NSE7_FSN_AR-7.6 by Fortinet Actual Free Exam Questions And Answers

Question 1

In IKEv2, which exchange establishes the first CHILD_SA?

A. INFORMATIONAL

B. IKE_AUTH

C. CREATE_CHILD_SA

D. IKE_SA_INIT

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 2

Refer to the exhibit.

A partial output of diagnose npu up6 port-list on FortiGate 2000E is shown.
An administrator is unable to analyze traffic flowing between port1 and port17 using the diagnose sniffer command.
Which two commands allow the administrator to view the traffic? (Choose two.)

A.

B.

C.

D.

Discussion 0

Correct Answer: A,D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 3

What are three key routing principles of SD-WAN? (Choose three.)

A. SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.

B. SD-WAN rules are skipped if the best route to the destination is a static route.

C. SD-WAN members are skipped if they do not have a valid route to the destination.

D. Internet Service Database (ISDB) routes have precedence over SD-WAN rules.

E. Routes to directly connected subnets always have precedence over SD-WAN rules.

Discussion 0

Correct Answer: A,C,D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 4

Exhibit.

Refer to the exhibit, which contains a screenshot of some phase 1 settings.
The VPN is not up. To diagnose the issue, the administrator enters the following CLI commands on an SSH session on FortiGate:

However, the IKE real-time debug does not show any output. Why?

A. The debug shows only error messages. If there is no output, then the phase 1 and phase 2 configurations match.

B. The administrator must also run the command diagnose debug enable.

C. The log-filter setting is incorrect. The VPN traffic does not match this filter.

D. Replace diagnose debug application ike -1 with diagnose debug application ipsec -1.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 5

Refer to the exhibit.

A revision history window at the FortiManager device layer is shown.
The IT team is trying to identify the administrator responsible for the most recent update to the FortiGate device database.
What can the IT team conclude?

A. To identify the user who created the event, in the FortiManager system logs, they must use the type=script filter in the user field.

B. The user script_manager, an API user from the Fortinet Developer Network (FDN), is retrieving a configuration.

C. To identify the user who created the event, they must view it on the Configuration and Installation widget on FortiGate at the FortiManager device layer.

D. The retrieve process was automatically triggered by a Remote FortiGate Directly (via CLI) script.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 6

Refer to the exhibit, which shows the output of a diagnose command.

What two conclusions can you draw from the output shown in the exhibit? (Choose two answers)

A. Traffic in the original direction (coming from the IP address 10.171.121.38) will be routed to the next- hop IP address 10.0.1.10.

B. Traffic in the original direction (coming from the IP address 10.171.121.38) will be routed to the next- hop IP address 10.200.1.1.

C. This is a pinhole session created to allow traffic for a protocol that requires additional sessions to operate through FortiGate.

D. This is an expected session created by the IPS engine.

Discussion 0

Correct Answer: A,C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 7

Refer to the exhibit, which shows the output of a policy route table entry.

Which type of policy route does the output show?

A. A regular policy route

B. An ISDB route

C. An SD-WAN rule

D. A regular policy route, which is associated with an active static route in the FIB

Discussion 0

Correct Answer: C Vote an answer

Question 8

What are two reasons you might see iprope_in_check() check failed, drop when using the debug flow?
(Choose two.)

A. Packet was dropped because of policy route misconfiguration.

B. Trusted host list misconfiguration.

C. Packet was dropped because of traffic shaping.

D. VIP or IP pool misconfiguration.

Discussion 0

Correct Answer: B,D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 9

Consider the scenario where the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate.
Which action will FortiGate take when using the default settings for SSL certificate inspection?

A. FortiGate uses the first entry listed in the SAN field in the server certificate.

B. FortiGate uses the SNI from the user ' s web browser.

C. FortiGate uses the CN information from the Subject field in the server certificate.

D. FortiGate closes the connection because this represents an invalid SSL/TLS configuration.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 10

Refer to the exhibit, which shows the partial output of a real-time OSPF debug.

Why are the two FortiGate devices unable to form an adjacency?

A. The two FortiGate devices attempting adjacency are in area 0.0.0.0.

B. One FortiGate device is configured to require authentication, while the other is not.

C. The Hello packet is being sent from an OSPF router with ID 0.0.0.112.

D. The passwords on the FortiGate devices do not match.

Discussion 0

Correct Answer: B Vote an answer

Question 11

Which three common FortiGate-to-collector-agent connectivity issues can you identify using the FSSO real- time debug? (Choose three.)

A. Refused connection. Potential mismatch of TCP port.

B. Log is full on the collector agent.

C. Incompatible collector agent software version.

D. Mismatched pre-shared password.

E. Inability to reach IP address of the collector agent.

Discussion 0

Correct Answer: A,D,E Vote an answer

Fortinet NSE 7 - Secure Networking 7.6 Architect - NSE7_FSN_AR-7.6 Exam Practice Test

Contact Us

Useful Links

Latest Updated