Fortinet NSE 7 - Enterprise Firewall 7.2 - NSE7

QUESTION NO: 1
Refer to the exhibit.

The exhibit shows a prefix list configuration
What can you conclude from the above prefix-list configuration?

A. The prefixes 10.10.0/16 and 10.0.0.0/16 will be denied B. The prefix 10.10.0.0/16 will be denied C. The prefix 10.10.10.0/24 will be permitted D. The prefix 10.0.0.0/8 will be permitted

Correct Answer: C

QUESTION NO: 2
You contoured an address object on the tool fortiGate in a Security Fabric. This object is not synchronized with a downstream device. Which two reasons could be the cause? (Choose two)

A. The downstream TortiGate has fabric-object-unification set to local B. The root FortiGate has configuration-sync set to enable C. The address object on the tool FortiGate has fabric-object set to disable D. The downstream FortiGate has configuration-sync set to local

Correct Answer: A,C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
After enabling IPS you receive feedback about traffic being dropped.
What could be the reason?

A. Fail-open is set to disable B. IPS is configured to monitor C. Traffic-submit is set to disable D. Np-accel-mode is set to enable

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
Which two statements about the Security Fabric are true? (Choose two.)

A. Only FortiGate devices with configuration-sync sel to Local receive and synchronize the global CMDB objects that the root FortiGate sends. B. FortiGate uses the FortiTelemetry protocol to communicate with FortiAnalyzer. C. Each FortiGate device in the Security Fabric must have bidirectional FortiTelemetry connectivity. D. Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer. E. Each member of the Security Fabric maintains the shared Security Fabric map.

Correct Answer: C,D

QUESTION NO: 5
Refer to the exhibits, which contain the network topology and BGP configuration for a hub.
Exhibit A.

Exhibit B.

An administrator is trying to configure ADVPN with a hub and spoke VPN setup using iBGP. All the VPNs are up and connected to the hub. The hub is receiving route information from both spokes over iBGP; however the spokes are not receiving route information from each other.
What change must the administrator make to the hub BGP configuration so that the routes learned from one spoke are forwarded to the other spoke?

A. Configure auto-discovery-sender on the hub B. Enable route redistribution under config router bgp C. Configure the hub as a route reflector D. Add a prefix list to the hub that permits routes to be shared between the spokes

Correct Answer: A

QUESTION NO: 6
What are two functions of automation stitches? (Choose two.)

A. Automation stitches can be configured on any FortiGate device in a Security Fabric environment. B. Automation stitches can be created to run diagnostic commands and email the results when CPU or memory usage exceeds specified thresholds. C. An automation stitch configured to execute actions in parallel can be set to insert a specific delay between actions. D. An automation stitch configured to execute actions sequentially can take parameters from previous actions as input for the current action.

Correct Answer: B,D

QUESTION NO: 7
Which two statements about bfd are true? (Choose two)

A. It can support neighbor only over the next hop in BGP B. It works for OSPF and BGP C. You must configure n globally only D. You can disable it at the protocol level

Correct Answer: B,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
Refer to the exhibit, which contains a partial OSPF configuration.

What can you conclude from this output?

A. FortiGate restarts if the topology changes. B. Neighbors maintain communication with the restarting router. C. The router sends grace LSAs before it restarts. D. The restarting router sends gratuitous ARP for 30 seconds.

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 9
An administrator has configured two fortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device What can the administrator do to fix this problem?

A. Verify that the speed and duplex settings match between me FortiGate interfaces and the connected switch ports B. Configure set link -failed signal enable under-config system ha on both Cluster members C. Configure remote Iink monitoring to detect an issue in the forwarding path D. Configure set send-garp-on-failover enables under config system ha on both cluster members

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

Fortinet NSE 7 - Enterprise Firewall 7.2 - NSE7_EFW-7.2 Exam Questions