peer device4. This option is not related to the routing table or the phase 1 configuration. References: 1: Technical Tip: `set net-device' new route-based IPsec logic 2: Adding a static route 3: IPSec VPN concepts 4: Dynamic routing over IPsec VPN

• Question 55:

  Refer to the exhibit, which shows a routing table.

  

  What two options can you configure in OSPF to block the advertisement of the 10.1.10.0 prefix? (Choose two.)

  A. Remove the 16.1.10.C prefix from the OSPF network
  B. Configure a distribute-list-out
  C. Configure a route-map out
  D. Disable Redistribute Connected
  B. Configure a distribute-list-out
  C. Configure a route-map out

  ---

  To block the advertisement of the 10.1.10.0 prefix in OSPF, you can configure a distribute-list-out or a route-map out. A distribute-list-out is used to filter outgoing routing updates from being advertised to OSPF neighbors1. A route-map out can also be used for filtering and is applied to outbound routing updates2. References: Technical Tip: Inbound route filtering in OSPF usi ... - Fortinet Community, OSPF | FortiGate / FortiOS 7.2.2 - Fortinet Documentation

• Question 56:

  Which statement about the designated router (DR) and backup designated router (BDR) in an OSPF multi-access network is true?

  A. Only the DR receives link state information from non-DR routers.
  B. Non-DR and non-BDR routers form full adjacencies to DR only.
  C. FortiGate first checks the OSPF ID to elect a DR.
  D. Non-DR and non-BDR routers send link state updates and acknowledgements to 224.0.0.6.
  B. Non-DR and non-BDR routers form full adjacencies to DR only.

• Question 57:

  What is true about the Fitter override option in the application control profile?

  A. Helps to configure actions for predefined categories
  B. Helps to categorize applications based on behavior risk or on technology
  C. Helps to view the application control signatures for a specific category
  D. Helps to control specific signature and applications
  B. Helps to categorize applications based on behavior risk or on technology

• Question 58:

  Which two statements about bfd are true? (Choose two)

  A. It can support neighbor only over the next hop in BGP
  B. You can disable it at the protocol level
  C. It works for OSPF and BGP
  D. You must configure n globally only
  B. You can disable it at the protocol level
  C. It works for OSPF and BGP

  ---

  BFD (Bidirectional Forwarding Detection) is a protocol that can quickly detect failures in the forwarding path between two adjacent devices. You can disable BFD at the protocol level by using the "set bfd disable" command under the OSPF or BGP configuration. BFD works for both OSPF and BGP protocols, as well as static routes and SD-WAN rules. References: BFD | FortiGate / FortiOS 7.2.0 - Fortinet Document Library, section "BFD".

• Question 59:

  You created a VPN community using VPN Manager on FortiManager. You also added gateways to the VPN community. Now you are trying to create firewall policies to permit traffic over the tunnel however, the VPN interfaces do not appear as available options.

  A. Create interface mappings for the IPsec VPN interfaces before you use them in a policy.
  B. Refresh the device status using the Device Manager so that FortiGate populates the IPSec interfaces
  C. Configure the phase 1 settings in the VPN community that you didnt initially configure. FortiGate automatically generates the interfaces after you configure the required settings
  D. install the VPN community and gateway configuration on the fortiGate devices so that the VPN interfaces appear on the Policy Objects on fortiManager.
  D. install the VPN community and gateway configuration on the fortiGate devices so that the VPN interfaces appear on the Policy Objects on fortiManager.

  ---

  Explanation Explanation/Reference:To use the VPN interfaces in a policy, you need to install the VPN community and gateway configuration on the FortiGate devices first. This will create the VPN interfaces on the FortiGate and sync them with FortiManager.

• Question 60:

  Refer to the exhibit, which contains a partial BGP combination.

  

  You want to configure a loopback as the OGP source.

  Which two parameters must you set in the BGP configuration? (Choose two)

  A. ebgp-enforce-multihop
  B. recursive-next-hop
  C. ibgp-enfoce-multihop
  D. update-source
  A. ebgp-enforce-multihop
  D. update-source

  ---

  Explanation Explanation/Reference:To configure a loopback as the BGP source, you need to set the "ebgp- enforce-multihop" and "update-source" parameters in the BGP configuration. The "ebgp- enforce-multihop" allows EBGP connections to neighbor routers that are not directly connected, while "update-source" specifies the IP address that should be used for the BGP session. References: BGP on loopback, Loopback interface, Technical Tip: Configuring EBGP Multihop Load-Balancing, Technical Tip: BGP routes are not installed in routing table with loopback as update source