Fortinet NSE7_EFW-7.0 Exam Questions Simulate Actual NSE7_EFW-7.0 Exam

1. Refer to the exhibit, which contains partial output from an IKE real-time debug.





Why did the tunnel not come up?

2. Which two statements about the Security Fabric are true? (Choose two.)

3. An administrator has created a VPN community within VPN Manager on FortiManager. They also added gateways to the VPN community and are now trying to create firewall policies to permit traffic over the tunnel; however, the VPN interfaces are not listed as available options.

What step must the administrator take to resolve this issue?

4. Refer to the exhibit, which contains the partial output of the get vpn ipsec tunnel details command.





Based on the output, which two statements are correct? (Choose two.)

5. An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage. However, after the changes, one network application started to have problems. During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets, and before the arrival of the SYN/ACKs. When the SYN/ACK packets arrive to the FortiGate, the unit has already deleted the respective sessions.

Which TCP session timer must be increased to fix this problem?

6. A FortiGate device has the following LDAP configuration:





The administrator executed the ‘dsquery’ command in the Windows LDAp server 10.0.1.10, and got the following output:

>dsquery user Csamid administrator

“CN=Administrator, CN=Users, DC=trainingAD, DC=training, DC=lab”

Based on the output, what FortiGate LDAP setting is configured incorrectly?

7. An administrator has configured two FortiGate devices for an HA cluster. While testing the HA failover, the administrator noticed that some of the switches in the network continue to send traffic to the former primary unit. The administrator decides to enable the setting link-failed-signal to fix the problem.

Which statement is correct regarding this command?

8. Refer to the exhibits.





Which contain the partial configurations of two VPNs on FortiGate.

An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovered that FortiGate is not matching the user-2 VPN for members of the Users-2 group.

Which two changes must administrator make to fix the issue? (Choose two.)

9. View the exhibit, which contains the output of a debug command, and then answer the question below.





Which one of the following statements about this FortiGate is correct?

10. View the exhibit, which contains the output of a BGP debug command, and then answer the question below.





Which of the following statements about the exhibit are true? (Choose two.)

11. View the exhibit, which contains a partial routing table, and then answer the question below.





Assuming all the appropriate firewall policies are configured, which of the following pings will FortiGate route? (Choose two.)

12. Examine the following traffic log; then answer the question below.

date-20xx-02-01 time=19:52:01 devname=master device_id="xxxxxxx"

log_id=0100020007 type=event subtype=system pri critical vd=root service=kemel status=failure msg="NAT port is exhausted."

What does the log mean?

13. View the exhibit, which contains the output of a diagnose command, and the answer the question below.





Which statements are true regarding the Weight value?

14. Which of the following statements are true regarding the SIP session helper and the SIP application layer gateway (ALG)? (Choose three.)

15. Refer to the exhibits, which show the configuration on FortiGate and partial internet session information from a user on the internal network.





An administrator would like to test session failover between the two service provider connections.

What changes must the administrator make to force this existing session to immediately start using the other interface? (Choose two.)

16. Refer to the exhibit, which contains partial output from an IKE real-time debug.





Which two statements about this debug output are correct? (Choose two.)

17. Which two configuration commands change the default behavior for content-inspected traffic while FortiGate is in conserve mode? (Choose two.)

18. Which three conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three.)

19. View the exhibit, which contains an entry in the session table, and then answer the question below.





Which one of the following statements is true regarding FortiGate’s inspection of this session?

20. An administrator has enabled HA session synchronization in a HA cluster with two members.

Which flag is added to a primary unit’s session to indicate that it has been synchronized to the secondary unit?

21. Which two statements about an auxiliary session are true? (Choose two.)

22. Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)

23. Refer to the exhibit, which contains the output of a debug command.





If the default settings are in place, what can be concluded about the conserve mode shown in the exhibit?

24. An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device. The administrator decides to enable the setting link-failed-signal to fix the problem.

Which statement about this setting is true?

25. Examine the following partial outputs from two routing debug commands; then answer the question below.

# get router info kernel

tab=254 vf=0 scope=0type=1 proto=11 prio=0 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0

gwy=10.200.1.254 dev=2(port1)

tab=254 vf=0 scope=0type=1 proto=11 prio=10 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0

gwy=10.200.2.254 dev=3(port2)

tab=254 vf=0 scope=253type=1 proto=2 prio=0 0.0.0.0/0.0.0.0/.->10.0.1.0/24 pref=10.0.1.254

gwy=0.0.0.0 dev=4(port3)

# get router info routing-table all s*0.0.0.0/0 [10/0] via 10.200.1.254, portl [10/0] via 10.200.2.254, port2, [10/0] dO.0.1.0/24 is directly connected, port3 dO.200.1.0/24 is directly connected, portl d0.200.2.0/24 is directly connected, port2

Which outbound interface or interfaces will be used by this FortiGate to route web traffic from internal users to the Internet?

26. Examine the output of the ‘get router info bgp summary’ command shown in the exhibit; then answer the question below.





Which statement can explain why the state of the remote BGP peer 10.200.3.1 is Connect?

27. How does FortiManager handle FortiGuard requests from FortiGate devices, when it is configured as a local FDS?

28. Which statement is true regarding File description (FD) conserve mode?

29. Which two statements about conserve mode are true? (Choose two.)

30. Refer to the exhibit, which contains a CLI script configuration on FortiManager.





An administrator configured the CLI script on FortiManager, but the script failed to apply any changes to the managed device after being executed.

What are two reasons why the script did not make any changes to the managed device? (Choose two.)

31. Refer to the exhibit, which shows a session entry.

Which statement about this session is true?

32. Examine the output of the ‘diagnose ips anomaly list’ command shown in the exhibit; then answer the question below.





Which IP addresses are included in the output of this command?

33. Refer to the exhibit, which contains the partial output of a diagnose command.





Based on the output, which two statements are correct? (Choose two.)

34. Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)

35. A FortiGate is rebooting unexpectedly without any apparent reason.

What troubleshooting tools could an administrator use to get more information about the problem? (Choose two.)

36. Refer to the exhibit, which shows the output of diagnose sys session stat.





Which statement about the output shown in the exhibit is correct?

37. An administrator has configured a dial-up IPsec VPN with one phase 2, extended authentication (XAuth) and IKE mode configuration.

The administrator has also enabled the IKE real time debug:

diagnose debug application ike-1

diagnose debug enable

In which order is each step and phase displayed in the debug output each time a new dial-up user is connecting to the VPN?

38. Refer to the exhibit, which shows a session table entry.





Which statement about FortiGate behavior relating to this session is true?

39. Refer to the exhibit, which contains the output of a BGP debug command.





Which statement about the exhibit is true?

40. When using the SSL certificate inspection method for HTTPS traffic, how does FortiGate filter web requests when the browser client does not provide the server name indication (SNI) extension?

41. An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device.

What can the administrator do to fix this problem?

42. Refer to the exhibit, which shows a FortiGate configuration.





An administrator is troubleshooting a web filter issue on FortiGate. The administrator has configured a web filter profile and applied it to a policy; however, the web filter is not inspecting any traffic that is passing through the policy.

What must the administrator change to fix the issue?

43. Which action will FortiGate take when using the default settings for SSL certificate inspection, where the server name indication (SNI) does not match either the common name (CN) or any of the subject altemative names (SAN) in the server certificate?

44. Refer to the exhibit, which contains a TCL script configuration on FortiManager.

An administrator has configured the TCL script on FortiManager, but the TCL script failed to apply any changes to the managed device after being run.





Why did the TCL script fail to make any changes to the managed device?

45. Refer to the exhibit, which contains the output of the diagnose vpn tunnel list.

Which command will capture ESP traffic for the VPN named DialUp_0?

46. An administrator has configured a FortiGate device with two VDOMs: root and internal. The administrator has also created and inter-VDOM link that connects both VDOMs. The objective is to have each VDOM advertise some routes to the other VDOM via OSPF through the inter-VDOM link.

What OSPF configuration settings must match in both VDOMs to have the OSPF adjacency successfully forming? (Choose three.)

47. View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.





The administrator does not have access to the remote gateway.

Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?

48. Which statement about protocol options is true?

49. Which two configuration settings change the behavior for content-inspected traffic while FortiGate is in conserve mode? (Choose two.)