お手軽NSE7_EFW-7.2問題集PDFのベスト問題集を使おう！高得点目指すならここ
NSE 7 Network Security Architect NSE7_EFW-7.2試験と認定テストエンジン
Fortinet NSE7_EFW-7.2 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 # 27
Refer to the exhibit, which shows a routing table.
What two options can you configure in OSPF to block the advertisement of the 10.1.10.0 prefix? (Choose two.)
- A. Disable Redistribute Connected
- B. Configure a distribute-list-out
- C. Configure a route-map out
- D. Remove the 16.1.10.C prefix from the OSPF network
正解：B、C
解説：
To block the advertisement of the 10.1.10.0 prefix in OSPF, you can configure a distribute-list-out or a route- map out. A distribute-list-out is used to filter outgoing routing updates from being advertised to OSPF neighbors1. A route-map out can also be used for filtering and is applied to outbound routing updates2. References := Technical Tip: Inbound route filtering in OSPF usi ... - Fortinet Community, OSPF | FortiGate / FortiOS 7.2.2 - Fortinet Documentation
質問 # 28
Exhibit.
Refer to the exhibit, which contains the partial interface configuration of two FortiGate devices.
Which two conclusions can you draw from this con figuration? (Choose two)
- A. 10.1.5.254 is the default gateway of the internal network
- B. By default FortiGate B is the primary virtual router
- C. On failover new primary device uses the same MAC address as the old primary
- D. The VRRP domain uses the physical MAC address of the primary FortiGate
正解：C、D
解説：
The configuration shows that VRRP (Virtual Router Redundancy Protocol) is enabled and both FortiGates have the vrrp-virtual-mac enable command, meaning they share the same MAC address. The primary FortiGate uses its physical MAC address as indicated by the set type physical command. The priority value determines which FortiGate is the primary virtual router, and in this case, FortiGate-A has a higher priority than FortiGate-B, so it is the primary by default. The IP address 10.1.5.254 is the virtual IP address of the VRRP group, not the default gateway of the internal network. Reference: You can find more information about VRRP configuration and troubleshooting in the following Fortinet Enterprise Firewall 7.2 documents:
VRRP
Technical Tip: FortiGate VRRP configuration and debug
Configuration Example: How to configure VRRP between a FortiGate and a Cisco router
質問 # 29
You created a VPN community using VPN Manager on FortiManager. You also added gateways to the VPN community. Now you are trying to create firewall policies to permit traffic over the tunnel however, the VPN interfaces do not appear as available options.
- A. Create interface mappings for the IPsec VPN interfaces before you use them in a policy.
- B. install the VPN community and gateway configuration on the fortiGate devices so that the VPN interfaces appear on the Policy Objects on fortiManager.
- C. Refresh the device status using the Device Manager so that FortiGate populates the IPSec interfaces
- D. Configure the phase 1 settings in the VPN community that you didnt initially configure. FortiGate automatically generates the interfaces after you configure the required settings
正解：B
解説：
To use the VPN interfaces in a policy, you need to install the VPN community and gateway configuration on the FortiGate devices first. This will create the VPN interfaces on the FortiGate and sync them with FortiManager. Reference:
Creating IPsec VPN communities
VPN | FortiGate / FortiOS 7.2.0
質問 # 30
Which two statements about bfd are true? (Choose two)
- A. You must configure n globally only
- B. It works for OSPF and BGP
- C. You can disable it at the protocol level
- D. It can support neighbor only over the next hop in BGP
正解：B、C
解説：
BFD (Bidirectional Forwarding Detection) is a protocol that can quickly detect failures in the forwarding path between two adjacent devices. You can disable BFD at the protocol level by using the "set bfd disable" command under the OSPF or BGP configuration. BFD works for both OSPF and BGP protocols, as well as static routes and SD-WAN rules. Reference := BFD | FortiGate / FortiOS 7.2.0 - Fortinet Document Library, section "BFD".
質問 # 31
You contoured an address object on the tool fortiGate in a Security Fabric. This object is not synchronized with a downstream device. Which two reasons could be the cause? (Choose two)
- A. The address object on the tool FortiGate has fabric-object set to disable
- B. The downstream TortiGate has fabric-object-unification set to local
- C. The root FortiGate has configuration-sync set to enable
- D. The downstream FortiGate has configuration-sync set to local
正解：A、B
解説：
* Option A is correct because the address object on the tool FortiGate will not be synchronized with the downstream devices if it has fabric-object set to disable. This option controls whether the address object is shared with other FortiGate devices in the Security Fabric or not1.
* Option C is correct because the downstream FortiGate will not receive the address object from the tool FortiGate if it has fabric-object-unification set to local. This option controls whether the downstream FortiGate uses the address objects from the root FortiGate or its own local address objects2.
* Option B is incorrect because the root FortiGate has configuration-sync set to enable by default, which means that it will synchronize the address objects with the downstream devices unless they are disabled by the fabric-object option3.
* Option D is incorrect because the downstream FortiGate has configuration-sync set to local by default, which means that it will receive the address objects from the root FortiGate unless they are overridden by the fabric-object-unification option4. References: =
* 1: Group address objects synchronized from FortiManager5
* 2: Security Fabric address object unification6
* 3: Configuration synchronization7
* 4: Configuration synchronization7
* : Security Fabric - Fortinet Documentation
質問 # 32
Refer to the exhibit, which shows a network diagram.
Which IPsec phase 2 configuration should you impalement so that only one remote site is connected at any time?
- A. Set net-device to enable
- B. Set single-source to enable
- C. Set route-overlap to either use-new or use-old
- D. Set route-overlap to allow.
正解：C
解説：
To ensure that only one remote site is connected at any given time in an IPsec VPN scenario, you should use route-overlap with the option to either use-new or use-old. This setting dictates which routes are preferred and how overlaps in routes are handled, allowing for one connection to take precedence over the other (C).
References:
* FortiOS Handbook - IPsec VPN
質問 # 33
You want to block access to the website ww.eicar.org using a custom IPS signature.
Which custom IPS signature should you configure?
- A.
- B.
- C.
- D.
正解：B
解説：
Option D is the correct answer because it specifically blocks access to the website "www.eicar.org" using TCP protocol and HTTP service, which are commonly used for web browsing. The other options either use the wrong protocol (UDP), the wrong service (DNS or SSL), or the wrong pattern ("eicar" instead of "www.eicar.org"). Reference := Configuring custom signatures | FortiGate / FortiOS 7.4.0 - Fortinet Document Library, section "Signature to block access to example.com".
質問 # 34
You want to configure faster failure detection for BGP.
Which parameter should you enable on both connected FortiGate devices?
- A. Distribute-list-in
- B. bfd
- C. Graceful-restart
- D. Ebgp-enforce-multihop
正解：B
解説：
BFD (Bidirectional Forwarding Detection) is a protocol that provides fast failure detection for BGP by sending periodic messages to verify the connectivity between two peers1. BFD can be enabled on both connected FortiGate devices by using the command set bfd enable under the BGP configuration2. References:
= Technical Tip : FortiGate BFD implementation and examples ..., Configure BGP | FortiGate / FortiOS 7.0.2
- Fortinet Documentation
質問 # 35
Refer to the exhibit, which shows a network diagram.
Which IPsec phase 2 configuration should you impalement so that only one remote site is connected at any time?
- A. Set net-device to enable
- B. Set route-overlap to either use-new or use-old
- C. Set single-source to enable
- D. Set route-overlap to allow.
正解：C
解説：
The "single-source" option ensures that only one remote site is connected at any time, which aligns with the requirement in the question. This option prevents multiple VPN tunnels from being established between the same source and destination networks, and allows only the most recent tunnel to be active. This can be useful for scenarios where multiple remote sites have the same IP address range, as shown in the exhibit. Reference := Fortinet Enterprise Firewall Study Guide for FortiOS 7.2, page 142.
質問 # 36
Which ADVPN configuration must be configured using a script on fortiManager, when using VPN Manager to manage fortiGate VPN tunnels?
- A. Enable AD-VPN in IPsec phase 1
- B. Set protected network to all
- C. Disable add-route on hub
- D. Configure IP addresses on IPsec virtual interlaces
正解：A
解説：
To enable AD-VPN, you need to edit an SD-WAN overlay template and enable the Auto-Discovery VPN toggle. This will automatically add the required settings to the IPsec template and the BGP template. You cannot enable AD-VPN directly in the IPsec phase 1 settings using VPN Manager. Reference := ADVPN | FortiManager 7.2.0 - Fortinet Documentation
質問 # 37
Exhibit.
Refer to the exhibit, which contains the partial ADVPN configuration of a spoke.
Which two parameters must you configure on the corresponding single hub? (Choose two.)
- A. Set auto-discovery-forwarder enable
- B. Set auto-discovery-receiver enable
- C. Set auto-discovery-sender enable
- D. Set ike-version 2
正解：A、C
解説：
For an ADVPN spoke configuration shown, the corresponding hub must haveauto-discovery-senderenabled to send shortcut advertisement messages to the spokes. Also, the hub would need to have auto-discovery-forwarderenabled if it is to forward on those shortcut advertisements to other spokes. This allows the hub to inform all spokes about the best path to reach each other. Theike-versiondoes not need to be reconfigured on the hub if it's already set to version 2 andauto-discovery-receiveris not necessary on the hub because it's the one sending the advertisements, not receiving.
References:
* FortiOS Handbook - ADVPN
質問 # 38
Refer to the exhibit, which shows config system central-management information.
Which setting must you configure for the web filtering feature to function?
- A. Configure server-type with the rating option.
- B. Set update-server-location to automatic.
- C. Configure securewf.fortiguard. net on the default servers.
- D. Add server. fortiguard. net to the server list.
正解：A
解説：
For the web filtering feature to function effectively, the FortiGate device needs to have a server configured for rating services. The rating option in the server-type setting specifies that the server is used for URL rating lookup, which is essential for web filtering. The displayed configuration does not list any FortiGuard web filtering servers, which would be necessary for web filtering. The setting set include-default-servers disable indicates that the default FortiGuard servers are not being used, and hence, a specific server for web filtering (like securewf.fortiguard.net) needs to be configured.
質問 # 39
Which two statements about IKE vision 2 are true? (Choose two.)
- A. Phase 1 includes main mode
- B. It supports the extensible authentication protocol (EAP)
- C. It supports the XAuth protocol.
- D. It exchanges a minimum of four messages to establish a secure tunnel
正解：B、D
質問 # 40
Which two statements about the Security fabric are true? (Choose two.)
- A. Only the root FortiGate sends logs to FortiAnalyzer
- B. FortiGate uses the FortiTelemetry protocol to communicate with FortiAnatyzer.
- C. Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer
- D. Only FortiGate devices with configuration-sync receive and synchronize global CMDB objects that the toot FortiGate sends
正解：B、C
解説：
FortiGate uses the FortiTelemetry protocol to communicate with FortiAnalyzer and other Security Fabric devices to exchange information such as device status, network topology, and security events1. Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer, where it can be viewed and analyzed2. Reference: = Security Fabric - Fortinet Documentation, Fortinet Security Fabric for Securing Digital Innovations
質問 # 41
After enabling IPS you receive feedback about traffic being dropped.
What could be the reason?
- A. Traffic-submit is set to disable
- B. Fail-open is set to disable
- C. IPS is configured to monitor
- D. Np-accel-mode is set to enable
正解：B
解説：
Fail-open is a feature that allows traffic to pass through the IPS sensor without inspection when the sensor fails or is overloaded. If fail-open is set to disable, traffic will be dropped in such scenarios1. Reference: = IPS | FortiGate / FortiOS 7.2.3 - Fortinet Documentation
質問 # 42
After enabling IPS you receive feedback about traffic being dropped.
What could be the reason?
- A. Traffic-submit is set to disable
- B. Fail-open is set to disable
- C. IPS is configured to monitor
- D. Np-accel-mode is set to enable
正解：B
解説：
Fail-open is a feature that allows traffic to pass through the IPS sensor without inspection when the sensor fails or is overloaded. If fail-open is set to disable, traffic will be dropped in such scenarios1. References:
= IPS | FortiGate / FortiOS 7.2.3 - Fortinet Documentation
When IPS (Intrusion Prevention System) is configured, iffail-openis set to disable, it means that if the IPS engine fails, traffic will not be allowed to pass through, which can result in traffic being dropped (D). This is in contrast to a fail-open setting, which would allow traffic to bypass the IPS engine if it is not operational.
質問 # 43
Refer to the exhibit, which shows an ADVPN network.
Which VPN phase 1 parameters must you configure on the hub for the ADVPN feature to function? (Choose two.)
- A. set auto-discovery-forwarder enable
- B. set auto-discovery-receiver enable
- C. set add-route enable
- D. set auto-discovery-sender enable
正解：A、B
解説：
For the ADVPN feature to function properly on the hub, the following phase 1 parameters must be configured:
A: set auto-discovery-forwarder enable: This enables the hub to forward shortcut information to the spokes, which is essential for them to establish direct tunnels.
C: set auto-discovery-receiver enable: This allows the hub to receive shortcut offers from the spokes.
This information is corroborated by the Fortinet documentation, which explains that in an ADVPN setup, the hub must be able to both forward and receive shortcut information for dynamic tunnel creation between spokes.
質問 # 44
Exhibit.
Refer to exhibit, which shows a central management configuration
Which server will FortiGate choose for web filler rating requests if 10.0.1.240 is experiencing an outage?
- A. 10.0.1.243
- B. 10.0.1.244
- C. 10.0.1.242
- D. Public FortiGuard servers
正解：B
解説：
In the event of an outage at 10.0.1.240, the FortiGate will choose the next server in the sequence for web filter rating requests, which is 10.0.1.244 according to the configuration shown in the exhibit. This is because the server list is ordered by priority, and the server with the lowest priority number is chosen first. If that server is unavailable, the next server with the next lowest priority number is chosen, and so on. The public FortiGuard servers are only used if the include-default-servers option is enabled and all the custom servers are unavailable. References := Fortinet Enterprise Firewall Study Guide for FortiOS 7.2, page 132.
質問 # 45
Refer to the exhibit, which contains a partial BGP combination.
You want to configure a loopback as the OGP source.
Which two parameters must you set in the BGP configuration? (Choose two)
- A. recursive-next-hop
- B. ebgp-enforce-multihop
- C. update-source
- D. ibgp-enfoce-multihop
正解：B、C
解説：
To configure a loopback as the BGP source, you need to set the "ebgp-enforce-multihop" and "update-source" parameters in the BGP configuration. The "ebgp-enforce-multihop" allows EBGP connections to neighbor routers that are not directly connected, while "update-source" specifies the IP address that should be used for the BGP session1. References := BGP on loopback, Loopback interface, Technical Tip: Configuring EBGP Multihop Load-Balancing, Technical Tip: BGP routes are not installed in routing table with loopback as update source
質問 # 46
Exhibit.
Refer to exhibit, which shows a central management configuration
Which server will FortiGate choose for web filler rating requests if 10.0.1.240 is experiencing an outage?
- A. 10.0.1.243
- B. 10.0.1.244
- C. 10.0.1.242
- D. Public FortiGuard servers
正解：B
解説：
In the event of an outage at 10.0.1.240, the FortiGate will choose the next server in the sequence for web filter rating requests, which is 10.0.1.244 according to the configuration shown in the exhibit. This is because the server list is ordered by priority, and the server with the lowest priority number is chosen first. If that server is unavailable, the next server with the next lowest priority number is chosen, and so on. The public FortiGuard servers are only used if the include-default-servers option is enabled and all the custom servers are unavailable. Reference := Fortinet Enterprise Firewall Study Guide for FortiOS 7.2, page 132.
質問 # 47
Exhibit.
Refer to the exhibit, which shows a partial web filter profile conjuration What can you cone udo from this configuration about access to www.facebook, com, which is categorized as Social Networking?
- A. The access is blocked based on the Content Filter configuration
- B. The access is blocked based on the URL Filter configuration
- C. The access is allowed based on the FortiGuard Category Based Filter configuration
- D. The access is hocked if the local or the public FortiGuard server does not reply
正解：B
解説：
The access to www.facebook.com is blocked based on the URL Filter configuration. In the exhibit, it shows that the URL "www.facebook.com" is specifically set to "Block" under the URL Filter section1. Reference := Fortigate: How to configure Web Filter function on Fortigate, Web filter | FortiGate / FortiOS 7.0.2 | Fortinet Document Library, FortiGate HTTPS web URL filtering ... - Fortinet ... - Fortinet Community
質問 # 48
......
無料提供中のNSE7_EFW-7.2試験問題集で（2025年最新のPDF問題集）信頼度の高いNSE7_EFW-7.2テストエンジン：https://jp.fast2test.com/NSE7_EFW-7.2-premium-file.html