更新されたのは2024年11月試験エンジンはNSE7_SDW-7.2無料お試しサンプルが365日更新されます
試験合格保証NSE7_SDW-7.2試験には正確な問題解答付き！
Fortinet NSE7_SDW-7.2 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 # 57
Refer to the exhibit, which shows an SD-WAN zone configuration on the FortiGate GUI.
Based on the exhibit, which statement is true?
- A. You can delete the virtual-wan-link zone because it contains no member.
- B. You can move port1 from the underlay zone to the overlay zone.
- C. The overlay zone contains four members.
- D. The corporate zone contains no member.
正解：D
解説：
Based on the exhibit, the "corporate" zone contains no member (B). In the FortiGate GUI, zones without members do not display any interfaces listed under them, which is the case for the corporate zone in the exhibit. References: This conclusion is based on standard Fortinet GUI interpretation and the operational logic of SD-WAN zones as per Fortinet's guidelines and user interface standards.
質問 # 58
Refer to the exhibit, which shows the IPsec phase 1 configuration of a spoke.
What must you configure on the IPsec phase 1 configuration for ADVPN to work with SD-WAN?
- A. You must enable auto-discovery-sender.
- B. You must disable idle-timeout.
- C. You must set ike-version to 1.
- D. You must enable net-device.
正解：D
質問 # 59
Refer to the exhibit.
The exhibit shows output of the command diagnose 3vg sdwan service collected on a FortiGate device.
The administrator wants to know through which interface FortiGate will steer the traffic from local users on subnet 10.0.1.0/255.255.255.192 and with a destination of the business application Salesforce located on HO servers 10.0.0.1.
Based on the exhibits, which two statements are correct? (Choose two.)
- A. FortiGate steers traffic for business application according to service rule 2 and steers traffic through port2.
- B. FortiGate steers traffic to HO servers according to service rule 1 and it uses port1 or port2 because both interfaces are selected.
- C. When FortiGate cannot recognize the application of the flow it steers the traffic destined to server 10.0.0.1 according to service rule 3.
- D. There is no service defined for the Salesforce application, so FortiGate will use the service rule 3 and steer the traffic through interface T_HQ1.
正解：B、C
質問 # 60
Refer to the exhibit.
FortiGate has multiple dial-up VPN interfaces incoming on port1 that match only FIRST_VPN.
Which two configuration changes must be made to both IPsec VPN interfaces to allow incoming connections to match all possible IPsec dial-up interfaces? (Choose two.)
- A. Configure the IKE mode to be aggressive mode.
- B. Specify a unique peer ID for each dial-up VPN interface.
- C. Use unique Diffie Hellman groups on each VPN interface.
- D. Use different proposals are used between the interfaces.
正解：A、B
質問 # 61
Refer to the exhibit.
The exhibit shows the BGP configuration on the hub in a hub-and-spoke topology. The administrator wants BGP to advertise prefixes from spokes to other spokes over the IPsec overlays, including additional paths.
However, when looking at the spoke routing table, the administrator does not see the prefixes from other spokes and the additional paths.
Based on the exhibit, which three settings must the administrator configure inside each BGP neighbor group so spokes can learn other spokes prefixes and their additional paths? (Choose three.)
- A. Setadvertisement-intervalto the number of additional paths to advertise
- B. Setadditional-pathtosend
- C. Enablesoft-reconfiguration
- D. Setadv-additional-pathto the number of additional paths to advertise
- E. Enableroute-reflector-client
正解：B、D、E
質問 # 62
What are two advantages of using an IPsec recommended template to configure an IPsec tunnel in an hub-and-spoke topology? (Choose two.)
- A. It guides the administrator to use Fortinet recommended settings.
- B. It automatically install IPsec tunnels to every spoke when they are added to the FortiManager ADOM.
- C. It ensures consistent settings between phase1 and phase2.
- D. The VPN monitor tool provides additional statistics for tunnels defined with an IPsec recommended template.
正解：A、C
解説：
The use of an IPsec recommended template offers the advantage of ensuring consistent settings between phase1 and phase2 (A), which is essential for the stability and security of the IPsec tunnel. Additionally, it guides the administrator to use Fortinet's recommended settings (B), which are designed to optimize performance and security based on Fortinet's best practices. References: The benefits of using IPsec recommended templates are outlined in Fortinet's SD-WAN documentation, which emphasizes the importance of consistency and adherence to recommended configurations.
質問 # 63
Refer to the exhibit.
The device exchanges routes using IBGP.
Which two statements are correct about the IBGP configuration and routing information on the device? (Choose two.)
- A. Each BGP route is three hops away from the destination.
- B. You can run the get router info routing-table database command to display the additional paths.
- C. additional-path is enabled.
- D. ibgp-multipath is disabled.
正解：B、C
質問 # 64
Refer to the exhibits.
Exhibit A
Exhibit B
Exhibit A shows an SD-WAN event log and exhibit B shows the member status and the SD-WAN rule configuration.
Based on the exhibits, which two statements are correct? (Choose two.)
- A. Port2 has a lower latency than port1.
- B. FortiGate updated the outgoing interface list on the rule so it prefers port2.
- C. Port2 has the highest member priority.
- D. SD-WAN rule ID 1 is set to lowest cost (SLA) mode.
正解：C、D
質問 # 65
Which statement is correct about SD-WAN and ADVPN?
- A. Routes for ADVPN shortcuts must be manually configured.
- B. You must use IKEv2 on IPsec tunnels.
- C. SD-WAN can steer traffic to ADVPN shortcuts, established over IPsec overlays, configured as SD-WAN members.
- D. SD-WAN does not monitor the health and performance of ADVPN shortcuts.
正解：C
質問 # 66
Which are two benefits of using CLI templates in FortiManager? (Choose two.)
- A. You can configure interfaces as SD-WAN members without having to remove references first.
- B. You can reference meta fields.
- C. You can configure FortiManager to sync local configuration changes made on the managed device, to the CLI template.
- D. You can configure advanced CLI settings.
正解：B、D
質問 # 67
Exhibit.
The exhibit shows VPN event logs on FortiGate. In the output shown in the exhibit, which statement is true?
- A. There is one shortcut tunnel built from master tunnel T_MPLS_0.
- B. There are no IPsec tunnel statistics log messages for ADVPN cuts.
- C. The master tunnel T_INET_0 cannot accept the ADVPN shortcut.
- D. The VPN tunnel T_MPLS_0 is a shortcut tunnel.
正解：A
解説：
Explanation
VPN event logs record the status of VPN tunnels, such as the establishment, termination, or failure of a tunnel.
The output includes the following information:
logid: the log ID number
type: the log type, either traffic or event
subtype: the log subtype, either vpn or ipsec
level: the log level, either error, warning, or notice
vd: the virtual domain name
logdesc: the log description
msg: the log message
action: the log action, such as tunnel-up, tunnel-down, or tunnel-stats
remip: the remote IP address
locip: the local IP address
remport: the remote port number
locport: the local port number
outintf: the outgoing interface name
cookies: the IKE SA cookies
user: the user name
group: the user group name
useralt: the alternative user name
xauthuser: the XAuth user name
authgroup: the XAuth user group name
assignip: the assigned IP address
vpntunnel: the VPN tunnel name
tunnellip: the tunnel loopback IP address
tunnelid: the tunnel ID number
tunneltype: the tunnel type, either ipsec or ssl
duration: the tunnel duration in seconds
sentbyte: the number of bytes sent
rcvdbyte: the number of bytes received
nextstat: the next statistics interval in seconds
advpnsc: the ADVPN shortcut flag, either 0 or 1
Based on the exhibit, the following statement is true:
There is one shortcut tunnel built from master tunnel T_MPLS_0. This means that the VPN tunnel
T_MPLS_0 is a master tunnel that can send ADVPN shortcut offers to other spokes, and the VPN tunnel
T_MPLS_0_0 is a shortcut tunnel that is built from the master tunnel T_MPLS_01. In the exhibit, the
log action for T_MPLS_0 is tunnel-up, and the log action for T_MPLS_0_0 is shortcut-up. The advpnsc
flag for T_MPLS_0 is 0, indicating that it is not a shortcut tunnel, while the advpnsc flag for
T_MPLS_0_0 is 1, indicating that it is a shortcut tunnel.
質問 # 68
Which CLI command do you use to perform real-time troubleshooting for ADVPN negotiation?
- A. diagnose debug application ike
- B. get ipsec tunnel list
- C. diagnose vpn tunnel list
- D. get router info routing-table all
正解：A
解説：
Explanation
IKE real-time debug - useful when debugging ADVPN shortcut messages and spoke-to-spoke negotiations.
* diagnose debug console timestamp enable
* diagnose vpn ike log filter clear
* diagnose vpn ike log filter mdst-addr4 <ip.of.hub> <ip.of.spoke>
* diagnose debug application ike -1
* diagnose debug enable
質問 # 69
Refer to the exhibit.
Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2.
Which two configuration settings are required for Toronto and London spokes to establish an ADVPN shortcut? (Choose two.)
- A. On the spokes, auto-discovery-receiver must be enabled on the IPsec VPN to the hub.
- B. On the hubs, net-device must be enabled on all IPsec VPNs.
- C. On the hubs, auto-discovery-sender must be enabled on the IPsec VPNs to spokes.
- D. auto-discovery-forwarder must be enabled on all IPsec VPNs.
正解：A、C
質問 # 70
Which two statements describe how IPsec phase 1 main mode id different from aggressive mode when performing IKE negotiation? (Choose two.)
- A. Three packets are exchanged between an initiator and a responder instead of six packets.
- B. The use of Diffie Hellman keys is limited by the responder and needs initiator acceptance.
- C. A peer ID is included in the first packet from the initiator, along with suggested security policies.
- D. XAuth is enabled as an additional level of authentication, which requires a username and password.
正解：A、C
質問 # 71
Which two statements about the SD-WAN zone configuration are true? (Choose two.)
- A. An SD-WAN member can belong to two or more zones.
- B. You can delete the default zones.
- C. Theservice-sla-tie-breaksetting enables you to configure preferred member selection based on the best
route to the destination. - D. The default zones are virtual-wan-link and SASE.
正解：C、D
質問 # 72
What are two common use cases for remote internet access (RIA)? (Choose two.)
- A. Provide internet access through the hub
- B. Provide direct internet access on spokes
- C. Provide thorough inspection on spokes
- D. Centralize security inspection on the hub
正解：A、D
解説：
Explanation
B:Provide internet access through the hub:This involves routing branch or remote office internet traffic
through a central hub, ensuring consistent security policies and possibly better management of network
resources.
C:Centralize security inspection on the hub:With this approach, all internet-bound traffic from various spokes
is inspected at the hub, leveraging centralized security mechanisms for thorough inspection and policy
enforcement.
質問 # 73
Refer to the exhibits.
Exhibit A -
Exhibit B -
Exhibit A shows a site-to-site topology between two FortiGate devices: branch1_fgt and dc1_fgt. Exhibit B shows the system global and system settings configuration on dc1_fgt.
When branch1_client establishes a connection to dc1_host, the administrator observes that, on dc1_fgt, the reply traffic is routed over T_INET_0_0, even though T_INET_1_0 is the preferred member in the matching SD-WAN rule.
Based on the information shown in the exhibits, what configuration change must be made on dc1_fgt so dc1_fgt routes the reply traffic over T_INET_1_0?
- A. Enable auxiliary-session under config system settings.
- B. Enable snat-route-change under config system global.
- C. Disable allow-subnet-overlap under config system settings.
- D. Disable t#p-session-without-syn under config system settings.
正解：A
質問 # 74
Refer to the exhibit.
Based on the exhibit, which two statements are correct about the health of the selected members? (Choose two.)
- A. During passive monitoring, FortiGate can't detect dead members.
- B. After FortiGate switches to active mode, FortiGate never fails back to passive monitoring.
- C. FortiGate can offload the traffic that is subject to passive monitoring to hardware.
- D. FortiGate passively monitors the member if TCP traffic is passing through the member.
正解：A、D
質問 # 75 
Exhibit B -
Exhibit A shows the system interface with the static routes and exhibit B shows the firewall policies on the managed FortiGate.
Based on the FortiGate configuration shown in the exhibits, what issue might you encounter when creating an SD-WAN zone for port1 and port2?
- A. port1 and port2 are not administratively down.
- B. port2 is referenced in a static route.
- C. port1 is assigned a manual IP address.
- D. port1 is referenced in a firewall policy.
正解：D
質問 # 76
Which two statements reflect the benefits of implementing the ADVPN solution to replace conventional VPN topologies? (Choose two.)
- A. It creates redundant tunnels between hub-and-spokes, in case failure takes place on the primary links.
- B. It dynamically assigns cost and weight between the hub and the spokes, based on the physical distance.
- C. It provides direct connectivity between all sites by creating on-demand tunnels between spokes.
- D. It ensures that spoke-to-spoke traffic no longer needs to flow through the tunnels through the hub.
正解：C、D
質問 # 77
Which two statements are correct when traffic matches the implicit SD-WAN rule? (Choose two.)
- A. All SD-WAN rules have the default setting enabled.
- B. Traffic does not match any of the entries in the policy route table.
- C. Traffic is load balanced using the algorithm set for the v4-ecmp-mode setting.
- D. The sdwan_service_id flag in the session information is 0.
正解：B、D
解説：
sdwan_service_id is 0 = match SD-WAN implicit rule, study guide 7.0 page 120, 7.2 page 149 SD-WAN rules internally are interpreted as a Policy route, so when the traffic doesn't match with any policy route, it will be flowing by implict policy.
質問 # 78
What are two common use cases for remote internet access (RIA)? (Choose two.)
- A. Provide internet access through the hub
- B. Provide direct internet access on spokes
- C. Provide thorough inspection on spokes
- D. Centralize security inspection on the hub
正解：A、D
解説：
B: Provide internet access through the hub: This involves routing branch or remote office internet traffic through a central hub, ensuring consistent security policies and possibly better management of network resources.
C: Centralize security inspection on the hub: With this approach, all internet-bound traffic from various spokes is inspected at the hub, leveraging centralized security mechanisms for thorough inspection and policy enforcement.
質問 # 79
Exhibit.
Which conclusion about the packet debug flow output is correct?
- A. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the firewall policy, and the packet was dropped.
- B. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
- C. The total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
- D. The packet size exceeded the outgoing interface MTU.
正解：B
解説：
In a Per-IP shaper configuration, if an IP address exceeds the configured concurrent session limit, the message "Denied by quota check" appears. SD-WAN 7.0 Study Guide page 287
質問 # 80
......
試験問題はNSE7_SDW-7.2最新版を提供するのはテストエンジン：https://jp.fast2test.com/NSE7_SDW-7.2-premium-file.html