[2023年12月] 最新のNSE 7 Network Security Architect NSE7_EFW-7.0試験解答豪華セット問題集
FortinetコンテンツをマスターしてNSE7_EFW-7.0試験合格保証つき問題集！
Fortinet NSE 7 - Enterprise Firewall 7.0は、さまざまなタイプのサイバー脅威に対する高度な保護を提供する包括的なネットワークセキュリティソリューションです。このセキュリティソリューションは、侵入防止、アプリケーション制御、Webフィルタリング、ネットワーク可視化などの機能を備え、企業ネットワークを内側から保護するように設計されています。FortinetのNSE7_EFW-7.0試験は、このセキュリティソリューションを使用する専門家のスキルと知識をテストするために設計されています。
質問 # 86
View the exhibit, which contains the partial output of an IKE real time debug, and then answer the question below.
The administrator does not have access to the remote gateway.
Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?
- A. Change phase 1 encryption to AES128 and authentication to SHA512.
- B. Change phase 1 encryption to 3DES and authentication to CBC.
- C. Change phase 1 encryption to 3DES and authentication to SHA256.
- D. Change phase 1 encryption to AESCBC and authentication to SHA128.
正解：B
質問 # 87
View the exhibit, which contains the output of a diagnose command, and then answer the question below.
Which statements are true regarding the output in the exhibit? (Choose two.)
- A. FortiGate will probe 121.111.236.179 every fifteen minutes for a response.
- B. Servers with the D flag are considered to be down.
- C. FortiGate used 209.222.147.3 as the initial server to validate its contract.
- D. Servers with a negative TZ value are experiencing a service outage.
正解：A、C
質問 # 88
A FortiGate is configured as an explicit web proxy. Clients using this web proxy are reposting DNS errors when accessing any website.
The administrator executes the following debug commands and observes that the n-dns-timeout counter is increasing:
What should the administrator check to fix the problem?
- A. The connectivity between the FortiGate unit and the DNS server.
- B. The connectivity between the client workstations and the DNS server.
- C. That DNS service is enabled in the explicit web proxy interface.
- D. That DNS traffic from client workstations is allowed by the explicit web proxy policies.
正解：A
質問 # 89
View the exhibit, which contains a partial routing table, and then answer the question below.
Assuming all the appropriate firewall policies are configured, which of the following pings will FortiGate route? (Choose two.)
- A. Source IP address 10.1.0.24, Destination IP address 10.72.3.20.
- B. Source IP address 10.73.9.10, Destination IP address 10.72.3.15.
- C. Source IP address 10.72.3.52, Destination IP address 10.1.0.254.
- D. Source IP address 10.72.3.27, Destination IP address 10.1.0.52.
正解：C、D
質問 # 90
Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)
- A. Preview pending configuration changes for managed devices.
- B. Import policy packages from managed devices.
- C. Import interface mappings from managed devices.
- D. Install configuration changes to managed devices.
- E. Add devices to FortiManager.
正解：A、D
質問 # 91
Examine the output from the 'diagnose vpn tunnel list' command shown in the exhibit; then answer the question below.
Which command can be used to sniffer the ESP traffic for the VPN DialUP_0?
- A. diagnose sniffer packet any 'host 10.0.10.10'
- B. diagnose sniffer packet any 'port 500'
- C. diagnose sniffer packet any 'port 4500'
- D. diagnose sniffer packet any 'esp'
正解：C
質問 # 92
A FortiGate device has the following LDAP configuration:
The administrator executed the 'dsquery' command in the Windows LDAp server 10.0.1.10, and got the following output:
>dsquery user -samid administrator
"CN=Administrator, CN=Users, DC=trainingAD, DC=training, DC=lab"
Based on the output, what FortiGate LDAP setting is configured incorrectly?
- A. cnid.
- B. username.
- C. dn.
- D. password.
正解：B
解説：
https://kb.fortinet.com/kb/viewContent.do?externalId=FD37516
質問 # 93
A FortiGate is rebooting unexpectedly without any apparent reason. What troubleshooting tools could an administrator use to get more information about the problem? (Choose two.)
- A. Crashlogs.
- B. Logs.
- C. Policy monitor.
- D. Firewall monitor.
正解：A、B
質問 # 94
Refer to the exhibit, which shows the output of a debug command.
Which two statements about the output are true? (Choose two.)
- A. Based on the network type of port 4, OSPF hello packets will be sent to 224.0.0.6.
- B. Based on the network type of port 4, OSPF hello packets will be sent to 224.0.0.5.
- C. In the network connected to port 4, two OSPF routers are down.
- D. There are a total of 5 OSPF routers attached to the Port4 network segment.
正解：B、D
質問 # 95
View the exhibit, which contains a partial web filter profile configuration, and then answer the question below.
Which action will FortiGate take if a user attempts to access www.dropbox.com, which is categorized as File Sharing and Storage?
- A. FortiGate will block the connection based on the URL Filter configuration.
- B. FortiGate will allow the connection based on the FortiGuard category based filter configuration.
- C. FortiGate will exempt the connection based on the Web Content Filter configuration.
- D. FortiGate will block the connection as an invalid URL.
正解：A
質問 # 96
Examine the following partial output from two system debug commands; then answer the question below.
Which of the following statements are true regarding the above outputs? (Choose two.)
- A. The Cached value is always the Active value plus the Inactive value
- B. The unit is in kernel conserve mode
- C. The unit is running a 32-bit FortiOS
- D. Kernel indirectly accesses the low memory (LowTotal) through memory paging
正解：A、C
質問 # 97
A FortiGate is rebooting unexpectedly without any apparent reason .
What troubleshooting tools could an administrator use to get more information about the problem? (Choose two.)
- A. Crashlogs.
- B. Logs.
- C. Policy monitor.
- D. Firewall monitor.
正解：A、B
質問 # 98
Refer to the exhibit, which shows a session entry. Which statement about this session is true?
- A. It is an ICMP session from 10.1.10.10 to 10.200.1.1.
- B. It is an ICMP session from 10.1.10.10 to 10.200.5. 1.
- C. It is a TCP session in close_wait state, from 10. l. 10.10 to 10.200.1.1.
- D. It is a TCP session in the established state, from 10.1.10.10 to 10.200.5.1.
正解：B
解説：
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiGate-session-table-information/ta-p/196988?externalId=FD30042
質問 # 99
Refer to the exhibit, which contains the partial output of the get vpn ipsec tunnel details command.
Based on the output, which two statements are correct? (Choose two.)
- A. Different SPI values are a result of auto-negotiation being disabled for phase 2 selectors.
- B. The npu_flag for this tunnel is 02.
- C. The npu_flag for this tunnel is 03.
- D. Anti-replay is enabled.
正解：C、D
質問 # 100
Examine the output from the BGP real time debug shown in the exhibit, then the answer the question below:
Which statements are true regarding the output in the exhibit? (Choose two.)
- A. The state of the remote BGP peer will go to Connect after it confirms the received prefixes.
- B. Local BGP peer received a prefix for a default route.
- C. BGP peers have successfully interchanged Open and Keepalive messages.
- D. The state of the remote BGP peer is OpenConfirm.
正解：B、C
質問 # 101
An administrator has enabled HA session synchronization in a HA cluster with two members. Which flag is added to a primary unit's session to indicate that it has been synchronized to the secondary unit?
- A. dirty.
- B. redir.
- C. nds.
- D. synced
正解：D
解説：
The synced sessions have the 'synced' flag. The command 'diag sys session list' can be used to see the sessions on the member, with the associated flags.
質問 # 102
An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage. However, after the changes, one network application started to have problems. During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets, and before the arrival of the SYN/ACKs. When the SYN/ACK packets arrive to the FortiGate, the unit has already deleted the respective sessions. Which TCP session timer must be increased to fix this problem?
- A. TCP half close.
- B. TCP time wait.
- C. TCP session time to live.
- D. TCP half open.
正解：D
解説：
http://docs-legacy.fortinet.com/fos40hlp/43prev/wwhelp/wwhimpl/common/html/wwhelp.htm?context=fgt&file=CLI_get_Commands.58.25.html The tcp-halfopen-timer controls for how long, after a SYN packet, a session without SYN/ACK remains in the table.
The tcp-halfclose-timer controls for how long, after a FIN packet, a session without FIN/ACK remains in the table.
The tcp-timewait-timer controls for how long, after a FIN/ACK packet, a session remains in the table. A closed session remains in the session table for a few seconds more to allow any out-of-sequence packet.
質問 # 103
Which configuration can be used to reduce the number of BGP sessions in an IBGP network?
- A. route-reflector-peer enable
- B. route-reflector enable
- C. route-reflector-server enable
- D. route-reflector-client enable
正解：D
解説：
https://docs.fortinet.com/document/fortigate/7.0.11/cli-reference/572620/config-router-bgp set route-reflector-client [enable|disable]
質問 # 104
Refer to the exhibits, which show the configuration on FortiGate and partial session information for internet traffic from a user on the internal network.
If the priority on route ID 2 were changed from 10 to 0, what would happen to traffic matching that user session?
- A. The session would be deleted, and the client would need to start a new session.
- B. The session would remain in the session table, but its traffic would now egress from both port1 and port2.
- C. The session would remain in the session table, and its traffic would egress from port2.
- D. The session would remain in the session table, and its traffic would egress from port1.
正解：D
解説：
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-SNAT-route-change-to-update-existing-NAT/ta-p/198439
質問 # 105
Refer to the exhibit, which shows the output of a diagnose command.
What can be concluded about the debug output in this scenario?
- A. The first server provided to FortiGate when it performed a DNS query looking for a list of rating servers, was 121.111.236.179.
- B. FortiGate used 64.26.151.37 as the initial server to validate its contract.
- C. There is a natural correlation between the value in the Packets field and the value in the Weight field.
- D. Servers with a negative TZ value are less preferred for rating requests.
正解：C
質問 # 106
Examine the IPsec configuration shown in the exhibit; then answer the question below.
An administrator wants to monitor the VPN by enabling the IKE real time debug using these commands:
diagnose vpn ike log-filter src-addr4 10.0.10.1
diagnose debug application ike -1
diagnose debug enable
The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are being interchanged between both IPsec gateways. However, the IKE real time debug does NOT show any output .
Why isn't there any output?
- A. The IKE real time shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.
- B. The log-filter setting is set incorrectly. The VPN's traffic does not match this filter.
- C. The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.
- D. The IKE real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.
正解：B
質問 # 107
......
Fortinet NSE7_EFW-7.0（Fortinet NSE 7 - Enterprise Firewall 7.0）認定試験は、Fortinetの企業向けファイアウォールソリューションの展開、設定、および管理におけるネットワークセキュリティプロフェッショナルの知識とスキルを試験するために設計されています。この認定試験は、最新の脅威や脆弱性から企業ネットワークを保護する専門知識を証明したいネットワークセキュリティプロフェッショナルを対象としています。
あなたを合格させるFortinet NSE7_EFW-7.0試験専門問題集はここにある：https://jp.fast2test.com/NSE7_EFW-7.0-premium-file.html
最新NSE 7 Network Security Architect NSE7_EFW-7.0練習テストに最速準備問題をゲットせよ：https://drive.google.com/open?id=1aZ4p0SXOLLOCnpWeXTbS2wBJIFlMZpYF