[2025年08月] 今すぐダウンロード！リアルFortinet NSE7_EFW-7.2試験問題集テストエンジン試験問題
最新NSE7_EFW-7.2テスト問題集を試そう！最新Fortinet試験合格させます
質問 # 22
Refer to the exhibit, which shows device registration on FortiManager.
What can you conclude about the Spoke-1 and Spoke-2 configurations with respect to the information cond:
Modified (recent auto-updated)?
- A. On NGFW-A, the configuration was changed and spokes are wailing for an autoupdate.
- B. Spoke-1 and Spoke-2 are sharing the same security policy configuration and the same policy package.
- C. Based on the policy configuration on NGFW-1, the configuration on both spokes is modified and automatically updated.
- D. On both Spoke-1 and Spoke-2, the configuration was changed directly on the FortiGate device, and the changes were automatically retrieved by the device database.
正解：A
質問 # 23
Refer to the exhibit, which shows a partial routing table.
What two conclusions can you draw from the FortiGate output shown in the exhibit? (Choose two.)
- A. FortiGate is not using the destination subnets of the quick mode selectors to populate the routing table.
- B. add-route is enabled in the tunnel IPSec phase 1 configuration.
- C. net-device is disabled in the tunnel IPSec phase 1 configuration.
- D. FortiGate creates separate virtual interfaces for each VPN client.
正解：A、C
質問 # 24
Refer to the exhibit, which shows a network diagram.
Which protocol should you use to configure the FortiGate cluster?
- A. FGCP in active-passive mode
- B. FGCP in active-active mode
- C. FGSP
- D. VRRP
正解：C
質問 # 25
Refer to the exhibit, which shows an error in system fortiguard configuration.
What is the reason you cannot set the protocol to udp in config system fortiguard?
- A. You do not have the corresponding write access.
- B. udp is not a protocol option.
- C. fortiguard-anycast is set to enable.
- D. FortiManager provides FortiGuard.
正解：B
解説：
The reason for the command failure when trying to set the protocol to UDP in theconfig system fortiguardis likely that UDP is not a protocol option in this context. The command syntax might be incorrect or the option to set a protocol for FortiGuard updates might not exist in this manner.
So the correct answer is D. udp is not a protocol option.
質問 # 26
Refer to the exhibit, which shows two configured FortiGate devices and peering over FGSP.
The main link directly connects the two FortiGate devices and is configured using the set session-syn-dev <interface> command.
What is the primary reason to configure the main link?
- A. To have both sessions and configuration synchronization in layer 2
- B. To have both sessions and configuration synchronization in layer 3
- C. To have only configuration synchronization in layer 3
- D. To load balance both sessions and configuration synchronization between layer 2 and 3
正解：B
解説：
The primary purpose of configuring a main link between the devices is to synchronize session information so that if one unit fails, the other can continue processing traffic without dropping active sessions.
A).To have both sessions and configuration synchronization in layer 2.This is incorrect because FGSP is used for session synchronization, not configuration synchronization.
B).To load balance both sessions and configuration synchronization between layer 2 and 3.FGSP does not perform load balancing and is not used for configuration synchronization.
C).To have only configuration synchronization in layer 3.The main link is not used solely for configuration synchronization.
D).To have both sessions and configuration synchronization in layer 3.The main link in an FGSP setup is indeed used to synchronize session information across the devices, and it operates at layer 3 since it uses IP addresses to establish the peering.
質問 # 27
Refer to the exhibits, which contain the network topology and BGP configuration for a hub.
Exhibit A.
Exhibit B.
An administrator is trying to configure ADVPN with a hub and spoke VPN setup using iBGP. All the VPNs are up and connected to the hub. The hub is receiving route information from both spokes over iBGP; however the spokes are not receiving route information from each other.
What change must the administrator make to the hub BGP configuration so that the routes learned from one spoke are forwarded to the other spoke?
- A. Add a prefix list to the hub that permits routes to be shared between the spokes
- B. Enable route redistribution under config router bgp
- C. Configure the hub as a route reflector
- D. Configure auto-discovery-sender on the hub
正解：D
質問 # 28
Exhibit.
Refer to exhibit, which shows a central management configuration
Which server will FortiGate choose for web filler rating requests if 10.0.1.240 is experiencing an outage?
- A. Public FortiGuard servers
- B. 10.0.1.242
- C. 10.0.1.243
- D. 10.0.1.244
正解：D
解説：
In the event of an outage at 10.0.1.240, the FortiGate will choose the next server in the sequence for web filter rating requests, which is 10.0.1.244 according to the configuration shown in the exhibit. This is because the server list is ordered by priority, and the server with the lowest priority number is chosen first. If that server is unavailable, the next server with the next lowest priority number is chosen, and so on. The public FortiGuard servers are only used if the include-default-servers option is enabled and all the custom servers are unavailable. Reference := Fortinet Enterprise Firewall Study Guide for FortiOS 7.2, page 132.
質問 # 29
Refer to the exhibits, which show the configurations of two address objects from the same FortiGate.
Why can you modify the Engineering address object, but not the Finance address object?
- A. FortiGate joined the Security Fabric and the Finance address object was configured on the root FortiGate.
- B. Another user is editing the Finance address object in workspace mode.
- C. FortiGate is registered on FortiManager.
- D. You have read-only access.
正解：B
解説：
The inability to modify the Finance address object while being able to modify the Engineering address object suggests that the Finance object is being managed by a higher authority in the Security Fabric, likely the root FortiGate. When a FortiGate is part of a Security Fabric, address objects and other configurations may be managed centrally. This aligns with the Fortinet FortiGate documentation on Security Fabric and central management of address objects.
質問 # 30
Refer to the exhibit.
which contains a partial configuration of the global system. What can you conclude from this output?
- A. NPs and CPs arc disabled
- B. NPs and CPs are enabled
- C. Only CPs arc disabled
- D. Only NPs are disabled
正解：A
解説：
The configuration output shows various global settings for a FortiGate device. The terms NP (Network Processor) and CP (Content Processor) relate to FortiGate's hardware acceleration features. However, the provided configuration output does not directly mention the status (enabled or disabled) of NPs and CPs.
Typically, the command to disable or enable hardware acceleration features would specifically mention NP or CP in the command syntax. Therefore, based on the output provided, we cannot conclusively determine the status of NPs and CPs, hence option D is the closest answer since the output does not confirm that they are enabled.
References:
* FortiOS Handbook - CLI Reference for FortiOS 5.2
質問 # 31
Which two statements about ADVPN are true? (Choose two.)
- A. You must disable add-route in the hub.
- B. You must configure phase 2 quick mode selectors to 0.0.0.0 0.0.0.0.
- C. The hub adds routes based on IKE negotiations.
- D. AllFortiGate devices must be in the same autonomous system (AS).
正解：B、C
解説：
C). The hub adds routes based on IKE negotiations: This is part of the ADVPN functionality where the hub learns about the networks behind the spokes and can add routes dynamically based on the IKE negotiations with the spokes.
D). You must configure phase 2 quick mode selectors to 0.0.0.0 0.0.0.0: This wildcard setting in the phase 2 selectors allows any-to-any tunnel establishment, which is necessary for the dynamic creation of spoke-to-spoke tunnels.
These configurations are outlined in Fortinet's documentation for setting up ADVPN, where the hub's role in route control and the use of wildcard selectors for phase 2 are emphasized to enable dynamic tunneling between spokes.
質問 # 32
Exhibit.
Refer to the exhibit, which shows the output from the webfilter fortiguard cache dump and webfilter categories commands.
Using the output, how can an administrator determine the category of the training.fortinet.comam website?
- A. The administrator must convert the first three digits of the IP hex value to binary
- B. The administrator must add both the Pima in and Iphex values of 34 to get the category number
- C. The administrator must convert the first two digits of the Domain hex value to a decimal value
- D. The administrator can look up the hex value of 34 in the second command output.
正解：D
解説：
* Option B is correct because the administrator can determine the category of the training.fortinet.com website by looking up the hex value of 34 in the second command output. This is because the first command output shows that the domain and the IP of the website are both in category (Hex) 34, which corresponds to Information Technology in the second command output1.
* Option A is incorrect because the administrator does not need to convert the first three digits of the IP hex value to binary. The IP hex value is already in the same format as the category hex value, so the administrator can simply compare them without any conversion2.
* Option C is incorrect because the administrator does not need to add both the Pima in and Iphex values of 34 to get the category number. The Pima in and Iphex values are not related to the category number, but to the cache TTL and the database version respectively3.
* Option D is incorrect because the administrator does not need to convert the first two digits of the Domain hex value to a decimal value. The Domain hex value is already in the same format as the category hex value, so the administrator can simply compare them without any conversion2. References:
=
* 1: Technical Tip: Verify the webfilter cache content4
* 2: Hexadecimal to Decimal Converter5
* 3: FortiGate - Fortinet Community6
* : Web filter | FortiGate / FortiOS 7.2.0 - Fortinet Documentation7
質問 # 33
Exhibit.
Refer to the exhibit, which contains a partial VPN configuration.
What can you conclude from this configuration1?
- A. The VPN should use the dynamic routing protocol to exchange routing information Through the tunnels.
- B. FortiGate creates separate virtual interfaces for each dial up client.
- C. The routing table shows a single IPSec virtual interface.
- D. Dead peer detection s disabled.
正解：C
解説：
The configuration line "set dpd on-idle" indicates that dead peer detection (DPD) is set to trigger only when the tunnel is idle, not actively disabled1. References: FortiGate IPSec VPN User Guide - Fortinet Document Library From the given VPN configuration, dead peer detection (DPD) is set to 'on-idle', indicating that DPD is enabled and will be used to detect if the other end of the VPN tunnel is still alive when no traffic is detected.
Hence, option C is incorrect. The configuration shows the tunnel set to type 'dynamic', which does not create separate virtual interfaces for each dial-up client (A), and it is not specified that dynamic routing will be used (B). Since this is a phase 1 configuration snippet, the routing table aspect (D) cannot be concluded from this alone.
質問 # 34
Exhibit.
Refer to the exhibit, which shows an ADVPN network.
The client behind Spoke-1 generates traffic to the device located behind Spoke-2.
Which first message floes the hub send to Spoke-110 bring up the dynamic tunnel?
- A. Shortcut query
- B. Shortcut offer
- C. Shortcut forward
- D. Shortcut reply
正解：A
解説：
In an ADVPN scenario, when traffic is initiated from a client behind one spoke to another spoke, the hub sends a shortcut query to the initiating spoke. This query is used to determine if there is a more direct path for the traffic, which can then trigger the establishment of a dynamic tunnel between the spokes.
質問 # 35
Refer to the exhibit, which contains a partial OSPF configuration.
What can you conclude from this output?
- A. FortiGate restarts if the topology changes.
- B. The router sends grace LSAs before it restarts.
- C. Neighbors maintain communication with the restarting router.
- D. The restarting router sends gratuitous ARP for 30 seconds.
正解：A
解説：
From the partial OSPF (Open Shortest Path First) configuration output:
B: The router sends grace LSAs before it restarts: This is implied by the command 'set restart-mode graceful- restart'. When OSPF is configured with graceful restart, the router sends grace LSAs (Link State Advertisements) to inform its neighbors that it is restarting, allowing for a seamless transition without recalculating routes.
Fortinet documentation on OSPF configuration clearly states that enabling graceful restart mode allows the router to maintain its adjacencies and routes during a brief restart period.
質問 # 36
You want to configure faster failure detection for BGP.
Which parameter should you enable on both connected FortiGate devices?
- A. Graceful-restart
- B. Distribute-list-in
- C. Ebgp-enforce-multihop
- D. bfd
正解：D
解説：
BFD (Bidirectional Forwarding Detection) is a protocol that provides fast failure detection for BGP by sending periodic messages to verify the connectivity between two peers. BFD can be enabled on both connected FortiGate devices by using the command set bfd enable under the BGP configuration.
質問 # 37
Refer to the exhibit, which shows an error in system fortiguard configuration.
What is the reason you cannot set the protocol to udp in config system fortiguard?
- A. You do not have the corresponding write access.
- B. fortiguard-anycast is set to enable.
- C. udp is not a protocol option.
- D. FortiManager provides FortiGuard.
正解：B
解説：
The reason for the command failure when trying to set the protocol to UDP in theconfig system fortiguardis likely that UDP is not a protocol option in this context. The command syntax might be incorrect or the option to set a protocol for FortiGuard updates might not exist in this manner. So the correct answer is D. udp is not a protocol option.
質問 # 38
Refer to the exhibit, which shows a routing table.
What two options can you configure in OSPF to block the advertisement of the 10.1.10.0 prefix?
(Choose two.)
- A. Configure a distribute-list-out
- B. Remove the 10.1.10.0 prefix from the OSPF network
- C. Configure a route-map out
- D. Disable Redistribute Connected
正解：B、D
解説：
On OSFP distribute-list and route-maps exist only incoming, and because you want to exclude a connected network from redistribution you can not use the option "redistibute connected", so you have to specify the networks manually.
質問 # 39
Exhibit.
Refer to the exhibit, which shows a partial touting table
What two concisions can you draw from the corresponding FortiGate configuration? (Choose two.)
- A. net-device is enabled in the tunnel IPSec phase 1 configuration
- B. add-route is disabled in the tunnel IPSec phase 1 configuration.
- C. IPSec Tunnel aggregation is configured
- D. OSPI is configured to run over IPSec.
正解：A、B
解説：
* Option B is correct because the routing table shows that the tunnel interfaces have a netmask of
255.255.255.255, which indicates that net-device is enabled in the phase 1 configuration. This option allows the FortiGate to use the tunnel interface as a next-hop for routing, without adding a route to the phase 2 destination1.
* Option D is correct because the routing table does not show any routes to the phase 2 destination networks, which indicates that add-route is disabled in the phase 1 configuration. This option controls whether the FortiGate adds a static route to the phase 2 destination network using the tunnel interface as the gateway2.
* Option A is incorrect because IPSec tunnel aggregation is a feature that allows multiple phase 2 selectors to share a single phase 1 tunnel, reducing the number of tunnels and improving performance3.
This feature is not related to the routing table or the phase 1 configuration.
* Option C is incorrect because OSPF is a dynamic routing protocol that can run over IPSec tunnels, but it requires additional configuration on the FortiGate and the peer device4. This option is not related to the routing table or the phase 1 configuration. References: =
* 1: Technical Tip: 'set net-device' new route-based IPsec logic2
* 2: Adding a static route5
* 3: IPSec VPN concepts6
* 4: Dynamic routing over IPsec VPN7
質問 # 40
Refer to the exhibit, which shows the output of diagnose sys session list.
If the HA ID for the primary device is 0, what will happen if the primary fails and the secondary becomes the primary?
- A. Traffic for this session continues to be permitted on the new primary device after failover, without requiring the client to restart the session with the server.
- B. The session will be removed from the session table of the secondary device due to the presence of allowed error packets, which will force the client to restart the session with the server.
- C. The session state will be preserved but the kernel will need to re-evaluate the session due to NAT being applied.
- D. The secondary device has this session synchronized; however, because application control is applied, the session will be marked dirty and have to be re-evaluated after failover.
正解：A
解説：
https://community.fortinet.com/t5/FortiGate/Technical-Note-How-to-see-if-a-session-is-synced-in- HA/ta-p/194185
質問 # 41
Refer to the exhibits, which show the configurations of two address objects from the same FortiGate.
Why can you modify the Engineering address object, but not the Finance address object?
- A. FortiGate joined the Security Fabric and the Finance address object was configured on the root FortiGate.
- B. FortiGate is registered on FortiManager.
- C. Another user is editing the Finance address object in workspace mode.
- D. You have read-only access.
正解：A
解説：
The inability to modify the Finance address object while being able to modify the Engineering address object suggests that the Finance object is being managed by a higher authority in the Security Fabric, likely the root FortiGate. When a FortiGate is part of a Security Fabric, address objects and other configurations may be managed centrally. This aligns with the Fortinet FortiGate documentation on Security Fabric and central management of address objects.
質問 # 42
Which statement about network processor (NP) offloading is true?
- A. For TCP traffic FortiGate CPU offloads the first packets of SYN/ACK and ACK of the three-way handshake to NP
- B. You can disable the NP for each firewall policy using the command np-acceleration st to loose.
- C. The NP provides IPS signature matching
- D. The NP checks the session key or IPSec SA
正解：A
解説：
Option A is correct because the FortiGate CPU offloads the first packets of TCP sessions to the NP for faster connection establishment and reduced CPU load1. This feature is called TCP offloading and it is enabled by default on FortiGate models with NP6 or higher2.
Option B is incorrect because the NP does not provide IPS signature matching. The NP only handles the packet forwarding and encryption/decryption functions, while the IPS signature matching is performed by the content processor (CP) or the CPU3.
Option C is incorrect because the command to disable the NP for each firewall policy is set np-acceleration disable, not set np-acceleration st to loose4. This command can be used to prevent certain traffic types from being offloaded to the NP, such as multicast, broadcast, or non-IP packets5.
Option D is incorrect because the NP does not check the session key or IPSec SA. The NP only offloads the IPSec encryption/decryption and tunneling functions, while the session key and IPSec SA are managed by the CPU. Reference: =
1: TCP offloading
2: Network processors (NP6, NP6XLite, NP6Lite, and NP4)
3: Content processors (CP9, CP9XLite, CP9Lite)
4: Disabling NP offloading for firewall policies
5: NP hardware acceleration alters packet flow
6: IPSec VPN concepts
質問 # 43
Refer to the exhibit, which contains an active-active toad balancing scenario.
During the traffic flow the primary FortiGate forwards the SYN packet to the secondary FortiGate.
What is the destination MAC address or addresses when packets are forwarded from the primary FortiGate to the secondary FortiGate?
- A. Secondary physical MAC port2 then virtual MAC port2
- B. Secondary virtual MAC port1 then physical MAC port1
- C. Secondary physical MAC port1
- D. Secondary virtual MAC port1
正解：C
解説：
In an active-active load balancing scenario, when the primary FortiGate forwards the SYN packet to the secondary FortiGate, the destination MAC address would be the secondary's physical MAC on port1, as the packet is being sent over the network and the physical MAC is used for layer 2 transmissions.
質問 # 44
While configuring the BGP protocol, an administrator applies the set netuork-inport-check disable command under config network.
What will FortiGate do as a result of this command?
- A. FortiGate will not advertise the prefixes, if it is not in the routing table.
- B. FortiGate will advertise only the corresponding prefixes in the BGP network table to its BGP neighbor, even if itis not in the routing table.
- C. FortiGate will advertise all the prefixes in the BGP network table to its BGP neighbor, even f itis not in the routing table.
- D. FortiGate will not advertise any imported routes received from one BGP neighbor to another.
正解：C
質問 # 45
Which FortiGate in a Security I auric sends togs to FortiAnalyzer?
- A. Each FortiGate in the Security fabric.
- B. Only the root FortiGate.
- C. Only the last FortiGate that handled a session in the Security Fabric
- D. The FortiGate devices performing network address translation (NAT) or unified threat management (UTM). if configured.
正解：A
解説：
* Option B is correct because each FortiGate in the Security Fabric can send logs to FortiAnalyzer for centralized logging and analysis12. This allows you to monitor and manage the entire Security Fabric from a single console and view aggregated reports and dashboards.
* Option A is incorrect because the root FortiGate is not the only device that can send logs to FortiAnalyzer. The root FortiGate is the device that initiates the Security Fabric and acts as the central point of contact for other FortiGate devices3. However, it does not have to be the only log source for FortiAnalyzer.
* Option C is incorrect because the FortiGate devices performing NAT or UTM are not the only devices that can send logs to FortiAnalyzer. These devices can perform additional security functions on the traffic that passes through them, such as firewall, antivirus, web filtering, etc4. However, they are not the only devices that generate logs in the Security Fabric.
* Option D is incorrect because the last FortiGate that handled a session in the Security Fabric is not the only device that can send logs to FortiAnalyzer. The last FortiGate is the device that terminates the session and applies the final security policy5. However, it does not have to be the only device that reports the session information to FortiAnalyzer. References: =
* 1: Security Fabric - Fortinet Documentation1
* 2: FortiAnalyzer Demo6
* 3: Security Fabric topology
* 4: Security Fabric UTM features
* 5: Security Fabric session handling
質問 # 46
......
あなたを必ず合格させるNSE7_EFW-7.2問題集PDF2025年最新のに更新された82問あります：https://jp.fast2test.com/NSE7_EFW-7.2-premium-file.html