Spring Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Fortinet
NSE 7 Network Security Architect
NSE7_EFW-7.0
Fortinet NSE 7 - Enterprise Firewall 7.0 Questions and Answers

Pass the Fortinet NSE 7 Network Security Architect NSE7_EFW-7.0 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam NSE7_EFW-7.0 Premium Access

View all detail and faqs for the NSE7_EFW-7.0 exam

Go to Exam

779 Students Passed

85% Average Score

90% Same Questions

Viewing page 5 out of 5 pages

Viewing questions 41-50 out of questions

Questions # 41:

Refer to the exhibit, which contains partial output from an IKE real-time debug.

Question # 41

Why did the tunnel not come up?

Options:

The local gateway has configured less secure encryption and hashing algorithms compared to the remote gateway.

The Diffie-Hellman group does not match on the local and remote gateways.

The proposal ID does not match between local and remote gateways.

The encapsulation method for phase 2 is set to none on local and remote gateways.

Answer

Explanation

local gateway: encryption AES-128, hash SHA remote gateway: encryption AES-256, hash SHA-256 So local gateway has less secure settings

Questions # 42:

Examine the IPsec configuration shown in the exhibit; then answer the question below.

Question # 42

An administrator wants to monitor the VPN by enabling the IKE real time debug using these commands:

diagnose vpn ike log-filter src-addr4 10.0.10.1

diagnose debug application ike -1

diagnose debug enable

The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are being interchanged between both IPsec gateways. However, the IKE real time debug does NOT show any output. Why isn’t there any output?

Options:

The IKE real time shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.

The log-filter setting is set incorrectly. The VPN’s traffic does not match this filter.

The IKE real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.

The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.

Answer

Questions # 43:

What is the diagnose test application ipsmonitor 99 command used for?

Options:

To enable IPS bypass mode

To provide information regarding IPS sessions

To disable the IPS engine

To restart all IPS engines and monitors

Answer

Questions # 44:

An administrator is running the following sniffer in a FortiGate:

diagnose sniffer packet any “host 10.0.2.10” 2

What information is included in the output of the sniffer? (Choose two.)

Options:

Ethernet headers.

IP payload.

IP headers.

Port names.

Answer

B, C

Explanation

https://kb.fortinet.com/kb/documentLink.do?externalID=11186

Questions # 45:

A FortiGate is configured as an explicit web proxy. Clients using this web proxy are reposting DNS errors when accessing any website. The administrator executes the following debug commands and observes that the n-dns-timeout counter is increasing:

Question # 45

What should the administrator check to fix the problem?

Options:

The connectivity between the FortiGate unit and the DNS server.

The connectivity between the client workstations and the DNS server.

That DNS traffic from client workstations is allowed by the explicit web proxy policies.

That DNS service is enabled in the explicit web proxy interface.

Answer

Questions # 46:

Refer to the exhibit, which contains the output of diagnose sys session list.

Question # 46

If the HA ID for the primary unit is zero (0), which statement about the output is true?

Options:

This session cannot be synced with the slave unit.

The inspection of this session has been offloaded to the slave unit.

The master unit is processing this traffic.

This session is for HA heartbeat traffic.

Answer

Questions # 47:

Refer to the exhibit, which shows a partial routing table.

Question # 47

Assuming all the appropriate firewall policies are configured, which two pings will FortiGate route? (Choose two.)

Options:

Source IP address: 10.1.0.10. Destination IP address: 10.64.1.52

Source IPaddress: 10.72.3.52. Destination IP address: 10.1.0.254

Source IPaddress: 10.10.4.24, Destination IPaddress: 10.72.3.20

Source IPaddress: 10.73.9.10, Destination IPaddress: 10.72.3.15

Answer

A, B

Questions # 48:

An administrator has created a VPN community within VPN Manager on FortiManager. They also added gateways to the VPN community and are now trying to create firewall policies to permit traffic over the tunnel; however, the VPN interfaces are not listed as available options.

What step must the administrator take to resolve this issue?

Options:

Install the VPN community and gateway configuration to the FortiGate devices, in order for the interfaces to be displayed within Policy & Objects on FortiManager

Set up all of the phase 1 settings in the VPN community that they neglected to set up initially. The interfaces will be automatically generated after the administrator configures all of the required settings.

Refresh the device status from the Device Manager so that FortiGate will populate the IPsec interfaces.

Create interface mappings for the IPsec VPN interfaces, before they can be used in a policy.

Answer

Explanation

1- Create a VPN Community

2- Install VPN Configuration

3- Add IPsec Firewall Policies

4- Install the Policies

Viewing page 5 out of 5 pages

Viewing questions 41-50 out of questions