合格させるNSE 7 Network Security Architect NSE7_EFW-6.4テスト問題集で[2022年03月11日] 更新された117問あります [Q26-Q49]

合格させるNSE 7 Network Security Architect NSE7_EFW-6.4テスト問題集で[2022年03月11日] 更新された117問あります

Fortinet NSE7_EFW-6.4実際の問題と100%カバー率でリアル試験問題

質問 26
View the exhibit, which contains an entry in the session table, and then answer the question below.

Which one of the following statements is true regarding FortiGate's inspection of this session?

A. FortiGate forwarded this session without any inspection.
B. FortiGate applied proxy-based inspection.
C. FortiGate applied flow-based inspection.
D. FortiGate applied explicit proxy-based inspection.

正解: B

解説:
https://kb.fortinet.com/kb/viewContent.do?externalId=FD30042

質問 27
A FortiGate device has the following LDAP configuration:

The LDAP user student cannot authenticate. The exhibit shows the output of the authentication real time debug while testing the student account:

Based on the above output, what FortiGate LDAP settings must the administer check? (Choose two.)

A. username.
B. dn.
C. cnid.
D. password.

正解: A,D

解説:
https://kb.fortinet.com/kb/viewContent.do?externalId=13141

質問 28
A FortiGate device has the following LDAP configuration:

The administrator executed the 'dsquery' command in the Windows LDAp server 10.0.1.10, and got the following output:
>dsquery user -samid administrator
"CN=Administrator, CN=Users, DC=trainingAD, DC=training, DC=lab"
Based on the output, what FortiGate LDAP setting is configured incorrectly?

A. password.
B. username.
C. dn.
D. cnid.

正解: B

解説:
https://kb.fortinet.com/kb/viewContent.do?externalId=FD37516

質問 29
View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

Why didn't the tunnel come up?

A. The remote gateway is using aggressive mode and the local gateway is configured to use man mode.
B. The pre-shared keys do not match.
C. The remote gateway's phase 1 configuration does not match the local gateway's phase 1 configuration.
D. The remote gateway's phase 2configuration does not match the local gateway's phase 2 configuration.

正解: C

質問 30
View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.

The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel. To diagnose, the administrator enters these CLI commands:

However, the IKE real time debug does not show any output. Why?

A. The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.
B. The debug shows only error messages. If there is no output, then the tunnel is operating normally.
C. The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.
D. The log-filter setting was set incorrectly. The VPN's traffic does not match this filter.

正解: D

質問 31
View the following FortiGate configuration.

All traffic to theInternet currently egresses from port1. The exhibit shows partial session information for Internet traffic from a user on the internal network:

If the priority on route ID 1 were changed from 5 to 20, what would happen to traffic matching that user's session?

A. The session would remain in the session table, and its traffic would still egress from port1.
B. The session would remain in thesession table, and its traffic would start to egress from port2.
C. The session would be deleted, so the client would need to start a new session.
D. The session would remain in the session table, but its traffic would now egress from both port1 and port2.

正解: A

解説:
Explanation
http://kb.fortinet.com/kb/documentLink.do?externalID=FD40943

質問 32
Two independent FortiGate HA clusters are connected to the same broadcast domain. The administrator has reported that both clusters are using the same HA virtual MAC address. This creates a duplicated MAC address problem in the network. What HA setting must be changed in one of the HA clusters to fix the problem?

A. Group name.
B. Gratuitous ARPs.
C. Session pickup.
D. Group ID.

正解: D

解説:
Explanation
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-high-availability-52/HA_failoverVMAC.htm

質問 33
Which of the following conditions must be met fora static route to be active in the routing table? (Choose three.)

A. There is no other route, to the same destination, with a higher distance.
B. The outgoing interface is up.
C. The next-hop IP address is up.
D. The next-hop IP address belongs to one of the outgoing interface subnets.
E. The link health monitor (if configured) is up.

正解: B,D,E

解説:
Explanation
A configured static route only goes to routing table from routing database when all the following are met :
* The outgoing interface is up
* There isno other matching route with a lower distance
* The link health monitor (if configured) is successful
* The next-hop IP address belongs to one of the outgoing interface subnets

質問 34
View the exhibit, which contains the output of a BGP debug command, and then answer the question below.

Which ofthe following statements about the exhibit are true? (Choose two.)

A. The local router has not established a TCP session with 100.64.3.1.
B. The local router's BGP state is Established with the 10.125.0.60 peer.
C. Since the counters were last reset; the 10.200.3.1 peer has never been down.
D. The local router has received atotal of three BGP prefixes from all peers.

正解: A,B

質問 35
Examine the following partial output from a sniffer command; then answer the question below.

What is the meaning of the packets dropped counter at the end of the sniffer?

A. Number of packets that didn't match the sniffer filter.
B. Number of total packets dropped by the FortiGate.
C. Number of packets that matched the sniffer filter but could not be captured by the sniffer.
D. Number of packets that matched the sniffer filter and were dropped by the FortiGate.

正解: C

解説:
https://kb.fortinet.com/kb/documentLink.do?externalID=11655

質問 36
Four FortiGate devices configured for OSPF connected to the same broadcast domain. The first unit is elected as the designated router The second unit is elected as the backup designated router Under normal operation, how many OSPFfull adjacencies are formed to each of the other two units?

A. 0
B. 1
C. 2
D. 3

正解: C

質問 37
Examine the following partialoutput from a sniffer command; then answer the question below.

What is the meaning of the packets dropped counter at the end of the sniffer?

A. Number of packets that didn't match the sniffer filter.
B. Number of total packets dropped by the FortiGate.
C. Number of packets that matched the sniffer filter but could not be captured by the sniffer.
D. Number of packets that matched the sniffer filter and were dropped by the FortiGate.

正解: C

解説:
Explanation
https://kb.fortinet.com/kb/documentLink.do?externalID=11655

質問 38
What global configuration setting changes the behavior for content-inspected traffic while FortiGate is in system conserve mode?

A. ips-failopen
B. utm-failopen
C. mem-failopen
D. av-failopen

正解: D

解説:
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-security-profiles-54/Other_Profile_Considerations/Conserve%20mode.htm

質問 39
An administrator has configured a FortiGate device with two VDOMs: root and internal. The administrator has also created and inter-VDOM link that connects both VDOMs. The objective is to have each VDOM advertise some routes to the other VDOM via OSPF through the inter-VDOM link. What OSPF configuration settings must match in both VDOMs to have the OSPF adjacency successfully forming? (Choose three.)

A. OSPF interface area.
B. OSPF interface cost.
C. OSPF interface MTU.
D. Interface subnet mask.
E. Router ID.

正解: A,C,D

質問 40
View the exhibit, which contains a session entry, and then answer the question below.

Which statement is correct regarding this session?

A. It is a TCP session in CLOSE_WAIT state from 10.1.10.10 to 10.200.1.1.
B. It is an ICMP session from 10.1.10.10 to 10.200.5.1.
C. It is a TCP session in ESTABLISHED state from 10.1.10.10 to 10.200.5.1.
D. It is an ICMP session from 10.1.10.10 to 10.200.1.1.

正解: B

質問 41
Refer to the exhibit, which contains partial output from an IKE real-time debug.

Which two statements about this debug output are correct? (Choose two.)

A. The initiator provided remote as its IPsec peer ID.
B. It shows a phase 1 negotiation.
C. The remote gateway IP address is 10.0.0.1.
D. The negotiation is using AES128 encryption with CBC hash.

正解: A,B

質問 42
Examine the output of the 'diagnose sys session list expectation' command shown in the exhibit; than answer the question below.

Which statement is true regarding the session in the exhibit?

A. It is for managementtraffic terminating at the FortiGate.
B. It was created by a session helper or ALG.
C. It is for traffic originated from the FortiGate.
D. It was created by the FortiGate kernel to allow push updates from FotiGuard.

正解: B

質問 43
Which of the following conditions must be met for a static route to be active in the routing table? (Choose three.)

A. There is no other route, to the same destination, with a higher distance.
B. The outgoing interface is up.
C. The next-hop IP address is up.
D. The next-hop IP address belongs to one of the outgoing interface subnets.
E. The link health monitor (if configured) is up.

正解: B,D,E

解説:
A configured static route only goes to routing table from routing database when all the following are met :
The outgoing interface is up
There is no other matching route with a lower distance
The link health monitor (if configured) is successful
The next-hop IP address belongs to one of the outgoing interface subnets

質問 44
Which two statements about bulk configuration changes made using FortiManager CLI scripts are correct? (Choose two.)

A. When run on the Device Database, you must use the installation wizard to apply the changes to the managed FortiGate device.
B. When run on the All FortiGate in ADOM, changes are automatically installed without the creation of a new revision history.
C. When run on the Policy Package, ADOM database, changes are applied directly to the managed FortiGate device.
D. When run on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.

正解: A,D

質問 45
Examine the following routing table and BGP configuration; then answer the question below.

TheBGP connection is up, but the local peer is NOT advertising the prefix 192.168.1.0/24. Which configuration change will make the local peer advertise this prefix?

A. Disable the setting network-import-check.
B. Enable the redistribution of static routers into BGP.
C. Enable the setting ebgp-multipath.
D. Enable the redistribution of connected routers into BGP.

正解: A

質問 46
View the exhibit, which contains the output of diagnose sys session list, and then answer the question below.

If the HA ID for the primary unit is zero (0), which statement is correct regarding the output?

A. The inspection of this session has been offloaded to the slave unit.
B. This session is for HA heartbeat traffic.
C. This session is synced with the slave unit.
D. This session cannot be synced with the slave unit.

正解: C

質問 47
Examine the IPsec configuration shown in the exhibit; then answer the question below.

An administrator wants to monitor the VPN by enabling theIKE real time debug using these commands:
diagnose vpn ike log-filter src-addr4 10.0.10.1
diagnose debug application ike -1
diagnose debug enable
The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are beinginterchanged between both IPsec gateways. However, the IKE real time debug does NOT show any output. Why isn't there any output?

A. The log-filter setting is set incorrectly. The VPN's traffic does not match this filter.
B. The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.
C. The IKE real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.
D. The IKE real time shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.

正解: A

質問 48
Examine the output of the 'diagnose sys session list expectation' command shown in the exhibit; than answer the question below.

Which statement is true regarding the session in the exhibit?