NSE7_EFW-7.0試験無料問題集（165題）「Fortinet NSE 7

出題：1

How does FortiManager handle FortiGuard requests from FortiGate devices, when it is configured as a local FDS?

A. FortiManager will respond to update requests only if they originate from a managed device.

B. FortiManager can download and maintain local copies of FortiGuard databases.

C. FortiManager does not support rating requests.

D. FortiManager supports only FortiGuard push to managed devices.

正解：B 解答を投票する

出題：2

Refer to the exhibit, which contains partial outputs from two routing debug commands.

Why is the port2 default route not in the second command's output?

A. It has a higher distance than the default route using port1.

B. It has a lower priority value than the default route using port1.

C. It is disabled in the FortiGate configuration.

D. It has a higher priority value than the default route using port1.

正解：A 解答を投票する

出題：3

A corporate network allows Internet Access to FSSO users only. The FSSO user student does not have Internet access after successfully logged into the Windows AD network. The output of the 'diagnose debug authd fsso list' command does not show student as an active FSSO user. Other FSSO users can access the Internet without problems. What should the administrator check? (Choose two.)

A. The student workstation's IP subnet must be listed in the CA's trusted list.

B. At least one of the student's user groups must be allowed by a FortiGate firewall policy.

C. The user student must not be listed in the CA's ignore user list.

D. The user student must belong to one or more of the monitored user groups.

正解：B,C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

A FortiGate's portl is connected to a private network. Its port2 is connected to the Internet. Explicit web proxy is enabled in port1 and only explicit web proxy users can access the Internet. Web cache is NOT enabled. An internal web proxy user is downloading a file from the Internet via HTTP. Which statements are true regarding the two entries in the FortiGate session table related with this traffic? (Choose two.)

A. One of the sessions has the IP address of port2 as the source IP address.

B. One session has the proxy flag on, the other one does not.

C. Both session have the local flag on.

D. The destination IP addresses of both sessions are IP addresses assigned to FortiGate's interfaces.

正解：A,C 解答を投票する

出題：5

What does the dirty flag mean in a FortiGate session?

A. The session must be removed from the former primary unit after an HA failover.

B. The next packet must be re-evaluated against the firewall policies.

C. Traffic has been identified as from an application that is not allowed.

D. Traffic has been blocked by the antivirus inspection.

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：6

Refer to the exhibit, which contains a screenshot of some phase 1 settings.

The VPN is not up. To diagnose the issue, the administrator enters the following CLI commands to an SSH session on FortiGate: diagnose vpn ike log-filter dst-addr4 10.0.10.1 diagnose debug application ike -1 However, the IKE real-time debug does not show any output. Why?

A. The administrator must enable the following real-time debug: diagnose debug application ipsec -1.

B. The administrator must also run the command diagnose debug enable.

C. The debug shows only error messages. If there is no output, then the phase 1 and phase 2 configurations match.

D. The log-filter setting is incorrect. The VPN traffic does not match this filter.

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：7

Refer to the exhibit, which shows the output of diagnose sys session stat.

Which statement about the output shown in the exhibit is correct?

A. All the sessions in the session table are TCP sessions.

B. 162 sessions have been deleted because of memory page exhaustion.

C. There are two sessions that have not been removed in case of any out-of-order packets that arrive.

D. There are 166 TCP sessions waiting to complete the three-way handshake.

正解：C 解答を投票する

出題：8

Which statement about the designated router (DR) and backup designated router (BDR) in an OSPF multi-access network is true?

A. Non-DR and non-BDR routers send link state updates and acknowledgements to 224.0.0.6.

B. Only the DR receives link state information from non-DR routers.

C. FortiGate first checks the OSPF ID to elect a DR.

D. Non-DR and non-BDR routers form full adjacencies to DR only.

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

NSE7_EFW-7.0試験無料問題集「Fortinet NSE 7 - Enterprise Firewall 7.0 認定」