Labour Day Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: geek65

NSE7_EFW-7.0 Fortinet NSE 7 - Enterprise Firewall 7.0 Questions and Answers

Questions 4

View the IPS exit log, and then answer the question below.

# diagnose test application ipsmonitor 3

ipsengine exit log”

pid = 93 (cfg), duration = 5605322 (s) at Wed Apr 19 09:57:26 2017

code = 11, reason: manual

What is the status of IPS on this FortiGate?

Options:

A.

IPS engine memory consumption has exceeded the model-specific predefined value.

B.

IPS daemon experienced a crash.

C.

There are communication problems between the IPS engine and the management database.

D.

All IPS-related features have been disabled in FortiGate’s configuration.

Buy Now
Questions 5

Examine the output of the 'diagnose debug rating' command shown in the exhibit; then answer the question below.

Which statement are true regarding the output in the exhibit? (Choose two.)

Options:

A.

There are three FortiGuard servers that are not responding to the queries sent by the FortiGate.

B.

The TZ value represents the delta between each FortiGuard server's time zone and the FortiGate's time zone.

C.

FortiGate will send the FortiGuard queries to the server with highest weight.

D.

A server's round trip delay (RTT) is not used to calculate its weight.

Buy Now
Questions 6

Which statement about NGFW policy-based application filtering is true?

Options:

A.

After the application has been identified, the kernel uses only the Layer 4 header to match the traffic.

B.

The IPS security profile is the only security option you can apply to the security policy with the action set to ACCEPT.

C.

After IPS identifies the application, it adds an entry to a dynamic ISDB table.

D.

FortiGate will drop all packets until the application can be identified.

Buy Now
Questions 7

Examine the output of the ‘get router info bgp summary’ command shown in the exhibit; then answer the question below.

Which statements are true regarding the output in the exhibit? (Choose two.)

Options:

A.

BGP state of the peer 10.125.0.60 is Established.

B.

BGP peer 10.200.3.1 has never been down since the BGP counters were cleared.

C.

Local BGP peer has not received an OpenConfirm from 10.200.3.1.

D.

The local BGP peer has received a total of 3 BGP prefixes.

Buy Now
Questions 8

An administrator has configured a dial-up IPsec VPN with one phase 2, extended authentication (XAuth) and IKE mode configuration. The administrator has also enabled the IKE real time debug:

diagnose debug application ike-1

diagnose debug enable

In which order is each step and phase displayed in the debug output each time a new dial-up user is connecting to the VPN?

Options:

A.

Phase1; IKE mode configuration; XAuth; phase 2.

B.

Phase1; XAuth; IKE mode configuration; phase2.

C.

Phase1; XAuth; phase 2; IKE mode configuration.

D.

Phase1; IKE mode configuration; phase 2; XAuth.

Buy Now
Questions 9

Examine the output of the ‘get router info ospf interface’ command shown in the exhibit; then answer the question below.

Which statements are true regarding the above output? (Choose two.)

Options:

A.

The port4 interface is connected to the OSPF backbone area.

B.

The local FortiGate has been elected as the OSPF backup designated router.

C.

There are at least 5 OSPF routers connected to the port4 network.

D.

Two OSPF routers are down in the port4 network.

Buy Now
Questions 10

View the exhibit, which contains the output of a BGP debug command, and then answer the question below.

Which of the following statements about the exhibit are true? (Choose two.)

Options:

A.

For the peer 10.125.0.60, the BGP state of is Established.

B.

The local BGP peer has received a total of three BGP prefixes.

C.

Since the BGP counters were last reset, the BGP peer 10.200.3.1 has never been down.

D.

The local BGP peer has not established a TCP session to the BGP peer 10.200.3.1.

Buy Now
Questions 11

Two independent FortiGate HA clusters are connected to the same broadcast domain. The administrator has reported that both clusters are using the same HA virtual MAC address. This creates a duplicated MAC address problem in the network. What HA setting must be changed in one of the HA clusters to fix the problem?

Options:

A.

Group ID.

B.

Group name.

C.

Session pickup.

D.

Gratuitous ARPs.

Buy Now
Questions 12

Which of the following conditions must be met for a static route to be active in the routing table? (Choose three.)

Options:

A.

The next-hop IP address is up.

B.

There is no other route, to the same destination, with a higher distance.

C.

The link health monitor (if configured) is up.

D.

The next-hop IP address belongs to one of the outgoing interface subnets.

E.

The outgoing interface is up.

Buy Now
Questions 13

What is the diagnose test application ipsmonitor 99 command used for?

Options:

A.

To enable IPS bypass mode

B.

To provide information regarding IPS sessions

C.

To disable the IPS engine

D.

To restart all IPS engines and monitors

Buy Now
Questions 14

Refer to the exhibit, which shows the output of a BGP debug command.

Which statement explains why the state of the 10.200.3.1 peer is Connect?

Options:

A.

The local router has a different AS number than the remote peer.

B.

The local router is receiving BGP keepalives from the remote peer, but the local peer has not received the openConfirm yet.

C.

The local router initiated the BGP session to 10.200.3.1 but did not receive a response.

D.

The router 10.200.3.1 has authentication configured for BGP and the local router does not.

Buy Now
Questions 15

An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage. However, after the changes, one network application started to have problems. During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets, and before the arrival of the SYN/ACKs. When the SYN/ACK packets arrive to the FortiGate, the unit has already deleted the respective sessions. Which TCP session timer must be increased to fix this problem?

Options:

A.

TCP half open.

B.

TCP half close.

C.

TCP time wait.

D.

TCP session time to live.

Buy Now
Questions 16

The logs in a FSSO collector agent (CA) are showing the following error:

failed to connect to registry: PIKA1026 (192.168.12.232)

What can be the reason for this error?

Options:

A.

The CA cannot resolve the name of the workstation.

B.

The FortiGate cannot resolve the name of the workstation.

C.

The remote registry service is not running in the workstation 192.168.12.232.

D.

The CA cannot reach the FortiGate with the IP address 192.168.12.232.

Buy Now
Questions 17

View the exhibit, which contains a partial web filter profile configuration, and then answer the question below.

Which action will FortiGate take if a user attempts to access www.dropbox.com, which is categorized as File Sharing and Storage?

Options:

A.

FortiGate will exempt the connection based on the Web Content Filter configuration.

B.

FortiGate will block the connection based on the URL Filter configuration.

C.

FortiGate will allow the connection based on the FortiGuard category based filter configuration.

D.

FortiGate will block the connection as an invalid URL.

Buy Now
Questions 18

View the exhibit, which contains the output of a real-time debug, Which statement about this output is true?

Which of the following statements is true regarding this output?

Options:

A.

The requested URL belongs to category ID 255.

B.

The server hostname Is training, fortinet.com.

C.

FortiGate found the requested URL in its local cache.

D.

This web request was inspected using the ftgd-allow web filler profile.

Buy Now
Questions 19

View the exhibit, which contains the output of get sys ha status, and then answer the question below.

Which statements are correct regarding the output? (Choose two.)

Options:

A.

The slave configuration is not synchronized with the master.

B.

The HA management IP is 169.254.0.2.

C.

Master is selected because it is the only device in the cluster.

D.

port 7 is used the HA heartbeat on all devices in the cluster.

Buy Now
Questions 20

An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device.

What can the administrator do to fix this problem?

Options:

A.

Configure remote link monitoring to detect an issue in the forwarding path.

B.

Configure set send-garp-on-failover enable under config system ha on both cluster members.

C.

Verify that the speed and duplex settings match between the FortiGate interfaces and the connected switch ports.

D.

Configure set link-failed-signal enable under config system ha on both cluster members.

Buy Now
Questions 21

Examine the following traffic log; then answer the question below.

date-20xx-02-01 time=19:52:01 devname=master device_id="xxxxxxx" log_id=0100020007 type=event subtype=system pri critical vd=root service=kemel status=failure msg="NAT port is exhausted."

What does the log mean?

Options:

A.

There is not enough available memory in the system to create a new entry in the NAT port table.

B.

The limit for the maximum number of simultaneous sessions sharing the same NAT port has been reached.

C.

FortiGate does not have any available NAT port for a new connection.

D.

The limit for the maximum number of entries in the NAT port table has been reached.

Buy Now
Questions 22

View the exhibit, which contains the output of diagnose sys session stat, and then answer the question below.

Which statements are correct regarding the output shown? (Choose two.)

Options:

A.

There are 0 ephemeral sessions.

B.

All the sessions in the session table are TCP sessions.

C.

No sessions have been deleted because of memory pages exhaustion.

D.

There are 166 TCP sessions waiting to complete the three-way handshake.

Buy Now
Questions 23

What does the dirty flag mean in a FortiGate session?

Options:

A.

Traffic has been blocked by the antivirus inspection.

B.

The next packet must be re-evaluated against the firewall policies.

C.

The session must be removed from the former primary unit after an HA failover.

D.

Traffic has been identified as from an application that is not allowed.

Buy Now
Questions 24

Refer to the exhibit, which contains the debug output of diagnose dvm device list.

Which two statements about the output shown in the exhibit are correct? (Choose two.)

Options:

A.

ADOMs are disabled on the FortiManager

B.

The FortiGate configuration is in sync with latest running revision history.

C.

There are pending device-level changes yet to be installed on Local-FortiGate.

D.

The policy package has been modified for Local-FortiGate.

Buy Now
Exam Code: NSE7_EFW-7.0
Exam Name: Fortinet NSE 7 - Enterprise Firewall 7.0
Last Update: May 2, 2024
Questions: 163
NSE7_EFW-7.0 pdf

NSE7_EFW-7.0 PDF

$28  $80
NSE7_EFW-7.0 Engine

NSE7_EFW-7.0 Testing Engine

$33.25  $95
NSE7_EFW-7.0 PDF + Engine

NSE7_EFW-7.0 PDF + Testing Engine

$45.5  $130