NSE7_EFW-7.0試験問題を今すぐ試そう！最新の[2023年最新] 正解回答付き [Q80-Q102]

NSE7_EFW-7.0試験問題を今すぐ試そう！最新の[2023年最新] 正解回答付き

練習できるNSE7_EFW-7.0には認定ガイド問題と解答とトレーニングを提供しています

質問 # 80
What is the purpose of an internal segmentation firewall (ISFW)?

A. It is the first line of defense at the network perimeter.
B. It splits the network into multiple security segments to minimize the impact of breaches.
C. It is an all-in-one security appliance that is placed at remote sites to extend the enterprise network.
D. It inspects incoming traffic to protect services in the corporate DMZ.

正解：B

解説：
ISFW splits your network into multiple security segments. They serve as a breach containers from attacks that come from inside.

質問 # 81
Examine the IPsec configuration shown in the exhibit; then answer the question below.

An administrator wants to monitor the VPN by enabling the IKE real time debug using these commands:
diagnose vpn ike log-filter src-addr4 10.0.10.1
diagnose debug application ike -1
diagnose debug enable
The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are being interchanged between both IPsec gateways. However, the IKE real time debug does NOT show any output .
Why isn't there any output?

A. The log-filter setting is set incorrectly. The VPN's traffic does not match this filter.
B. The IKE real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.
C. The IKE real time shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.
D. The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.

正解：A

質問 # 82
Refer to the exhibit, which contains the partial output of the get vpn ipsec tunnel details command.

Based on the output, which two statements are correct? (Choose two.)

A. Anti-replay is disabled.
B. Hub2Spoke1 is configured on interface wan2.
C. Hub2Spoke1 is a policy-based VPN.
D. Phase 2 authentication is set to sha1 on both sides.

正解：B、D

質問 # 83
A FortiGate has two default routes:

All Internet traffic is currently using port1. The exhibit shows partial information for one sample session of Internet traffic from an internal user:

What would happen with the traffic matching the above session if the priority on the first default route (IDd1) were changed from 5 to 20?

A. The session would be deleted, and the client would need to start a new session.
B. The session would remain in the session table, and its traffic would start to egress from port2.
C. The session would remain in the session table, but its traffic would now egress from both port1 and port2.
D. The session would remain in the session table, and its traffic would still egress from port1.

正解：D

質問 # 84
Exhibits:

Refer to the exhibits, which contain the network topology and BGP configuration for a hub.
An administrator is trying to configure ADVPN with a hub-spoke VPN setup using iBGP. All the VPNs are up and connected to the hub. The hub is receiving route information from both spokes over iBGP; however, the spokes are not receiving route information from each other.
What change must the administrator make to the hub BGP configuration so that the routes learned by one spoke are forwarded to the other spokes?

A. Make the configuration of remote-as different from the configuration of local-as.
B. Change the router id to 10.1.0.254.
C. Configure the hub as a route reflector client.
D. Configure an individual neighbor and remove neighbor-range configuration.

正解：C

質問 # 85
When using the SSL certificate inspection method for HTTPS traffic, how does FortiGate filter web requests when the browser client does not provide the server name indication (SNI) extension?

A. FortiGate uses CN information from the Subject field in the server's certificate.
B. FortiGate uses the requested URL from the user's web browser.
C. FortiGate blocks the request without any further inspection.
D. FortiGate switches to the full SSL inspection method to decrypt the data.

正解：A

質問 # 86
Examine the partial output from the IKE real time debug shown in the exhibit; then answer the question below.

Why didn't the tunnel come up?

A. The remote gateway's Phase-2 configuration does not match the local gateway's phase-2 configuration.
B. The remote gateway's Phase-1 configuration does not match the local gateway's phase-1 configuration.
C. One IPsec gateway is using main mode, while the other IPsec gateway is using aggressive mode.
D. IKE mode configuration is not enabled in the remote IPsec gateway.

正解：B

質問 # 87
Examine the following partial outputs from two routing debug commands; then answer the question below:

Why the default route using port2 is not displayed in the output of the second command?

A. It has a higher priority than the default route using port1.
B. It has a higher distance than the default route using port1.
C. It is disabled in the FortiGate configuration.
D. It has a lower priority than the default route using port1.

正解：B

質問 # 88
Examine the output of the 'diagnose debug rating' command shown in the exhibit; then answer the question below.

Which statement are true regarding the output in the exhibit? (Choose two.)

A. The TZ value represents the delta between each FortiGuard server's time zone and the FortiGate's time zone.
B. FortiGate will send the FortiGuard queries to the server with highest weight.
C. There are three FortiGuard servers that are not responding to the queries sent by the FortiGate.
D. A server's round trip delay (RTT) is not used to calculate its weight.

正解：A、B

質問 # 89
Refer to the exhibit, which contains the partial output of a diagnose command.

Based on the output, which two statements are correct? (Choose two.)

A. The remote gateway has quick mode selectors containing a destination subnet of 10.1.2.0/24.
B. DPD is disabled.
C. The remote gateway IP is 10.200.5.1.
D. Anti-replay is enabled.

正解：A、D

解説：
Enterprise_Firewall_7.0_Study_Guide-Online.pdf p 427, 444
Since the local subnet is 10.1.2.0/24, the remote gateway has the destination subnet as 10.1.2.0. The remote gateway IP is 10.200.4.1. DPD is enabled (dpd-link=on)

質問 # 90
When using the SSL certificate inspection method to inspect HTTPS traffic, how does FortiGate filter web requests when the client browser does not provide the server name indication (SNI) extension?

A. FortiGate uses the requested URL from the user's web browser.
B. FortiGate blocks the request without any further inspection.
C. FortiGate switches to the full SSL inspection method to decrypt the data.
D. FortiGate uses the CN information from the Subject field in the server certificate.

正解：D

質問 # 91
Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)

A. Add devices to FortiManager.
B. Preview pending configuration changes for managed devices.
C. Install configuration changes to managed devices.
D. Import interface mappings from managed devices.
E. Import policy packages from managed devices.

正解：B、C

解説：
https://help.fortinet.com/fmgr/50hlp/56/5-6-2/FortiManager_Admin_Guide/1000_Device%20Manager/1200_install_to%20devices/0400_Install%20wizard-device%20settings.htm There are 4 main wizards: Add Device: is used to add devices to central management and import their configurations.
Install: is used to install configuration changes from Device Manager or Policies & Objects to the managed devices. It allows you to preview the changes and, if the administrator doesn't agree with the changes, cancel and modify them.
Import policy: is used to import interface mapping, policy database, and objects associated with the managed devices into a policy package under the Policy & Object tab. It runs with the Add Device wizard by default and may be run at any time from the managed device list.
Re-install policy: is used to perform a quick install of the policy package. It doesn't give the ability to preview the changes that will be installed to the managed device.

質問 # 92
Which two conditions would prevent a static route from being added to the routing table? (Choose two.)

A. The route has a lower priority value than another route to the same destination.
B. There is another other route to the same destination, with a lower distance.
C. The next-hop IP address is unreachable.
D. The interface specified in the route configuration is down

正解：B、D

解説：
The routing table contains only the static route with the lowest distance https://community.fortinet.com/t5/FortiGate/Technical-Note-Routing-behavior-depending-on-distance-and/ta-p/198221

質問 # 93
View the exhibit, which contains the output of a diagnose command, and the answer the question below.

Which statements are true regarding the Weight value?

A. Its value is incremented with each packet lost.
B. Its initial value is calculated based on the round trip delay (RTT).
C. It determines which FortiGuard server is used for license validation.
D. Its initial value is statically set to 10.

正解：A

質問 # 94
Examine the IPsec configuration shown in the exhibit; then answer the question below.

An administrator wants to monitor the VPN by enabling the IKE real time debug using these commands:
diagnose vpn ike log-filter src-addr4 10.0.10.1
diagnose debug application ike -1
diagnose debug enable
The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are being interchanged between both IPsec gateways. However, the IKE real time debug does NOT show any output. Why isn't there any output?

A. The log-filter setting is set incorrectly. The VPN's traffic does not match this filter.
B. The IKE real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.
C. The IKE real time shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.
D. The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.

正解：A

質問 # 95
Refer to the exhibit, which shows the output of a debug command.

Which two statements about the output are true? (Choose two.)

A. Port4 is connected to the OSPF backbone area.
B. In the network connected to port4, two OSPF routers are down.
C. The local FortiGate is the backup designated router.
D. The local FortiGate OSPF router ID is 0.0.0.4.

正解：A、D

質問 # 96
Refer to the exhibit, which contains partial output from an IKE real-time debug.

Why did the tunnel not come up?

A. The Diffie-Hellman group does not match on the local and remote gateways.
B. The proposal ID does not match between local and remote gateways.
C. The local gateway has configured less secure encryption and hashing algorithms compared to the remote gateway.
D. The encapsulation method for phase 2 is set to none on local and remote gateways.

正解：C

解説：
local gateway: encryption AES-128, hash SHA remote gateway: encryption AES-256, hash SHA-256 So local gateway has less secure settings

質問 # 97
Refer to the exhibit, which contains partial output from an IKE real-time debug.

Which two statements about this debug output are correct? (Choose two.)

A. The negotiation is using AES128 encryption with CBC hash.
B. The initiator provided remote as its IPsec peer ID.
C. It shows a phase 1 negotiation.
D. The remote gateway IP address is 10.0.0.1.

正解：B、C

質問 # 98
A FortiGate device has the following LDAP configuration:

The administrator executed the 'dsquery' command in the Windows LDAp server 10.0.1.10, and got the following output:
>dsquery user -samid administrator
"CN=Administrator, CN=Users, DC=trainingAD, DC=training, DC=lab"
Based on the output, what FortiGate LDAP setting is configured incorrectly?

A. password.
B. cnid.
C. dn.
D. username.

正解：D

質問 # 99
View these partial outputs from two routing debug commands:

Which outbound interface will FortiGate use to route web traffic from internal users to the Internet?

A. Both port1 and port2
B. port2
C. port3
D. port1

正解：D

質問 # 100
View the exhibit, which contains the output of diagnose sys session stat, and then answer the question below.

Which statements are correct regarding the output shown? (Choose two.)

A. There are 166 TCP sessions waiting to complete the three-way handshake.
B. There are 0 ephemeral sessions.
C. All the sessions in the session table are TCP sessions.
D. No sessions have been deleted because of memory pages exhaustion.

正解：B、D

質問 # 101
View the following FortiGate configuration.

All traffic to the Internet currently egresses from port1.
The exhibit shows partial session information for Internet traffic from a user on the internal network:

If the priority on route ID 1 were changed from 5 to 20, what would happen to traffic matching that user's session?

A. The session would remain in the session table, and its traffic would start to egress from port2.
B. The session would remain in the session table, but its traffic would now egress from both port1 and port2.
C. The session would remain in the session table, and its traffic would still egress from port1.
D. The session would be deleted, so the client would need to start a new session.

正解：C

質問 # 102
......

試験準備には欠かさない！トップクラスのFortinet NSE7_EFW-7.0試験アプリ学習ガイド練習問題最新版：https://jp.fast2test.com/NSE7_EFW-7.0-premium-file.html

無料Fortinet NSE7_EFW-7.0テスト練習問題試験問題集：https://drive.google.com/open?id=1aZ4p0SXOLLOCnpWeXTbS2wBJIFlMZpYF