Spring Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Fortinet
NSE 7 Network Security Architect
NSE7_EFW-7.0
Fortinet NSE 7 - Enterprise Firewall 7.0 Questions and Answers

Pass the Fortinet NSE 7 Network Security Architect NSE7_EFW-7.0 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam NSE7_EFW-7.0 Premium Access

View all detail and faqs for the NSE7_EFW-7.0 exam

Go to Exam

779 Students Passed

85% Average Score

90% Same Questions

Viewing page 4 out of 5 pages

Viewing questions 31-40 out of questions

Questions # 31:

Refer to the exhibit, which shows partial outputs from two routing debug commands.

Question # 31

Why is the port2 default route not in the second command output?

Options:

The port2 interface is disabled in the FortiGate configuration.

The port1 default route has a lower distance than the default route using port2.

The port1 default route has a higher priority value than the default route using port2.

The port1 default route has a lower priority value than the default route using port2.

Answer

Questions # 32:

Refer to the exhibit, which contains a TCL script configuration on FortiManager.

An administrator has configured the TCL script on FortiManager, but the TCL script failed to apply any changes to the managed device after being run.

Question # 32

Why did the TCL script fail to make any changes to the managed device?

Options:

The TCL command run_cmd has not been created.

The TCL script must start with tinclude <>.

Incomplete commands are ignored in TCL scripts.

Changes to an interface configuration can be made only by a CLI script.

Answer

Explanation

https://docs.fortinet.com/document/fortimanager/7.2.2/administration-guide/914165/tcl-scripts

Questions # 33:

View the exhibit, which contains the partial output of a diagnose command, and then answer the question below.

Question # 33

Based on the output, which of the following statements is correct?

Options:

Anti-reply is enabled.

DPD is disabled.

Quick mode selectors are disabled.

Remote gateway IP is 10.200.5.1.

Answer

Questions # 34:

Which two statements about an auxiliary session are true? (Choose two.)

Options:

With the auxiliary session setting disabled, only auxiliary sessions are offloaded.

With the auxiliary session setting enabled, two sessions are created in case of routing change.

With the auxiliary session setting enabled, ECMP traffic is accelerated to the NP6 processor.

With the auxiliary session setting disabled, for each traffic path, FortiGate uses the same auxiliary session.

Answer

B, C

Explanation

[Reference: https://docs.fortinet.com/document/fortigate/7.0.1/administration-guide/14295/controlling-return-path-with-auxiliary-session, NSE7 Study Guide Chapter 4 , slide “ECMP Accelerated with Auxiliary session”, ]

Questions # 35:

View the central management configuration shown in the exhibit, and then answer the question below.

Question # 35

Which server will FortiGate choose for antivirus and IPS updates if 10.0.1.243 is experiencing an outage?

Options:

10.0.1.240

One of the public FortiGuard distribution servers

10.0.1.244

10.0.1.242

Answer

Questions # 36:

Examine the following routing table and BGP configuration; then answer the question below.

Question # 36

TheBGP connection is up, but the local peer is NOT advertising the prefix 192.168.1.0/24. Which configuration change will make the local peer advertise this prefix?

Options:

Enable the redistribution of connected routers into BGP.

Enable the redistribution of static routers into BGP.

Disable the setting network-import-check.

Enable the setting ebgp-multipath.

Answer

Questions # 37:

Which two statements about the Security Fabric are true? (Choose two.)

Options:

Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer.

Only the root FortiGate sends logs to FortiAnalyzer.

Only FortiGate devices with fabric-object-unification set to default will receive and synchronize global CMDB objects sent by the root FortiGate.

FortiGate uses FortiTelemetry protocol to communicate with FortiAnalyzer.

Answer

A, C

Explanation

FortiGate's to Root uses FortiTelemetry (TCP-8013) FortiTelemetry is also used for FortiClient communication Root Fortigate to FortiAnalyzer uses API (TCP-443)

Questions # 38:

What does the dirty flag mean in a FortiGate session?

Options:

Traffic has been blocked by the antivirus inspection.

The next packet must be re-evaluated against the firewall policies.

The session must be removed from the former primary unit after an HA failover.

Traffic has been identified as from an application that is not allowed.

Answer

Explanation

https://kb.fortinet.com/kb/viewContent.do?externalId=FD40119 &sliceId=1

Questions # 39:

Refer to the exhibit, which shows the output of diagnose sys session list.

Question # 39

If the HA ID for the primary device is 0, what will happen if the primary fails and the secondary becomes the primary?

Options:

Traffic for this session continues to be permitted on the new primary device after failover, without requiring the client to restart the session with the server.

The secondary device has this session synchronized; however, because application control is applied, the session will be marked dirty and have to be re-evaluated after failover.

The session state will be preserved but the kernel will need to re-evaluate the session due to NAT being applied.

The session will be removed from the session table of the secondary device due to the presence of allowed error packets, which will force the client to restart the session with the server.

Answer

Explanation

https://community.fortinet.com/t5/FortiGate/Technical-Note-How-to-see-if-a-session-is-synced-in-HA/ta-p/194185

Questions # 40:

Refer to the exhibits.

Question # 40

Which contain the partial configurations of two VPNs on FortiGate.

An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovered that FortiGate is not matching the user-2 VPN for members of the Users-2 group.

Which two changes must administrator make to fix the issue? (Choose two.)

Options:

Use different pre-shared keys on both VPNs

Enable Mode Config on both VPNs.

Set up specific peer IDs on both VPNs.

Change to aggressive mode on both VPNs.

Answer

C, D

Explanation

To set peer-id, the VPN must be set in aggressive mode - https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-Peer-IDs-to-select-an-IPSec-dialup/ta-p/192292

Viewing page 4 out of 5 pages

Viewing questions 31-40 out of questions