NSE7_EFW-6.4試験無料問題集（124題）「Fortinet NSE 7

出題：1

A FortiGate's portl is connected to a private network. Its port2 is connected to the Internet. Explicit web proxy is enabled in port1 and only explicit web proxy users can access the Internet. Web cache is NOT enabled. An internal web proxy user is downloading a file from the Internet via HTTP. Which statements are true regarding the two entries in the FortiGate session table related with this traffic? (Choose two.)

A. One of the sessions has the IP address of port2 as the source IP address.

B. One session has the proxy flag on, the other one does not.

C. Both session have the local flag on.

D. The destination IP addresses of both sessions are IP addresses assigned to FortiGate's interfaces.

正解：A,C 解答を投票する

出題：2

Which statement about NGFW policy-based application filtering is true?

A. The IPS security profile is the only security option you can apply to the security policy with the action set to ACCEPT.

B. FortiGate will drop all packets until the application can be identified.

C. After IPS identifies the application, it adds an entry to a dynamic ISDB table.

D. After the application has been identified, the kernel uses only the Layer 4 header to match the traffic.

正解：B 解答を投票する

出題：3

An administrator added the following Ipsec VPN to a FortiGate configuration:
configvpn ipsec phasel -interface
edit "RemoteSite"
set type dynamic
set interface "portl"
set mode main
set psksecret ENC LCVkCiK2E2PhVUzZe
next
end
config vpn ipsec phase2-interface
edit "RemoteSite"
set phasel name "RemoteSite"
set proposal 3des-sha256
next
end
However, the phase 1 negotiation is failing. The administrator executed the IKF real time debug while attempting the Ipsec connection. The output is shown in the exhibit.

What is causing the IPsec problem in the phase 1 ?

A. NAT-T settings do not match

B. The pre-shared key is wrong

C. The phrase-1 mode must be changed to aggressive

D. The incoming IPsec connection is matching the wrong VPN configuration

正解：B 解答を投票する

出題：4

Which two conditions must be met for a statistic route to be active in the routing table? (Choose two.)

A. The link health monitor (if configured) is up.

B. The outgoing interface is up.

C. The next-hop IP address is up.

D. There is no other route, to the same destination, with a higher distance.

正解：A,B 解答を投票する

出題：5

The CLI command set intelligent-mode <enable | disable> controls the IPS engine's adaptive scanning behavior. Which of the following statements describes IPS adaptive scanning?

A. Determines the optimal number of IPS engines required based on system load.

B. Choose a matching algorithm based on available memory and the type of inspection being performed.

C. Downloads signatures on demand from FDS based on scanning requirements.

D. Determines when it is secure enough to stop scanning session traffic.

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：6

View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

Why didn't the tunnel come up?

A. The pre-shared keys do not match.

B. The remote gateway's phase 2 configuration does not match the local gateway's phase 2 configuration.

C. The remote gateway's phase 1 configuration does not match the local gateway's phase 1 configuration.

D. The remote gateway is using aggressive mode and the local gateway is configured to use man mode.

正解：C 解答を投票する

出題：7

A FortiGate is rebooting unexpectedly without any apparent reason. What troubleshooting tools could an administrator use to get more information about the problem? (Choose two.)

A. Crashlogs.

B. Firewall monitor.

C. Policy monitor.

D. Logs.

正解：A,D 解答を投票する

出題：8

Refer to the exhibit, which contains the output of get system ha status.
Which two statements about the output are true? (Choose two.)

A. port7 is used as the HA heartbeat on all devices in the cluster.

B. Primary is selected based on the priority configured under config system ha.

C. The HA management IP is 169.254.0.2.

D. The slave configuration is synchronized with the master.

正解：A,B 解答を投票する

出題：9

Examine the following partial output from two system debug commands; then answer the question below.

Which of the following statements are true regarding the above outputs? (Choose two.)

A. Kernel indirectly accesses the low memory (LowTotal) through memory paging

B. The Cached value is always the Active value plus the Inactive value

C. The unit is in kernel conserve mode

D. The unit is running a 32-bit FortiOS

正解：B,D 解答を投票する

出題：10

Refer to the exhibit, which contains the partial output of a diagnose command.

Based on the output, which two statements are correct? (Choose two.)

A. The remote gateway IP is 10.200.4.1.

B. Anti-replay is enabled

C. DPD is disabled.

D. Quick mode selectors are disabled.

正解：A,B 解答を投票する

NSE7_EFW-6.4試験無料問題集「Fortinet NSE 7 - Enterprise Firewall 6.4 認定」