練習できるNSE7_EFW-6.4問題には認定ガイド問題と解答とトレーニングを提供しています
無料Fortinet NSE7_EFW-6.4テスト練習問題試験問題集
質問 37
Refer to the exhibit, which contains a TCL script configuration on FortiManager.
An administrator has configured the TCL script on FortiManager, but failed to apply any changes to the managed device after being executed.
Why did the TCL script fail to make any changes to the managed device?
- A. The TCL command run_cmd has not been created.
- B. Changes in an interface configuration can only be done by CLI script.
- C. The TCL script must start with #include <>.
- D. Incomplete commands are ignored in TCL scripts.
正解: A
質問 38
Which the following events can trigger the election of a new primary unit in a HA cluster? (Choose two.)
- A. One of the monitored interfaces in the primary unit is disconnected.
- B. Primary unit stops sending HA heartbeat
- C. The FortiGuard license for the primary unit is updated.
- D. A secondary unit is removed from the HA cluster.
正解: A,B
質問 39
View the exhibit, which contains theoutput of get sys ha status, and then answer the question below.
Which statements are correct regarding the output? (Choose two.)
- A. Master is selected because it is the only device in the cluster.
- B. The slave configuration is not synchronized with the master.
- C. port 7 is used the HA heartbeat on all devices in the cluster.
- D. The HA management IP is 169.254.0.2.
正解: B,C
質問 40
An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage. However, after the changes, one network application started to have problems. During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets, and before the arrival of the SYN/ACKs. When the SYN/ACK packets arrive to the FortiGate, the unit has already deleted the respective sessions. Which TCP session timer must be increased to fix this problem?
- A. TCP half close.
- B. TCP half open.
- C. TCP time wait.
- D. TCP session time to live.
正解: B
解説:
http://docs-legacy.fortinet.com/fos40hlp/43prev/wwhelp/wwhimpl/common/html/wwhelp.htm?context=fgt&file=CLI_get_Commands.58.25.html The tcp-halfopen-timer controls for how long, after a SYN packet, a session without SYN/ACK remains in the table.
The tcp-halfclose-timer controls for how long, after a FIN packet, a session without FIN/ACK remains in the table.
The tcp-timewait-timer controls for how long, after a FIN/ACK packet, a session remains in the table. A closed session remains in the session table for a few seconds more to allow any out-of-sequence packet.
質問 41
Which of the following conditions must be met for a static route to be active in the routing table? (Choose three.)
- A. There is no other route, to the same destination, with a higher distance.
- B. The outgoing interface is up.
- C. The next-hop IP address is up.
- D. The next-hop IP address belongs to one of the outgoing interface subnets.
- E. The link health monitor (if configured) is up.
正解: B,D,E
解説:
A configured static route only goes to routing table from routing database when all the following are met :
The outgoing interface is up
There is no other matching route with a lower distance
The link health monitor (if configured) is successful
The next-hop IP address belongs to one of the outgoing interface subnets
質問 42
Examine the output from the 'diagnose debug authd fsso list' command; then answer the question below.
# diagnose debug authd fsso list -FSSO logons-IP: 192.168.3.1 User: STUDENT Groups: TRAININGAD/USERS Workstation: INTERNAL2. TRAINING. LAB The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.
What should the administrator check?
- A. The reserve DNS lookup forthe IP address 192.168.3.1.
- B. The IP address recorded in the logon event for the user STUDENT.
- C. The DNS name resolution for the workstation name INTERNAL2. TRAINING. LAB.
- D. The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2. TRAINING. LAB.
正解: D
質問 43
Examine the output from the 'diagnose debug authd fsso list' command; then answer the question below.
# diagnose debug authd fsso list-FSSO logons-IP: 192.168.3.1 User: STUDENT Groups: TRAINI NGAD/USERS Workstation: INTERNAL2. TRAINING. LAB The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.
What should the administrator check?
- A. The reserve DNS lookup forthe IP address 192.168.3.1.
- B. The IP address recorded in the logon event for the user STUDENT.
- C. The DNS name resolution for the workstation name INTERNAL2. TRAINING. LAB.
- D. The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2.
TRAINING. LAB.
正解: D
質問 44
View the following FortiGate configuration.
All traffic to the Internet currently egresses from port1. The exhibit shows partial session information for Internet traffic from a user on the internal network:
If the priority on route ID 1 were changed from 5 to 20, what would happen to traffic matching that user's session?
- A. The session would remain in the session table, and its traffic would still egress from port1.
- B. The session would remain in the session table, and its traffic would start to egress from port2.
- C. The session would be deleted, so the client would need to start a new session.
- D. The session would remain in the session table, but its traffic would now egress from both port1 and port2.
正解: A
解説:
http://kb.fortinet.com/kb/documentLink.do?externalID=FD40943
質問 45
What is the diagnose test application ipsmonitor 99 command used for?
- A. To disable the IPS engine
- B. To provide information regarding IPS sessions
- C. To restart all IPS engines and monitors
- D. To enable IPS bypass mode
正解: C
質問 46
A corporate network allows Internet Access to FSSO users only. The FSSO user student does not have Internet access after successfully logged into the Windows AD network. The output of the 'diagnose debug authd fsso list' command does not show student as an active FSSO user. Other FSSO users can access the Internet without problems. What should the administrator check? (Choose two.)
- A. The user student must not be listed in the CA's ignore user list.
- B. The student workstation's IP subnet must be listed in the CA's trusted list.
- C. At least one of the student's user groups must be allowed by a FortiGate firewall policy.
- D. The user student must belong to one or more of the monitored user groups.
正解: A,C
解説:
https://kb.fortinet.com/kb/documentLink.do?externalID=FD38828
質問 47
Refer to the exhibit, which contains the output of diagnose sys session list.
If the HA ID for the primary unit is zero (0), which statement about the output is true?
- A. The inspection of this session has been offloaded to the slave unit.
- B. This session is for HA heartbeat traffic.
- C. The master unit is processing this traffic.
- D. This session cannot be synced with the slave unit.
正解: C
質問 48
Refer to the exhibit, which contains the partial output of the get vpn ipsec tunnel details command.
Based on the output, which two statements are correct? (Choose two.)
- A. Hub2Spoke1 is configured on interface wan2.
- B. Phase 2 authentication is set to sha1 on both sides.
- C. Anti-replay is disabled.
- D. Hub2Spoke1 is a policy-based VPN.
正解: A,B
質問 49
An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer. If the administrator knows that there is no NAT device located between both FortiGates, what command should the administrator execute?
- A. diagnose sniffer packet any 'udp port 500 or udp port 4500'
- B. diagnose sniffer packet any 'udp port 4500'
- C. diagnose sniffer packet any 'esp'
- D. diagnose sniffer packet any 'udp port 500'
正解: C
解説:
Capture IKE Traffic without NAT: diagnose sniffer packet 'host and udp port 500' -------------------------------------- Capture ESP Traffic without NAT: diagnose sniffer packet any 'host and esp' -------------------------------------- Capture IKE and ESP with NAT-T: diagnose sniffer packet any 'host and (udp port 500 or udp port 4500)'
質問 50
Which of the following statements are correct regarding application layer test commands? (Choose two.)
- A. Some of them can be used to restart an application.
- B. They display real-time application debugs.
- C. They are used to filter real-time debugs.
- D. Some of them display statistics and configuration information about a feature or process.
正解: A,D
解説:
Application layer test commands don't display info in real time, but they do show statistics and configuration info about a feature or process. You can also use some of these commands to restart a process or execute a change in its operation.
質問 51
View the exhibit, which contains a screenshot of some phase-1settings, and then answer the question below.
The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel. To diagnose, the administrator enters these CLI commands:
However, the IKE real time debug does not show any output. Why?
- A. The log-filter setting was set incorrectly. The VPN's traffic does not match thisfilter.
- B. The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.
- C. The debug shows only error messages. If there is no output, then the tunnel is operating normally.
- D. The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.
正解: A
質問 52
An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device. The administrator decides to enable the setting link-failed-signal to fix the problem.
Which statement about this setting is true?
- A. It sends a link failed signal to all connected devices.
- B. It sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.
- C. It disabled all the non-heartbeat interfaces in all HA members for two seconds after a failover.
- D. It forces the former primary device to shut down all its non-heartbeat interfaces for one second, while the failover occurs.
正解: D
質問 53
View the exhibit, which contains a partial web filter profile configuration, and then answer the question below.
Which action willFortiGate take if a user attempts to access www.dropbox.com, which is categorized as File Sharing and Storage?
- A. FortiGate will block the connection as an invalid URL.
- B. FortiGate will block the connection based on the URL Filter configuration.
- C. FortiGate will allow the connection based on the FortiGuard category based filter configuration.
- D. FortiGate will exempt the connection based on the Web Content Filter configuration.
正解: B
解説:
Explanation
fortigate does it in order Static URL -> FortiGuard -> Content -> Advanced (java, cookie removal..)so block it in first step
質問 54
View these partial outputs from two routing debug commands:
Which outbound interface will FortiGate use to route web traffic from internal users to the Internet?
- A. port3
- B. port2
- C. port1
- D. Both port1 and port2
正解: C
質問 55
View theexhibit, which contains the output of a BGP debug command, and then answer the question below.
Which of the following statements about the exhibit are true? (Choose two.)
- A. The local BGPpeer has received a total of three BGP prefixes.
- B. The local BGP peer has not established a TCP session to the BGP peer 10.200.3.1.
- C. Since the BGP counters were last reset, the BGP peer 10.200.3.1 has never been down.
- D. For the peer 10.125.0.60, the BGP state of is Established.
正解: B,D
質問 56
Examine the output of the 'diagnose sys session list expectation' command shown in the exhibit; than answer the question below.
Which statement is true regarding the session in the exhibit?
- A. It was created by a session helper or ALG.
- B. It is for management traffic terminating at the FortiGate.
- C. It is for traffic originated from the FortiGate.
- D. It was created by the FortiGate kernel to allow push updates from FotiGuard.
正解: A
質問 57
How does FortiManager handle FortiGuard requests from FortiGate devices, when it is configured as a local FDS?
- A. FortiManager supports only FortiGuard push to managed devices.
- B. FortiManager will respond to update requests only if they originate from a managed device.
- C. FortiManager can download and maintain local copies of FortiGuard databases.
- D. FortiManager does not support rating requests.
正解: C
質問 58
......
試験準備には欠かさない！トップクラスのFortinet NSE7_EFW-6.4試験アプリ学習ガイドで練習問題最新版：https://jp.fast2test.com/NSE7_EFW-6.4-premium-file.html
問題集練習試験問題学習ガイドはNSE7_EFW-6.4試験：https://drive.google.com/open?id=1VBQVfXyP2SpDMmy5tiPhPUEYZaf_wTo9