Fortinet Fortinet Certifications NSE7_EFW Questions & Answers

• Question 11:

  View the exhibit, which contains the partial output of an IKE real time debug, and then answer the question below. The administrator does not have access to the remote gateway. Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?

  A. Change phase 1 encryption to AESCBC and authentication to SHA128.

  B. Change phase 1 encryption to 3DES and authentication to CBC.

  C. Change phase 1 encryption to AES128 and authentication to SHA512.

  D. Change phase 1 encryption to 3DES and authentication to SHA256.

  Correct Answer: C

• Question 12:

  Which of the following statements is true regarding a FortiGate configured as an explicit web proxy?

  A. FortiGate limits the number of simultaneous sessions per explicit web proxy user. This limit CANNOT be modified by the administrator.

  B. FortiGate limits the total number of simultaneous explicit web proxy users.

  C. FortiGate limits the number of simultaneous sessions per explicit web proxy user The limit CAN be modified by the administrator

  D. FortiGate limits the number of workstations that authenticate using the same web proxy user credentials. This limit CANNOT be modified by the administrator.

  Correct Answer: C

• Question 13:

  Examine the following partial output from two system debug commands; then answer the question below.

  

  Which of the following statements are true regarding the above outputs? (Choose two.)

  A. The unit is running a 32-bit FortiOS

  B. The unit is in kernel conserve mode

  C. The Cached value is always the Active value plus the Inactive value

  D. Kernel indirectly accesses the low memory (LowTotal) through memory paging

  Correct Answer: AC

• Question 14:

  Examine the output from the BGP real time debug shown in the exhibit, then the answer the question below: Which statements are true regarding the output in the exhibit? (Choose two.)

  

  A. BGP peers have successfully interchanged Open and Keepalive messages.

  B. Local BGP peer received a prefix for a default route.

  C. The state of the remote BGP peer is OpenConfirm.

  D. The state of the remote BGP peer will go to Connect after it confirms the received prefixes.

  Correct Answer: AB

• Question 15:

  View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question

  below.

  ike 0: comes 10.0.0.2:500->10.0.0.1:500, ifindex=7....

  ike 0: IKEv1 exchange=Aggressive id=baf47d0988e9237f/2f405ef3952f6fda len=430

  ike 0: in

  BAF47D0988E9237F2F405EF3952F6FDA0110040000000000000001AE0400003C000000010000000100

  0000300101000

  ike 0:RemoteSite:4: initiator: aggressive mode get 1st response... ike 0:RemoteSite:4: VID RFC 3947 4A131c81070358455C5728F20E95452F ike 0:RemoteSite:4: VID DPD AFCAD71368A1F1C96B8696FC77570100

  ike 0:RemoteSite:4: VID FORTIGATE 8299031757A36082C6A621DE000502D7

  ike 0:RemoteSite:4: peer is FortiGate/Fortios (v5 b727)

  ike 0:RemoteSite:4: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3

  ike 0:RemoteSite:4: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3C0000000

  ike 0:RemoteSite:4: received peer identifier FQDN `remore'

  ike 0:RemoteSite:4: negotiation result

  ike 0:RemoteSite:4: proposal id = 1:

  ike 0:RemoteSite:4: protocol id = ISAKMP:

  ike 0:RemoteSite:4: trans_id = KEY_IKE.

  ike 0:RemoteSite:4: encapsulation = IKE/none

  ike 0:RemoteSite:4: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key 璴en=128 ike 0:RemoteSite:4:

  type=OAKLEY_HASH_ALG, val=SHA.

  ike 0:RemoteSite:4: type-AUTH_METHOD, val=PRESHARED_KEY.

  ike 0:RemoteSite:4: type=OAKLEY_GROUP, val=MODP1024.

  ike 0:RemoteSite:4: ISAKMP SA lifetime=86400

  ike 0:RemoteSite:4: ISAKMP SA baf47d0988e9237f/2f405ef3952f6fda key 16:

  B25B6C9384D8BDB24E3DA3DC90CF5E73

  ike 0:RemoteSite:4: PSK authentication succeeded

  ike 0:RemoteSite:4: authentication OK

  ike 0:RemoteSite:4: add INITIAL-CONTACT

  ike 0:RemoteSite:4: enc

  BAF47D0988E9237F405EF3952F6FDA081004010000000000000080140000181F2E48BFD8E9D603F

  ike 0:RemoteSite:4: out BAF47D0988E9237F405EF3952F6FDA08100401000000000000008C2E3FC9BA061816A396F009A12 ike 0:RemoteSite:4: sent IKE msg (agg_i2send): 10.0.0.1:500-10.0.0.2:500, len=140,

  id=baf47d0988e9237f/2 ike 0:RemoteSite:4: established IKE SA baf47d0988e9237f/2f405ef3952f6fda Which statements about this debug output are correct? (Choose two.)

  A. The remote gateway IP address is 10.0.0.1.

  B. It shows a phase 1 negotiation.

  C. The negotiation is using AES128 encryption with CBC hash.

  D. The initiator has provided remote as its IPsec peer ID.

  Correct Answer: BD

• Question 16:

  View the exhibit, which contains the output of diagnose sys session list, and then answer the question below.

  

  If the HA ID for the primary unit is zero (0), which statement is correct regarding the output?

  A. This session is for HA heartbeat traffic.

  B. This session is synced with the slave unit.

  C. The inspection of this session has been offloaded to the slave unit.

  D. This session cannot be synced with the slave unit.

  Correct Answer: B

• Question 17:

  An administrator is running the following sniffer in a FortiGate:

  diagnose sniffer packet any "host 10.0.2.10" 2

  What information is included in the output of the sniffer? (Choose two.)

  A. Ethernet headers.

  B. IP payload.

  C. IP headers.

  D. Port names.

  Correct Answer: BC

• Question 18:

  What events are recorded in the crashlogs of a FortiGate device? (Choose two.)

  A. A process crash.

  B. Configuration changes.

  C. Changes in the status of any of the FortiGuard licenses.

  D. System entering to and leaving from the proxy conserve mode.

  Correct Answer: AD

• Question 19:

  A FortiGate is configured as an explicit web proxy. Clients using this web proxy are reposting DNS errors when accessing any website. The administrator executes the following debug commands and observes that the n-dns-timeout counter is increasing:

  

  What should the administrator check to fix the problem?

  A. The connectivity between the FortiGate unit and the DNS server.

  B. The connectivity between the client workstations and the DNS server.

  C. That DNS traffic from client workstations is allowed by the explicit web proxy policies.

  D. That DNS service is enabled in the explicit web proxy interface.

  Correct Answer: AB

• Question 20:

  A FortiGate has two default routes:

  

  All Internet traffic is currently using port1. The exhibit shows partial information for one sample session of Internet traffic from an internal user:

  

  What would happen with the traffic matching the above session if the priority on the first default route (IDd1) were changed from 5 to 20?

  A. Session would remain in the session table and its traffic would keep using port1 as the outgoing interface.

  B. Session would remain in the session table and its traffic would start using port2 as the outgoing interface.

  C. Session would be deleted, so the client would need to start a new session.

  D. Session would remain in the session table and its traffic would be shared between port1 and port2.

  Correct Answer: A