NSE7_EFW-6.0 by Fortinet Actual Free Exam Questions And Answers

Question 1

Examine the following partial outputs from two routing debug commands; then answer the question below:

Why the default route using port2 is not displayed in the output of the second command?

A. It has a higher distance than the default route using port1.

B. It has a higher priority than the default route using port1.

C. It is disabled in the FortiGate configuration.

D. It has a lower priority than the default route using port1.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 2

Two independent FortiGate HA clusters are connected to the same broadcast domain. The administrator has reported that both clusters are using the same HA virtual MAC address. This creates a duplicated MAC address problem in the network. What HA setting must be changed in one of the HA clusters to fix the problem?

A. Group name.

B. Gratuitous ARPs.

C. Group ID.

D. Session pickup.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 3

Examine the following partial outputs from two routing debug commands; then answer the question below.
# get router info kernel
tab=254 vf=0 scope=0type=1 proto=11 prio=0 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=10.200.1.254 dev=2(port1) tab=254 vf=0 scope=0type=1 proto=11 prio=10 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=10.200.2.254 dev=3(port2) tab=254 vf=0 scope=253type=1 proto=2 prio=0 0.0.0.0/0.0.0.0/.->10.0.1.0/24 pref=10.0.1.254 gwy=0.0.0.0 dev=4(port3)
# get router info routing-table all s*0.0.0.0/0 [10/0] via 10.200.1.254, portl [10/0] via 10.200.2.254, port2,
[10/0] dO.0.1.0/24 is directly connected, port3 dO.200.1.0/24 is directly connected, portl d0.200.2.0/24 is directly connected, port2 Which outbound interface or interfaces will be used by this FortiGate to route web traffic from internal users to the Internet?

A. port2.

B. port3.

C. Both portl and port2.

D. port!

Discussion 0

Correct Answer: A Vote an answer

Question 4

View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

Why didn't the tunnel come up?

A. The remote gateway is using aggressive mode and the local gateway is configured to use man mode.

B. The remote gateway's phase 1 configuration does not match the local gateway's phase 1 configuration.

C. The pre-shared keys do not match.

D. The remote gateway's phase 2 configuration does not match the local gateway's phase 2 configuration.

Discussion 0

Correct Answer: B Vote an answer

Question 5

Examine the output of the 'get router info ospf neighbor' command shown in the exhibit; then answer the question below.

Which statements are true regarding the output in the exhibit? (Choose two.)

A. The interface ToRemote is OSPF network type point-to-point.

B. The OSPF routers with the IDs 0.0.0.69 and 0.0.0.117 are both designated routers for the wan1 network.

C. The local FortiGate is the backup designated router for the wan1 network.

D. The OSPF router with the ID 0.0.0.2 is the designated router for the ToRemote network.

Discussion 0

Correct Answer: A,C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 6

Examine the IPsec configuration shown in the exhibit; then answer the question below.

An administrator wants to monitor the VPN by enabling the IKE real time debug using these commands:
diagnose vpn ike log-filter src-addr4 10.0.10.1
diagnose debug application ike -1
diagnose debug enable
The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are being interchanged between both IPsec gateways. However, the IKE real time debug does NOT show any output. Why isn't there any output?

A. The log-filter setting is set incorrectly. The VPN's traffic does not match this filter.

B. The IKE real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.

C. The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.

D. The IKE real time shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.

Discussion 0

Correct Answer: A Vote an answer

Question 7

Examine the following routing table and BGP configuration; then answer the question below.

TheBGP connection is up, but the local peer is NOT advertising the prefix 192.168.1.0/24. Which configuration change will make the local peer advertise this prefix?

A. Enable the redistribution of static routers into BGP.

B. Enable the redistribution of connected routers into BGP.

C. Enable the setting ebgp-multipath.

D. Disable the setting network-import-check.

Discussion 0

Correct Answer: D Vote an answer

Question 8

View the exhibit, which contains an entry in the session table, and then answer the question below.

Which one of the following statements is true regarding FortiGate's inspection of this session?

A. FortiGate applied proxy-based inspection.

B. FortiGate applied explicit proxy-based inspection.

C. FortiGate applied flow-based inspection.

D. FortiGate forwarded this session without any inspection.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 9

Examine the output of the 'diagnose ips anomaly list' command shown in the exhibit; then answer the question below.

Which IP addresses are included in the output of this command?

A. Those whose traffic matches a DoS policy.

B. Those whose traffic exceeded a threshold of a matching DoS policy.

C. Those whose traffic was detected as an anomaly by an IPS sensor.

D. Those whose traffic matches an IPS sensor.

Discussion 0

Correct Answer: A Vote an answer

Question 10

Examine the output from the 'diagnose debug authd fsso list' command; then answer the question below.
# diagnose debug authd fsso list FSSO logons-IP: 192.168.3.1 User: STUDENT Groups:
TRAININGAD/USERS Workstation: INTERNAL2. TRAINING. LAB The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.
What should the administrator check?

A. The IP address recorded in the logon event for the user STUDENT.

B. The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2.
TRAINING. LAB.

C. The DNS name resolution for the workstation name INTERNAL2. TRAINING. LAB.

D. The reserve DNS lookup forthe IP address 192.168.3.1.

Discussion 0

Correct Answer: B Vote an answer

Fortinet NSE 7 - Enterprise Firewall 6.0 - NSE7_EFW-6.0 Exam Practice Test

Contact Us

Useful Links

Latest Updated