2025年01月実際に出るNSE7_SDW-7.2試験問題集には正確で更新された問題
NSE7_SDW-7.2試験問題集でPDF問題とテストエンジン
Fortinet NSE7_SDW-7.2 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 # 45
Refer to the exhibits.
An administrator is testing application steering in SD-WAN. Before generating test traffic, the administrator collected the information shown in exhibit A.
After generating GoToMeeting test traffic, the administrator examined the respective traffic log on FortiAnalyzer, which is shown in exhibit B.
The administrator noticed that the traffic matched the implicit SD-WAN rule, but they expected the traffic to match rule ID 1.
Which two reasons explain why the traffic matched the implicit SD-WAN rule? (Choose two.)
- A. Full SSL inspection is not enabled on the matching firewall policy.
- B. FortiGate did not refresh the routing information on the session after the application was detected.
- C. The session 3-tuple did not match any of the existing entries in the ISDB application cache.
- D. Port1 and port2 do not have a valid route to the destination.
正解：A、D
解説：
Study guide 7.2 Page 191
質問 # 46
Which two statements about SD-WAN central management are true? (Choose two.)
- A. It does not support meta fields.
- B. It supports normalized interfaces for SD-WAN member configuration.
- C. It uses templates to configure SD-WAN on managed devices.
- D. The objects are saved in the ADOM common object database.
正解：C、D
解説：
Explanation
Normalized interfaces are not supported for SD-WAN templates. You can create multiple SD-WAN zones and
add interface members to the SD-WAN zones. You must bind the interface members by name to physical
interfaces or VPN
interfaces.https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan-new-features/794804/new-sd-wan-template-
質問 # 47
Refer to the exhibit.
Which configuration change is required if the responder FortiGate uses a dynamic routing protocol to exchange routes over IPsec?
- A. add-route must be disabled.
- B. type must be set to static.
- C. exchange-interface-ip must be enabled.
- D. mode-cfg must be enabled.
正解：A
質問 # 48
Refer to the exhibit.
The exhibit shows the BGP configuration on the hub in a hub-and-spoke topology. The administrator wants
BGP to advertise prefixes from spokes to other spokes over the IPsec overlays, including additional paths.
However, when looking at the spoke routing table, the administrator does not see the prefixes from other
spokes and the additional paths.
Based on the exhibit, which three settings must the administrator configure inside each BGP neighbor group so
spokes can learn other spokes prefixes and their additional paths? (Choose three.)
- A. Enablesoft-reconfiguration
- B. Enableroute-reflector-client
- C. Setadvertisement-intervalto the number of additional paths to advertise
- D. Setadditional-pathtosend
- E. Setadv-additional-pathto the number of additional paths to advertise
正解：B、D、E
質問 # 49
Exhibit.
Which conclusion about the packet debug flow output is correct?
- A. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
- B. The total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
- C. The packet size exceeded the outgoing interface MTU.
- D. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the firewall policy, and the packet was dropped.
正解：A
解説：
In a Per-IP shaper configuration, if an IP address exceeds the configured concurrent session limit, the message "Denied by quota check" appears. SD-WAN 7.0 Study Guide page 287
質問 # 50 
Exhibit B -
Exhibit A shows the system interface with the static routes and exhibit B shows the firewall policies on the managed FortiGate.
Based on the FortiGate configuration shown in the exhibits, what issue might you encounter when creating an SD-WAN zone for port1 and port2?
- A. port1 is assigned a manual IP address.
- B. port1 is referenced in a firewall policy.
- C. port2 is referenced in a static route.
- D. port1 and port2 are not administratively down.
正解：B
質問 # 51
Refer to the exhibit.
Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2.
Which two configuration settings are required for Toronto and London spokes to establish an ADVPN
shortcut? (Choose two.)
- A. On the hubs,auto-discovery-sendermust be enabled on the IPsec VPNs to spokes.
- B. On the spokes,auto-discovery-receivermust be enabled on the IPsec VPN to the hub.
- C. auto-discovery-forwardermust be enabled on all IPsec VPNs.
- D. On the hubs,net-devicemust be enabled on all IPsec VPNs.
正解：A、B
質問 # 52
Exhibit.
Which conclusion about the packet debug flow output is correct?
- A. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions
configured in the traffic shaper, and the packet was dropped. - B. The total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions
configured in the traffic shaper, and the packet was dropped. - C. The packet size exceeded the outgoing interface MTU.
- D. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions
configured in the firewall policy, and the packet was dropped.
正解：A
解説：
Explanation
In a Per-IP shaper configuration, if an IP address exceeds the configured concurrent session limit, the message
"Denied by quota check" appears.SD-WAN 7.0 Study Guide page 287
質問 # 53
Which two settings can you configure to speed up routing convergence in BGP? (Choose two.)
- A. holdtime-timer
- B. set-route-tag
- C. link-down-failover
- D. update-source
正解：A、C
質問 # 54
Which two protocols in the IPsec suite are most used for authentication and encryption? (Choosetwo.)
- A. Security Association (SA)
- B. Secure Shell (SSH)
- C. Internet Key Exchange (IKE)
- D. Encapsulating Security Payload (ESP)
正解：C、D
質問 # 55
Refer to the exhibit.
Which two SD-WAN template member settings support the use of FortiManager meta fields? (Choose two.)
- A. Cost
- B. Gateway IP
- C. Priority
- D. Interface member
正解：B、D
質問 # 56
What are two benefits of choosing packet duplication over FEC for data loss correction on noisy links? (Choose two.)
- A. Packet duplication can leverage multiple IPsec overlays for sending additional data.
- B. Packet duplication uses smaller parity packets which results in less bandwidth consumption.
- C. Packet duplication supports hardware offloading.
- D. Packet duplication does not require a route to the destination.
正解：A、C
質問 # 57
Refer to the exhibits.
Exhibit A shows two IPsec templates to define Branch_IPsec_1 and Branch_IPsec_2. Each template defines a VPN tunnel.
Exhibit B shows the error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device.
Which statement best explain the cause for this issue?
- A. You should review the branch1_fgt configuration for the already configured tunnel with the name HUB1-VPN2.
- B. You can assign only one IPsec template to each FortiGate device.
- C. You can assign only one template with a tunnel of fype static to each FortiGate device
- D. You can define only one IPsec tunnel from branch devices to HUB1.
正解：B
解説：
The error message in Exhibit B indicates a conflicting template assignment. This occurs because FortiManager does not allow the assignment of multiple IPsec templates that define VPN tunnels with the same name or settings to the same FortiGate device. The conflict arises from trying to assign a second IPsec template to a device that already has one assigned.References:This is based on Fortinet's best practices and administrative guidelines which state that each FortiGate device should be assigned a unique IPsec template to avoid configuration conflicts.
質問 # 58 
Which two conclusions for traffic that matches the traffic shaper are true? (Choose two.)
- A. The traffic shaper limits the bandwidth of each source IP to a maximum of 6250 KBps.
- B. The traffic shaper drops packets if the bandwidth is less than 2500 KBps.
- C. The measured bandwidth is less than 100 KBps.
- D. The traffic shaper drops packets if the bandwidth exceeds 6250 KBps.
正解：C、D
質問 # 59 
Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2. The administrator configured ADVPN on both hub-and-spoke groups.
Which two outcomes are expected if a user in Toronto sends traffic to London? (Choose two.)
- A. London generates an IKE information message that contains the Toronto public IP address.
- B. The first packets from Toronto to London are routed through Hub 1 then to Hub 2.
- C. Toronto needs to establish a site-to-site tunnel with Hub 2 to bypass Hub 1.
- D. Traffic from Toronto to London triggers the dynamic negotiation of a direct site-to-site VPN.
正解：B、D
質問 # 60
Refer to the exhibit.
Which two SD-WAN template member settings support the use of FortiManager meta fields? (Choose two.)
- A. Cost
- B. Gateway IP
- C. Priority
- D. Interface member
正解：B、D
質問 # 61
Refer to the exhibit.
Which statement explains the output shown in the exhibit?
- A. FortiGate will not re-evaluate the session following a firewall policy change.
- B. FortiGate must re-evaluate the session due to routing change.
- C. FortiGate used192.2.0.1as the gateway for the original direction of the traffic.
- D. FortiGate performed standard FIB routing on the session.
正解：B
解説：
Explanation
The snat-route-change option is enabled by default. This option enables FortiGate to re-evaluate the routing
table and select a new egress interface if the next hop IP address changes. This option only applies to sessions
in the dirty state. Sessions in the log state are not affected by routing changes.
質問 # 62
Refer to the exhibit.
The exhibit shows the details of a session and the index numbers of some relevant interfaces on a FortiGate appliance that supports hardware offloading. Based on the information shown in the exhibits, which two statements about the session are true? (Choose two.)
- A. The auxiliary session can be offloaded to hardware.
- B. The original direction of the symmetric traffic flows from port3 to port2.
- C. The main session cannot be offloaded to hardware.
- D. The reply direction of the asymmetric traffic flows from port2 to port3.
正解：A、D
質問 # 63
Refer to the exhibits.
Exhibit A -
Exhibit B -
Exhibit A shows the traffic shaping policy and exhibit B shows the firewall policy.
The administrator wants FortiGate to limit the bandwidth used by YouTube. When testing, the administrator determines that FortiGate does not apply traffic shaping on YouTube traffic.
Based on the policies shown in the exhibits, what configuration change must be made so FortiGate performs traffic shaping on YouTube traffic?
- A. Destination internet service must be enabled on the traffic shaping policy.
- B. Application control must be enabled on the firewall policy.
- C. Individual SD-WAN members must be selected as the outgoing interface on the traffic shaping policy.
- D. Web filtering must be enabled on the firewall policy.
正解：B
質問 # 64
Refer to the exhibit.
Based on the exhibit, which two actions does FortiGate perform on sessions after a firewall policy change?
(Choose two.)
- A. FortiGate flushes all sessions.
- B. FortiGate terminates the old sessions.
- C. FortiGate evaluates new sessions.
- D. FortiGate does not change existing sessions.
正解：C、D
解説：
FortiGate not to flag existing impacted session as dirty by setting firewall-session-dirty to check new. The results is that FortiGate evaluates only new session against the new firewall policy.
質問 # 65
Which CLI command do you use to perform real-time troubleshooting for ADVPN negotiation?
- A. diagnose debug application ike
- B. get router info routing-table all
- C. diagnose vpn tunnel list
- D. get ipsec tunnel list
正解：A
解説：
IKE real-time debug - useful when debugging ADVPN shortcut messages and spoke-to-spoke negotiations.
* diagnose debug console timestamp enable
* diagnose vpn ike log filter clear
* diagnose vpn ike log filter mdst-addr4 <ip.of.hub> <ip.of.spoke>
* diagnose debug application ike -1
* diagnose debug enable
質問 # 66
Which two statements describe how IPsec phase 1 main mode is different from aggressive mode when
performing IKE negotiation? (Choose two )
- A. A total of six packets are exchanged between an initiator and a responder instead of three packets.
- B. The use of Diffie Hellman keys is limited by the responder and needs initiator acceptance.
- C. XAuth is enabled as an additional level of authentication, which requires a username and password.
- D. A peer ID is included in the first packet from the initiator, along with suggested security policies.
正解：A、C
質問 # 67
Refer to the exhibit.
Based on the exhibit, which two statements are correct about the health of the selected members? (Choose
two.)
- A. FortiGate passively monitors the member if TCP traffic is passing through the member.
- B. After FortiGate switches to active mode, FortiGate never fails back to passive monitoring.
- C. During passive monitoring, FortiGate can't detect dead members.
- D. FortiGate can offload the traffic that is subject to passive monitoring to hardware.
正解：A、C
質問 # 68
Refer to the exhibit.
Which are two expected behaviors of the traffic that matches the traffic shaper? (Choose two.)
- A. The traffic shaper limits the bandwidth of each source IP address to a maximum of 625 KB/sec.
- B. The number of simultaneous connections among all source IP addresses cannot exceed five connections.
- C. The number of simultaneous connections allowed for each source IP address cannot exceed five connections.
- D. The traffic shaper limits the combined bandwidth of all connections to a maximum of 5 MB/sec.
正解：A、C
質問 # 69
......
合格させるFortinet NSE7_SDW-7.2試験最速合格にはFast2test：https://jp.fast2test.com/NSE7_SDW-7.2-premium-file.html