Fortinet NSE7_EFW-7.0認定ガイドPDFは100%カバー率でリアル試験問題 [Q20-Q43]

Fortinet NSE7_EFW-7.0認定ガイドPDFは100%カバー率でリアル試験問題

合格させるNSE7_EFW-7.0試験にはリアル問題解答

質問 # 20
View the global IPS configuration, and then answer the question below.

Which of the following statements is true regarding this configuration?

A. FortiGate will spawn IPS engine instances based on the system load.
B. IPS will use the faster matching algorithm which is only available for units with more than 4 GB memory.
C. IPS will scan every byte in every session.
D. New packets will be passed through without inspection if the IPS socket buffer runs out of memory.

正解：C

質問 # 21
Refer to the exhibits.

Which contain the partial configurations of two VPNs on FortiGate.
An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovered that FortiGate is not matching the user-2 VPN for members of the Users-2 group.
Which two changes must administrator make to fix the issue? (Choose two.)

A. Change to aggressive mode on both VPNs.
B. Set up specific peer IDs on both VPNs.
C. Use different pre-shared keys on both VPNs
D. Enable Mode Config on both VPNs.

正解：A、B

質問 # 22
An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer.
If the administrator knows that there is no NAT device located between both FortiGates, what command should the administrator execute?

A. diagnose sniffer packet any 'esp'
B. diagnose sniffer packet any 'udp port 500 or udp port 4500'
C. diagnose sniffer packet any 'udp port 500'
D. diagnose sniffer packet any 'udp port 4500'

正解：A

質問 # 23
Refer to the exhibit, which shows the output of a debug command.

Which two statements about the output are true? (Choose two.)

A. In the network connected to port4, two OSPF routers are down.
B. The local FortiGate OSPF router ID is 0.0.0.4.
C. Port4 is connected to the OSPF backbone area.
D. The local FortiGate is the backup designated router.

正解：B、C

質問 # 24
What does the dirty flag mean in a FortiGate session?

A. Traffic has been blocked by the antivirus inspection.
B. The next packet must be re-evaluated against the firewall policies.
C. The session must be removed from the former primary unit after an HA failover.
D. Traffic has been identified as from an application that is not allowed.

正解：B

質問 # 25
Refer to the exhibit, which contains partial output from an IKE real-time debug.

Based on the debug output, which phase 1 setting is enabled in the configuration of this VPN?

A. auto-discovery-forwarder
B. auto-discovery-receiver
C. auto-discovery-shortcut
D. auto-discovery-sender

正解：D

質問 # 26
Examine the output of the 'get router info ospf interface' command shown in the exhibit; then answer the question below.

Which statements are true regarding the above output? (Choose two.)

A. There are at least 5 OSPF routers connected to the port4 network.
B. The port4 interface is connected to the OSPF backbone area.
C. The local FortiGate has been elected as the OSPF backup designated router.
D. Two OSPF routers are down in the port4 network.

正解：A、B

解説：
on BROADCAST network there are 4 neighbors, among which 1*DR +1*BDR. So our FG has 4 neighbors, but create adjacency only with 2 (with DR and BDR). 2 neighbors DRother (not down).

質問 # 27
Refer to the exhibit, which contains a TCL script configuration on FortiManager.
An administrator has configured the TCL script on FortiManager, but the TCL script failed to apply any changes to the managed device after being run.

Why did the TCL script fail to make any changes to the managed device?

A. Changes to an interface configuration can be made only by a CLI script.
B. The TCL script must start with tinclude <>.
C. The TCL command run_cmd has not been created.
D. Incomplete commands are ignored in TCL scripts.

正解：C

質問 # 28
Refer to the exhibit, which contains the partial output of a diagnose command.

Based on the output, which two statements are correct? (Choose two.)

A. DPD is disabled.
B. The remote gateway IP is 10.200.4.1.
C. Quick mode selectors are disabled.
D. Anti-replay is enabled

正解：B、D

質問 # 29
View the exhibit, which contains the output of a web diagnose command, and then answer the question below.

Which one of the following statements explains why the cache statistics are all zeros?

A. There are no users making web requests.
B. FortiGate is using a flow-based web filter and the cache applies only to proxy-based inspection.
C. The administrator has reallocated the cache memory to a separate process.
D. The FortiGuard web filter cache is disabled in the FortiGate's configuration.

正解：D

質問 # 30
A FortiGate is rebooting unexpectedly without any apparent reason. What troubleshooting tools could an administrator use to get more information about the problem? (Choose two.)

A. Firewall monitor.
B. Policy monitor.
C. Crashlogs.
D. Logs.

正解：C、D

質問 # 31
View the exhibit, which contains the output of a diagnose command, and then answer the question below.

What statements are correct regarding the output? (Choose two.)

A. This is an expected session created by a session helper.
B. This is an expected session created by an application control profile.
C. Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.0.1.10.
D. Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.200.1.1.

正解：A、D

質問 # 32
Which two statements about the Security Fabric are true? (Choose two.)

A. Only FortiGate devices with fabric-object-unification set to default will receive and synchronize global CMDB objects sent by the root FortiGate.
B. FortiGate uses FortiTelemetry protocol to communicate with FortiAnalyzer.
C. Only the root FortiGate sends logs to FortiAnalyzer.
D. Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer.

正解：A、D

解説：
FortiGate's to Root uses FortiTelemetry (TCP-8013) FortiTelemetry is also used for FortiClient communication Root Fortigate to FortiAnalyzer uses API (TCP-443)

質問 # 33
Which statement about NGFW policy-based application filtering is true?

A. FortiGate will drop all packets until the application can be identified.
B. After IPS identifies the application, it adds an entry to a dynamic ISDB table.
C. After the application has been identified, the kernel uses only the Layer 4 header to match the traffic.
D. The IPS security profile is the only security option you can apply to the security policy with the action set to ACCEPT.

正解：A

質問 # 34
View the exhibit, which contains the output of a real-time debug, and then answer the question below.

Which of the following statements is true regarding this output? (Choose two.)

A. This web request was inspected using the root web filter profile.
B. The requested URL belongs to category ID 52.
C. FortiGate found the requested URL in its local cache.
D. The web request was allowed by FortiGate.

正解：B、C

質問 # 35
An administrator cannot connect to the GIU of a FortiGate unit with the IP address 10.0.1.254. The administrator runs the debug flow while attempting the connection using HTTP. The output of the debug flow is shown in the exhibit:

Based on the error displayed by the debug flow, which are valid reasons for this problem? (Choose two.)

A. The packet is denied because of reverse path forwarding check.
B. Redirection of HTTP to HTTPS administrative access is disabled.
C. HTTP administrative access is configured with a port number different than 80.
D. HTTP administrative access is disabled in the FortiGate interface with the IP address 10.0.1.254.

正解：C、D

質問 # 36
In which two ways does FortiManager function when it is deployed as a local FDS? (Choose two.)

A. It caches available firmware updates for unmanaged devices.
B. It can be configured as an update server, a rating server, or both.
C. It supports rating requests from non-FortiGate devices.
D. It provides VM license validation services.

正解：B、D

質問 # 37
An administrator has enabled HA session synchronization in a HA cluster with two members .
Which flag is added to a primary unit's session to indicate that it has been synchronized to the secondary unit?

A. synced
B. nds.
C. dirty.
D. redir.

正解：A

質問 # 38
Examine the output of the 'diagnose ips anomaly list' command shown in the exhibit; then answer the question below.

Which IP addresses are included in the output of this command?

A. Those whose traffic matches an IPS sensor.
B. Those whose traffic was detected as an anomaly by an IPS sensor.
C. Those whose traffic matches a DoS policy.
D. Those whose traffic exceeded a threshold of a matching DoS policy.

正解：C

質問 # 39
Which two statements about conserve mode are true? (Choose two.)

A. FortiGate starts dropping all new sessions when the system memory reaches the configured red threshold.
B. FortiGate exits conserve mode when the system memory goes below the configured green threshold.
C. FortiGate enters conserve mode when the system memory reaches the configured extreme threshold.
D. FortiGate starts taking the configured action for new sessions requiring content inspection when the system memory reaches the configured red threshold.

正解：B、D

質問 # 40
View the exhibit, which contains the output of get sys ha status, and then answer the question below.

Which statements are correct regarding the output? (Choose two.)

A. The HA management IP is 169.254.0.2.
B. port 7 is used the HA heartbeat on all devices in the cluster.
C. Master is selected because it is the only device in the cluster.
D. The slave configuration is not synchronized with the master.

正解：B、D

質問 # 41
View the exhibit, which contains the output of diagnose sys session list, and then answer the question below.

If the HA ID for the primary unit is zero (0), which statement is correct regarding the output?