Fortinet Fortinet Certifications NSE7_SDW-6.4 Questions & Answers

• Question 21:

  Refer to the exhibit.

  

  

  Multiple IPsec VPNs are formed between two hub-and-spokes groups, and site-to-site between Hub 1 and Hub 2 The administrator configured ADVPN on the dual regions topology

  Which two statements are correct if a dynamic site-to-site tunne1 between Toronto and London has been established? (Choose two)

  A. auto-discovery-receiver is enabled on the egress VPN interfaces on the spokes

  B. auto-discovery-sender is enabled on the ingress VPN interfaces on hubs

  C. tunnel-search IS set to phase 2 quick mode selectors

  D. add-route is enabled to install static routes on hub devices

  E. auto-discovery-forwarder IS enabled on all VPN interfaces

  Correct Answer: AB

• Question 22:

  Refer to the exhibit.

  

  Which two conclusions for traffic that matches the traffic shaper are true? (Choose two.)

  A. The traffic shaper drops packets if the bandwidth exceeds 6250 KBps.

  B. The traffic shaper limits the bandwidth of each source IP to a maximum of 6250 KBps.

  C. The traffic shaper drops packets if the bandwidth is less than 2500 KBps.

  D. The measured bandwidth is less than 100 KBps.

  Correct Answer: AD

• Question 23:

  Refer to exhibits.

  

  

  Exhibit A shows the firewall policy and exhibit B shows the traffic shaping policy.

  The traffic shaping policy is being applied to all outbound traffic; however, inbound traffic is not being evaluated by the shaping policy.

  Based on the exhibits, what configuration change must be made in which policy so that traffic shaping can be applied to inbound traffic?

  A. The reverse shaper option must be enabled and a traffic shaper must be selected

  B. The guaranteed-10mbps option must be selected as the reverse shaper option.

  C. A new firewall policy must be created and SD-WAN must be selected as the incoming interface.

  D. The guaranteed-10mbps option must be selected as the per-IP shaper option

  Correct Answer: A

• Question 24:

  In which two ways does FortiGate learn the FortiManager IP address or FQDN for zero-touch provisioning? (Choose two.)

  A. From a FortiGuard definitions update

  B. From the central management configuration configured in FortiDeploy

  C. From a DHCP server configured with options 240 or 241

  D. From another FortiGate device in the same local network

  Correct Answer: BC

  https://www.historiantech.com/zeroish-touch-provisioning-with-fortimanager-explained/

• Question 25:

  Refer to the exhibit.

  

  Based on the output, which two statements are true? (Choose two )

  A. The diagnostic output presents only of the policy routes

  B. The all_rules rule is the implicit SD-WAN rule in place

  C. There is more than one SD-WAN rule configured

  D. At least one policy route is implemented and in effect

  Correct Answer: AC

• Question 26:

  Which two protocols in the IPsec suite are most used for authentication and encryption? (Choose two)

  A. Secure Shell (SSH)

  B. Encapsulating Security Payload (ESP)

  C. Internet Key Exchange (IKE)

  D. Transport Layer Security (TLS)

  E. Security Association (SA)

  Correct Answer: BC

• Question 27:

  Which diagnostic command can you use to show the SD-WAN rules interface information and state?

  A. diagnose sys virtual-wan-link neighbor.

  B. diagnose sys virtual--wan--link route-tag-list

  C. diagnose sys virtual--wan--link member.

  D. diagnose sys virtual-wan-link service

  Correct Answer: D

  Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/818746/sd-wan-related-diagnose-commands

• Question 28:

  Refer to Exhibit:

  

  Which statement is correct it the responder FortiGate is using a dynamic routing protocol over the IPsec VPN interface?

  A. The phase 1 type must be changed to static for dynamic routing.

  B. Only dial-up connections without XAuth can be used for the dynamic routing

  C. add-route must be disabled to prevent FortiGate from installing VPN static routes

  D. peertype must be set to accept only one peer ID for a unique VPN interface

  Correct Answer: C

• Question 29:

  Refer to the exhibit

  

  Which statement about the ADVPN device role in handling traffic is true?

  A. Two spokes 100.64.3.1 and 10.1.2. 254 forward their queries to their hubs

  B. This is a hub that has received a query from a spoke and has forwarded it to another spoke

  C. This is a spoke that has received a query from a remote hub and has forwarded the response to its hub

  D. Two hubs. 10.1.1.254 and 10.1.2.254, are receiving and forwarding queries between each other

  Correct Answer: B

• Question 30:

  Which statement is correct about the SD-WAN and ADVPN?

  A. ADVPN interface can be a member of SD-WAN interface.

  B. Dynamic VPN is not supported as an SD-Wan interface.

  C. Spoke support dynamic VPN as a static interface.

  D. Hub FortiGate is limited to use ADVPN as SD-WAN member interface.

  Correct Answer: A