[2022] Pass Fortinet NSE7_EFW-7.0 Exam Updated 115 Questions
Get 2022 Updated Free Fortinet NSE7_EFW-7.0 Exam Questions and Answer
NEW QUESTION 25
View the exhibit, which contains a partial web filter profile configuration, and then answer the question below.
Which action will FortiGate take if a user attempts to access www.dropbox.com, which is categorized as File Sharing and Storage?
- A. FortiGate will exempt the connection based on the Web Content Filter configuration.
- B. FortiGate will block the connection as an invalid URL.
- C. FortiGate will block the connection based on the URL Filter configuration.
- D. FortiGate will allow the connection based on the FortiGuard category based filter configuration.
Answer: C
NEW QUESTION 26
View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.
The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel.
To diagnose, the administrator enters these CLI commands:
However, the IKE real time debug does not show any output .
Why ?
- A. The debug shows only error messages. If there is no output, then the tunnel is operating normally.
- B. The log-filter setting was set incorrectly. The VPN's traffic does not match this filter.
- C. The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.
- D. The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.
Answer: B
NEW QUESTION 27
View the exhibit, which contains the output of a debug command, and then answer the question below.
Which of the following statements about the exhibit are true? (Choose two.)
- A. Port4 is connected to the OSPF backbone area.
- B. The local FortiGate has been elected as the OSPF backup designated router.
- C. The local FortiGate's OSPF router ID is 0.0.0.4
- D. In the network on port4, two OSPF routers are down.
Answer: A,C
NEW QUESTION 28
Which statement is true regarding File description (FD) conserve mode?
- A. Restarting the WAD process is required to leave FD conserve mode.
- B. IPS inspection is affected when FortiGate enters FD conserve mode.
- C. A FortiGate enters FD conserve mode when the amount of available description is less than 5%.
- D. FD conserve mode affects all daemons running on the device.
Answer: C
NEW QUESTION 29
What events are recorded in the crashlogs of a FortiGate device? (Choose two.)
- A. A process crash.
- B. System entering to and leaving from the proxy conserve mode.
- C. Configuration changes.
- D. Changes in the status of any of the FortiGuard licenses.
Answer: A,B
NEW QUESTION 30
View the exhibit, which contains the output of diagnose sys session stat, and then answer the question below.
Which statements are correct regarding the output shown? (Choose two.)
- A. There are 0 ephemeral sessions.
- B. All the sessions in the session table are TCP sessions.
- C. There are 166 TCP sessions waiting to complete the three-way handshake.
- D. No sessions have been deleted because of memory pages exhaustion.
Answer: A,D
NEW QUESTION 31
An administrator has configured a dial-up IPsec VPN with one phase 2, extended authentication (XAuth) and IKE mode configuration.
The administrator has also enabled the IKE real time debug:
diagnose debug application ike-1
diagnose debug enable
In which order is each step and phase displayed in the debug output each time a new dial-up user is connecting to the VPN?
- A. Phase1; XAuth; phase 2; IKE mode configuration.
- B. Phase1; XAuth; IKE mode configuration; phase2.
- C. Phase1; IKE mode configuration; XAuth; phase 2.
- D. Phase1; IKE mode configuration; phase 2; XAuth.
Answer: B
NEW QUESTION 32
Which of the following statements are true regarding the SIP session helper and the SIP application layer gateway (ALG)? (Choose three.)
- A. SIP ALG can create expected sessions for media traffic; SIP helper does not.
- B. SIP ALG supports SIP HA failover; SIP helper does not.
- C. SIP helper supports SIP over TCP and UDP; SIP ALG supports only SIP over UDP.
- D. SIP ALG supports SIP over IPv6; SIP helper does not.
- E. SIP session helper runs in the kernel; SIP ALG runs as a user space process.
Answer: B,D,E
NEW QUESTION 33
An administrator cannot connect to the GIU of a FortiGate unit with the IP address 10.0.1.254. The administrator runs the debug flow while attempting the connection using HTTP.
The output of the debug flow is shown in the exhibit:
Based on the error displayed by the debug flow, which are valid reasons for this problem? (Choose two.)
- A. Redirection of HTTP to HTTPS administrative access is disabled.
- B. HTTP administrative access is configured with a port number different than 80.
- C. HTTP administrative access is disabled in the FortiGate interface with the IP address 10.0.1.254.
- D. The packet is denied because of reverse path forwarding check.
Answer: B,C
NEW QUESTION 34
Four FortiGate devices configured for OSPF connected to the same broadcast domain. The first unit is elected as the designated router. The second unit is elected as the backup designated router.
Under normal operation, how many OSPF full adjacencies are formed to each of the other two units?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
NEW QUESTION 35
Examine the following partial output from two system debug commands; then answer the question below.
Which of the following statements are true regarding the above outputs? (Choose two.)
- A. The Cached value is always the Active value plus the Inactive value
- B. The unit is in kernel conserve mode
- C. The unit is running a 32-bit FortiOS
- D. Kernel indirectly accesses the low memory (LowTotal) through memory paging
Answer: A,C
NEW QUESTION 36
View the exhibit, which contains the partial output of a diagnose command, and then answer the question below.
Based on the output, which of the following statements is correct?
- A. DPD is disabled.
- B. Remote gateway IP is 10.200.5.1.
- C. Anti-reply is enabled.
- D. Quick mode selectors are disabled.
Answer: C
NEW QUESTION 37
View these partial outputs from two routing debug commands:
Which outbound interface will FortiGate use to route web traffic from internal users to the Internet?
- A. Both port1 and port2
- B. port2
- C. port3
- D. port1
Answer: D
NEW QUESTION 38
Refer to the exhibit, which contains the output of diagnose sys session list.
If the HA ID for the primary unit is zero (0), which statement about the output is true?
- A. This session is for HA heartbeat traffic.
- B. This session cannot be synced with the slave unit.
- C. The master unit is processing this traffic.
- D. The inspection of this session has been offloaded to the slave unit.
Answer: C
NEW QUESTION 39
A FortiGate device has the following LDAP configuration:
The LDAP user student cannot authenticate.
The exhibit shows the output of the authentication real time debug while testing the student account:
Based on the above output, what FortiGate LDAP settings must the administer check? (Choose two.)
- A. cnid.
- B. username.
- C. password.
- D. dn.
Answer: B,C
NEW QUESTION 40
View the exhibit, which contains the output of a diagnose command, and the answer the question below.
Which statements are true regarding the Weight value?
- A. Its initial value is calculated based on the round trip delay (RTT).
- B. It determines which FortiGuard server is used for license validation.
- C. Its initial value is statically set to 10.
- D. Its value is incremented with each packet lost.
Answer: D
NEW QUESTION 41
Refer to exhibit, which contains the output of a BGP debug command.
Which statement explains why the state of the 10.200.3.1 peer is Connect?
- A. The local router is receiving BGP keepalives from the remote peer, but the local peer has not received the OpenConfirm yet.
- B. The local router has received the BGP prefixes from the remote peer.
- C. The TCP session to 10.200.3.1 has not completed the 3-way handshake.
- D. The local router is receiving the BGP keepalives from the peer, but it has not received a BGP prefix yet.
Answer: C
NEW QUESTION 42
A FortiGate's portl is connected to a private network. Its port2 is connected to the Internet. Explicit web proxy is enabled in port1 and only explicit web proxy users can access the Internet. Web cache is NOT enabled. An internal web proxy user is downloading a file from the Internet via HTTP .
Which statements are true regarding the two entries in the FortiGate session table related with this traffic? (Choose two.)
- A. One session has the proxy flag on, the other one does not.
- B. One of the sessions has the IP address of port2 as the source IP address.
- C. The destination IP addresses of both sessions are IP addresses assigned to FortiGate's interfaces.
- D. Both session have the local flag on.
Answer: B,D
NEW QUESTION 43
View the following FortiGate configuration.
All traffic to the Internet currently egresses from port1.
The exhibit shows partial session information for Internet traffic from a user on the internal network:
If the priority on route ID 1 were changed from 5 to 20, what would happen to traffic matching that user's session?
- A. The session would remain in the session table, and its traffic would start to egress from port2.
- B. The session would remain in the session table, but its traffic would now egress from both port1 and port2.
- C. The session would remain in the session table, and its traffic would still egress from port1.
- D. The session would be deleted, so the client would need to start a new session.
Answer: C
NEW QUESTION 44
......
Verified NSE7_EFW-7.0 exam dumps Q&As with Correct 115 Questions and Answers: https://www.braindumpspass.com/Fortinet/NSE7_EFW-7.0-practice-exam-dumps.html
NSE7_EFW-7.0 Dumps PDF and Test Engine Exam Questions: https://drive.google.com/open?id=1-4pDeGrdmvfHOcHLDyXzBaHFgeYcm1PC
