Fortinet NSE 7 - Enterprise Firewall 6.4 - NSE7

QUESTION NO: 1
Refer to the exhibit, which shows a partial routing table.

Assuming all the appropriate firewall policies are configured, which two pings will FortiGate route? (Choose two.)

A. Source IPaddress: 10.10.4.24, Destination IPaddress: 10.72.3.20 B. Source IPaddress: 10.72.3.52. Destination IP address: 10.1.0.254 C. Source IP address: 10.1.0.10. Destination IP address: 10.64.1.52 D. Source IPaddress: 10.73.9.10, Destination IPaddress: 10.72.3.15

Correct Answer: B,C

QUESTION NO: 2
Which two statements about the Security Fabric are true? (Choose two.)

A. FortiGate uses FortiTelemetry protocol to communicate with FortiAnalyzer. B. Branch FortiGate devices must be configured first. C. Only the root FortiGate collects network information and forwards it to FortiAnalyzer. D. All FortiGate devices in the Security Fabric must have bidirectional FortiTelemetry connectivity.

Correct Answer: A,D

QUESTION NO: 3
An administrator has configured the following CLI script on FortiManager, which failed to apply any changes to the managed device after being executed.

Why didn't the script make any changes to the managed device?

A. Incomplete commands are ignored in CLI scripts. B. Static routes can only be added using TCL scripts. C. Commands that start with the # sign are not executed. D. CLI scripts will add objects only if they are referenced by policies.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
A FortiGate is configured as an explicit web proxy. Clients using this web proxy are reposting DNS errors when accessing any website. The administrator executes the following debug commands and observes that the n-dns-timeout counter is increasing:

What should the administrator check to fix the problem?

A. That DNS service is enabled in the explicit web proxy interface. B. That DNS traffic from client workstations is allowed by the explicit web proxy policies. C. The connectivity between the client workstations and the DNS server. D. The connectivity between the FortiGate unit and the DNS server.

Correct Answer: D

QUESTION NO: 5
Refer to the exhibit, which contains the debug output of diagnose dvm device list.

Which two statements about the output shown in the exhibit are correct? (Choose two.)

A. There are pending device-level changes yet to be installed on Local-FortiGate. B. The policy package has been modified for Local-FortiGate. C. The FortiGate configuration is in sync with latest running revision history. D. ADOMs are disabled on the FortiManager

Correct Answer: A,C

QUESTION NO: 6
Refer to the exhibit, which shows a session entry. Which statement about this session is true?

A. It is a TCP session in the established state, from 10.1.10.10 to 10.200.5.1. B. It is an ICMP session from 10.1.10.10 to 10.200.5. 1. C. It is a TCP session in close_wait state, from 10. l. 10.10 to 10.200.1.1. D. It is an ICMP session from 10.1.10.10 to 10.200.1.1.

Correct Answer: B

QUESTION NO: 7
Refer to the exhibit, which contains the output of a BGP debug command.

Which statement about the exhibit is true?

A. The local router has received a total of three BGP prefixes from all peers. B. Since the counters were last reset, the 10.200.3.1 peer has never been down. C. The local router BGP state is OpenConfirm with the 10.127.0.75 peer. D. The local router has not established a TCP session with 100.64.3.1.

Correct Answer: D

QUESTION NO: 8
View the exhibit, which contains the output of a diagnose command, and then answer the question below.

What statements are correct regarding the output? (Choose two.)

A. Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.200.1.1. B. Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.0.1.10. C. This is an expected session created by a session helper. D. This is an expected session created by an application control profile.

Correct Answer: A,C

QUESTION NO: 9
View the global IPS configuration, and then answer the question below.

Which of the following statements is true regarding this configuration?

A. IPS will scan every byte in every session. B. FortiGate will spawn IPS engine instances based on the system load. C. New packets will be passed through without inspection if the IPS socket buffer runs out of memory. D. IPS will use the faster matching algorithm which is only available for units with more than 4 GB memory.

Correct Answer: A

Fortinet NSE 7 - Enterprise Firewall 6.4 - NSE7_EFW-6.4 Exam Questions