素晴らしいNSE7_SDW-6.4試験問題集試そうNSE7_SDW-6.4問題集PDF [Q18-Q36]

素晴らしいNSE7_SDW-6.4試験問題集試そうNSE7_SDW-6.4問題集PDF

NSE7_SDW-6.4問題集PDFでNSE7_SDW-6.4リアル試験問題解答

Fortinet NSE 7 - SD-WAN 6.4 試験は、セキュアな SD-WAN テクノロジーとその組織に提供するメリットについて深い理解を持つ個人を対象としています。この認定を取得することにより、候補者は、セキュアな SD-WAN ソリューションを設計、展開、構成、および管理する能力を証明します。

Fortinet NSE7_SDW-6.4試験は、SD-WAN技術および関連するセキュリティ機能の深い理解を必要とする厳格で難しい試験です。試験に合格した候補者は、SD-WANソリューションを展開、構成、およびトラブルシューティングし、サイバー脅威からネットワークを保護するためのセキュリティベストプラクティスを実装する能力を証明します。

質問 # 18
Which statement about using BGP routes in SD-WAN is true?

A. You must use external BGP.
B. You must use BGP to route traffic for both overlay and underlay links.
C. Learned routes can be used as dynamic destinations in SD-WAN rules.
D. You must configure AS path prepending.

正解：C

質問 # 19
Which two tasks about using central VPN management are true? (Choose two.)

A. You configure VPN communities to define common IPsec settings shared by all VPN gateways.
B. You must enable VPN zones for SD-WAN deployments.
C. FortiManager installs VPN settings on both managed and external gateways.
D. You can configure full mesh, star, and dial-up VPN topologies.

正解：A、D

質問 # 20
Which two benefits from using forward error correction (FEC) in IPsec VPNs are true? (Choose two.)

A. FEC transmits additional packets as redundant data to the remote device.
B. FEC transmits the original payload in full to recover the error in transmission.
C. FEC reduces the stress on the remote device buffer to reconstruct packet loss.
D. FEC improves reliability, which overcomes adverse WAN conditions such as noisy links.

正解：A、D

質問 # 21
Which diagnostic command can you use to show the SD-WAN rules interface information and state?

A. diagnose sys virtual-wan-link service
B. diagnose sys virtual-wan-link neighbor.
C. diagnose sys virtual-wan-link member.
D. diagnose sys virtual-wan-link route-tag-list

正解：A

質問 # 22
Refer to the exhibit.

What must you configure to enable ADVPN?

A. ADVPN should only be enabled on unmanaged FortiGate devices.
B. On the hub VPN, only the device needs additional phase one settings.
C. The protected subnets should be set to address object to all (0.0.0.0/0).
D. Each VPN device has a unique pre-shared key configured separately on phase one.

正解：D

解説：
Explanation/Reference:

質問 # 23
Refer to the exhibit.

FortiGate has multiple dial-up VPN interfaces incoming on portl that match only FIRSTJVPN.
Which two configuration changes must be made to both IPsec
VPN interfaces to allow incoming connections to match all possible IPsec dial-up interfaces? (Choose two )

A. Configure the IKE mode to be aggressive mode
B. Configure a unique peer ID for each dial-up VPN interface
C. Use different proposals are used between the interfaces.
D. Use unique Diffie Hellman groups on each VPN interface

正解：A、B

質問 # 24
Which statement defines how a per-IP traffic shaper of 10 Mbps is applied to the entire network?

A. The 10 Mbps bandwidth is shared equally among the IP addresses.
B. FortiGate allocates each IP address a maximum 10 Mbps of bandwidth.
C. A single user uses the allocated bandwidth divided by total number of users.
D. Each IP is guaranteed a minimum 10 Mbps of bandwidth

正解：B

解説：
Reference:
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/885253/per-ip-traffic-shaper

質問 # 25
Refer to the exhibit. Which conclusion about the packet debug flow output is correct?

A. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the firewall policy, and the packet was dropped.
B. The total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
C. The packet size exceeded the outgoing interface MTU.
D. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.

正解：D

質問 # 26
Refer to the exhibit.

Multiple IPsec VPNs are formed between two hub-and-spokes groups, and site-to-site between Hub 1 and Hub 2 The administrator configured ADVPN on the dual regions topology Which two statements are correct if a dynamic site-to-site tunne1 between Toronto and London has been established? (Choose two)

A. tunnel-search IS set to phase 2 quick mode selectors
B. auto-discovery-receiver is enabled on the egress VPN interfaces on the spokes
C. auto-discovery-sender is enabled on the ingress VPN interfaces on hubs
D. auto-discovery-forwarder IS enabled on all VPN interfaces
E. add-route is enabled to install static routes on hub devices

正解：B、C

質問 # 27
Refer to exhibits.
Exhibit A.

Exhibit B.

Exhibit A shows the traffic shaping policy and exhibit B show: the firewall policy FortiGate is not performing traffic shaping as expected basi on the policies shown in the exhibits.
To correct this traffic shaping issue on FortiGate, what configuration change must be made on which policy?

A. The web filter profile must be enabled on the firewall policy
B. The URL category must be specified on the traffic shaping policy
C. The application control profile must be enabled on the firewall policy.
D. The shaper mode must be applied per-IP shaper on the traffic shaping policy

正解：A

質問 # 28
When attempting to establish an IPsec tunnel to FortiGate, all remote users match the FIRST_VPN IPsec VPN. This includes remote users that want to connect to the SECOND_VPN IPsec VPN. Which two configuration changes must you make on both IPsec VPNs so that remote users can connect to their intended IPsec VPN? (Choose two.)

A. Change the IKE mode to aggressive.
B. Configure different proposals.
C. Configure a unique peer ID.
D. Configure different Diffie Hellman groups.

正解：A、C

解説：
https://kb.fortinet.com/kb/documentLink.do?externalID=10114

質問 # 29
Which diagnostic command can you use to show the SD-WAN rules interface information and state?

A. diagnose sys virtual-wan-link neighbor.
B. diagnose sys virtual-wan-link member.
C. diagnose sys virtual-wan-link route-tag-list
D. diagnose sys virtual-wan-link service

正解：A

質問 # 30
Refer to the exhibit.

FortiGate has multiple dial-up VPN interfaces incoming on port1 that match only FIRST_VPN.
Which two configuration changes must be made to both IPsec VPN interfaces to allow incoming connections to match all possible IPsec dial-up interfaces? (Choose two.)

A. Specify a unique peer ID for each dial-up VPN interface.
B. Use unique Diffie Hellman groups on each VPN interface.
C. Use different proposals are used between the interfaces.
D. Configure the IKE mode to be aggressive mode.

正解：B、C

質問 # 31
An administrator is troubleshooting VoIP quality issues that occur when calling external phone numbers The SD-WAN interface on the edge FortiGate is configured with the default settings, and is using two upstream links One link has random jitter and latency issues and is based on a wireless connection Which two actions must the administrator apply simultaneously on the edge FortiGate to improve VoIP quality using SD_WAN rules?

A. Choose the suitable interface based on the interface cost and weight.
B. Use the performance SLA targets to detect latency and jitter instantly.
C. Place the troublesome link at the top of the interface preference list.
D. Configure an SD-WAN rule to load balance all traffic without VoIP.
E. Select the corresponding SD-WAN balancing strategy in the SD-WAN rule.

正解：B、E

質問 # 32
Which three protocols are available only on the command line to configure as performance SLA status check? (Choose three.)

A. icmp
B. tcp-echo
C. udp-echo
D. twamp
E. smtp

正解：B、C、D

質問 # 33
Refer to exhibits.
Exhibit A.

Exhibit B.

Exhibit A, which shows the SD-WAN performance SLA and exhibit B shows the health of the participating SD-WAN members.
Based on the exhibits, which statement is correct?

A. Check interval is the time to wait before a packet sent by a member interface considered as lost.
B. The dead member interface stays unavailable until an administrator manually brings the interface back.
C. Port2 needs to wait 500 milliseconds to change the status from alive to dead.
D. The SLA state of port2 has exceeded three consecutive unanswered requests from the SLA server.

正解：D

質問 # 34
Why is it effective to use SD WAN rules when configuring application control?

A. Because traffic can be load balanced based on application type
B. Because the application database is manually maintained by administrators
C. Because you must use certificate full inspection on the firewall policy
D. Because SD-WAIM rules are independent from firewall policies to avoid controlling applications

正解：A

解説：
You can configure rules to steer traffic based on the application detected by Fortigate. This is know as application steering or application-aware routing

質問 # 35
Refer to the exhibit.

Which two statements about the debug output are correct? (Choose two )