NSE7_EFW-7.2 Practice Questions Preview

Question 1

Single choice

Refer to the exhibit, which shows two configured FortiGate devices and peering over FGSP.

The main link directly connects the two FortiGate devices and is configured using the set session-syn-dev
<interface> command.

What is the primary reason to configure the main link?

A
To have both sessions and configuration synchronization in layer 2
B
To load balance both sessions and configuration synchronization between layer 2 and 3
C
To have only configuration synchronization in layer 3
D
To have both sessions and configuration synchronization in layer 3

Reveal answer details Close answer details

Correct answerD

Explanation

The primary purpose of configuring a main link between the devices is to synchronize session information so that if one unit fails, the other can continue processing traffic without dropping active sessions. A. To have both sessions and configuration synchronization in layer 2. This is incorrect because FGSP is used for session synchronization, not configuration synchronization.
B. To load balance both sessions and configuration synchronization between layer 2 and 3.
FGSP does not perform load balancing and is not used for configuration synchronization.
C. To have only configuration synchronization in layer 3. The main link is not used solely for configuration
synchronization.
D. To have both sessions and configuration synchronization in layer 3. The main link in an FGSP setup is
indeed used to synchronize session information across the devices, and it operates at layer 3 since it uses IP addresses to establish the peering.

Question 2

Multiple choice

Which two statements about metadata variables are true? (Choose two.)

A
You create them on FortiGate
B
They apply only to non-firewall objects.
C
The metadata format is $<metadata_variabie_name>.
D
They can be used as variables in scripts

Reveal answer details Close answer details

Correct answersC, D

Question 3

Multiple choice

Refer to the exhibit, which shows a routing table.

What two options can you configure in OSPF to block the advertisement of the 10.1.10.0 prefix? (Choose two.)

A
Remove the 16.1.10.C prefix from the OSPF network
B
Configure a distribute-list-out
C
Configure a route-map out
D
Disable Redistribute Connected

Reveal answer details Close answer details

Correct answersB, C

Explanation

To block the advertisement of the 10.1.10.0 prefix in OSPF, you can configure a distribute-list-out or a route-map out. A distribute-list-out is used to filter outgoing routing updates from being advertised to OSPF neighbors 1. A route-map out can also be used for filtering and is applied to outbound routing updates 2.
References:
Technical Tip: Inbound route filtering in OSPF usi ... - Fortinet Community, OSPF | FortiGate /
FortiOS 7.2.2 - Fortinet Documentation

Question 4

Multiple choice

In which two ways does FortiManager function when it is deployed as a local FDS? (Choose two.)

A
It caches available firmware updates for both managed and unmanaged devices
B
It can be configured as an update server a rating server or both
C
It functions as rating server only for web filtering and antispam services
D
It downloads license information for registered and unregistered devices

Reveal answer details Close answer details

Correct answersB, C

Question 5

Single choice

Which statement about network processor (NP) offloading is true?

A
For TCP traffic FortiGate CPU offloads the first packets of SYN/ACK and ACK of the three-way handshake to NP
B
The NP provides IPS signature matching
C
You can disable the NP for each firewall policy using the command np-acceleration st to loose.
D
The NP checks the session key or IPSec SA

Reveal answer details Close answer details

Correct answerD

Question 6

Single choice

An administrator has configured two fortiGate devices for an HA cluster.

While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device What can the administrator do to fix this problem?

A
Verify that the speed and duplex settings match between me FortiGate interfaces and the connected switch ports
B
Configure set link -failed signal enable under-config system ha on both Cluster members
C
Configure remote Iink monitoring to detect an issue in the forwarding path
D
Configure set send-garp-on-failover enables under config system ha on both cluster members

Reveal answer details Close answer details

Correct answerD

Question 7

Single choice

Exhibit.

Refer to the exhibit, which provides information on BGP neighbors.

Which can you conclude from this command output?

A
The router are in the number to match the remote peer.
B
You must change the AS number to match the remote peer.
C
BGP is attempting to establish a TCP connection with the BGP peer.
D
The bfd configuration to set to enable.

Reveal answer details Close answer details

Correct answerC

Explanation

The BGP state is "Idle", indicating that BGP is attempting to establish a TCP connection with the peer. This is the first state in the BGP finite state machine, and it means that no TCP connection has been established yet. If the TCP connection fails, the BGP state will reset to either active or idle, depending on the configuration.

Question 8

Single choice

Refer to the exhibit, which contains a partial configuration of the global system.

What can you conclude from this output?

A
NPs and CPs are enabled
B
Only CPs arc disabled
C
Only NPs are disabled
D
NPs and CPs arc disabled

Reveal answer details Close answer details

Correct answerA

Question 9

Single choice

You want to block access to the website ww.eicar.org using a custom IPS signature.

Which custom IPS signature should you configure?

A
F-SBID( --name "eicar"; --protocol udp; --flow from_server; --pattern "eicar"; --context host;)
B
F-SBID( --name "detect_eicar"; --protocol udp; --service ssl; --flow from_client; --pattern
"www.eicar.org"; --no_case; --context host;)
C
F-SBID( --name "detect_eicar"; --protocol tcp; --service dns; --flow from_server; --pattern "eicar"; --
no_case;)
D
F-SBID( --name "eicar"; --protocol tcp; --service HTTP; --flow from_client; --pattern "www.eicar.org"; --
no_case; --context host;)

Reveal answer details Close answer details

Correct answerD

Explanation

Option D is the correct answer because it specifically blocks access to the website "www.eicar.org" using TCP protocol and HTTP service, which are commonly used for web browsing. The other options either use the wrong protocol (UDP), the wrong service (DNS or SSL), or the wrong pattern ("eicar" instead of
"www.eicar.org").
References:
Configuring custom signatures | FortiGate / FortiOS 7.4.0 - Fortinet Document Library, section
"Signature to block access to example.com".

Question 10

Single choice

After enabling IPS you receive feedback about traffic being dropped.

What could be the reason?

A
Np-accel-mode is set to enable
B
Traffic-submit is set to disable
C
IPS is configured to monitor
D
Fail-open is set to disable

Reveal answer details Close answer details

Correct answerD

Explanation

Fail-open is a feature that allows traffic to pass through the IPS sensor without inspection when the sensor fails or is overloaded. If fail-open is set to disable, traffic will be dropped in such scenarios.
References:
IPS | FortiGate / FortiOS 7.2.3 - Fortinet Documentation
When IPS (Intrusion Prevention System) is configured, if fail-open is set to disable, it means that if the IPS
engine fails, traffic will not be allowed to pass through, which can result in traffic being dropped (D). This is in contrast to a fail-open setting, which would allow traffic to bypass the IPS engine if it is not operational.

Question 11

Multiple choice

Refer to the exhibit, which contains information about an IPsec VPN tunnel.

What two conclusions can you draw from the command output? (Choose two.)

A
Dead peer detection is set to enable.
B
The IKE version is 2.
C
Both IPsec SAs are loaded on the kernel.
D
Forward error correction in phase 2 is set to enable.

Reveal answer details Close answer details

Correct answersB, C

Explanation

From the command output shown in the exhibit:
B. The IKE version is 2: This can be deduced from the presence of 'ver=2' in the output, which indicates
that IKEv2 is being used. C. Both IPsec SAs are loaded on the kernel: This is indicated by the line 'npu flags=0x0/0', suggesting that no offload to NPU is occurring, and hence, both Security Associations are loaded onto the kernel for processing. Fortinet documentation specifies that the version of IKE (Internet Key Exchange) used and the loading of IPsec Security Associations can be verified through the diagnostic commands related to VPN tunnels.

Question 12

Single choice

While configuring the BGP protocol, an administrator applies the set netuork-inport-check disable command under config network.

What will FortiGate do as a result of this command?

A
FortiGate will advertise only the corresponding prefixes in the BGP network table to its BGP neighbor, even if itis not in the routing table.
B
FortiGate will advertise all the prefixes in the BGP network table to its BGP neighbor, even f itis not in the routing table.
C
FortiGate will not advertise any imported routes received from one BGP neighbor to another.
D
FortiGate will not advertise the prefixes, if it is not in the routing table.

Reveal answer details Close answer details

Correct answerB