Fortinet NSE 7 - Enterprise Firewall 7.0 - NSE7

QUESTION NO: 1
A FortiGate device has the following LDAP configuration:

The LDAP user student cannot authenticate. The exhibit shows the output of the authentication real time debug while testing the student account:

Based on the above output, what FortiGate LDAP settings must the administer check? (Choose two.)

A. password. B. username. C. cnid. D. dn.

Correct Answer: A,B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
Refer to the exhibits.

Which contain the partial configurations of two VPNs on FortiGate.
An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovered that FortiGate is not matching the user-2 VPN for members of the Users-2 group.
Which two changes must administrator make to fix the issue? (Choose two.)

A. Change to aggressive mode on both VPNs. B. Enable Mode Config on both VPNs. C. Use different pre-shared keys on both VPNs D. Set up specific peer IDs on both VPNs.

Correct Answer: A,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
What configuration changes can reduce the memory utilization in a FortiGate? (Choose two.)

A. Increase the TCP session timers. B. Increase the FortiGuard cache time to live. C. Reduce the maximum file size to inspect. D. Reduce the session time to live.

Correct Answer: C,D

QUESTION NO: 4
What are two functions of automation stitches? (Choose two.)

A. Automation stitches can be configured on any FortiGate device in a Security Fabric environment. B. An automation stitch configured to execute actions in parallel can be set to insert a specific delay between actions. C. Automation stitches can be created to run diagnostic commands and attach the results to an email message when CPU or memory usage exceeds specified thresholds. D. An automation stitch configured to execute actions sequentially can take parameters from previous actions as input for the current action.

Correct Answer: C,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 5
Refer to the exhibit, which contains partial output from an IKE real-time debug.

Why did the tunnel not come up?

A. The local gateway has configured less secure encryption and hashing algorithms compared to the remote gateway. B. The Diffie-Hellman group does not match on the local and remote gateways. C. The encapsulation method for phase 2 is set to none on local and remote gateways. D. The proposal ID does not match between local and remote gateways.

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 6
Refer to the exhibit, which shows a central management configuration.

Which server will FortiGate choose for web filter rating requests, if 10.0.1.240 is experiencing an outage?

A. Public FortiGuard servers B. 10.0.1.243 C. 10.0.1.242 D. 10.0.1.244

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 7
Exhibits:

Refer to the exhibits, which contain the network topology and BGP configuration for a hub.
An administrator is trying to configure ADVPN with a hub-spoke VPN setup using iBGP. All the VPNs are up and connected to the hub. The hub is receiving route information from both spokes over iBGP; however, the spokes are not receiving route information from each other.
What change must the administrator make to the hub BGP configuration so that the routes learned by one spoke are forwarded to the other spokes?

A. Configure the hub as a route reflector client. B. Make the configuration of remote-as different from the configuration of local-as. C. Configure an individual neighbor and remove neighbor-range configuration. D. Change the router id to 10.1.0.254.

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
Refer to the exhibit, which contains the output of a BGP debug command.

Which statement about the exhibit is true?

A. The local router has received a total of three BGP prefixes from all peers. B. Since the counters were last reset, the 10.200.3.1 peer has never been down. C. The local router BGP state is OpenConfirm with the 10.127.0.75 peer. D. The local router has not established a TCP session with 100.64.3.1.

Correct Answer: D

QUESTION NO: 9
What is the purpose of an internal segmentation firewall (ISFW)?

A. It is an all-in-one security appliance that is placed at remote sites to extend the enterprise network. B. It inspects incoming traffic to protect services in the corporate DMZ. C. It splits the network into multiple security segments to minimize the impact of breaches. D. It is the first line of defense at the network perimeter.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 10
An LDAP user cannot authenticate against a FortiGate device. Examine the real time debug output shown in the exhibit when the user attempted the authentication; then answer the question below.

Based on the output in the exhibit, what can cause this authentication problem?

A. The FortiGate has been configured with the wrong password for the LDAP administrator. B. The FortiGate has been configured with the wrong authentication schema. C. User student is not found in the LDAP server. D. User student is using a wrong password.

Correct Answer: C

QUESTION NO: 11
Refer to the exhibit, which shows the output of a diagnose command.

What can be concluded about the debug output in this scenario?

A. FortiGate used 64.26.151.37 as the initial server to validate its contract. B. There is a natural correlation between the value in the Packets field and the value in the Weight field. C. Servers with a negative TZ value are less preferred for rating requests. D. The first server provided to FortiGate when it performed a DNS query looking for a list of rating servers, was 121.111.236.179.

Correct Answer: B

Fortinet NSE 7 - Enterprise Firewall 7.0 - NSE7_EFW-7.0 Exam Questions