Weekend Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = simple70

Home
Fortinet
NSE 7 Network Security Architect
NSE7_EFW-7.0
Fortinet NSE 7 - Enterprise Firewall 7.0 Questions and Answers

Pass the Fortinet NSE 7 Network Security Architect NSE7_EFW-7.0 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam NSE7_EFW-7.0 Premium Access

View all detail and faqs for the NSE7_EFW-7.0 exam

Go to Exam

445 Students Passed

95% Average Score

94% Same Questions

Viewing page 1 out of 5 pages

Viewing questions 1-10 out of questions

Questions # 1:

Refer to the exhibit, which contains the partial output of the get vpn ipsec tunnel details command.

Question # 1

Based on the output, which two statements are correct? (Choose two.)

Options:

The npu_flag for this tunnel is 03.

Different SPI values are a result of auto-negotiation being disabled for phase 2 selectors.

Anti-replay is enabled.

The npu_flag for this tunnel is 02.

Answer

A, C

Questions # 2:

Exhibits:

Question # 2

Refer to the exhibits, which contain the network topology and BGP configuration for a hub.

An administrator is trying to configure ADVPN with a hub-spoke VPN setup using iBGP. All the VPNs are up and connected to the hub. The hub is receiving route information from both spokes over iBGP; however, the spokes are not receiving route information from each other.

What change must the administrator make to the hub BGP configuration so that the routes learned by one spoke are forwarded to the other spokes?

Options:

Configure an individual neighbor and remove neighbor-range configuration.

Configure the hub as a route reflector client.

Change the router id to 10.1.0.254.

Make the configuration of remote-as different from the configuration of local-as.

Answer

Explanation

Source: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-BGP-route-reflector/ta-p/191503 Source 2: RFC 4456

Questions # 3:

Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)

Options:

Installing configuration changes to managed devices

Importing interface mappings from managed devices

Adding devices to FortiManager

Previewing pending configuration changes for managed devices

Answer

A, D

Explanation

[Reference: https://docs.fortinet.com/document/fortimanager/6.2.0/administration-guide/668612/using-the-install-wizard-to-install-device-settings-only, ]

Questions # 4:

Refer to the exhibit, which shows a partial routing table.

Question # 4

Assuming all the appropriate firewall policies are configured, what two changes would an administrator need to make if they wanted to send traffic from a client directly connected to port3, to a server directly connected to port4? (Choose two.)

Options:

Configure route leaking between VRF 12 and VRF 21.

Disable auto-asic-offload as this is not supported between VRF instances.

Configure RIPv2 to exchange route information between the VRF instances.

Configure route leaking between port3 and port4.

Enable SNAT on the relevant firewall policies to prevent RPF check drops.

Answer

A, E

Explanation

Enterprise_Firewall_7.0_Study_Guide-Online.pdf p 148, 159

Questions # 5:

Refer to the exhibit, which contains partial output from an IKE real-time debug.

Question # 5

Which two statements about this debug output are correct? (Choose two.)

Options:

The initiator provided remote as its IPsec peer ID.

It shows a phase 2 negotiation.

Perfect Forward Secrecy (PFS) is enabled in the configuration.

The local gateway IP address is 10.0.0.1.

Answer

A, D

Explanation

A because : received peer identifier FQDN 'remote' D because : ike 0: comes 10.0.0.2:500 -> 10.0.0.1:500

Questions # 6:

View the exhibit, which contains the output of a real-time debug, Which statement about this output is true?

Question # 6

Which of the following statements is true regarding this output?

Options:

The requested URL belongs to category ID 255.

The server hostname Is training, fortinet.com.

FortiGate found the requested URL in its local cache.

This web request was inspected using the ftgd-allow web filler profile.

Answer

Explanation

Example log for no local cache case: #id=93000 msg="pid=57 urlfilter_main-723 in main.c received pkt:count=91 "IPS and WAD will only send request to urlfilter daemon when cache is missed. " So the WAD process by itself found the URL rating in the local cache and didn`t ask for help from the URL process as in the example.

Questions # 7:

Which statement about IKE and IKE NAT-T is true?

Options:

IKE is used to encapsulate ESP traffic in some situations, and IKE NAT-T is used only when the local FortiGate is using NAT on the IPsec interface.

IKE is the standard implementation for IKEv1 and IKE NAT-T is an extension added in IKEv2.

They both use UDP as their transport protocol and the port number is configurable.

They each use their own IP protocol number.

Answer

Explanation

IKE without NAT-T runs over UDP port 500. IKE with NAT-T runs over UDP port 4500. It can be configurable - https://docs.fortinet.com/document/fortigate/7.0.0/new-features/33578/configurable-ike-port

Questions # 8:

Which statement about memory conserve mode is true?

Options:

A FortiGate exits conserve mode when the configured memory use threshold reaches yellow.

A FortiGate starts dropping all the new and old sessions when the configured memory use threshold reaches extreme.

A FortiGate starts dropping new sessions when the configured memory use threshold reaches red

A FortiGate enters conserve mode when the configured memory use threshold reaches red

Answer

Questions # 9:

Refer to the exhibit, which shows the output of a diagnose command.

Question # 9

What can you conclude from the output shown in the exhibit? (Choose two.)

Options:

This is a pinhole session created to allow traffic for a protocol that requires additional sessions to operate through FortiGate.

This is an expected session created by the IPS engine.

Traffic in the original direction (coming from the IP address 10.171.121.38) will be routed to the next-hop IP address 10.200.1.1.

Traffic in the original direction (coming from the IP address 10.171.121.38) will be routed to the next-hop IP address 10.0.1.10.

Answer

A, D

Explanation

Enterprise_Firewall_7.0_Study_Guide-Online.pdf p 110, 111, 115

Questions # 10:

When does a RADIUS server send an Access-Challenge packet?

Options:

The server does not have the user credentials yet.

The server requires more information from the user, such as the token code for two-factor authentication.

The user credentials are wrong.

The user account is not found in the server.

Answer

Viewing page 1 out of 5 pages

Viewing questions 1-10 out of questions

Modal title

Registered Required

In order to participate in the comments you need to be logged-in.
You can sign-up or login (it's free).

TOP CODES

Top selling exam codes in the certification world, popular, in demand and updated to help you pass on the first try.

2V0-11.25

ADM-201

Agentforce-Specialist

CMMC-CCP

Data-Cloud-Consultant

PCNSE

PDI

PSE-Strata-Pro-24

Secure-Software-Design

Sharing-and-Visibility-Architect

Workday-Pro-Integrations

ZDTA