Try Fortinet : NSE7_FSN_AR-7.6 valid & accurate questions and answers

Fortinet NSE7_FSN_AR-7.6 Exam Overview:

Fortinet NSE7_FSN_AR-7.6 Exam Syllabus Topics:

Fortinet NSE 7 - Secure Networking 7.6 Architect Sample Questions:

1. Refer to the exhibit.

Which two statements about the output are true, considering NGFW-1 and NGFW-2 have been up for a week? (Choose two.)

A) If a configuration change is made to the secondary FortiGate, the Configuration Status will not change.
B) If FGVM...649 is rebooted, FGVM...650 will become the primary FortiGate and retain that role, even after FGVM...649 rejoins the cluster.
C) If port7 becomes disconnected on the secondary FortiGate, both FortiGate devices will elect themselves as primary.
D) If a configuration change is made to the primary FortiGate at this time, the secondary will initiate a synchronization reset.

2. If you configure set tcp-mss-sender and set tcp-mss-receiver in a firewall policy, how does it affect the size and handling of TCP packets in the network?

A) The TCP packet modifies the packet size only if no fragmentation occurs.
B) The commands affect both the payload size of the packet and the size of the IP header for handling TCP packets.
C) Applying the commands in a firewall policy determines the largest payload a device can handle in a single TCP segment.
D) The maximum segment size permitted in the firewall policy determines whether TCP packets are allowed or denied.

3. During the last network migration, the IT department discovered that all-zero phase selectors in phase 2 IPsec configurations impacted network operations.
What are two valid recommendations to prevent potential invalid paths during future migrations? (Choose two.)

A) Configure an IP address on the IPsec interface of each firewall to establish unique peer connections and avoid impacting network operations.
B) Configure an IPsec aggregate to create redundancy between each firewall peer.
C) Configure the VPN with the exact network segments that will be encrypted in the phase 2 selectors.
D) Configure routing protocols to specify allowed subnets over the tunnel.

4. As an IT manager, you want to delegate the installation and management of your SD-WAN deployment to a managed security service provider (MSSP).
Each site must maintain direct internet access and be secure. You expect significant traffic flow between the sites and want to delegate as much of the network administration and management as possible to the MSSP.
Which two MSSP deployment blueprints address your requirements? (Choose two.)

A) Use a shared hub on the MSSP premises and a dedicated hub on the customer premises, and install the spokes on the customer premises.
B) Install a dedicated hub on the MSSP premises for the customer, and install the spokes on the customer premises.
C) Use a shared hub on the MSSP premises with a dedicated VDOM for the customer, and install the spokes on the customer premises.
D) Install the hub and spokes on the customer premises, and enable the MSSP to manage the SD-WAN deployment using FortiManager with a dedicated ADOM.

5. Refer to the exhibit, which contains partial output from an IKE real-time debug.

The administrator does not have access to the remote gateway.
Based on the debug output, which configuration change the administrator make to the local gateway to resolve the phase 1 negotiation error?

A) In the phase 1 network configuration, set the IKE version to 2.
B) In the phase 1 proposal configuration, add AES256-SHA256 to the list of encryption algorithms.
C) In the phase 1 proposal configuration, add AESCBC-SHA2 to the list of encryption algorithms.
D) In the phase 1 proposal configuration, add AES128-SHA128 to the list of encryption algorithms.

Solutions: