最新のFortinet NSE7_SDW-7.2試験問題解答がズラリ
NSE7_SDW-7.2試験練習テスト問題（更新された99問あります)
質問 # 58
Exhibit.
The exhibit shows VPN event logs on FortiGate. In the output shown in the exhibit, which statement is true?
- A. There are no IPsec tunnel statistics log messages for ADVPN cuts.
- B. The master tunnel T_INET_0 cannot accept the ADVPN shortcut.
- C. The VPN tunnel T_MPLS_0 is a shortcut tunnel.
- D. There is one shortcut tunnel built from master tunnel T_MPLS_0.
正解：D
解説：
VPN event logs record the status of VPN tunnels, such as the establishment, termination, or failure of a tunnel.
The output includes the following information:
logid: the log ID number
type: the log type, either traffic or event
subtype: the log subtype, either vpn or ipsec
level: the log level, either error, warning, or notice
vd: the virtual domain name
logdesc: the log description
msg: the log message
action: the log action, such as tunnel-up, tunnel-down, or tunnel-stats remip: the remote IP address locip: the local IP address remport: the remote port number locport: the local port number outintf: the outgoing interface name cookies: the IKE SA cookies user: the user name group: the user group name useralt: the alternative user name xauthuser: the XAuth user name authgroup: the XAuth user group name assignip: the assigned IP address vpntunnel: the VPN tunnel name tunnellip: the tunnel loopback IP address tunnelid: the tunnel ID number tunneltype: the tunnel type, either ipsec or ssl duration: the tunnel duration in seconds sentbyte: the number of bytes sent rcvdbyte: the number of bytes received nextstat: the next statistics interval in seconds advpnsc: the ADVPN shortcut flag, either 0 or 1 Based on the exhibit, the following statement is true:
There is one shortcut tunnel built from master tunnel T_MPLS_0. This means that the VPN tunnel T_MPLS_0 is a master tunnel that can send ADVPN shortcut offers to other spokes, and the VPN tunnel T_MPLS_0_0 is a shortcut tunnel that is built from the master tunnel T_MPLS_01. In the exhibit, the log action for T_MPLS_0 is tunnel-up, and the log action for T_MPLS_0_0 is shortcut-up. The advpnsc flag for T_MPLS_0 is 0, indicating that it is not a shortcut tunnel, while the advpnsc flag for T_MPLS_0_0 is 1, indicating that it is a shortcut tunnel.
質問 # 59
Exhibit.
Which conclusion about the packet debug flow output is correct?
- A. The total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions
configured in the traffic shaper, and the packet was dropped. - B. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions
configured in the firewall policy, and the packet was dropped. - C. The packet size exceeded the outgoing interface MTU.
- D. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions
configured in the traffic shaper, and the packet was dropped.
正解：D
解説：
Explanation
In a Per-IP shaper configuration, if an IP address exceeds the configured concurrent session limit, the message
"Denied by quota check" appears.SD-WAN 7.0 Study Guide page 287
質問 # 60
Which two tasks are part of using central VPN management? (Choose two.)
- A. You can configure full mesh, star, and dial-up VPN topologies.
- B. You configure VPN communities to define common IPsec settings shared by all VPN gateways.
- C. FortiManager installs VPN settings on both managed and external gateways.
- D. You must enable VPN zones for SD-WAN deployments.
正解：A、B
質問 # 61
Refer to the exhibit.
Which conclusion about the packet debug flow output is correct?
- A. The original traffic exceeded the maximum packets per second of the outgoing interface, and the packet was dropped.
- B. The reply traffic exceeded the maximum bandwidth configured in the traffic shaper, and the packet was dropped.
- C. The original traffic exceeded the maximum bandwidth configured in the traffic shaper, and the packet was dropped.
- D. The original traffic exceeded the maximum bandwidth of the outgoing interface, and the packet was dropped.
正解：C
質問 # 62
Refer to the exhibits.
Exhibit A shows two IPsec templates to define Branch_IPsec_1 and Branch_IPsec_2. Each template defines a VPN tunnel.
Exhibit B shows the error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device.
Which statement best explain the cause for this issue?
- A. You can define only one IPsec tunnel from branch devices to HUB1.
- B. You should review the branch1_fgt configuration for the already configured tunnel with the name HUB1-VPN2.
- C. You can assign only one template with a tunnel of fype static to each FortiGate device
- D. You can assign only one IPsec template to each FortiGate device.
正解：D
解説：
The error message in Exhibit B indicates a conflicting template assignment. This occurs because FortiManager does not allow the assignment of multiple IPsec templates that define VPN tunnels with the same name or settings to the same FortiGate device. The conflict arises from trying to assign a second IPsec template to a device that already has one assigned. References: This is based on Fortinet's best practices and administrative guidelines which state that each FortiGate device should be assigned a unique IPsec template to avoid configuration conflicts.
質問 # 63
Exhibit.
The exhibit shows VPN event logs on FortiGate. In the output shown in the exhibit, which statement is true?
- A. There are no IPsec tunnel statistics log messages for ADVPN cuts.
- B. The master tunnel T_INET_0 cannot accept the ADVPN shortcut.
- C. The VPN tunnel T_MPLS_0 is a shortcut tunnel.
- D. There is one shortcut tunnel built from master tunnel T_MPLS_0.
正解：D
解説：
VPN event logs record the status of VPN tunnels, such as the establishment, termination, or failure of a tunnel. The output includes the following information:
logid: the log ID number
type: the log type, either traffic or event
subtype: the log subtype, either vpn or ipsec
level: the log level, either error, warning, or notice
vd: the virtual domain name
logdesc: the log description
msg: the log message
action: the log action, such as tunnel-up, tunnel-down, or tunnel-stats remip: the remote IP address locip: the local IP address remport: the remote port number locport: the local port number outintf: the outgoing interface name cookies: the IKE SA cookies user: the user name group: the user group name useralt: the alternative user name xauthuser: the XAuth user name authgroup: the XAuth user group name assignip: the assigned IP address vpntunnel: the VPN tunnel name tunnellip: the tunnel loopback IP address tunnelid: the tunnel ID number tunneltype: the tunnel type, either ipsec or ssl duration: the tunnel duration in seconds sentbyte: the number of bytes sent rcvdbyte: the number of bytes received nextstat: the next statistics interval in seconds advpnsc: the ADVPN shortcut flag, either 0 or 1 Based on the exhibit, the following statement is true:
There is one shortcut tunnel built from master tunnel T_MPLS_0. This means that the VPN tunnel T_MPLS_0 is a master tunnel that can send ADVPN shortcut offers to other spokes, and the VPN tunnel T_MPLS_0_0 is a shortcut tunnel that is built from the master tunnel T_MPLS_01. In the exhibit, the log action for T_MPLS_0 is tunnel-up, and the log action for T_MPLS_0_0 is shortcut-up. The advpnsc flag for T_MPLS_0 is 0, indicating that it is not a shortcut tunnel, while the advpnsc flag for T_MPLS_0_0 is 1, indicating that it is a shortcut tunnel.
質問 # 64
Refer to the exhibit.
Which statement explains the output shown in the exhibit?
- A. FortiGate used 192.2.0.1 as the gateway for the original direction of the traffic.
- B. FortiGate will not re-evaluate the session following a firewall policy change.
- C. FortiGate must re-evaluate the session due to routing change.
- D. FortiGate performed standard FIB routing on the session.
正解：C
解説：
The snat-route-change option is enabled by default. This option enables FortiGate to re-evaluate the routing table and select a new egress interface if the next hop IP address changes. This option only applies to sessions in the dirty state. Sessions in the log state are not affected by routing changes.
質問 # 65
Refer to the exhibits.
Exhibit A shows the SD-WAN rule status and the learned BGP routes with community 65000:10.
Exhibit B shows the SD-WAN rule configuration, the BGP neighbor configuration, and the route map configuration.
The administrator wants to steer corporate traffic using routes tags in the SD-WAN rule ID 1.
However, the administrator observes that the corporate traffic does not match the SD-WAN rule ID 1.
Based on the exhibits, which configuration change is required to fix issue?
- A. In SD-WAN rule ID 1, change the destination to use ISDB entries.
- B. In the dcl-lab-rm route map configuration, unset match-community.
- C. In the dcl-lab-rm route map configuration, set set-route-tag to 10.
- D. In the BGP neighbor configuration, apply the route map dcl-lab-rm in the outbound direction.
正解：D
質問 # 66
Refer to the exhibit.
Which statement about the role of the ADVPN device in handling traffic is true?
- A. Two spokes,192.2.0.1and10.0.2.101, forward their queries to their hubs.
- B. Two hubs,10.0.1.101and10.0.2.101, are receiving and forwarding queries between each other.
- C. This is a spoke that has received a query from a remote hub and has forwarded the response to its hub.
- D. This is a hub that has received a query from a spoke and has forwarded it to another spoke.
正解：D
質問 # 67
Refer to the exhibits.
Exhibit A -
Exhibit B -
Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SD-WAN member status, the
routing table, and the performance SLA status.
If port2 is detected dead by FortiGate, what is the expected behavior?
- A. FortiGate removes all static routes for port2.
- B. Host 8.8.8.8 is reachable through port1 and port2.
- C. The administrator manually restores the static routes for port2, if port2 becomes alive.
- D. Port2 becomes alive after three successful probes are detected.
正解：A
解説：
Explanation
This is due to Update static route is enable which removes the static route entry referencing the interface if the
interface is dead
質問 # 68
Refer to the exhibit.
Which two SD-WAN template member settings support the use of FortiManager meta fields? (Choose two.)
- A. Gateway IP
- B. Cost
- C. Interface member
- D. Priority
正解：A、C
質問 # 69
Refer to the exhibit.
Based on the output, which two conclusions are true? (Choose two.)
- A. The SD-WAN rules take precedence over regular policy routes.
- B. Theall_rulesrule represents the implicit SD-WAN rule.
- C. Entry1(id=1)is a regular policy route.
- D. There is more than one SD-WAN rule configured.
正解：C、D
質問 # 70
Refer to the exhibits.
Exhibit A shows the packet duplication rule configuration, the SD-WAN zone status output, and the sniffer output on FortiGate acting as the sender. Exhibit B shows the sniffer output on a FortiGate acting as the receiver.
The administrator configured packet duplication on both FortiGate devices. The sniffer output on the sender FortiGate shows that FortiGate forwards an ICMP echo request packet over three overlays, but it only receives one reply packet through T_INET_1_0.
Based on the output shown in the exhibits, which two reasons can cause the observed behavior? (Choose two.)
- A. On the sender FortiGate, duplication-max-num is set to 3.
- B. The ICMP echo request packets received over T_INET_0_0 and T_MPLS_0 were offloaded to NPU.
- C. On the receiver FortiGate, packet-de-duplication is enabled.
- D. The ICMP echo request packets sent over T_INET_0_0 and T_MPLS_0 were dropped along the way.
正解：A、C
質問 # 71
Refer to the exhibit, which shows the IPsec phase 1 configuration of a spoke.
What must you configure on the IPsec phase 1 configuration for ADVPN to work with SD-WAN?
- A. You must disable idle-timeout.
- B. You must enable auto-discovery-sender.
- C. You must set ike-version to 1.
- D. You must enable net-device.
正解：D
質問 # 72 
Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2. The administrator configured ADVPN on both hub-and-spoke groups.
Which two outcomes are expected if a user in Toronto sends traffic to London? (Choose two.)
- A. The first packets from Toronto to London are routed through Hub 1 then to Hub 2.
- B. Traffic from Toronto to London triggers the dynamic negotiation of a direct site-to-site VPN.
- C. Toronto needs to establish a site-to-site tunnel with Hub 2 to bypass Hub 1.
- D. London generates an IKE information message that contains the Toronto public IP address.
正解：A、B
質問 # 73
Which best describes the SD-WAN traffic shaping mode that bases itself on a percentage of available bandwidth?
- A. Interface-based shaping mode
- B. Shared-policy shaping mode
- C. Reverse-policy shaping mode
- D. Per-IP shaping mode
正解：A
解説：
Interface-based shaping goes further, enabling traffic controls based on percentage of the interface bandwidth.
質問 # 74
Exhibit.
Which conclusion about the packet debug flow output is correct?
- A. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
- B. The total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
- C. The packet size exceeded the outgoing interface MTU.
- D. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the firewall policy, and the packet was dropped.
正解：A
解説：
In a Per-IP shaper configuration, if an IP address exceeds the configured concurrent session limit, the message "Denied by quota check" appears. SD-WAN 7.0 Study Guide page 287
質問 # 75
Which two conclusions for traffic that matches the traffic shaper are true? (Choose two.)
- A. The measured bandwidth is less than 100 KBps.
- B. The traffic shaper drops packets if the bandwidth exceeds 6250 KBps.
- C. The traffic shaper drops packets if the bandwidth is less than 2500 KBps.
- D. The traffic shaper limits the bandwidth of each source IP to a maximum of 6250 KBps.
正解：A、B
質問 # 76
Refer to the exhibit.
Which statement about the role of the ADVPN device in handling traffic is true?
- A. Two spokes, 192.2.0.1 and 10.0.2.101, forward their queries to their hubs.
- B. Two hubs, 10.0.1.101 and 10.0.2.101, are receiving and forwarding queries between each other.
- C. This is a spoke that has received a query from a remote hub and has forwarded the response to its hub.
- D. This is a hub that has received a query from a spoke and has forwarded it to another spoke.
正解：D
質問 # 77
Which diagnostic command can you use to show the SD-WAN rules, interface information, and state?
- A. diagnose sys sdwan route-tag-list
- B. diagnose sys sdwan neighbor
- C. diagnose sys sdwan member
- D. diagnose sys sdwan service
正解：C
解説：
Reference:
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/818746/sd-wan-related-diagnose-commands
質問 # 78
......
あなたを合格させるFortinet試験にはNSE7_SDW-7.2試験問題集：https://jp.fast2test.com/NSE7_SDW-7.2-premium-file.html