検証済みのNSE7_SDW-7.2問題集と解答で合格保証もしくは全額返金 [2025年03月]
NSE7_SDW-7.2のPDF問題集で2025年03月06日最近更新された問題
Fortinet NSE7_SDW-7.2 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 # 20
Refer to the exhibits.
An administrator is testing application steering in SD-WAN. Before generating test traffic, the administrator collected the information shown in exhibit A.
After generating GoToMeeting test traffic, the administrator examined the respective traffic log on FortiAnalyzer, which is shown in exhibit B. The administrator noticed that the traffic matched the implicit SD-WAN rule, but they expected the traffic to match rule ID 1.
Which two reasons explain why the traffic matched the implicit SD-WAN rule? (Choose two.)
- A. The session 3-tuple did not match any of the existing entries in the ISDB application cache.
- B. Port1 and port2 do not have a valid route to the destination.
- C. Full SSL inspection is not enabled on the matching firewall policy.
- D. FortiGate did not refresh the routing information on the session after the application was detected.
正解：A、D
解説：
Study guide 7.2 Page 191
質問 # 21
Refer to the exhibit.
The exhibit shows the SD-WAN rule status and configuration.
Based on the exhibit, which change in the measured latency will make T_MPLS_0 the new preferred member?
- A. When T_N1PLS_0 has a latency of 80 ms.
- B. When T_INET_0_0 and T_MPLS_0 have the same latency.
- C. When T_MPLS_0 has a latency of 100 ms.
- D. When T_INET_0_0 has a latency of 250 ms.
正解：A
質問 # 22
What are two advantages of using an IPsec recommended template to configure an IPsec tunnel in an hub-and- spoke topology? (Choose two.)
- A. The VPN monitor tool provides additional statistics for tunnels defined with an IPsec recommended template.
- B. It automatically install IPsec tunnels to every spoke when they are added to the FortiManager ADOM.
- C. It ensures consistent settings between phase1 and phase2.
- D. It guides the administrator to use Fortinet recommended settings.
正解：A、B
解説：
The use of an IPsec recommended template offers the advantage of ensuring consistent settings between phase1 and phase2 (A), which is essential for the stability and security of the IPsec tunnel. Additionally, it guides the administrator to use Fortinet's recommended settings (B), which are designed to optimize performance and security based on Fortinet's best practices.References:The benefits of using IPsec recommended templates are outlined in Fortinet's SD-WAN documentation, which emphasizes the importance of consistency and adherence to recommended configurations.
質問 # 23
Refer to the exhibits.
Exhibit A -
Exhibit B -
Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SD-WAN member status, the routing table, and the performance SLA status.
If port2 is detected dead by FortiGate, what is the expected behavior?
- A. Host 8.8.8.8 is reachable through port1 and port2.
- B. The administrator manually restores the static routes for port2, if port2 becomes alive.
- C. Port2 becomes alive after three successful probes are detected.
- D. FortiGate removes all static routes for port2.
正解：D
解説：
This is due to Update static route is enable which removes the static route entry referencing the interface if the interface is dead
質問 # 24 
Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2. The administrator configured ADVPN on both hub-and-spoke groups.
Which two outcomes are expected if a user in Toronto sends traffic to London? (Choose two.)
- A. Traffic from Toronto to London triggers the dynamic negotiation of a direct site-to-site VPN.
- B. London generates an IKE information message that contains the Toronto public IP address.
- C. The first packets from Toronto to London are routed through Hub 1 then to Hub 2.
- D. Toronto needs to establish a site-to-site tunnel with Hub 2 to bypass Hub 1.
正解：A、C
質問 # 25
Refer to the exhibit.
Based on the exhibit, which two actions does FortiGate perform on traffic passing through port2? (Choose two.)
- A. FortiGate performs routing lookups for new sessions only, after a route change.
- B. FortiGate always blocks all traffic, after a route change.
- C. FortiGate does not change the routing information on existing sessions that use a valid gateway, after a route change.
- D. FortiGate flushes all routing information from the session table, after a route change.
正解：A、C
質問 # 26
Which two statements about SD-WAN central management are true? (Choose two.)
- A. It does not support meta fields.
- B. It uses templates to configure SD-WAN on managed devices.
- C. The objects are saved in the ADOM common object database.
- D. It supports normalized interfaces for SD-WAN member configuration.
正解：B、C
解説：
Normalized interfaces are not supported for SD-WAN templates. You can create multiple SD-WAN zones and add interface members to the SD-WAN zones. You must bind the interface members by name to physical interfaces or VPN interfaces.https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan-new-features/794804
/new-sd-wan-template-fmg
質問 # 27
Refer to the exhibits.
An administrator is testing application steering in SD-WAN. Before generating test traffic, the administrator collected the information shown in exhibit A.
After generating GoToMeeting test traffic, the administrator examined the respective traffic log on FortiAnalyzer, which is shown in exhibit B.
The administrator noticed that the traffic matched the implicit SD-WAN rule, but they expected the traffic to match rule ID 1.
Which two reasons explain why the traffic matched the implicit SD-WAN rule? (Choose two.)
- A. The session 3-tuple did not match any of the existing entries in the ISDB application cache.
- B. FortiGate did not refresh the routing information on the session after the application was detected.
- C. Port1 and port2 do not have a valid route to the destination.
- D. Full SSL inspection is not enabled on the matching firewall policy.
正解：C、D
解説：
Study guide 7.2 Page 191
質問 # 28
Refer to the exhibit.
FortiGate has multiple dial-up VPN interfaces incoming on port1 that match only FIRST_VPN.
Which two configuration changes must be made to both IPsec VPN interfaces to allow incoming connections to match all possible IPsec dial-up interfaces? (Choose two.)
- A. Use unique Diffie Hellman groups on each VPN interface.
- B. Use different proposals are used between the interfaces.
- C. Configure the IKE mode to be aggressive mode.
- D. Specify a unique peer ID for each dial-up VPN interface.
正解：C、D
質問 # 29 
Exhibit A shows the firewall policy and exhibit B shows the traffic shaping policy.
The traffic shaping policy is being applied to all outbound traffic; however, inbound traffic is not being evaluated by the shaping policy.
Based on the exhibits, what configuration change must be made in which policy so that traffic shaping can be applied to inbound traffic?
- A. In the firewall policy, select Proxy-based as Inspection Mode.
- B. In the traffic shaping policy, select Assign Shaping Class ID as Action.
- C. Create a new firewall policy, and the select the SD-WAN zone as Incoming Interface.
- D. In the traffic shaping policy, enable Reverse shaper, and then select the traffic shaper to use.
正解：D
質問 # 30
Refer to the exhibit.
Which are two expected behaviors of the traffic that matches the traffic shaper? (Choose two.)
- A. The number of simultaneous connections among all source IP addresses cannot exceed five connections.
- B. The traffic shaper limits the combined bandwidth of all connections to a maximum of 5 MB/sec.
- C. The traffic shaper limits the bandwidth of each source IP address to a maximum of 625 KB/sec.
- D. The number of simultaneous connections allowed for each source IP address cannot exceed five connections.
正解：C、D
質問 # 31
Refer to the exhibit.
Which statement explains the output shown in the exhibit?
- A. FortiGate must re-evaluate the session due to routing change.
- B. FortiGate will not re-evaluate the session following a firewall policy change.
- C. FortiGate performed standard FIB routing on the session.
- D. FortiGate used 192.2.0.1 as the gateway for the original direction of the traffic.
正解：A
解説：
The snat-route-change option is enabled by default. This option enables FortiGate to re-evaluate the routing table and select a new egress interface if the next hop IP address changes. This option only applies to sessions in the dirty state. Sessions in the log state are not affected by routing changes.
質問 # 32
Refer to the exhibit.
Based on the exhibit, which two statements are correct about the health of the selected members? (Choose two.)
- A. During passive monitoring, FortiGate can't detect dead members.
- B. After FortiGate switches to active mode, FortiGate never fails back to passive monitoring.
- C. FortiGate can offload the traffic that is subject to passive monitoring to hardware.
- D. FortiGate passively monitors the member if TCP traffic is passing through the member.
正解：A、D
質問 # 33
Refer to the exhibit.
An administrator used the SD-WAN overlay template to prepare an IPsec configuration for a hub-and-spoke SD-WAN topology. The exhibit shows the installation preview for one FortiGate device. In the exhibit, which statement best describes the configuration applied to the FortiGate device?
- A. It is a spoke device that establishes dynamic IPsec tunnels to the hub. The subnet range is 10.10.128.0/23.
- B. It is a hub device and will automatically discover the spoke devices that are in the SD-WAN topology.
- C. It is a hub device. It can send ADVPN shortcut offers.
- D. It is a spoke device that establishes dynamic IPsec tunnels to the hub. It can send ADVPN shortcut requests.
正解：D
解説：
According to the SD-WAN 7.2 Study Guide, the SD-WAN overlay template simplifies the configuration of IPsec tunnels in a hub-and-spoke topology. The template defines the following parameters:
type: dynamic for spokes, static for hubs
interface: the WAN interface to use for the IPsec tunnel
network-overlay: enable for spokes, disable for hubs
network-id: a unique identifier for each spoke
auto-discovery-sender: enable for hubs, disable for spokes
auto-discovery-receiver: enable for spokes, disable for hubs
Based on the exhibit, the FortiGate device has the following configuration:
type: dynamic
interface: port1
network-overlay: enable
network-id: 5
auto-discovery-sender: disable
auto-discovery-receiver: enable
Therefore, the FortiGate device is a spoke that establishes dynamic IPsec tunnels to the hub. It also has the network-overlay and auto-discovery-receiver options enabled, which means it can send ADVPN shortcut requests to other spokes when it receives a shortcut offer from the hub
質問 # 34
Exhibit.
The exhibit shows the output of the command diagnose sys sdwan health-check status collected on a FortiGate device. Which two statements are correct about the health check status on this FortiGate device? (Choose two.)
- A. The health-check VPN_PING orders the members according to the lowest jitter.
- B. The interface T_INET_0 missed three SLA targets.
- C. The interface T_INET_1 missed one SLA target.
- D. There is no SLA criteria configured for the health-check Level3_DNS.
正解：A、D
解説：
According to the FortiGate / FortiOS 6.4.2 Administration Guide, the health check status command displays the status of the health check probes for each SD-WAN member interface. The output includes the following information:
* state: the current state of the interface, either alive or dead
* packet-loss: the percentage of packets lost during the health check
* latency: the average round-trip time in milliseconds
* jitter: the variation in latency
* mos: the mean opinion score, a measure of voice quality
* bandwidth: the available bandwidth in kilobits per second for each direction (up, down, bi)
* sla map: a bitmap that indicates which SLA criteria are met or failed Based on the exhibit, the following statements are correct:
* The health-check VPN_PING orders the members according to the lowest jitter. This means that the interface with the lowest jitter value is listed first, followed by the next lowest, and so on1. In the exhibit, the order is T_MPLS, T_INET_1, and T_INET_0.
* There is no SLA criteria configured for the health-check Level3_DNS. This means that the health check does not use any SLA parameters to determine the state of the interface2. In the exhibit, the sla map value is 0x0 for both port1 and port2, indicating that no SLA criteria are applied.
質問 # 35
Refer to the exhibits.
Exhibit A shows two IPsec templates to define Branch_IPsec_1 and Branch_IPsec_2. Each template defines a VPN tunnel.
Exhibit B shows the error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device.
Which statement best explain the cause for this issue?
- A. You can assign only one IPsec template to each FortiGate device.
- B. You can define only one IPsec tunnel from branch devices to HUB1.
- C. You can assign only one template with a tunnel of fype static to each FortiGate device
- D. You should review the branch1_fgt configuration for the already configured tunnel with the name HUB1-VPN2.
正解：A
解説：
The error message in Exhibit B indicates a conflicting template assignment. This occurs because FortiManager does not allow the assignment of multiple IPsec templates that define VPN tunnels with the same name or settings to the same FortiGate device. The conflict arises from trying to assign a second IPsec template to a device that already has one assigned. References: This is based on Fortinet's best practices and administrative guidelines which state that each FortiGate device should be assigned a unique IPsec template to avoid configuration conflicts.
質問 # 36
Refer to the exhibit.
Which statement about the role of the ADVPN device in handling traffic is true?
- A. Two hubs, 10.0.1.101 and 10.0.2.101, are receiving and forwarding queries between each other.
- B. Two spokes, 192.2.0.1 and 10.0.2.101, forward their queries to their hubs.
- C. This is a spoke that has received a query from a remote hub and has forwarded the response to its hub.
- D. This is a hub that has received a query from a spoke and has forwarded it to another spoke.
正解：D
質問 # 37
Which action fortigate performs on the traffic that is subject to a per-IP traffic shaper of 10 Mbps?
- A. Fortigate limits each source ip address to a maximum bandwidth of 10 Mbps.
- B. FortiGate shares 10 Mbps of bandwidth equally among all source IP addresses.
RIAS - C. FortiGate applies traffic shaping to the original traffic direction only.
- D. FortiGate guarantees a minimum of 10 Mbps of bandwidth to each source IP address.
正解：A
質問 # 38
Which diagnostic command can you use to show the member utilization statistics measured by performance
SLAs for the last 10 minutes?
- A. diagnose sys sdwan intf-sla-log
- B. diagnose ays sdwan health-check
- C. diagnose sys sdwan sla-log
- D. diagnose sys sdwan log
正解：C
質問 # 39
Which two protocols in the IPsec suite are most used for authentication and encryption? (Choosetwo.)
- A. Internet Key Exchange (IKE)
- B. Encapsulating Security Payload (ESP)
- C. Security Association (SA)
- D. Secure Shell (SSH)
正解：A、B
質問 # 40
Refer to the exhibits.
Exhibit A -
Exhibit B -
Exhibit A shows the traffic shaping policy and exhibit B shows the firewall policy.
The administrator wants FortiGate to limit the bandwidth used by YouTube. When testing, the administrator determines that FortiGate does not apply traffic shaping on YouTube traffic.
Based on the policies shown in the exhibits, what configuration change must be made so FortiGate performs traffic shaping on YouTube traffic?
- A. Application control must be enabled on the firewall policy.
- B. Individual SD-WAN members must be selected as the outgoing interface on the traffic shaping policy.
- C. Web filtering must be enabled on the firewall policy.
- D. Destination internet service must be enabled on the traffic shaping policy.
正解：C
質問 # 41
......
NSE7_SDW-7.2試験問題有効なNSE7_SDW-7.2問題集PDF：https://jp.fast2test.com/NSE7_SDW-7.2-premium-file.html