NSE7_EFW-7.0 Dumps PDF - NSE7_EFW-7.0 Real Exam Questions Answers [Q18-Q33] : Top Exam Collection : http://blog.topexamcollection.com

Q18. An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device. The administrator decides to enable the setting link-failed-signal to fix the problem.
Which statement about this setting is true?

It sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.

It sends a link failed signal to all connected devices.

It disabled all the non-heartbeat interfaces in all HA members for two seconds after a failover.

It forces the former primary device to shut down all its non-heartbeat interfaces for one second, while the failover occurs.

Q19. Examine the output from the ‘diagnose debug authd fsso list’ command; then answer the question below.
diagnose debug authd fsso list -FSSO logons-IP: 192.168.3.1 User: STUDENT Groups: TRAININGAD/USERS Workstation: INTERNAL2. TRAINING. LAB The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.
What should the administrator check?

The IP address recorded in the logon event for the user STUDENT.

The DNS name resolution for the workstation name INTERNAL2. TRAINING. LAB.

The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2. TRAINING. LAB.

The reserve DNS lookup forthe IP address 192.168.3.1.

Q20. An administrator cannot connect to the GIU of a FortiGate unit with the IP address 10.0.1.254. The administrator runs the debug flow while attempting the connection using HTTP.
The output of the debug flow is shown in the exhibit:

Based on the error displayed by the debug flow, which are valid reasons for this problem? (Choose two.)

HTTP administrative access is disabled in the FortiGate interface with the IP address 10.0.1.254.

Redirection of HTTP to HTTPS administrative access is disabled.

HTTP administrative access is configured with a port number different than 80.

The packet is denied because of reverse path forwarding check.

Q21. View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

Why didn’t the tunnel come up?

The pre-shared keys do not match.

The remote gateway’s phase 2 configuration does not match the local gateway’s phase 2 configuration.

The remote gateway’s phase 1 configuration does not match the local gateway’s phase 1 configuration.

The remote gateway is using aggressive mode and the local gateway is configured to use man mode.

Q22. Refer to the exhibit, which shows a FortiGate configuration.

An administrator is troubleshooting a web filter issue on FortiGate. The administrator has configured a web filter profile and applied it to a policy; however, the web filter is not inspecting any traffic that is passing through the policy.
What must the administrator change to fix the issue?

The administrator must increase webfilter-timeout.

The administrator must disable webfilter-force-off.

The administrator must change protocol to TCP.

The administrator must enable fortiguard-anycast.

Q23. Which of the following statements are true regarding the SIP session helper and the SIP application layer gateway (ALG)? (Choose three.)

SIP session helper runs in the kernel; SIP ALG runs as a user space process.

SIP ALG supports SIP HA failover; SIP helper does not.

SIP ALG supports SIP over IPv6; SIP helper does not.

SIP ALG can create expected sessions for media traffic; SIP helper does not.

SIP helper supports SIP over TCP and UDP; SIP ALG supports only SIP over UDP.

Q24. Examine the following traffic log; then answer the question below.
date-20xx-02-01 time=19:52:01 devname=master device_id=”xxxxxxx”
log_id=0100020007 type=event subtype=system pri critical vd=root service=kemel status=failure msg=”NAT port is exhausted.”
What does the log mean?

There is not enough available memory in the system to create a new entry in the NAT port table.

The limit for the maximum number of simultaneous sessions sharing the same NAT port has been reached.

FortiGate does not have any available NAT port for a new connection.

The limit for the maximum number of entries in the NAT port table has been reached.

Q25. Examine the output of the ‘diagnose ips anomaly list’ command shown in the exhibit; then answer the question below.

Which IP addresses are included in the output of this command?

Those whose traffic matches a DoS policy.

Those whose traffic matches an IPS sensor.

Those whose traffic exceeded a threshold of a matching DoS policy.

Those whose traffic was detected as an anomaly by an IPS sensor.

Q26. Examine the output of the ‘diagnose debug rating’ command shown in the exhibit; then answer the question below.

Which statement are true regarding the output in the exhibit? (Choose two.)

There are three FortiGuard servers that are not responding to the queries sent by the FortiGate.

The TZ value represents the delta between each FortiGuard server’s time zone and the FortiGate’s time zone.

FortiGate will send the FortiGuard queries to the server with highest weight.

A server’s round trip delay (RTT) is not used to calculate its weight.

Q27. View the exhibit, which contains the partial output of an IKE real time debug, and then answer the question below.

The administrator does not have access to the remote gateway.
Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?

Change phase 1 encryption to AESCBC and authentication to SHA128.

Change phase 1 encryption to 3DES and authentication to CBC.

Change phase 1 encryption to AES128 and authentication to SHA512.

Change phase 1 encryption to 3DES and authentication to SHA256.

Q28. View the exhibit, which contains the output of get sys ha status, and then answer the question below.

Which statements are correct regarding the output? (Choose two.)

The slave configuration is not synchronized with the master.

The HA management IP is 169.254.0.2.

Master is selected because it is the only device in the cluster.

port 7 is used the HA heartbeat on all devices in the cluster.

Q29. An administrator is running the following sniffer in a FortiGate: diagnose sniffer packet any “host 10.0.2.10” 2
What information is included in the output of the sniffer? (Choose two.)

Ethernet headers.

IP payload.

IP headers.

Port names.

Q30. View the exhibit, which contains the output of a BGP debug command, and then answer the question below.

Which of the following statements about the exhibit are true? (Choose two.)

For the peer 10.125.0.60, the BGP state of is Established.

The local BGP peer has received a total of three BGP prefixes.

Since the BGP counters were last reset, the BGP peer 10.200.3.1 has never been down.

The local BGP peer has not established a TCP session to the BGP peer 10.200.3.1.

Q31. Which two statements about FortiManager is true when it is deployed as a local FDS? (Choose two.)

It caches available firmware updates for unmanaged devices.

It can be configured as an update server, or a rating server, but not both.

It supports rating requests from both managed and unmanaged devices.

It provides VM license validation services.

Q32. Which two configuration settings change the behavior for content-inspected traffic while FortiGate is in conserve mode? (Choose two.)

IPS failopen

mem failopen

AV failopen

UTM failopen

Q33. What is the diagnose test application ipsmonitor 99 command used for?

To enable IPS bypass mode

To provide information regarding IPS sessions

To disable the IPS engine

To restart all IPS engines and monitors