[2024年05月]更新のNSE7_SDW-7.0試験事前練習テスト試験問題と解答NSE 7 Network Security Architect学習ガイド
Fortinet NSE 7 - SD-WAN 7.0認証サンプル解答
FortinetのNSE7_SDW-7.0認定試験は、SD-WANソリューションに関する候補者の知識を総合的に評価するテストです。試験は、候補者がSD-WANソリューションを設定およびトラブルシューティングする能力を証明するために、多肢選択問題およびシミュレーションで構成されています。試験に合格するためには、候補者はSD-WANアーキテクチャ、導入、セキュリティに関する深い理解力、および一般的な問題のトラブルシューティング能力を証明する必要があります。
Fortinet NSE7_SDW-7.0認定試験では、SD-WANアーキテクチャ、展開シナリオ、セキュリティ上の考慮事項、トラブルシューティング手法など、幅広いトピックを対象としています。候補者は、SD-WANテクノロジーを深く理解し、Fortinet SD-WANソリューションを構成および管理する機能を理解する必要があります。
質問 # 16
Refer to the exhibit.
In a dual-hub hub-and-spoke SD-WAN deployment, which is a benefit of disabling the anti-replay setting on the hubs?
- A. It instructs the hub to skip content inspection on TCP traffic, to improve performance.
- B. It instructs the hub to not check the ESP sequence numbers on IPsec traffic, to improve performance.
- C. It instructs the hub to disable the reordering of TCP packets on behalf of the receiver, to improve performance.
- D. It instructs the hub to disable TCP sequence number check, which is required for TCP sessions originated from spokes to fail over back and forth between the hubs.
正解：D
質問 # 17
Refer to the exhibit.
The exhibit shows the BGP configuration on the hub in a hub-and-spoke topology. The administrator wants BGP to advertise prefixes from spokes to other spokes over the IPsec overlays, including additional paths. However, when looking at the spoke routing table, the administrator does not see the prefixes from other spokes and the additional paths.
Based on the exhibit, which three settings must the administrator configure inside each BGP neighbor group so spokes can learn other spokes prefixes and their additional paths? (Choose three.)
- A. Set adv-additional-path to the number of additional paths to advertise
- B. Enable soft-reconfiguration
- C. Set additional-path to send
- D. Set advertisement-interval to the number of additional paths to advertise
- E. Enable route-reflector-client
正解：A、C、E
質問 # 18
Which two statements about SD-WAN central management are true? (Choose two.)
- A. It supports normalized interfaces for SD-WAN member configuration.
- B. It uses templates to configure SD-WAN on managed devices.
- C. The objects are saved in the ADOM common object database.
- D. It does not support meta fields.
正解：B、C
解説：
Normalized interfaces are not supported for SD-WAN templates. You can create multiple SD-WAN zones and add interface members to the SD-WAN zones. You must bind the interface members by name to physical interfaces or VPN interfaces.https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan-new-features/794804/new-sd-wan-template-fmg
質問 # 19
Refer to the exhibit.
The exhibit shows the SD-WAN rule status and configuration.
Based on the exhibit, which change in the measured latency will make T_MPLS_0 the new preferred member?
- A. When T_MPLS_0 has a latency of 100 ms.
- B. When T_INET_0_0 has a latency of 250 ms.
- C. When T_INET_0_0 and T_MPLS_0 have the same latency.
- D. When T_N1PLS_0 has a latency of 80 ms.
正解：D
質問 # 20
Refer to the exhibits.
Exhibit A -
Exhibit B -
Exhibit A shows a site-to-site topology between two FortiGate devices: branch1_fgt and dc1_fgt. Exhibit B shows the system global and system settings configuration on dc1_fgt.
When branch1_client establishes a connection to dc1_host, the administrator observes that, on dc1_fgt, the reply traffic is routed over T_INET_0_0, even though T_INET_1_0 is the preferredmember in the matching SD-WAN rule.
Based on the information shown in the exhibits, what configuration change must be made on dc1_fgt so dc1_fgt routes the reply traffic over T_INET_1_0?
- A. Disable allow-subnet-overlap under config system settings.
- B. Enable auxiliary-session under config system settings.
- C. Enable snat-route-change under config system global.
- D. Disable tp-session-without-syn under config system settings.
正解：B
解説：
Explanation
Controlling return path with auxiliary session When multiple incoming or outgoing interfaces are used in ECMP or for load balancing, changes to routing, incoming, or return traffic interfaces impacts how an existing sessions handles the traffic. Auxiliary sessions can be used to handle these changes to traffic patterns.https://docs.fortinet.com/document/fortigate/7.0.11/administration-guide/14295/controlling-return-path-
質問 # 21
Refer to the exhibit.
Based on the exhibit, which action does FortiGate take?
- A. FortiGate fails over to the secondary device after it detects all SD-WAN members as dead.
- B. FortiGate brings up port5 after it detects all SD-WAN members as alive.
- C. FortiGate brings down port5 after it detects all SD-WAN members as dead.
- D. FortiGate bounces port5 after it detects all SD-WAN members as dead.
正解：A
質問 # 22
Refer to the exhibit.
Based on the exhibit, which two actions does FortiGate perform on sessions after a firewall policy change? (Choose two.)
- A. FortiGate evaluates new sessions.
- B. FortiGate does not change existing sessions.
- C. FortiGate flushes all sessions.
- D. FortiGate terminates the old sessions.
正解：A、B
解説：
FortiGate not to flag existing impacted session as dirty by setting firewall-session-dirty to check new. The results is that FortiGate evaluates only new session against the new firewall policy.
質問 # 23
Refer to the exhibits.
Exhibit A -
Exhibit B -
Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SD-WAN member status, the routing table, and the performance SLA status.
If port2 is detected dead by FortiGate, what is the expected behavior?
- A. Host 8.8.8.8 is reachable through port1 and port2.
- B. The administrator manually restores the static routes for port2, if port2 becomes alive.
- C. Port2 becomes alive after three successful probes are detected.
- D. FortiGate removes all static routes for port2.
正解：D
解説：
This is due to Update static route is enable which removes the static route entry referencing the interface if the interface is dead
質問 # 24
Which two tasks are part of using central VPN management? (Choose two.)
- A. You configure VPN communities to define common IPsec settings shared by all VPN gateways.
- B. You must enable VPN zones for SD-WAN deployments.
- C. FortiManager installs VPN settings on both managed and external gateways.
- D. You can configure full mesh, star, and dial-up VPN topologies.
正解：A、D
質問 # 25
Which are three key routing principles in SD-WAN? (Choose three.)
- A. By default, SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.
- B. By default, SD-WAN members are skipped if they do not have a valid route to the destination.
- C. FortiGate performs route lookups for new sessions only.
- D. SD-WAN rules have precedence over ISDB routes.
- E. Regular policy routes have precedence over SD-WAN rules.
正解：A、B、E
質問 # 26
What is a benefit of using application steering in SD-WAN?
- A. The traffic always skips the regular policy routes.
- B. You steer traffic based on the detected application.
- C. You do not need to configure firewall policies that accept the SD-WAN traffic.
- D. You do not need to enable SSL inspection.
正解：B
質問 # 27
Refer to the exhibit.
Based on the output shown in the exhibit, which two criteria on the SD-WAN member configuration can be used to select an outgoing interface in an SD-WAN rule? (Choose two.)
- A. Set load-balance-mode source-ip-ip-based.
- B. Set source 100.64.1.1.
- C. Set cost 15.
- D. Set priority 10.
正解：C、D
質問 # 28
Refer to the exhibit.
Which conclusion about the packet debug flow output is correct?
- A. The original traffic exceeded the maximum bandwidth of the outgoing interface, and the packet was dropped.
- B. The reply traffic exceeded the maximum bandwidth configured in the traffic shaper, and the packet was dropped.
- C. The original traffic exceeded the maximum bandwidth configured in the traffic shaper, and the packet was dropped.
- D. The original traffic exceeded the maximum packets per second of the outgoing interface, and the packet was dropped.
正解：C
質問 # 29
Refer to the exhibit.
Based on the exhibit, which statement about FortiGate re-evaluating traffic is true?
- A. Firewall policy ID 1 has source NAT disabled.
- B. FortiGate has terminated the session after a change on policy ID 1.
- C. Changes have been made on firewall policy ID 1 on FortiGate.
- D. The type of traffic defined and allowed on firewall policy ID 1 is UDP.
正解：C
質問 # 30
Which two statements are true about using SD-WAN to steer local-out traffic? (Choose two.)
- A. FortiGate does not consider the source address of the packet when matching an SD-WAN rule for local-out traffic.
- B. By default, FortiGate does not check if the selected member has a valid route to the destination.
- C. You must configure each local-out feature individually, to use SD-WAN.
- D. By default, local-out traffic does not use SD-WAN.
正解：C、D
質問 # 31
What are two reasons why FortiGate would be unable to complete the zero-touch provisioning process? (Choose two.)
- A. The zero-touch provisioning process has completed internally, behind FortiGate.
- B. The FortiGate cloud key has not been added to the FortiGate cloud portal.
- C. FortiDeploy has connected with FortiGate and provided the initial configuration to contact FortiManager
- D. A factory reset performed on FortiGate.
- E. FortiGate has obtained a configuration from the platform template in FortiGate cloud.
正解：A、B
質問 # 32
Refer to the exhibit.
An administrator is troubleshooting SD-WAN on FortiGate. A device behind branch1_fgt generates traffic to the 10.0.0.0/8 network. The administrator expects the traffic to match SD-WAN rule ID 1 and be routed over T_INET_0_0. However, the traffic is routed over T_INET_1_0.
Based on the output shown in the exhibit, which two reasons can cause the observed behavior? (Choose two.)
- A. T_INET_0_0 does not have a valid route to the destination.
- B. T_INET_1_0 has a higher member configuration priority than T_INET_0_0.
- C. The traffic matches a regular policy route configured with T_INET_1_0 as the outgoing device.
- D. T_INET_1_0 has a lower route priority value (higher priority) than T_INET_0_0.
正解：A、C
質問 # 33
Refer to the exhibits.
Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2. The administrator configured ADVPN on both hub-and-spoke groups.
Which two outcomes are expected if a user in Toronto sends traffic to London? (Choose two.)
- A. London generates an IKE information message that contains the Toronto public IP address.
- B. Toronto needs to establish a site-to-site tunnel with Hub 2 to bypass Hub 1.
- C. Traffic from Toronto to London triggers the dynamic negotiation of a direct site-to-site VPN.
- D. The first packets from Toronto to London are routed through Hub 1 then to Hub 2.
正解：C、D
質問 # 34
Which two protocols in the IPsec suite are most used for authentication and encryption? (Choose two.)
- A. Internet Key Exchange (IKE)
- B. Secure Shell (SSH)
- C. Security Association (SA)
- D. Encapsulating Security Payload (ESP)
正解：A、D
質問 # 35
Which two statements about SD-WAN central management are true? (Choose two.)
- A. It supports normalized interfaces for SD-WAN member configuration.
- B. It uses templates to configure SD-WAN on managed devices.
- C. The objects are saved in the ADOM common object database.
- D. It does not support meta fields.
正解：B、C
解説：
Explanation
Normalized interfaces are not supported for SD-WAN templates. You can create multiple SD-WAN zones and add interface members to the SD-WAN zones. You must bind the interface members by name to physical interfaces or VPN interfaces.https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan-new-features/794804/new-sd-wan-template-
質問 # 36
Refer to the exhibit.
Based on the output shown in the exhibit, which two criteria on the SD-WAN member configuration can be used to select an outgoing interface in an SD-WAN rule? (Choose two.)
- A. Set load-balance-mode source-ip-ip-based.
- B. Set source 100.64.1.1.
- C. Set cost 15.
- D. Set priority 10.
正解：C、D
質問 # 37
In a hub-and-spoke topology, what are two advantages of enabling ADVPN on the IPsec overlays? (Choose two.)
- A. It provides the benefits of a full-mesh topology in a hub-and-spoke network.
- B. It enables spokes to establish shortcuts to third-party gateways.
- C. It enables spokes to bypass the hub during shortcut negotiation.
- D. It provides direct connectivity between spokes by creating shortcuts.
正解：A、D
質問 # 38
Refer to the exhibit.
Based on the exhibit, which two actions does FortiGate perform on sessions after a firewall policy change?
(Choose two.)
- A. FortiGate evaluates new sessions.
- B. FortiGate does not change existing sessions.
- C. FortiGate flushes all sessions.
- D. FortiGate terminates the old sessions.
正解：A、B
解説：
Explanation
FortiGate not to flag existing impacted session as dirty by setting firewall-session-dirty to check new. The results is that FortiGate evaluates only new session against the new firewall policy.
質問 # 39
......
Fortinet NSE7_SDW-7.0認定は、2年間有効で、その後、候補者は認定を維持するために再認証する必要があります。再認証は、現行の試験を受験するか、特定のFortinetトレーニングコースを修了することで達成できます。この認定は、候補者がFortinetのSD-WAN技術と協力する能力を示し、雇用主にとって貴重な資格として認識されます。
Fortinet試験練習テスト最高得点を獲得しよう：https://jp.fast2test.com/NSE7_SDW-7.0-premium-file.html