Fortinet NSE 7 – Enterprise Firewall 6.4 NSE7_EFW-6.4 Exam Questions

1. What conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three.)

2. Anadministrator has decreased all the TCP session timers to optimize the FortiGate memory usage. However, after the changes, one network application started to have problems. During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets, and before the arrival of the SYN/ACKs. When the SYN/ACK packets arrive to the FortiGate, the unit has already deleted the respective sessions.

Which TCP session timer must be increased to fix this problem?

3. Examine the output of the ‘diagnose debug rating’ command shown in the exhibit; then answer the question below.

Which statement are true regarding the output in the exhibit? (Choose two.)

4. View the exhibit, which contains the output of a debug command, and then answer the question below.

Which one of the following statements about this FortiGate is correct?

5. View the exhibit, which contains the output of a BGP debug command, and then answer the question below.

Which of the following statements about the exhibit are true? (Choose two.)

6. View the exhibit, which contains the output of a diagnose command, and then answer the question below.

What statements are correct regarding the output? (Choose two.)

7. Which two statements about FortiManager is true when it is deployed as a local FDS? (Choose two.)

8. View the exhibit, which contains the output of a diagnose command, and then answer the question below.

Which statements are true regarding the output in the exhibit? (Choose two.)

9. Examine the output of the ‘diagnose sys session list expectation’ command shown in the exhibit; than answer the question below.

Which statement is true regarding the session in the exhibit?

10. 0.1.254. The administrator runs the debug flow while attempting the connection using

HTTP. The output of the debug flow is shown in the exhibit:

Based on the error displayed by the debug flow, which are valid reasons for this problem? (Choose two.)

11. A FortiGate is configured as an explicit web proxy. Clients using this web proxy are reposting DNS errors when accessing any website. The administrator executes the following debug commands and observes that the n-dns-timeout counter is increasing:

What should the administrator check to fix the problem?

12. View the exhibit, which contains the partial output of an IKE real time debug, and then answer the question below.

The administrator does not have access to the remote gateway.

Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?

13. An administrator has enabled HA session synchronization in a HA cluster with two members.

Which flag is added to a primary unit’s session to indicate that it has been synchronized to the secondary unit?

14. Which configuration can be used to reduce the number of BGP sessions in an IBGP network?

15. View the exhibit, which contains the output of get sys ha status, and then answer the question below.

Which statements are correct regarding the output? (Choose two.)

16. How does FortiManager handle FortiGuard requests from FortiGate devices, when it is configured as a local FDS?

17. View the global IPS configuration, and then answer the question below.

Which of the following statements is true regarding this configuration?

18. Examine the following traffic log; then answer the question below.

date-20xx-02-01 time=19:52:01 devname=master device_id="xxxxxxx"

log_id=0100020007 type=event subtype=system pri critical vd=root service=kemel

status=failure msg="NAT port is exhausted."

What does the log mean?

19. Which of the following statements are true regarding the SIP session helper and the SIP application layer gateway (ALG)? (Choose three.)

20. Two independent FortiGate HA clusters are connected to the same broadcast domain. The administrator has reported that both clusters are using the same HA virtual MAC address. This creates a duplicated MAC address problem in the network.

What HA setting must be changed in one of the HA clusters to fix the problem?

21. AFortiGate’s portl is connected to a private network. Its port2 is connected to the Internet. Explicit web proxy is enabled in port1 and only explicit web proxy users can access the Internet. Web cache is NOT enabled. An internal web proxy user is downloading a file from the Internet via HTTP.

Which statements are true regarding the two entries in the FortiGate session table related with this traffic? (Choose two.)

22. Which two configuration settings change the behavior for content-inspected traffic while FortiGate is in conserve mode? (Choose two.)

23. What does the dirty flag mean in aFortiGate session?

24. Which two conditions must be met for a statistic route to be active in the routing table? (Choose two.)

25. View the following FortiGate configuration.

All traffic to the Internet currently egresses from port1.

The exhibit shows partial session information for Internet traffic from a user on the internal network:

If the priority on route ID 1 were changed from 5 to 20, what would happen to traffic matching that user’s session?

26. Which of the following statements are correct regarding application layer test commands? (Choose two.)

27. Examine the output from the ‘diagnose debug authd fsso list’ command; then answer the

question below.

# diagnose debug authd fsso list―FSSO logons-IP: 192.168.3.1 User: STUDENT Groups: TRAININGAD/USERS Workstation: INTERNAL2. TRAINING. LAB The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.

What should the administrator check?

28. Examine the output of the ‘get router info ospf interface’ command shown in the exhibit; then answer the question below.

Which statements are true regarding the above output? (Choose two.)

29. Which of the following conditions must be met fora static route to be active in the routing table? (Choose three.)

30. The logs in a FSSO collector agent (CA) are showing the following error:

failed to connect to registry: PIKA1026 (192.168.12.232)

What can be the reason for this error?

31. In which two states is a given session categorized as ephemeral? (Choose two.)

32. What events are recorded in the crashlogs of a FortiGate device? (Choose two.)

33. View the exhibit, which contains a session entry, and then answer the question below.

Which statement is correct regarding this session?

34. Refer to exhibit, which contains the output of a BGP debug command.

Which statement explains why the state of the 10.200.3.1 peer is Connect?

35. A FortiGate device has the following LDAP configuration:

The administrator executed the ‘dsquery’ command in the Windows LDAp server 10.0.1.10, and got the following output:

>dsquery user Csamid administrator

“CN=Administrator, CN=Users, DC=trainingAD, DC=training, DC=lab”

Based on the output, what FortiGate LDAP setting is configured incorrectly?

36. Refer to exhibits.

Exhibit A.

Exhibit B.

Exhibit A shows the firewall policy and exhibit B shows the traffic shaping policy.

The traffic shaping policy is being applied to all outbound traffic however inbound traffic is not being evaluated by the shaping policy

Based on the exhibit, what configuration change must be made in which policy so that traffic shaping can be applied to inbound traffic’?

37. What are two benefits of using FortiManager to organize and manage the network for a group of FortiGate devices? (Choose two)

38. In the default SD-WAN minimum configuration, which two statements are correct when traffic matches the default implicit SD-WAN rule? (Choose two)

39. Refer to the exhibit.

Which two statements about the debug output are correct? (Choose two)

40. What would best describe the SD-WAN traffic shaping mode that bases itself on a percentage of available bandwidth?

41. Which statement is correct about the SD-WAN and ADVPN?

42. Which diagnostic command you can use to show interface-specific SLA logs for the last 10 minutes?

43. Refer to exhibits.

Exhibit A.

Exhibit B.

Exhibit A shows the traffic shaping policy and exhibit B show: the firewall policy

FortiGate is not performing traffic shaping as expected basi on the policies shown in the exhibits.

To correct this traffic shaping issue on FortiGate, what configuration change must be made on which policy?

44. Refer to the exhibit.

Which statement about the command route-tag in the SD-WAN rule is true?

45. Refer to the exhibit.

What must you configure to enable ADVPN?