合格できるFortinet NSE7_EFW-7.0のPDF問題集！最近更新された165問あります [Q85-Q103]

合格できるFortinet NSE7_EFW-7.0のPDF問題集！最近更新された165問あります

更新されたテストエンジンNSE7_EFW-7.0練習問題集と練習試験合格させます

Fortinet NSE7_EFW-7.0認定試験は、サイバーセキュリティソリューションの大手プロバイダーであるFortinetが提供する専門レベルの認定試験です。この認定試験は、エンタープライズレベルのファイアウォールテクノロジーを深く理解し、複雑なネットワークセキュリティソリューションを設計、実装、および管理できるネットワークセキュリティの専門家向けに特別に設計されています。この試験では、高レベルのセキュリティを維持しながら、Fortinet Enterpriseファイアウォールソリューションの構成、展開、管理に必要な知識とスキルを検証します。

質問 # 85
In which two states is a given session categorized as ephemeral? (Choose two.)

A. A UDP session with packets sent and received
B. A TCP session waiting for the SYN ACK
C. A UDP session with only one packet received
D. A TCP session waiting for FIN ACK

正解：B、C

質問 # 86
Refer to the exhibits.

Which contain the partial configurations of two VPNs on FortiGate.
An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovered that FortiGate is not matching the user-2 VPN for members of the Users-2 group.
Which two changes must administrator make to fix the issue? (Choose two.)

A. Change to aggressive mode on both VPNs.
B. Use different pre-shared keys on both VPNs
C. Enable Mode Config on both VPNs.
D. Set up specific peer IDs on both VPNs.

正解：A、D

解説：
To set peer-id, the VPN must be set in aggressive mode - https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-Peer-IDs-to-select-an-IPSec-dialup/ta-p/192292

質問 # 87
Examine the following partial output from a sniffer command; then answer the question below.

What is the meaning of the packets dropped counter at the end of the sniffer?

A. Number of packets that matched the sniffer filter and were dropped by the FortiGate.
B. Number of packets that didn't match the sniffer filter.
C. Number of packets that matched the sniffer filter but could not be captured by the sniffer.
D. Number of total packets dropped by the FortiGate.

正解：C

質問 # 88
Examine the IPsec configuration shown in the exhibit; then answer the question below.

An administrator wants to monitor the VPN by enabling the IKE real time debug using these commands:
diagnose vpn ike log-filter src-addr4 10.0.10.1
diagnose debug application ike -1
diagnose debug enable
The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are being interchanged between both IPsec gateways. However, the IKE real time debug does NOT show any output .
Why isn't there any output?

A. The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.
B. The IKE real time shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.
C. The IKE real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.
D. The log-filter setting is set incorrectly. The VPN's traffic does not match this filter.

正解：D

質問 # 89
View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.

The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel.
To diagnose, the administrator enters these CLI commands:

However, the IKE real time debug does not show any output .
Why ?

A. The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.
B. The log-filter setting was set incorrectly. The VPN's traffic does not match this filter.
C. The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.
D. The debug shows only error messages. If there is no output, then the tunnel is operating normally.

正解：B

質問 # 90
Examine the output of the 'diagnose sys session list expectation' command shown in the exhibit; than answer the question below.

Which statement is true regarding the session in the exhibit?

A. It is for traffic originated from the FortiGate.
B. It is for management traffic terminating at the FortiGate.
C. It was created by a session helper or ALG.
D. It was created by the FortiGate kernel to allow push updates from FotiGuard.

正解：C

質問 # 91
View the exhibit, which contains the output of get sys ha status, and then answer the question below.

Which statements are correct regarding the output? (Choose two.)

A. The HA management IP is 169.254.0.2.
B. Master is selected because it is the only device in the cluster.
C. The slave configuration is not synchronized with the master.
D. port 7 is used the HA heartbeat on all devices in the cluster.

正解：C、D

質問 # 92
Refer to the exhibit, which contains the output of a BGP debug command.

Which statement about the exhibit is true?

A. The local router BGP state is OpenConfirm with the 10.127.0.75 peer.
B. The local router has not established a TCP session with 100.64.3.1.
C. Since the counters were last reset, the 10.200.3.1 peer has never been down.
D. The local router has received a total of three BGP prefixes from all peers.

正解：B

質問 # 93
Refer to the exhibit, which contains the output of a BGP debug command.

Which statement about the exhibit is true?

A. The local router BGP state is OpenConfirm with the 10.127.0.75 peer.
B. The local router has not established a TCP session with 100.64.3.1.
C. Since the counters were last reset, the 10.200.3.1 peer has never been down.
D. The local router has received a total of three BGP prefixes from all peers.

正解：B

質問 # 94
Examine the following partial output from two system debug commands; then answer the question below.

Which of the following statements are true regarding the above outputs? (Choose two.)

A. The unit is in kernel conserve mode
B. The Cached value is always the Active value plus the Inactive value
C. The unit is running a 32-bit FortiOS
D. Kernel indirectly accesses the low memory (LowTotal) through memory paging

正解：B、C

質問 # 95
Examine the output of the 'get router info bgp summary' command shown in the exhibit; then answer the question below.

Which statements are true regarding the output in the exhibit? (Choose two.)

A. BGP state of the peer 10.125.0.60 is Established.
B. Local BGP peer has not received an OpenConfirm from 10.200.3.1.
C. BGP peer 10.200.3.1 has never been down since the BGP counters were cleared.
D. The local BGP peer has received a total of 3 BGP prefixes.

正解：A、B

質問 # 96
An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage. However, after the changes, one network application started to have problems. During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets, and before the arrival of the SYN/ACKs. When the SYN/ACK packets arrive to the FortiGate, the unit has already deleted the respective sessions .
Which TCP session timer must be increased to fix this problem?

A. TCP session time to live.
B. TCP half close.
C. TCP time wait.
D. TCP half open.

正解：D

質問 # 97
Refer to the exhibit, which shows partial outputs from two routing debug commands.

Why is the port2 default route not in the second command output?

A. The port1 default route has a lower priority value than the default route using port2.
B. The port1 default route has a lower distance than the default route using port2.
C. The port2 interface is disabled in the FortiGate configuration.
D. The port1 default route has a higher priority value than the default route using port2.

正解：B

質問 # 98
Refer to the exhibit, which contains a TCL script configuration on FortiManager.

An administrator has configured the TCL script on FortiManager, but failed to apply any changes to the managed device after being executed.
Why did the TCL script fail to make any changes to the managed device?

A. Changes in an interface configuration can only be done by CLI script.
B. The TCL command run_cmd has not been created.
C. Incomplete commands are ignored in TCL scripts.
D. The TCL script must start with #include <>.

正解：B

質問 # 99
View the exhibit, which contains a partial web filter profile configuration, and then answer the question below.

Which action will FortiGate take if a user attempts to access www.dropbox.com, which is categorized as File Sharing and Storage?

A. FortiGate will allow the connection based on the FortiGuard category based filter configuration.
B. FortiGate will exempt the connection based on the Web Content Filter configuration.
C. FortiGate will block the connection as an invalid URL.
D. FortiGate will block the connection based on the URL Filter configuration.

正解：D

解説：
fortigate does it in order Static URL -> FortiGuard - > Content -> Advanced (java, cookie removal..) so block it in first step

質問 # 100
An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage. However, after the changes, one network application started to have problems. During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets, and before the arrival of the SYN/ACKs. When the SYN/ACK packets arrive to the FortiGate, the unit has already deleted the respective sessions. Which TCP session timer must be increased to fix this problem?

A. TCP session time to live.
B. TCP half close.
C. TCP time wait.
D. TCP half open.

正解：D

解説：
http://docs-legacy.fortinet.com/fos40hlp/43prev/wwhelp/wwhimpl/common/html/wwhelp.htm?context=fgt&file=CLI_get_Commands.58.25.html The tcp-halfopen-timer controls for how long, after a SYN packet, a session without SYN/ACK remains in the table.
The tcp-halfclose-timer controls for how long, after a FIN packet, a session without FIN/ACK remains in the table.
The tcp-timewait-timer controls for how long, after a FIN/ACK packet, a session remains in the table. A closed session remains in the session table for a few seconds more to allow any out-of-sequence packet.

質問 # 101
View the exhibit, which contains the partial output of an IKE real time debug, and then answer the question below.

The administrator does not have access to the remote gateway.
Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?

A. Change phase 1 encryption to 3DES and authentication to SHA256.
B. Change phase 1 encryption to AES128 and authentication to SHA512.
C. Change phase 1 encryption to 3DES and authentication to CBC.
D. Change phase 1 encryption to AESCBC and authentication to SHA128.

正解：C

質問 # 102
Refer to the exhibit, which shows a FortiGate configuration.

An administrator is troubleshooting a web filter issue on FortiGate. The administrator has configured a web filter profile and applied it to a policy; however, the web filter is not inspecting any traffic that is passing through the policy.
What must the administrator change to fix the issue?