Fortinet NSE 7 - Secure Networking 7.6 Architect - NSE7_FSN

QUESTION NO: 1
You configure the overlay tunnels for an SD-WAN hub-and-spoke topology defined with IPsec tunnels, BGP on loopback, and dynamic BGP.
Which two are recommended IPsec settings for this topology? (Choose two answers.)

A. On the hub, set the parameter mode-cfg to enable. B. On the spoke, set the parameter net-device to enable. C. On the spoke, configure the parameter localid. D. On the hub, set the tunnel type to static.

Correct Answer: B,C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
Which two protocol states indicate that traffic is bidirectional? (Choose two.)

A. proto_state=05 for a TCP session. B. proto_state=01 for a TCP session. C. proto_state=01 for a UDP session. D. proto_state=00 for an ICMP session.

Correct Answer: B,C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
Refer to the exhibit.

Assuming a default configuration, which three statements are true? (Choose three.)

A. User C: Fail. There is no route to 10.0.4.63 using port1 in the touting table. B. Strict RPF is enabled by default. C. User B: Fail. There is no route to 95.56.234.24 . D. User A: Pass. The default static route through wan1 passes the RPF check regardless of the source IP address. E. User B: Pass. FortiGate will use asymmetric routing using wan1 to reply to traffic for 95.56.234.24.

Correct Answer: A,C,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
Refer to the exhibit, which shows a partial output from the get router info routing-table database command.

The administrator wants to configure a default static route for port3 and assign a distance of 50 and a priority of 0.
What will happen to the port1 and port2 default static routes after the port3 default static route is created?

A. The port1 default static route will be injected into the FIB. B. The port2 default static route will be injected into the forwarding information base (FIB). C. Both default static routes shown in the output will be injected into the FIB. D. Neither of the routes shown in the output will be injected into the FIB.

Correct Answer: B

QUESTION NO: 5
Refer to the exhibit.

The output of the command diagnose vpn tunnel list is shown.
Reviewing the debug command, what is the current status of the traffic flowing through the tunnel?

A. The outbound IPsec SA was copied to the NPU. B. The inbound IPsec SA was copied to the NPU. C. The inbound and outbound IPsec SAs were copied to the NPU. D. NP6 is handling the offloading.

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 6
Refer to the exhibit.

The port1 interface configuration on FortiGate and partial session information for ICMP traffic are shown.
Which two things happen to the session information if a routing change occurs that affects this session?
(Choose two answers)

A. This session will be unaffected by routing changes. The routing changes will apply only to new sessions. B. The session information will not change unless the current route has been removed from the routing table. C. The session information will not change even when the active route has been removed from the routing table. D. The session will be flagged as dirty but no route lookups will be performed.

Correct Answer: A,B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 7
The local OSPF router is unable to establish adjacency with a peer.
Which two things should the administrator do to troubleshoot the issue? (Choose two.)

A. Check if both peers have an IP address within the same subnet. B. Check if TCP port 179 is blocked. C. Check if IP protocol 89 is blocked. D. Check if there is an active static route to the peer.

Correct Answer: A,C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
Refer to the exhibit, which shows the output of a real-time debug. Which statement about this output is true?
(Choose one answer)

A. FortiGate found the requested URL in its local cache. B. This web request was inspected using the ftgd-allow web filter profile. C. The server hostname was extracted from the SNI in the client request, or from the CN in the server certificate. D. The requested URL belongs to category ID 255.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 9
Refer to the exhibit, which shows the partial output of a diagnose command.

Which two conclusions can you draw from the output shown in the exhibit? (Choose two.)

A. This is a pinhole session to allow traffic for a TCP protocol that dynamically assigns TCP ports. B. Clearing the master session has no impact on the expectation session. C. The session is checked against firewall policy ID 25. D. FortiGate will drop the expected traffic if it does not arrive within 23 seconds.

Correct Answer: A,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 10
Refer to the exhibit.

The partial output of a session table entry is shown.
Which two statements about the output shown in the exhibit are correct? (Choose two.)

A. The traffic matches Policy ID 1. B. The traffic is tagged for a VLAN interface. C. NP7 is handling offloading of this session. D. The session has been offloaded.

Correct Answer: A,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 11
Exhibit.

Refer to the exhibit, which shows two entries that were generated in the FSSO collector agent logs.
eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee What three conclusions can you draw from these log entries? {Choose three.)

A. A firewall is blocking traffic to port 139 and 445. B. The user ' s status shows as " not verified " in the collector agent. C. Remote registry is not running on the workstation. D. DNS resolution is unable to resolve the workstation name. E. The FortiGate firmware version is not compatible with that of the collector agent.

Correct Answer: A,B,C

QUESTION NO: 12
Refer to the exhibit.
Partial output of diagnose sys session stat command is shown.

An administrator has noticed unusual behavior from FortiGate. It appears that sessions are randomly removed.
Which two reasons could explain this? (Choose two.)

A. FortiGate is not accepting sessions because the device has been down 10 out of 120 seconds. B. FortiGate is deleting sessions because the kernel cannot allocate more memory pages C. FortiGate is dropping all TCP sessions with incomplete three-way handshakes. D. FortiGate is flushing sessions because of high memory usage.

Correct Answer: B,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 13
Which Iwo actions does FortiGate take after an administrator enables the auxiliary session selling? (Choose two.)

A. FortiGate creates two sessions in case of a routing change. B. FortiGate accelerates all ECMP traffic to the NP6 processor C. FortiGate only offloads auxiliary sessions. D. FortiGates creates a now auxiliary session for each packet it receives.

Correct Answer: A,B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 14
Refer to the exhibit.

Which three pieces of information does the diagnose sys top command provide? (Choose three.)

A. The diagnose sys top command has been running for 18 minutes. B. The cmdbsvr process is occupying 2.4% of the total user memory space. C. If the neweli daemon continues to be in the R state, it will need to be manually restarted. D. The miglogd daemon is running on CPU core ID 0. E. The miglogd daemon would be on top of the list, if the administrator pressed m on the keyboard.

Correct Answer: B,D,E

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 15
Refer to the exhibit.

The output of the get router info bgp summary command is shown.
Which statement regarding adjacencies between the local router and its neighbors is correct?

A. The local router and neighbor 100.64.2.254 are unable to establish adjacency because the TCP session could not be established. B. The local router and neighbor 100.64.2.254 are unable to establish adjacency because AS 100 is already used by neighbor 100.64.1.254. C. The local router and neighbor 100.64.2.254 are unable to establish adjacency until the adjacency with neighbor 100.64.1.254 ceases. D. The local router and neighbor 100.64.1.254 established adjacency because the priority of 100.64.1.254 is higher than that of 100.64.2.254.

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

Fortinet NSE 7 - Secure Networking 7.6 Architect - NSE7_FSN_AR-7.6 Exam Questions