無料更新されたFortinet NSE7_SDW-7.2テストエンジン問題には99問あります
ベストな問題集を使おうNSE 7 Network Security Architect NSE7_SDW-7.2専門試験問題
Fortinet NSE7_SDW-7.2 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 # 55
Refer to the exhibits.
Exhibit A shows two IPsec templates to define Branch_IPsec_1 and Branch_IPsec_2. Each template defines a VPN tunnel.
Exhibit B shows the error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device.
Which statement best explain the cause for this issue?
- A. You can assign only one IPsec template to each FortiGate device.
- B. You can assign only one template with a tunnel of fype static to each FortiGate device
- C. You should review the branch1_fgt configuration for the already configured tunnel with the name HUB1-VPN2.
- D. You can define only one IPsec tunnel from branch devices to HUB1.
正解：A
解説：
The error message in Exhibit B indicates a conflicting template assignment. This occurs because FortiManager does not allow the assignment of multiple IPsec templates that define VPN tunnels with the same name or settings to the same FortiGate device. The conflict arises from trying to assign a second IPsec template to a device that already has one assigned.References:This is based on Fortinet's best practices and administrative guidelines which state that each FortiGate device should be assigned a unique IPsec template to avoid configuration conflicts.
質問 # 56
Refer to the exhibits.
Exhibit A -
Exhibit B -
Exhibit A shows a site-to-site topology between two FortiGate devices: branch1_fgt and dc1_fgt. Exhibit B shows the system global and system settings configuration on dc1_fgt.
When branch1_client establishes a connection to dc1_host, the administrator observes that, on dc1_fgt, the reply traffic is routed over T_INET_0_0, even though T_INET_1_0 is the preferred member in the matching SD-WAN rule.
Based on the information shown in the exhibits, what configuration change must be made on dc1_fgt so dc1_fgt routes the reply traffic over T_INET_1_0?
- A. Disable allow-subnet-overlap under config system settings.
- B. Enable auxiliary-session under config system settings.
- C. Enable snat-route-change under config system global.
- D. Disable tp-session-without-syn under config system settings.
正解：D
質問 # 57
Refer to the exhibit.
Based on the exhibit, which two actions does FortiGate perform on traffic passing through port2? (Choose two.)
- A. FortiGate flushes all routing information from the session table, after a route change.
- B. FortiGate always blocks all traffic, after a route change.
- C. FortiGate does not change the routing information on existing sessions that use a valid gateway, after a route change.
- D. FortiGate performs routing lookups for new sessions only, after a route change.
正解：C、D
質問 # 58
Refer to the exhibit.
Which statement about the role of the ADVPN device in handling traffic is true?
- A. Two hubs, 10.0.1.101 and 10.0.2.101, are receiving and forwarding queries between each other.
- B. This is a spoke that has received a query from a remote hub and has forwarded the response to its hub.
- C. Two spokes, 192.2.0.1 and 10.0.2.101, forward their queries to their hubs.
- D. This is a hub that has received a query from a spoke and has forwarded it to another spoke.
正解：D
質問 # 59
Refer to the exhibit.
The exhibit shows output of the command diagnose 3vg sdwan service collected on a FortiGate device.
The administrator wants to know through which interface FortiGate will steer the traffic from local users on subnet 10.0.1.0/255.255.255.192 and with a destination of the business application Salesforce located on HO servers 10.0.0.1.
Based on the exhibits, which two statements are correct? (Choose two.)
- A. FortiGate steers traffic for business application according to service rule 2 and steers traffic through port2.
- B. When FortiGate cannot recognize the application of the flow it steers the traffic destined to server 10.0.0.1 according to service rule 3.
- C. FortiGate steers traffic to HO servers according to service rule 1 and it uses port1 or port2 because both interfaces are selected.
- D. There is no service defined for the Salesforce application, so FortiGate will use the service rule 3 and steer the traffic through interface T_HQ1.
正解：B、C
質問 # 60
Refer to the exhibit.
Based on the output shown in the exhibit, which two criteria on the SD-WAN member configuration can be used to select an outgoing interface in an SD-WAN rule? (Choose two.)
- A. Set cost 15.
- B. Set source 100.64.1.1.
- C. Set load-balance-mode source-ip-ip-based.
- D. Set priority 10.
正解：A、D
質問 # 61
Which diagnostic command can you use to show the SD-WAN rules, interface information, and state?
- A. diagnose sys sdwan member
- B. diagnose sys sdwan service
- C. diagnose sys sdwan neighbor
- D. diagnose sys sdwan route-tag-list
正解：A
解説：
Reference:
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/818746/sd-wan-related-diagnose-commands
質問 # 62
Exhibit.
The exhibit shows the output of the command diagnose sys sdwan health-check status collected on a FortiGate device. Which two statements are correct about the health check status on this FortiGate device? (Choose two.)
- A. The interface T_INET_0 missed three SLA targets.
- B. There is no SLA criteria configured for the health-check Level3_DNS.
- C. The interface T_INET_1 missed one SLA target.
- D. The health-check VPN_PING orders the members according to the lowest jitter.
正解：B、D
解説：
According to the FortiGate / FortiOS 6.4.2 Administration Guide, the health check status command displays the status of the health check probes for each SD-WAN member interface. The output includes the following information:
state: the current state of the interface, either alive or dead
packet-loss: the percentage of packets lost during the health check
latency: the average round-trip time in milliseconds
jitter: the variation in latency
mos: the mean opinion score, a measure of voice quality
bandwidth: the available bandwidth in kilobits per second for each direction (up, down, bi) sla map: a bitmap that indicates which SLA criteria are met or failed Based on the exhibit, the following statements are correct:
The health-check VPN_PING orders the members according to the lowest jitter. This means that the interface with the lowest jitter value is listed first, followed by the next lowest, and so on1. In the exhibit, the order is T_MPLS, T_INET_1, and T_INET_0.
There is no SLA criteria configured for the health-check Level3_DNS. This means that the health check does not use any SLA parameters to determine the state of the interface2. In the exhibit, the sla map value is 0x0 for both port1 and port2, indicating that no SLA criteria are applied.
質問 # 63
Refer to the exhibit.
Which configuration change is required if the responder FortiGate uses a dynamic routing protocol to exchange routes over IPsec?
- A. exchange-interface-ip must be enabled.
- B. type must be set to static.
- C. mode-cfg must be enabled.
- D. add-route must be disabled.
正解：D
質問 # 64
Which components make up the secure SD-WAN solution?
- A. Datacenter, branch offices, and public cloud
- B. Telephone, ISDN, and telecom network.
- C. FortiGate, FortiManager, FortiAnalyzer, and FortiDeploy
- D. Application, antivirus, and URL, and SSL inspection
正解：C
質問 # 65
Refer to the exhibit.
Which statement explains the output shown in the exhibit?
- A. FortiGate must re-evaluate the session due to routing change.
- B. FortiGate performed standard FIB routing on the session.
- C. FortiGate will not re-evaluate the session following a firewall policy change.
- D. FortiGate used192.2.0.1as the gateway for the original direction of the traffic.
正解：A
解説：
Explanation
The snat-route-change option is enabled by default. This option enables FortiGate to re-evaluate the routing
table and select a new egress interface if the next hop IP address changes. This option only applies to sessions
in the dirty state. Sessions in the log state are not affected by routing changes.
質問 # 66
Exhibit.
Which conclusion about the packet debug flow output is correct?
- A. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the firewall policy, and the packet was dropped.
- B. The total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
- C. The packet size exceeded the outgoing interface MTU.
- D. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
正解：D
解説：
In a Per-IP shaper configuration, if an IP address exceeds the configured concurrent session limit, the message
"Denied by quota check" appears. SD-WAN 7.0 Study Guide page 287
質問 # 67
What are two advantages of using an IPsec recommended template to configure an IPsec tunnel in a
hub-and-spoke topology? (Choose two.)
- A. VPN monitor tool provides additional statistics for tunnels defined with an IPsec recommended
template. - B. IPsec recommended template guides the administrator to use Fortinet recommended settings.
- C. FortiManager automatically installs IPsec tunnels to every spoke when they are added to the
FortiManager ADOM. - D. IPsec recommended template ensures consistent settings between phase1 and phase2
正解：B、C
解説：
Explanation
According to the SD-WAN 7.2 Study Guide, IPsec recommended templates are designed to simplify the
configuration of IPsec tunnels in a hub-and-spoke topology. They have the following advantages:
FortiManager automatically installs IPsec tunnels to every spoke when they are added to the
FortiManager ADOM. This reduces the manual effort and ensures that all spokes have the same
configuration.
IPsec recommended template guides the administrator to use Fortinet recommended settings, such as
encryption algorithms, key lifetimes, and dead peer detection. This ensures optimal performance and
security of the IPsec tunnels.
質問 # 68
Refer to the exhibit, which shows the IPsec phase 1 configuration of a spoke.
What must you configure on the IPsec phase 1 configuration for ADVPN to work with SD-WAN?
- A. You must enable auto-discovery-sender.
- B. You must set ike-version to 1.
- C. You must disable idle-timeout.
- D. You must enable net-device.
正解：D
質問 # 69
Refer to the exhibit.
FortiGate has multiple dial-up VPN interfaces incoming on port1 that match only FIRST_VPN.
Which two configuration changes must be made to both IPsec VPN interfaces to allow incoming connections to match all possible IPsec dial-up interfaces? (Choose two.)
- A. Use different proposals are used between the interfaces.
- B. Use unique Diffie Hellman groups on each VPN interface.
- C. Specify a unique peer ID for each dial-up VPN interface.
- D. Configure the IKE mode to be aggressive mode.
正解：C、D
質問 # 70
Which type statements about the SD-WAN members are true? (Choose two.)
- A. Interfaces of type VLAN can be used as SD-WAN members.
- B. An SD-WAN member can belong to two or more SD-WAN zones.
- C. You can manually define the SD-WAN members sequence number.
- D. Interfaces of type virtual wire pair can be used as SD-WAN members.
正解：A、C
解説：
SD-WAN members can be manually ordered by changing their sequence number (A), which allows administrators to prioritize the interfaces according to the routing requirements. Also, VLAN interfaces can be used as SD-WAN members (C), providing flexibility in network design and the use of existing VLAN infrastructure within the SD-WAN setup.
質問 # 71
Refer to the exhibit.
Based on the exhibit, which two statements are correct about the health of the selected members? (Choose two.)
- A. FortiGate can offload the traffic that is subject to passive monitoring to hardware.
- B. After FortiGate switches to active mode, FortiGate never fails back to passive monitoring.
- C. FortiGate passively monitors the member if TCP traffic is passing through the member.
- D. During passive monitoring, FortiGate can't detect dead members.
正解：C、D
質問 # 72
......
100%の合格率を試そう！更新されたのはNSE7_SDW-7.2試験問題 [2024年更新]：https://jp.fast2test.com/NSE7_SDW-7.2-premium-file.html