2024年05月 Fortinet NSE7_EFW-7.0実際にある問題と100%カバー率リアル試験問題
NSE7_EFW-7.0無料試験問題と解答PDF最新問題2024年05月
質問 # 72
View these partial outputs from two routing debug commands:
Which outbound interface will FortiGate use to route web traffic from internal users to the Internet?
- A. port1
- B. port3
- C. Both port1 and port2
- D. port2
正解：A
質問 # 73
Which two statements about FortiManager is true when it is deployed as a local FDS? (Choose two.)
- A. It provides VM license validation services.
- B. It supports rating requests from both managed and unmanaged devices.
- C. It can be configured as an update server, or a rating server, but not both.
- D. It caches available firmware updates for unmanaged devices.
正解：A、B
質問 # 74
Refer to the exhibit, which shows a partial routing table.
Assuming all the appropriate firewall policies are configured, which two pings will FortiGate route? (Choose two.)
- A. Source IPaddress: 10.73.9.10, Destination IPaddress: 10.72.3.15
- B. Source IP address: 10.1.0.10. Destination IP address: 10.64.1.52
- C. Source IPaddress: 10.10.4.24, Destination IPaddress: 10.72.3.20
- D. Source IPaddress: 10.72.3.52. Destination IP address: 10.1.0.254
正解：B、D
質問 # 75
Refer to the exhibit, which contains the partial output of the get vpn ipsec tunnel details command.
Based on the output, which two statements are correct? (Choose two.)
- A. Hub2Spoke1 is a policy-based VPN.
- B. Anti-replay is disabled.
- C. Hub2Spoke1 is configured on interface wan2.
- D. Phase 2 authentication is set to sha1 on both sides.
正解：C、D
質問 # 76
An administrator added the following Ipsec VPN to a FortiGate configuration:
configvpn ipsec phasel -interface
edit "RemoteSite"
set type dynamic
set interface "portl"
set mode main
set psksecret ENC LCVkCiK2E2PhVUzZe
next
end
config vpn ipsec phase2-interface
edit "RemoteSite"
set phasel name "RemoteSite"
set proposal 3des-sha256
next
end
However, the phase 1 negotiation is failing. The administrator executed the IKF real time debug while attempting the Ipsec connection.
The output is shown in the exhibit.
What is causing the IPsec problem in the phase 1 ?
- A. The pre-shared key is wrong
- B. The phrase-1 mode must be changed to aggressive
- C. NAT-T settings do not match
- D. The incoming IPsec connection is matching the wrong VPN configuration
正解：A
質問 # 77
Examine the output of the 'diagnose sys session list expectation' command shown in the exhibit; than answer the question below.
Which statement is true regarding the session in the exhibit?
- A. It is for traffic originated from the FortiGate.
- B. It was created by a session helper or ALG.
- C. It was created by the FortiGate kernel to allow push updates from FotiGuard.
- D. It is for management traffic terminating at the FortiGate.
正解：B
質問 # 78
View the exhibit, which contains an entry in the session table, and then answer the question below.
Which one of the following statements is true regarding FortiGate's inspection of this session?
- A. FortiGate applied explicit proxy-based inspection.
- B. FortiGate applied proxy-based inspection.
- C. FortiGate forwarded this session without any inspection.
- D. FortiGate applied flow-based inspection.
正解：B
質問 # 79
View the exhibit, which contains an entry in the session table, and then answer the question below.
Which one of the following statements is true regarding FortiGate's inspection of this session?
- A. FortiGate applied explicit proxy-based inspection.
- B. FortiGate applied proxy-based inspection.
- C. FortiGate forwarded this session without any inspection.
- D. FortiGate applied flow-based inspection.
正解：B
質問 # 80
Which real time debug should an administrator enable to troubleshoot RADIUS authentication problems?
- A. Diagnose authd console -log enable.
- B. Diagnose debug application fnbamd -1.
- C. Diagnose radius console -log enable.
- D. Diagnose debug application radius -1.
正解：B
質問 # 81
An administrator has enabled HA session synchronization in a HA cluster with two members. Which flag is added to a primary unit's session to indicate that it has been synchronized to the secondary unit?
- A. synced
- B. redir.
- C. dirty.
- D. nds.
正解：A
解説：
The synced sessions have the 'synced' flag. The command 'diag sys session list' can be used to see the sessions on the member, with the associated flags.
質問 # 82
Refer to the exhibit, which shows a session entry .
Which statement about this session is true?
- A. It is an ICMP session from 10.1.10.10 to 10.200.1.1.
- B. It is a TCP session in the established state, from 10.1.10.10 to 10.200.5.1.
- C. It is a TCP session in close_wait state, from 10. l. 10.10 to 10.200.1.1.
- D. It is an ICMP session from 10.1.10.10 to 10.200.5. 1.
正解：D
質問 # 83
View the exhibit, which contains a partial output of an IKE real-time debug, and then answer the question below.
Based on the debug output, which phase-1 setting is enabled in the configuration of this VPN?
- A. auto-discovery-shortcut
- B. auto-discovery-sender
- C. auto-discovery-forwarder
- D. auto-discovery-receiver
正解：C
質問 # 84
View the exhibit, which contains an entry in the session table, and then answer the question below.
Which one of the following statements is true regarding FortiGate's inspection of this session?
- A. FortiGate applied explicit proxy-based inspection.
- B. FortiGate applied proxy-based inspection.
- C. FortiGate forwarded this session without any inspection.
- D. FortiGate applied flow-based inspection.
正解：B
解説：
https://kb.fortinet.com/kb/viewContent.do?externalId=FD30042
質問 # 85
Examine the IPsec configuration shown in the exhibit; then answer the question below.
An administrator wants to monitor the VPN by enabling the IKE real time debug using these commands:
diagnose vpn ike log-filter src-addr4 10.0.10.1
diagnose debug application ike -1
diagnose debug enable
The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are being interchanged between both IPsec gateways. However, the IKE real time debug does NOT show any output .
Why isn't there any output?
- A. The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.
- B. The IKE real time shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.
- C. The IKE real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.
- D. The log-filter setting is set incorrectly. The VPN's traffic does not match this filter.
正解：D
質問 # 86
Which configuration can be used to reduce the number of BGP sessions in an IBGP network?
- A. Neighbor range
- B. Neighbor group
- C. Next-hop-self
- D. Route reflector
正解：D
質問 # 87
View the exhibit, which contains the output of get sys ha status, and then answer the question below.
Which statements are correct regarding the output? (Choose two.)
- A. The HA management IP is 169.254.0.2.
- B. Master is selected because it is the only device in the cluster.
- C. port 7 is used the HA heartbeat on all devices in the cluster.
- D. The slave configuration is not synchronized with the master.
正解：C、D
質問 # 88
In which two ways does FortiManager function when it is deployed as a local FDS? (Choose two.)
- A. It supports rating requests from non-FortiGate devices.
- B. It provides VM license validation services.
- C. It can be configured as an update server, a rating server, or both.
- D. It caches available firmware updates for unmanaged devices.
正解：B、C
質問 # 89
An administrator has enabled HA session synchronization in a HA cluster with two members .
Which flag is added to a primary unit's session to indicate that it has been synchronized to the secondary unit?
- A. synced
- B. redir.
- C. dirty.
- D. nds.
正解：A
質問 # 90
Which statement about the designated router (DR) and backup designated router (BDR) in an OSPF multi-access network is true?
- A. Non-DR and non-BDR routers send link state updates and acknowledgements to 224.0.0.6.
- B. Non-DR and non-BDR routers form full adjacencies to DR only.
- C. Only the DR receives link state information from non-DR routers.
- D. FortiGate first checks the OSPF ID to elect a DR.
正解：A
解説：
Some special IP multicast addresses are reserved for OSPF: 224.0.0.5: All OSPF routers must be able to transmit and listen to this address. 224.0.0.6: All DR and BDR routers must be able to transmit and listen to this address. https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/7039-1.html
質問 # 91
Refer to the exhibit, which shows the output of a debug command.
Which two statements about the output are true? (Choose two.)
- A. In the network connected to port4, two OSPF routers are down.
- B. Port4 is connected to the OSPF backbone area.
- C. The local FortiGate is the backup designated router.
- D. The local FortiGate OSPF router ID is 0.0.0.4.
正解：B、D
質問 # 92
View the exhibit, which contains the output of a diagnose command, and then answer the question below.
What statements are correct regarding the output? (Choose two.)
- A. Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.0.1.10.
- B. This is an expected session created by an application control profile.
- C. Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.200.1.1.
- D. This is an expected session created by a session helper.
正解：C、D
質問 # 93
You have configured FortiManager as a local FDS to provide FortiGate AV and IPS updates, but FortiGate devices are not receiving updates to their AV signature databases, IPS engines, or IPS signature databases.
Which two settings need to be verified for these features to function? (Choose two.)
- A. FortiGate needs to have the server list entry for FortiManager set to server-type update under config system central-management.
- B. FortiManager needs to be the license validation server for FortiGate devices trying to retrieve updated AV and IPS packages.
- C. FortiGate needs to have include-default-servers disabled under config system central-management.
- D. Service access needs to be enabled on FortiManager under System Settings > Network.
正解：A、D
解説：
NSE 7.0 Guide page 184-185
質問 # 94
Four FortiGate devices configured for OSPF connected to the same broadcast domain. The first unit is elected as the designated router. The second unit is elected as the backup designated router.
Under normal operation, how many OSPF full adjacencies are formed to each of the other two units?
- A. 0
- B. 1
- C. 2
- D. 3
正解：B
質問 # 95
View the exhibit, which contains the output of diagnose sys session list, and then answer the question below.
If the HA ID for the primary unit is zero (0), which statement is correct regarding the output?
- A. This session is for HA heartbeat traffic.
- B. This session cannot be synced with the slave unit.
- C. This session is synced with the slave unit.
- D. The inspection of this session has been offloaded to the slave unit.
正解：C
質問 # 96
An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device. The administrator decides to enable the setting link-failed-signal to fix the problem.
Which statement about this setting is true?
- A. It sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.
- B. It forces the former primary device to shut down all its non-heartbeat interfaces for one second, while the failover occurs.
- C. It sends a link failed signal to all connected devices.
- D. It disabled all the non-heartbeat interfaces in all HA members for two seconds after a failover.
正解：B
質問 # 97
......
Fortinet NSE7_EFW-7.0リアル2024年最新のブレーン問題集模擬試験問題集：https://www.goshiken.com/Fortinet/NSE7_EFW-7.0-mondaishu.html
最新NSE7_EFW-7.0試験問題集で最近更新された165問題：https://drive.google.com/open?id=1p8GAv7TrI7ZXsxH0lsD9WCqxL1FxbFwV