[2023年10月] 確実合格する有効な方法Fortinet試験問題集でNSE7_SDW-6.4試験学習ガイド
NSE7_SDW-6.4問題集とFortinet NSE 7 - SD-WAN 6.4トレーニングコースでお客様の合格を楽にさせる学習合格試験問題！
Fortinet NSE7_SDW-6.4（Fortinet NSE 7 - SD-WAN 6.4）認定試験は、SD-WAN技術とFortinetソリューションを扱うネットワークおよびセキュリティプロフェッショナル向けの上級レベルの試験です。この試験は、広範囲なトピックをカバーし、セキュアなSD-WANソリューションを設計、実装、および管理する候補者の知識とスキルを試験します。この認定資格は業界で高く評価され、SD-WAN技術とFortinetソリューションのスキルと知識を向上させたいプロフェッショナルに理想的です。
質問 # 13
Refer to exhibits.
Exhibit A shows the firewall policy and exhibit B shows the traffic shaping policy.
The traffic shaping policy is being applied to all outbound traffic; however, inbound traffic is not being evaluated by the shaping policy.
Based on the exhibits, what configuration change must be made in which policy so that traffic shaping can be applied to inbound traffic?
- A. Create a new firewall policy, and the select the SD-WAN zone as Incoming Interface.
- B. In the traffic shaping policy, select Assign Shaping Class ID as Action.
- C. In the firewall policy, select Proxy-based as Inspection Mode.
- D. In the traffic shaping policy, enable Reverse shaper, and then select the traffic shaper to use.
正解：D
質問 # 14
Refer to exhibits.
Exhibit A.
Exhibit B.
Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SO-WAN interface and the static routes configuration.
Port1 and port2 are member interfaces of the SD-WAN, and port2 becomes a dead member after reaching the failure thresholds Which statement about the dead member is correct?
- A. Subnets 100 .64-1.0/23 and 172 . 20 . 0. 0/16 are reachable only through port1
- B. Dead members require manual administrator access to bring them back alive
- C. Port2 might become alive when a single response is received from an SLA server
- D. SD-WAN interface becomes disabled and port1 becomes the WAN interface
正解：D
質問 # 15
Refer to the exhibit
Which statement about the ADVPN device role in handling traffic is true?
- A. Two hubs. 10.1.1.254 and 10.1.2.254, are receiving and forwarding queries between each other
- B. This is a spoke that has received a query from a remote hub and has forwarded the response to its hub
- C. This is a hub that has received a query from a spoke and has forwarded it to another spoke
- D. Two spokes 100.64.3.1 and 10.1.2. 254 forward their queries to their hubs
正解：C
質問 # 16
Which two tasks about using central VPN management are true? (Choose two.)
- A. You must enable VPN zones for SD-WAN deployments.
- B. You configure VPN communities to define common IPsec settings shared by all VPN gateways.
- C. You can configure full mesh, star, and dial-up VPN topologies.
- D. FortiManager installs VPN settings on both managed and external gateways.
正解：B、C
質問 # 17
Refer to the exhibit.
Which are two expected behaviors of the traffic that matches the traffic shaper? (Choose two.)
- A. The traffic shaper limits the bandwidth of each source IP address to a maximum of 625 KB/sec.
- B. The number of simultaneous connections among all source IP addresses can exceed 5 connections.
- C. The number of simultaneous connections allowed for each source IP address can exceed 5 connections.
- D. The traffic shaper limits the combined bandwidth of all connections to a maximum of 5 MB/sec.
正解：A、B
質問 # 18
Refer to exhibits.
Exhibit A.
Exhibit B.
Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SO-WAN interface and the static routes configuration.
Port1 and port2 are member interfaces of the SD-WAN, and port2 becomes a dead member after reaching the failure thresholds Which statement about the dead member is correct?
- A. SD-WAN interface becomes disabled and port1 becomes the WAN interface
- B. Dead members require manual administrator access to bring them back alive
- C. Port2 might become alive when a single response is received from an SLA server
- D. Subnets 100 .64.1.0/23 and 172 . 20 . 0. 0/16 are reachable only through port1
正解：D
質問 # 19
Refer to Exhibit:
Based on the exhibit, which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules, among the member interfaces?
- A. All traffic from a source IP is sent to the same interfaces.
- B. All traffic from a source IP Is sent to the most used Interface.
- C. All traffic from a source IP to a destination IP is sent to the least used interface.
- D. All traffic from a source IP to a destination IP Is sent to the same interface.
正解：D
質問 # 20
Refer to the exhibit.
What must you configure to enable ADVPN?
- A. The protected subnets should be set to address object to all (0.0 .0. o/o).
- B. ADVPN should only be enabled on unmanaged FortiGate devices.
- C. On the hub VPN, only the device needs additional phase one sett
- D. Each VPN device has a unique pre-shared key configured separately on phase one
正解：D
質問 # 21
What are two roles that SD-WAN orchestrator plays when it works with FortiManager? (Choose two )
- A. It configures and monitors SD-WAN networks on FortiGate devices that are managed by FortiManager.
- B. It acts as a standalone device to assist FortiManager to manage SD-WAN interfaces on the managed FortiGate devices.
- C. It acts as a hub FortiGate with an SD-WAN interface enabled and managed along with other FortiGate devices by FortiManager.
- D. It acts as an application that is released and signed by Fortinet to run as a part of management extensions on FortiManager.
正解：A、D
解説：
SD-WAN 6.4 Guide Page 158.
https://docs2.fortinet.com/document/fortimanager/6.4.0/sd-wan-orchestrator-6-4-0-administration-guide/91581/introduction
質問 # 22
Which statement is correct about SD-WAN and ADVPN?
- A. SD-WAN can steer traffic to ADVPN shortcuts established over IPsec overlays configured as SD-WAN members.
- B. Routes for ADVPN shortcuts must be manually configured.
- C. You must use OSPF.
- D. SD-WAN does not monitor the health and performance of ADVPN shortcuts.
正解：A
質問 # 23
Refer to exhibits.
Exhibit A shows the source NAT global setting and exhibit B shows the routing table on FortiGate.
Based on the exhibits, which two statements about increasing the port2 interface priority to 20 are true? (Choose two.)
- A. All the existing sessions using SNAT will be flushed and routed through port1.
- B. All the existing sessions will continue to use port2, and new sessions will use port1.
- C. All the existing sessions will be blocked from using port1 and port2.
- D. All the existing sessions that do not use SNAT will be flushed and routed through port1.
正解：A、B
質問 # 24
Refer to the exhibit.
Based on output shown in the exhibit, which two commands can be used by SD-WAN rules? (Choose two.)
- A. set cost 15.
- B. set priority 10.
- C. set load-balance-mode source-ip-based.
- D. set source 100.64.1.1.
正解：B、C
質問 # 25
Refer to the exhibit.
Multiple IPsec VPNs are formed between two hub-and-spokes groups, and site-to-site between Hub 1 and Hub 2 The administrator configured ADVPN on the dual regions topology
Which two statements are correct if a user in Toronto sends traffic to London? (Choose two )
- A. The first packets from Toronto to London are routed through Hub 1 then to Hub 2.
- B. London generates an IKE information message that contains the Toronto public IP address
- C. Toronto needs to establish a site-to-site tunnel with Hub 2 to bypass Hub 1.
- D. Traffic from Toronto to London triggers the dynamic negotiation of a direct site-to-site VPN
正解：C、D
質問 # 26
Which statement about using BGP routes in SD-WAN is true?
- A. Adding static routes must be enabled on all ADVPN interfaces.
- B. VPN topologies must be form using only BGP dynamic routing with SD-WAN
- C. Dynamic routing protocols can be used only with non-encrypted traffic
- D. Learned routes can be used as dynamic destinations in SD-WAN rules
正解：D
質問 # 27
Which three performance SLA protocols are available on the FortiGate CLI only? (Choose three.)
- A. twamp
- B. icmp
- C. udp-echo
- D. smtp
- E. tcp-echo
正解：A、C、E
解説：
Command output from a fortigate:
FW-01 (test-health-check) # set protocol
ping Use PING to test the link with the server.
tcp-echo Use TCP echo to test the link with the server.
udp-echo Use UDP echo to test the link with the server.
http Use HTTP-GET to test the link with the server.
twamp Use TWAMP to test the link with the server.
dns Use DNS query to test the link with the server.
tcp-connect Use a full TCP connection to test the link with the server.
ftp Use FTP to test the link with the server.
質問 # 28
Which CLI command do you use to perform real-time troubleshooting for ADVPN on either a hub or a spoke FortiGate?
- A. get router info routing-table
- B. diagnose debug application ike
- C. get ipsec tunnel list
- D. diagnose sys virtual-wan-link service
正解：B
質問 # 29
Refer to exhibits.
Exhibit A shows the SD-WAN rules and exhibit B shows the traffic logs. The SD-WAN traffic logs reflect how FortiGate processed traffic.
Which two statements about how the configured SD-WAN rules are processing traffic are true? (Choose two.)
- A. The initial session of an application goes through a learning phase in order to apply the correct rule.
- B. SD-WAN rules are evaluated in the same way as firewall policies: from top to bottom.
- C. The implicit rule overrides all other rules because parameters widely cover sources and destinations.
- D. The All_Access_Rules rule load balances Vimeo application traffic among SD-WAN member interfaces.
正解：B、C
質問 # 30
Refer to exhibits.
Exhibit B.
Exhibit A shows the firewall policy and exhibit B shows the traffic shaping policy.
The traffic shaping policy is being applied to all outbound traffic however inbound traffic is not being evaluated by the shaping policy Based on the exhibit, what configuration change must be made in which policy so that traffic shaping can be applied to inbound traffic'?
- A. The guaranteed-10mbps option must be selected as the reverse shaper option.
- B. The guaranteed-10mbps option must be selected as the per-IP shaper option
- C. A new firewall policy must be created and SD-WAN must be selected as the incoming interface.
- D. The reverse shaper option must be enabled and a traffic shaper must be selected
正解：A
質問 # 31
Refer to the exhibit.
Which statement about the command route-tag in the SD-WAN rule is true?
- A. It tags each route and references the tag in the routing table.
- B. It enables the SD-WAN rule to load balance and assign traffic with a route tag
- C. It uses route tags for a BGP community and assigns the SD-WAN rules with same tag.
- D. It ensures route tags match the SD-WAN rule based on the rule order
正解：C
解説：
SD-WAN 6.4.5 Guide Page 226.
質問 # 32
Refer to the exhibit.
FortiGate has multiple dial-up VPN interfaces incoming on port1 that match only FIRST_VPN.
Which two configuration changes must be made to both IPsec VPN interfaces to allow incoming connections to match all possible IPsec dial-up interfaces? (Choose two.)
- A. Specify a unique peer ID for each dial-up VPN interface.
- B. Use unique Diffie Hellman groups on each VPN interface.
- C. Use different proposals are used between the interfaces.
- D. Configure the IKE mode to be aggressive mode.
正解：A、D
解説：
SD-WAN 6.4.5 Study Guide. pg 182
質問 # 33
Which two statements about SLA targets and SD-WAN rules are true? (Choose two.)
- A. Member metrics are measured only if an SLA target is configured.
- B. SLA targets are used only by SD-WAN rules that are configured with Lowest Cost (SLA) or Maximize Bandwidth (SLA) as strategy.
- C. SD-WAN rules use SLA targets to check if the preferred members meet the SLA requirements.
- D. When configuring an SD-WAN rule, you can select multiple SLA targets of the same performance SLA.
正解：B、C
質問 # 34
Which CLI command do you use to perform real-time troubleshooting for ADVPN negotiation?
- A. get router info routing-table
- B. diagnose debug application ike
- C. get ipsec tunnel list
- D. diagnose sys virtual-wan-link service
正解：B
質問 # 35
......
Fortinet NSE7_SDW-6.4（Fortinet NSE 7-SD-WAN 6.4）認定試験は、ソフトウェア定義の広い領域ネットワーキング（SD-WAN）の分野で知識とスキルを検証しようとしているIT専門家にとって非常に価値のある認定試験です。 。この認定試験は、Fortinet製品とテクノロジーを使用してSD-WANソリューションの実装、構成、トラブルシューティングにおいて候補者の習熟度をテストするように設計されています。
リアル試験問題と解答Fortinet NSE7_SDW-6.4問題集はここに：https://drive.google.com/open?id=1z_p2PV6tpBWEgSx4RIn_GECgHHz_VIrM
最新 [2023年10月] 効果的な学習法で試験合格できるNSE7_SDW-6.4：https://jp.fast2test.com/NSE7_SDW-6.4-premium-file.html