最新のNSE7_SDW-7.2試験のリアル試験問題 本日無料更新されました
NSE7_SDW-7.2リアル試験問題解答は更新された[2024年11月26日]
質問 # 30
Refer to the exhibit.
Which statement about the role of the ADVPN device in handling traffic is true?
- A. This is a spoke that has received a query from a remote hub and has forwarded the response to its hub.
- B. This is a hub that has received a query from a spoke and has forwarded it to another spoke.
- C. Two hubs,10.0.1.101and10.0.2.101, are receiving and forwarding queries between each other.
- D. Two spokes,192.2.0.1and10.0.2.101, forward their queries to their hubs.
正解：B
質問 # 31
Which diagnostic command can you use to show the member utilization statistics measured by performance SLAs for the last 10 minutes?
- A. diagnose sys sdwan log
- B. diagnose sys sdwan sla-log
- C. diagnose ays sdwan health-check
- D. diagnose sys sdwan intf-sla-log
正解：B
質問 # 32
Refer to the exhibits.
Exhibit A
Exhibit B
Exhibit A shows the SD-WAN performance SLA configuration, the SD-WAN rule configuration, and the application IDs of Facebook and YouTube. Exhibit B shows the firewall policy configuration and the underlay zone status.
Based on the exhibits, which two statements are correct about the health and performance of port1 and port2?
(Choose two.)
- A. FortiGate is unable to measure jitter and packet loss on Facebook and YouTube traffic.
- B. The performance is an average of the metrics measured for Facebook and YouTube traffic passing through the member.
- C. FortiGate identifies the member as dead when there is no Facebook and YouTube traffic passing through the member.
- D. Non-TCP Facebook and YouTube traffic are not used for performance measurement.
正解：B、D
解説：
Study Guide 7.2, pages 103 - 104. Another comment said "because without using application Control on the firewall policy, SDWAN can't work" but there is a app control "default" defined on config.
質問 # 33
Refer to the exhibit.
Based on the exhibit, which two actions does FortiGate perform on sessions after a firewall policy change?
(Choose two.)
- A. FortiGate terminates the old sessions.
- B. FortiGate evaluates new sessions.
- C. FortiGate flushes all sessions.
- D. FortiGate does not change existing sessions.
正解：B、D
解説：
Explanation
FortiGate not to flag existing impacted session as dirty by setting firewall-session-dirty to check new. The
results is that FortiGate evaluates only new session against the new firewall policy.
質問 # 34
Refer to the exhibit.
The exhibit shows the SD-WAN rule status and configuration.
Based on the exhibit, which change in the measured latency will make T_MPLS_0 the new preferred member?
- A. When T_INET_0_0 and T_MPLS_0 have the same latency.
- B. When T_N1PLS_0 has a latency of 80 ms.
- C. When T_INET_0_0 has a latency of 250 ms.
- D. When T_MPLS_0 has a latency of 100 ms.
正解：B
質問 # 35
Which diagnostic command can you use to show the configured SD-WAN zones and their assigned members?
- A. diagnose sys sdwan zone
- B. diagnose sys sdwan service
- C. diagnose sys sdwan interface
- D. diagnose sys sdwan member
正解：D
質問 # 36
Refer to the exhibit.
Which configuration change is required if the responder FortiGate uses a dynamic routing protocol to exchange routes over IPsec?
- A. exchange-interface-ip must be enabled.
- B. mode-cfg must be enabled.
- C. type must be set to static.
- D. add-route must be disabled.
正解：D
質問 # 37
Exhibit.
The exhibit shows the output of the command diagnose sys sdwan health-check status collected on a FortiGate device. Which two statements are correct about the health check status on this FortiGate device? (Choose two.)
- A. The interface T_INET_0 missed three SLA targets.
- B. There is no SLA criteria configured for the health-check Level3_DNS.
- C. The interface T_INET_1 missed one SLA target.
- D. The health-check VPN_PING orders the members according to the lowest jitter.
正解：B、D
解説：
According to the FortiGate / FortiOS 6.4.2 Administration Guide, the health check status command displays the status of the health check probes for each SD-WAN member interface. The output includes the following information:
* state: the current state of the interface, either alive or dead
* packet-loss: the percentage of packets lost during the health check
* latency: the average round-trip time in milliseconds
* jitter: the variation in latency
* mos: the mean opinion score, a measure of voice quality
* bandwidth: the available bandwidth in kilobits per second for each direction (up, down, bi)
* sla map: a bitmap that indicates which SLA criteria are met or failed Based on the exhibit, the following statements are correct:
* The health-check VPN_PING orders the members according to the lowest jitter. This means that the interface with the lowest jitter value is listed first, followed by the next lowest, and so on1. In the exhibit, the order is T_MPLS, T_INET_1, and T_INET_0.
* There is no SLA criteria configured for the health-check Level3_DNS. This means that the health check does not use any SLA parameters to determine the state of the interface2. In the exhibit, the sla map value is 0x0 for both port1 and port2, indicating that no SLA criteria are applied.
質問 # 38 
Exhibit B -
Exhibit A shows the system interface with the static routes and exhibit B shows the firewall policies on the
managed FortiGate.
Based on the FortiGate configuration shown in the exhibits, what issue might you encounter when creating an
SD-WAN zone for port1 and port2?
- A. port1 is referenced in a firewall policy.
- B. port2 is referenced in a static route.
- C. port1 is assigned a manual IP address.
- D. port1 and port2 are not administratively down.
正解：A
質問 # 39
Refer to the exhibits.
An administrator is testing application steering in SD-WAN. Before generating test traffic, the administrator collected the information shown in exhibit A.
After generating GoToMeeting test traffic, the administrator examined the respective traffic log on FortiAnalyzer, which is shown in exhibit B. The administrator noticed that the traffic matched the implicit SD-WAN rule, but they expected the traffic to match rule ID 1.
Which two reasons explain why the traffic matched the implicit SD-WAN rule? (Choose two.)
- A. Port1 and port2 do not have a valid route to the destination.
- B. Full SSL inspection is not enabled on the matching firewall policy.
- C. The session 3-tuple did not match any of the existing entries in the ISDB application cache.
- D. FortiGate did not refresh the routing information on the session after the application was detected.
正解：C、D
解説：
Study guide 7.2 Page 191
質問 # 40
Refer to the exhibit.
Which conclusion about the packet debug flow output is correct?
- A. The original traffic exceeded the maximum packets per second of the outgoing interface, and the packet was dropped.
- B. The reply traffic exceeded the maximum bandwidth configured in the traffic shaper, and the packet was dropped.
- C. The original traffic exceeded the maximum bandwidth of the outgoing interface, and the packet was dropped.
- D. The original traffic exceeded the maximum bandwidth configured in the traffic shaper, and the packet was dropped.
正解：D
質問 # 41
Which statement about using BGP routes in SD-WAN is true?
- A. You must use external BGP.
- B. You must configure AS path prepending.
- C. Learned routes can be used as dynamic destinations in SD-WAN rules.
- D. You must use BGP to route traffic for both overlay and underlay links.
正解：C
質問 # 42
Refer to the exhibit, which shows the IPsec phase 1 configuration of a spoke.
What must you configure on the IPsec phase 1 configuration for ADVPN to work with SD-WAN?
- A. You must enable auto-discovery-sender.
- B. You must disable idle-timeout.
- C. You must set ike-version to 1.
- D. You must enable net-device.
正解：D
質問 # 43
Which best describes the SD-WAN traffic shaping mode that bases itself on a percentage of available bandwidth?
- A. Per-IP shaping mode
- B. Reverse-policy shaping mode
- C. Interface-based shaping mode
- D. Shared-policy shaping mode
正解：C
解説：
Interface-based shaping goes further, enabling traffic controls based on percentage of the interface bandwidth.
質問 # 44
Which diagnostic command can you use to show the SD-WAN rules, interface information, and state?
- A. diagnose sys sdwan neighbor
- B. diagnose sys sdwan service
- C. diagnose sys sdwan route-tag-list
- D. diagnose sys sdwan member
正解：D
解説：
Reference:
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/818746/sd-wan-related-diagnose-commands
質問 # 45
Refer to the exhibit.
Which two statements about the IPsec VPN configuration and the status of the IPsec VPN tunnel are true?
(Choose two.)
- A. FortiGate does not install IPsec static routes for remote protected networks in the routing table. Most Voted
- B. FortiGate facilitated the negotiation of the T_INET_1_0_0 ADVPN shortcut over T_INET_1_0.
- C. The phase 1 configuration supports the network-overlay setting. Most Voted
- D. Dead peer detection is disabled.
正解：A、B
質問 # 46
Which two statements describe how IPsec phase 1 main mode is different from aggressive mode when
performing IKE negotiation? (Choose two )
- A. XAuth is enabled as an additional level of authentication, which requires a username and password.
- B. A peer ID is included in the first packet from the initiator, along with suggested security policies.
- C. The use of Diffie Hellman keys is limited by the responder and needs initiator acceptance.
- D. A total of six packets are exchanged between an initiator and a responder instead of three packets.
正解：A、D
質問 # 47
......
最新のNSE7_SDW-7.2学習ガイド2024年最新の- 提供するのはテストエンジンとPDF：https://jp.fast2test.com/NSE7_SDW-7.2-premium-file.html