Access To Free Fortinet NSE7_EFW-7.0 Real Questions With Verified Answers

test2022-08-24T03:58:59+00:00

If you are looking for Fortinet NSE7_EFW-7.0 exam preparation, Fortinet NSE7_EFW-7.0 Real Questions offered by FreeTestShare are the best one for you! You can get real Fortinet NSE7_EFW-7.0 Real Questions With Verified Answers which cover 100% real exam objectives to help you for your success! You can pass the Fortinet NSE 7 – Enterprise Firewall 7.0 exam easily in a week only with FreeTestShare NSE7_EFW-7.0 Real Questions! If you are preparing or planning on NSE7_EFW-7.0 exam, you can try these NSE7_EFW-7.0 sample exam questions to see if you are ready for the real exam.

Try these NSE7_EFW-7.0 actual exam questions and answers for free.

Page 1 of 3

1. Refer to the exhibit, which contains partial outputs from two routing debug commands.

Why is the port2 default route not in the second command's output?

It has a higher priority value than the default route using port1.

It is disabled in the FortiGate configuration.

It has a lower priority value than the default route using port1.

It has a higher distance than the default route using port1.

2. Which two statements about OCVPN are true? (Choose two.)

Only root vdom supports OCVP

OCVPN supports static and dynamic IPs in WAN interface.

OCVPN offers only Hub-Spoke VPNs.

FortiGate devices under different FortiCare accounts can be used to form OCVP

3. Examine the following partial outputs from two routing debug commands; then answer the question below:

Why the default route using port2 is not displayed in the output of the second command?

It has a lower priority than the default route using port1.

It has a higher priority than the default route using port1.

It has a higher distance than the default route using port1.

It is disabled in the FortiGate configuration.

4. Examine the following partial outputs from two routing debug commands; then answer the question below.

# get router info kernel

tab=254 vf=0 scope=0type=1 proto=11 prio=0 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=10.200.1.254 dev=2(port1)

tab=254 vf=0 scope=0type=1 proto=11 prio=10 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=10.200.2.254 dev=3(port2)

tab=254 vf=0 scope=253type=1 proto=2 prio=0 0.0.0.0/0.0.0.0/.->10.0.1.0/24 pref=10.0.1.254 gwy=0.0.0.0 dev=4(port3)

# get router info routing-table all s*0.0.0.0/0 [10/0] via 10.200.1.254, portl [10/0] via 10.200.2.254, port2, [10/0] dO.0.1.0/24 is directly connected, port3 dO.200.1.0/24 is directly connected, portl d0.200.2.0/24 is directly connected, port2

Which outbound interface or interfaces will be used by this FortiGate to route web traffic from internal users to the Internet?

port!

port2.

Both portl and port2.

port3.

5. Refer to the exhibit, which contains the output of get system ha status.

Which two statements about the output are true? (Choose two.)

The slave configuration is synchronized with the master.

port7 is used as the HA heartbeat on all devices in the cluster.

Master is selected based on the priority configured under config system ha.

The HA management IP is 169.254.0.2.

6. View the exhibit, which contains the output of a diagnose command, and then answer the question below.

What statements are correct regarding the output? (Choose two.)

This is an expected session created by a session helper.

Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.0.1.10.

Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.200.1.1.

This is an expected session created by an application control profile.

7. When does a RADIUS server send an Access-Challenge packet?

The server does not have the user credentials yet.

The server requires more information from the user, such as the token code for two-factor authentication.

The user credentials are wrong.

The user account is not found in the server.

8. A corporate network allows Internet Access to FSSO users only. The FSSO user student does not have Internet access after successfully logged into the Windows AD network. The output of the ‘diagnose debug authd fsso list’ command does not show student as an active FSSO user. Other FSSO users can access the Internet without problems .

What should the administrator check? (Choose two.)

The user student must not be listed in the CA’s ignore user list.

The user student must belong to one or more of the monitored user groups.

The student workstation’s IP subnet must be listed in the CA’s trusted list.

At least one of the student’s user groups must be allowed by a FortiGate firewall policy.

9. In which two states is a given session categorized as ephemeral? (Choose two.)

A TCP session waiting to complete the three-way handshake.

A TCP session waiting for FIN AC

A UDP session with packets sent and received.

A UDP session with only one packet received.

10. Which two statements about an auxiliary session are true? (Choose two.)

With the auxiliary session setting enabled, ECMP traffic is accelerated to the NP6 processor.

With the auxiliary session setting enabled, two sessions will be created in case of routing change.

With the auxiliary session setting disabled, for each traffic path, FortiGate will use the same auxiliary session.

With the auxiliary session disabled, only auxiliary sessions will be offloaded.

Page 2 of 3

11. What is the diagnose test application ipsmonitor 99 command used for?

To enable IPS bypass mode

To provide information regarding IPS sessions

To disable the IPS engine

To restart all IPS engines and monitors

12. Which two configuration settings change the behavior for content-inspected traffic while FortiGate is in conserve mode? (Choose two.)

IPS failopen

mem failopen

AV failopen

UTM failopen

13. Examine the output of the ‘get router info bgp summary’ command shown in the exhibit; then answer the question below.

Which statement can explain why the state of the remote BGP peer 10.200.3.1 is Connect?

The local peer is receiving the BGP keepalives from the remote peer but it has not received any BGP prefix yet.

The TCP session for the BGP connection to 10.200.3.1 is down.

The local peer has received the BGP prefixed from the remote peer.

The local peer is receiving the BGP keepalives from the remote peer but it has not received the OpenConfirm yet.

14. Which two statements about bulk configuration changes made using FortiManager CLI scripts are correct? (Choose two.)

When run on the Device Database, you must use the installation wizard to apply the changes to the managed FortiGate device.

When run on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.

When run on the All FortiGate in ADOM, changes are automatically installed without the creation of a new revision history.

When run on the Policy Package, ADOM database, changes are applied directly to the managed FortiGate device.

15. Refer to the exhibit, which contains the output of a BGP debug command.

Which statement about the exhibit is true?

The local router has received a total of three BGP prefixes from all peers.

The local router has not established a TCP session with 100.64.3.1.

Since the counters were last reset, the 10.200.3.1 peer has never been down.

The local router BGP state is OpenConfirm with the 10.127.0.75 peer.

16. Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)

Preview pending configuration changes for managed devices.

Add devices to FortiManager.

Import policy packages from managed devices.

Install configuration changes to managed devices.

Import interface mappings from managed devices.

17. A FortiGate's portl is connected to a private network. Its port2 is connected to the Internet. Explicit web proxy is enabled in port1 and only explicit web proxy users can access the Internet. Web cache is NOT enabled. An internal web proxy user is downloading a file from the Internet via HTTP .

Which statements are true regarding the two entries in the FortiGate session table related with this traffic? (Choose two.)

Both session have the local flag on.

The destination IP addresses of both sessions are IP addresses assigned to FortiGate's interfaces.

One session has the proxy flag on, the other one does not.

One of the sessions has the IP address of port2 as the source IP address.

18. View the exhibit, which contains the partial output of an IKE real time debug, and then answer the question below.

The administrator does not have access to the remote gateway.

Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?

Change phase 1 encryption to AESCBC and authentication to SHA128.

Change phase 1 encryption to 3DES and authentication to CB

Change phase 1 encryption to AES128 and authentication to SHA512.

Change phase 1 encryption to 3DES and authentication to SHA256.

19. View the exhibit, which contains the output of a web diagnose command, and then answer the question below.

Which one of the following statements explains why the cache statistics are all zeros?

The administrator has reallocated the cache memory to a separate process.

There are no users making web requests.

The FortiGuard web filter cache is disabled in the FortiGate’s configuration.

FortiGate is using a flow-based web filter and the cache applies only to proxy-based inspection.

20. A FortiGate is configured as an explicit web proxy. Clients using this web proxy are reposting DNS errors when accessing any website.

The administrator executes the following debug commands and observes that the n-dns-timeout counter is increasing:

What should the administrator check to fix the problem?

The connectivity between the FortiGate unit and the DNS server.

The connectivity between the client workstations and the DNS server.

That DNS traffic from client workstations is allowed by the explicit web proxy policies.

That DNS service is enabled in the explicit web proxy interface.

Page 3 of 3

21. View the exhibit, which contains the output of a BGP debug command, and then answer the question below.

Which of the following statements about the exhibit are true? (Choose two.)

The local router's BGP state is Established with the 10.125.0.60 peer.

Since the counters were last reset; the 10.200.3.1 peer has never been down.

The local router has received a total of three BGP prefixes from all peers.

The local router has not established a TCP session with 100.64.3.1.

22. View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.

The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel.

To diagnose, the administrator enters these CLI commands:

However, the IKE real time debug does not show any output .

Why ?

The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.

The log-filter setting was set incorrectly. The VPN’s traffic does not match this filter.

The debug shows only error messages. If there is no output, then the tunnel is operating normally.

The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.

23. Examine the following traffic log; then answer the question below.

date-20xx-02-01 time=19:52:01 devname=master device_id="xxxxxxx"

log_id=0100020007 type=event subtype=system pri critical vd=root service=kemel status=failure msg="NAT port is exhausted."

What does the log mean?

There is not enough available memory in the system to create a new entry in the NAT port table.

The limit for the maximum number of simultaneous sessions sharing the same NAT port has been reached.

FortiGate does not have any available NAT port for a new connection.

The limit for the maximum number of entries in the NAT port table has been reached.

24. Examine the output from the 'diagnose debug authd fsso list' command; then answer the question below.

diagnose debug authd fsso list ―FSSO logons-IP: 192.168.3.1 User: STUDENT Groups: TRAININGAD/USERS Workstation: INTERNAL2. TRAINING. LAB The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.

What should the administrator check?

The IP address recorded in the logon event for the user STUDEN

The DNS name resolution for the workstation name INTERNAL2. TRAININ

The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2. TRAININ

The reserve DNS lookup forthe IP address 192.168.3.1.

25. View the IPS exit log, and then answer the question below.

# diagnose test application ipsmonitor 3

ipsengine exit log”

pid = 93 (cfg), duration = 5605322 (s) at Wed Apr19 09:57:26 2017

code = 11, reason: manual

What is the status of IPS on this FortiGate?

IPS engine memory consumption has exceeded the model-specific predefined value.

IPS daemon experienced a crash.

There are communication problems between the IPS engine and the management database.

All IPS-related features have been disabled in FortiGate’s configuration.

26. A FortiGate device has the following LDAP configuration:

The LDAP user student cannot authenticate.

The exhibit shows the output of the authentication real time debug while testing the student account:

Based on the above output, what FortiGate LDAP settings must the administer check? (Choose two.)

cnid.

username.

password.

dn.

27. An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer.

If the administrator knows that there is no NAT device located between both FortiGates, what command should the administrator execute?

diagnose sniffer packet any ‘udp port 500’

diagnose sniffer packet any ‘udp port 4500’

diagnose sniffer packet any ‘esp’

diagnose sniffer packet any ‘udp port 500 or udp port 4500’

28. Which two conditions must be met for a statistic route to be active in the routing table? (Choose two.)

The link health monitor (if configured) is up.

There is no other route, to the same destination, with a higher distance.

The outgoing interface is up.

The next-hop IP address is up.

29. A FortiGate device has the following LDAP configuration:

The administrator executed the ‘dsquery’ command in the Windows LDAp server 10.0.1.10, and got the following output:

>dsquery user Csamid administrator

“CN=Administrator, CN=Users, DC=trainingAD, DC=training, DC=lab”

Based on the output, what FortiGate LDAP setting is configured incorrectly?

cnid.

username.

password.

dn.