Fortinet Fortinet Certifications NSE7_EFW Questions & Answers

• Question 51:

  Which of the following conditions must be met for a static route to be active in the routing table? (Choose three.)

  A. The next-hop IP address is up.

  B. There is no other route, to the same destination, with a higher distance.

  C. The link health monitor (if configured) is up.

  D. The next-hop IP address belongs to one of the outgoing interface subnets.

  E. The outgoing interface is up.

  Correct Answer: ABE

• Question 52:

  An administrator has enabled HA session synchronization in a HA cluster with two members. Which flag is added to a primary unit's session to indicate that it has been synchronized to the secondary unit?

  A. redir.

  B. dirty.

  C. synced

  D. nds.

  Correct Answer: C

• Question 53:

  A FortiGate device has the following LDAP configuration: The LDAP user student cannot authenticate. The exhibit shows the output of the authentication real time debug while testing the student account:

  

  

  Based on the above output, what FortiGate LDAP settings must the administer check? (Choose two.)

  A. cnid.

  B. username.

  C. password.

  D. dn.

  Correct Answer: BC

• Question 54:

  Examine the output of the `diagnose sys session list expectation' command shown in the exhibit; than answer the question below.

  

  Which statement is true regarding the session in the exhibit?

  A. It was created by the FortiGate kernel to allow push updates from FotiGuard.

  B. It is for management traffic terminating at the FortiGate.

  C. It is for traffic originated from the FortiGate.

  D. It was created by a session helper or ALG.

  Correct Answer: A

• Question 55:

  An administrator added the following Ipsec VPN to a FortiGate configuration:

  configvpn ipsec phasel -interface

  edit "RemoteSite"

  set type dynamic

  set interface "portl"

  set mode main

  set psksecret ENC LCVkCiK2E2PhVUzZe

  next

  end

  config vpn ipsec phase2-interface

  edit "RemoteSite" set phasel name "RemoteSite" set proposal 3des-sha256 next end However, the phase 1 negotiation is failing. The administrator executed the IKF real time debug while

  attempting the Ipsec connection. The output is shown in the exhibit.

  

  What is causing the IPsec problem in the phase 1 ?

  A. The incoming IPsec connection is matching the wrong VPN configuration

  B. The phrase-1 mode must be changed to aggressive

  C. The pre-shared key is wrong

  D. NAT-T settings do not match

  Correct Answer: C

• Question 56:

  View the central management configuration shown in the exhibit, and then answer the question below.

  

  Which server will FortiGate choose for antivirus and IPS updates if 10.0.1.243 is experiencing an outage?

  A. 10.0.1.240

  B. One of the public FortiGuard distribution servers

  C. 10.0.1.244

  D. 10.0.1.242

  Correct Answer: B

• Question 57:

  View the global IPS configuration, and then answer the question below.

  

  Which of the following statements is true regarding this configuration?

  A. IPS will scan every byte in every session.

  B. FortiGate will spawn IPS engine instances based on the system load.

  C. New packets will be passed through without inspection if the IPS socket buffer runs out of memory.

  D. IPS will use the faster matching algorithm which is only available for units with more than 4 GB memory.

  Correct Answer: A

• Question 58:

  Examine the output of the `diagnose ips anomaly list' command shown in the exhibit; then answer the question below.

  

  Which IP addresses are included in the output of this command?

  A. Those whose traffic matches a DoS policy.

  B. Those whose traffic matches an IPS sensor.

  C. Those whose traffic exceeded a threshold of a matching DoS policy.

  D. Those whose traffic was detected as an anomaly by an IPS sensor.

  Correct Answer: A

• Question 59:

  View the exhibit, which contains the output of a debug command, and then answer the question below.

  

  Which of the following statements about the exhibit are true? (Choose two.)

  A. In the network on port4, two OSPF routers are down.

  B. Port4 is connected to the OSPF backbone area.

  C. The local FortiGate's OSPF router ID is 0.0.0.4

  D. The local FortiGate has been elected as the OSPF backup designated router.

  Correct Answer: BC

• Question 60:

  View the exhibit, which contains a partial web filter profile configuration, and then answer the question below.

  

  Which action will FortiGate take if a user attempts to access www.dropbox.com, which is categorized as File Sharing and Storage?

  A. FortiGate will exempt the connection based on the Web Content Filter configuration.

  B. FortiGate will block the connection based on the URL Filter configuration.

  C. FortiGate will allow the connection based on the FortiGuard category based filter configuration.

  D. FortiGate will block the connection as an invalid URL.

  Correct Answer: B