結果を保証するには最新2023年12月無料Fortinet NSE7_SDW-7.0で練習しよう
有効な問題最新版を無料で試そうNSE7_SDW-7.0試験問題集解答
Fortinet NSE7_SDW-7.0認定試験は、グローバルに認められており、ネットワークセキュリティのキャリアアップを目指すプロフェッショナルにとって貴重な資格です。また、ネットワークセキュリティのエリート資格であるFortinet NSE 7認定を取得するための要件でもあります。Fortinet NSE7_SDW-7.0認定試験に合格することは、候補者の職業への献身と、ネットワークセキュリティの最新技術やベストプラクティスに常にアップデートしている能力を証明します。
質問 # 13
Refer to the exhibit.
The exhibit shows the details of a session and the index numbers of some relevant interfaces on a FortiGate appliance that supports hardware offloading. Based on the information shown in the exhibits, which two statements about the session are true? (Choose two.)
- A. The main session cannot be offloaded to hardware.
- B. The auxiliary session can be offloaded to hardware.
- C. The reply direction of the asymmetric traffic flows from port2 to port3.
- D. The original direction of the symmetric traffic flows from port3 to port2.
正解：B、C
質問 # 14
Which two protocols in the IPsec suite are most used for authentication and encryption? (Choose two.)
- A. Internet Key Exchange (IKE)
- B. Secure Shell (SSH)
- C. Encapsulating Security Payload (ESP)
- D. Security Association (SA)
正解：A、C
質問 # 15
Refer to the exhibit.
FortiGate has multiple dial-up VPN interfaces incoming on port1 that match only FIRST_VPN.
Which two configuration changes must be made to both IPsec VPN interfaces to allow incoming connections to match all possible IPsec dial-up interfaces? (Choose two.)
- A. Specify a unique peer ID for each dial-up VPN interface.
- B. Use unique Diffie Hellman groups on each VPN interface.
- C. Use different proposals are used between the interfaces.
- D. Configure the IKE mode to be aggressive mode.
正解：A、D
質問 # 16
What is the route-tag setting in an SD-WAN rule used for?
- A. To indicate the routes that can be used for routing SD-WAN traffic.
- B. To indicate the destination of a rule based on learned BGP prefixes.
- C. To indicate the members that can be used to route SD-WAN traffic.
- D. To indicate the routes for health check probes.
正解：B
質問 # 17
What is a benefit of using application steering in SD-WAN?
- A. You do not need to configure firewall policies that accept the SD-WAN traffic.
- B. You steer traffic based on the detected application.
- C. The traffic always skips the regular policy routes.
- D. You do not need to enable SSL inspection.
正解：B
質問 # 18
Refer to the exhibit.
Based on the output, which two conclusions are true? (Choose two.)
- A. There is more than one SD-WAN rule configured.
- B. The all_rules rule represents the implicit SD-WAN rule.
- C. The SD-WAN rules take precedence over regular policy routes.
- D. Entry 1(id=1) is a regular policy route.
正解：A、D
質問 # 19
What are two reasons for using FortiManager to organize and manage the network for a group of FortiGate devices? (Choose two )
- A. It simplifies the deployment and administration of SD-WAN on managed FortiGate devices.
- B. It reduces WAN usage on FortiGate devices by acting as a local FortiGuard server.
- C. It acts as a policy compliance entity to review all managed FortiGate devices.
- D. It improves SD-WAN performance on the managed FortiGate devices.
- E. It sends probe signals as health checks to the beacon servers on behalf of FortiGate.
正解：A、B
質問 # 20
Which statement is correct about SD-WAN and ADVPN?
- A. SD-WAN can steer traffic to ADVPN shortcuts, established over IPsec overlays, configured as SD-WAN members.
- B. Routes for ADVPN shortcuts must be manually configured.
- C. You must use IKEv2 on IPsec tunnels.
- D. SD-WAN does not monitor the health and performance of ADVPN shortcuts.
正解：A
質問 # 21
Which two statements describe how IPsec phase 1 main mode is different from aggressive mode when performing IKE negotiation? (Choose two )
- A. A total of six packets are exchanged between an initiator and a responder instead of three packets.
- B. A peer ID is included in the first packet from the initiator, along with suggested security policies.
- C. The use of Diffie Hellman keys is limited by the responder and needs initiator acceptance.
- D. XAuth is enabled as an additional level of authentication, which requires a username and password.
正解：A、D
質問 # 22
Which SD-WAN setting enables FortiGate to delay the recovery of ADVPN shortcuts?
- A. link-down-failover
- B. hold-down-time
- C. idle-timeout
- D. auto-discovery-shortcuts
正解：B
質問 # 23
Refer to the exhibits.
Exhibit A
Exhibit B
Exhibit A shows the source NAT (SNAT) global setting and exhibit B shows the routing table on FortiGate.
Based on the exhibits, which two actions does FortiGate perform on existing sessions established over port2, if the administrator increases the static route priority on port2 to 20? (Choose two.)
- A. FortiGate flags the sessions as dirty.
- B. FortiGate continues routing the sessions with no SNAT, over port2.
- C. FortiGate performs a route lookup for the original traffic only.
- D. FortiGate updates the gateway information of the sessions with SNAT so that they use port1 instead of port2.
正解：A、D
質問 # 24
Which two statements about SD-WAN central management are true? (Choose two.)
- A. It does not support meta fields.
- B. It uses templates to configure SD-WAN on managed devices.
- C. It supports normalized interfaces for SD-WAN member configuration.
- D. The objects are saved in the ADOM common object database.
正解：B、D
解説：
Normalized interfaces are not supported for SD-WAN templates. You can create multiple SD-WAN zones and add interface members to the SD-WAN zones. You must bind the interface members by name to physical interfaces or VPN interfaces.https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan-new-features/794804/new-sd-wan-template-fmg
質問 # 25
Refer to the exhibit.
The exhibit shows the SD-WAN rule status and configuration.
Based on the exhibit, which change in the measured packet loss will make T_INET_1_0 the new preferred member?
- A. When T_INET_0_0 has 4% packet loss.
- B. When T_INET_1_0 has 4% packet loss.
- C. When all three members have the same packet loss.
- D. When T_INET_0_0 has 12% packet loss.
正解：C
質問 # 26
Refer to the exhibit.
The device exchanges routes using IBGP.
Which two statements are correct about the IBGP configuration and routing information on the device?
(Choose two.)
- A. ibgp-multipath is disabled.
- B. You can run the get router info routing-table database command to display the additional paths.
- C. Each BGP route is three hops away from the destination.
- D. additional-path is enabled.
正解：B、D
質問 # 27
Which two statements are true about using SD-WAN to steer local-out traffic? (Choose two.)
- A. By default, local-out traffic does not use SD-WAN.
- B. FortiGate does not consider the source address of the packet when matching an SD-WAN rule for local-out traffic.
- C. You must configure each local-out feature individually, to use SD-WAN.
- D. By default, FortiGate does not check if the selected member has a valid route to the destination.
正解：A、C
質問 # 28
Refer to the exhibits.
Exhibit A
Exhibit B
Exhibit A shows an SD-WAN event log and exhibit B shows the member status and the SD-WAN rule configuration.
Based on the exhibits, which two statements are correct? (Choose two.)
- A. FortiGate updated the outgoing interface list on the rule so it prefers port2.
- B. Port2 has a lower latency than port1.
- C. Port2 has the highest member priority.
- D. SD-WAN rule ID 1 is set to lowest cost (SLA) mode.
正解：A、B
質問 # 29
Refer to the exhibit.
The exhibit shows the BGP configuration on the hub in a hub-and-spoke topology. The administrator wants BGP to advertise prefixes from spokes to other spokes over the IPsec overlays, including additional paths. However, when looking at the spoke routing table, the administrator does not see the prefixes from other spokes and the additional paths.
Based on the exhibit, which three settings must the administrator configure inside each BGP neighbor group so spokes can learn other spokes prefixes and their additional paths? (Choose three.)
- A. Set advertisement-interval to the number of additional paths to advertise
- B. Set additional-path to send
- C. Enable route-reflector-client
- D. Enable soft-reconfiguration
- E. Set adv-additional-path to the number of additional paths to advertise
正解：B、C、E
質問 # 30
Refer to the exhibits.
Exhibit A -
Exhibit B -
Exhibit A shows the traffic shaping policy and exhibit B shows the firewall policy.
The administrator wants FortiGate to limit the bandwidth used by YouTube. When testing, the administrator determines that FortiGate does not apply traffic shaping on YouTube traffic.
Based on the policies shown in the exhibits, what configuration change must be made so FortiGate performs traffic shaping on YouTube traffic?
- A. Destination internet service must be enabled on the traffic shaping policy.
- B. Application control must be enabled on the firewall policy.
- C. Web filtering must be enabled on the firewall policy.
- D. Individual SD-WAN members must be selected as the outgoing interface on the traffic shaping policy.
正解：B
質問 # 31
Refer to the exhibit.
Which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules?
- A. All traffic from a source IP to a destination IP is sent to the least used interface.
- B. All traffic from a source IP is sent to the same interface.
- C. All traffic from a source IP is sent to the most used interface.
- D. All traffic from a source IP to a destination IP is sent to the same interface.
正解：D
質問 # 32
Refer to the exhibit.
Based on the exhibit, which two actions does FortiGate perform on sessions after a firewall policy change? (Choose two.)
- A. FortiGate terminates the old sessions.
- B. FortiGate evaluates new sessions.
- C. FortiGate does not change existing sessions.
- D. FortiGate flushes all sessions.
正解：B、C
解説：
FortiGate not to flag existing impacted session as dirty by setting firewall-session-dirty to check new. The results is that FortiGate evaluates only new session against the new firewall policy.
質問 # 33
Which CLI command do you use to perform real-time troubleshooting for ADVPN negotiation?
- A. get router info routing-table all
- B. diagnose debug application ike
- C. diagnose vpn tunnel list
- D. get ipsec tunnel list
正解：B
質問 # 34
......
NSE7_SDW-7.0ブレーン問題集PDF、Fortinet NSE7_SDW-7.0試験問題詰合せ：https://jp.fast2test.com/NSE7_SDW-7.0-premium-file.html