Fortinet NSE7_EFW-7.2 Online Practice Questions and Exam Preparation

Fortinet NSE7_EFW-7.2 Online Questions & Answers

• Question 71:

  Refer to the exhibit, which shows the output of a BGP summary.

  

  What two conclusions can you draw from this BGP summary? (Choose two.)

  A. External BGP (EBGP) exchanges routing information.
  B. The BGP session with peer 10. 127. 0. 75 is established.
  C. The router 100. 64. 3. 1 has the parameter bfd set to enable.
  D. The neighbors displayed are linked to a local router with the neighbor-range set to a value of 4.
  A. External BGP (EBGP) exchanges routing information.
  B. The BGP session with peer 10. 127. 0. 75 is established.

• Question 72:

  You want to block access to the website ww.eicar.org using a custom IPS signature.

  Which custom IPS signature should you configure?

  A. F-SBID( --name "eicar"; --protocol udp; --flow from_server; --pattern "eicar"; --context host;)
  B. F-SBID( --name "detect_eicar"; --protocol udp; --service ssl; --flow from_client; --pattern "www.eicar.org"; --no_case; --context host;)
  C. F-SBID( --name "detect_eicar"; --protocol tcp; --service dns; --flow from_server; --pattern "eicar"; --no_case;)
  D. F-SBID( --name "eicar"; --protocol tcp; --service HTTP; --flow from_client; --pattern "www.eicar.org"; --no_case; --context host;)
  D. F-SBID( --name "eicar"; --protocol tcp; --service HTTP; --flow from_client; --pattern "www.eicar.org"; --no_case; --context host;)

  ---

  Option D is the correct answer because it specifically blocks access to the website "www.eicar.org" using TCP protocol and HTTP service, which are commonly used for web browsing. The other options either use the wrong protocol (UDP), the wrong service (DNS or SSL), or the wrong pattern ("eicar" instead of "www.eicar.org"). References: Configuring custom signatures | FortiGate / FortiOS 7.4.0 - Fortinet Document Library, section "Signature to block access to example.com".

• Question 73:

  Refer to the exhibit which shows an OSPF network.

  

  Which types of link-state advertisements (LSA) will NGFW-1 send if it is a backup designated router (BDR)

  A. NGFW-1 will send type 1 and type 2 LSAs
  B. NGFW-1 will send type 1 and type 4 LSAs.
  C. NGFW-1 will send type 1 and type 3 LSAs
  D. NGFW-1 will send type 1 and type 5 LSAs
  C. NGFW-1 will send type 1 and type 3 LSAs

• Question 74:

  Exhibit.

  

  Refer to the exhibit, which shows the output from the webfilter fortiguard cache dump and webfilter categories commands.

  Using the output, how can an administrator determine the category of the training.fortinet.com am website?

  A. The administrator must convert the first three digits of the IP hex value to binary
  B. The administrator can look up the hex value of 34 in the second command output.
  C. The administrator must add both the Pima in and Iphex values of 34 to get the category number
  D. The administrator must convert the first two digits of the Domain hex value to a decimal value
  B. The administrator can look up the hex value of 34 in the second command output.

  ---

  Option B is correct because the administrator can determine the category of the training.fortinet.com website by looking up the hex value of 34 in the second command output. This is because the first command output shows that the domain and the IP of the website are both in category (Hex) 34, which corresponds to Information Technology in the second command output. Option A is incorrect because the administrator does not need to convert the first three digits of the IP hex value to binary. The IP hex value is already in the same format as the category hex value, so the administrator can simply compare them without any conversion. Option C is incorrect because the administrator does not need to add both the Pima in and Iphex values of 34 to get the category number. The Pima in and Iphex values are not related to the category number, but to the cache TTL and the database version respectively. Option D is incorrect because the administrator does not need to convert the first two digits of the Domain hex value to a decimal value. The Domain hex value is already in the same format as the category hex value, so the administrator can simply compare them without any conversion. References: 1: Technical Tip: Verify the webfilter cache content 2: Hexadecimal to Decimal Converter 3: FortiGate - Fortinet Community : Web filter | FortiGate / FortiOS 7.2.0 - Fortinet Documentation7

• Question 75:

  

  Refer to the exhibit, which shows information about an OSPF interface

  What two conclusions can you draw from this command output? (Choose two.)

  A. NGFW-1 sends its LSA updates to 224.0.0.6 address
  B. NGFW-1 sends its LSA updates to 224.0.0. 5 address
  C. NGFW-1 forms neighbor adjacency only with DR and BDR router.
  D. NGFW-1 forms neighbor adjacency only if other OSPF routers match the wait time of 40 seconds
  A. NGFW-1 sends its LSA updates to 224.0.0.6 address
  C. NGFW-1 forms neighbor adjacency only with DR and BDR router.

• Question 76:

  Exhibit.

  

  Refer to the exhibit which provides information on BGP neighbors What can you conclude from this command output?

  A. The local FortiGate has initiated a TCP connection, but there is no response from its BGP peer
  B. The local FortiGate starts sending its routing table with its iBGP peer
  C. The local FortiGate is having a fully established and active BGP connection with its peer
  D. The local FortiGate is missing the config neighbor command in its BGP configuration
  A. The local FortiGate has initiated a TCP connection, but there is no response from its BGP peer

• Question 77:

  Exhibit.

  

  Refer to the exhibit, which contains a partial policy configuration. Which setting must you configure to allow SSH?

  A. Specify SSH in the Service field
  B. Configure pot 22 in the Protocol Options field.
  C. Include SSH in the Application field
  D. Select an application control profile corresponding to SSH in the Security Profiles section
  C. Include SSH in the Application field

• Question 78:

  Refer to the exhibits, which show the configurations of two address objects from the same FortiGate.

  

  Why can you modify the Engineering address object, but not the Finance address object?

  A. You have read-only access.
  B. FortiGate joined the Security Fabric and the Finance address object was configured on the root FortiGate.
  C. FortiGate is registered on FortiManager.
  D. Another user is editing the Finance address object in workspace mode.
  D. Another user is editing the Finance address object in workspace mode.

  ---

  Explanation Explanation/Reference:The inability to modify the Finance address object while being able to modify the Engineering address object suggests that the Finance object is being managed by a higher authority in the Security Fabric, likely the root FortiGate. When a FortiGate is part of a Security Fabric, address objects and other configurations may be managed centrally. This aligns with the Fortinet FortiGate documentation on Security Fabric and central management of address objects.

• Question 79:

  Which two statements about IKE version 2 fragmentation are true? (Choose two.)

  A. Only some IKE version 2 packets are considered fragmentable.
  B. The reassembly timeout default value is 30 seconds.
  C. It is performed at the IP layer.
  D. The maximum number of IKE version 2 fragments is 128.
  A. Only some IKE version 2 packets are considered fragmentable.
  D. The maximum number of IKE version 2 fragments is 128.

  ---

  In IKE version 2, not all packets are fragmentable. Only certain messages within the IKE negotiation process can be fragmented. Additionally, there is a limit to the number of fragments that IKE version 2 can handle, which is 128. This is specified in the Fortinet documentation and ensures that the IKE negotiation process can proceed even in networks that have issues with large packets. The reassembly timeout and the layer at which fragmentation occurs are not specified in this context within Fortinet documentation.

• Question 80:

  You want to configure faster failure detection for BGP

  Which parameter should you enable on both connected FortiGate devices?

  A. Ebgp-enforce-multihop
  B. bfd
  C. Distribute-list-in
  D. Graceful-restart
  B. bfd

  ---

  BFD (Bidirectional Forwarding Detection) is a protocol that provides fast failure detection for BGP by sending periodic messages to verify the connectivity between two peers1. BFD can be enabled on both connected FortiGate devices by using the command set bfd enable under the BGP configuration.