[UPDATED 2022] Getting NSE7_EFW-7.0 Certification Made Easy!
NSE7_EFW-7.0 Exam Crack Test Engine Dumps Training With 115 Questions
NEW QUESTION 61
A FortiGate is configured as an explicit web proxy. Clients using this web proxy are reposting DNS errors when accessing any website.
The administrator executes the following debug commands and observes that the n-dns-timeout counter is increasing:
What should the administrator check to fix the problem?
- A. The connectivity between the FortiGate unit and the DNS server.
- B. That DNS service is enabled in the explicit web proxy interface.
- C. The connectivity between the client workstations and the DNS server.
- D. That DNS traffic from client workstations is allowed by the explicit web proxy policies.
Answer: A
NEW QUESTION 62
View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.
Which statements about this debug output are correct? (Choose two.)
- A. The initiator has provided remote as its IPsec peer ID.
- B. It shows a phase 1 negotiation.
- C. The remote gateway IP address is 10.0.0.1.
- D. The negotiation is using AES128 encryption with CBC hash.
Answer: A,B
NEW QUESTION 63
What does the dirty flag mean in a FortiGate session?
- A. The session must be removed from the former primary unit after an HA failover.
- B. The next packet must be re-evaluated against the firewall policies.
- C. Traffic has been identified as from an application that is not allowed.
- D. Traffic has been blocked by the antivirus inspection.
Answer: B
NEW QUESTION 64
Refer to the exhibit, which contains partial output from an IKE real-time debug.
Based on the debug output, which phase 1 setting is enabled in the configuration of this VPN?
- A. auto-discovery-shortcut
- B. auto-discovery-forwarder
- C. auto-discovery-sender
- D. auto-discovery-receiver
Answer: C
NEW QUESTION 65
Examine the following partial output from two system debug commands; then answer the question below.
Which of the following statements are true regarding the above outputs? (Choose two.)
- A. Kernel indirectly accesses the low memory (LowTotal) through memory paging
- B. The unit is in kernel conserve mode
- C. The unit is running a 32-bit FortiOS
- D. The Cached value is always the Active value plus the Inactive value
Answer: C,D
NEW QUESTION 66
An administrator added the following Ipsec VPN to a FortiGate configuration:
configvpn ipsec phasel -interface
edit "RemoteSite"
set type dynamic
set interface "portl"
set mode main
set psksecret ENC LCVkCiK2E2PhVUzZe
next
end
config vpn ipsec phase2-interface
edit "RemoteSite"
set phasel name "RemoteSite"
set proposal 3des-sha256
next
end
However, the phase 1 negotiation is failing. The administrator executed the IKF real time debug while attempting the Ipsec connection.
The output is shown in the exhibit.
What is causing the IPsec problem in the phase 1?
- A. The phrase-1 mode must be changed to aggressive
- B. NAT-T settings do not match
- C. The incoming IPsec connection is matching the wrong VPN configuration
- D. The pre-shared key is wrong
Answer: D
NEW QUESTION 67
Which statement about memory conserve mode is true?
- A. A FortiGate exits conserve mode when the configured memory use threshold reaches yellow.
- B. A FortiGate starts dropping all the new and old sessions when the configured memory use threshold reaches extreme.
- C. A FortiGate starts dropping new sessions when the configured memory use threshold reaches red
- D. A FortiGate enters conserve mode when the configured memory use threshold reaches red
Answer: D
NEW QUESTION 68
The logs in a FSSO collector agent (CA) are showing the following error:
failed to connect to registry: PIKA1026 (192.168.12.232)
What can be the reason for this error?
- A. The CA cannot reach the FortiGate with the IP address 192.168.12.232.
- B. The remote registry service is not running in the workstation 192.168.12.232.
- C. The CA cannot resolve the name of the workstation.
- D. The FortiGate cannot resolve the name of the workstation.
Answer: B
NEW QUESTION 69
Which two statements about the Security Fabric are true? (Choose two.)
- A. Branch FortiGate devices must be configured first.
- B. FortiGate uses FortiTelemetry protocol to communicate with FortiAnalyzer.
- C. All FortiGate devices in the Security Fabric must have bidirectional FortiTelemetry connectivity.
- D. Only the root FortiGate collects network information and forwards it to FortiAnalyzer.
Answer: C,D
NEW QUESTION 70
An administrator has configured the following CLI script on FortiManager, which failed to apply any changes to the managed device after being executed.
Why didn't the script make any changes to the managed device?
- A. Commands that start with the # sign are not executed.
- B. CLI scripts will add objects only if they are referenced by policies.
- C. Static routes can only be added using TCL scripts.
- D. Incomplete commands are ignored in CLI scripts.
Answer: A
NEW QUESTION 71
Examine the output from the 'diagnose vpn tunnel list' command shown in the exhibit; then answer the question below.
Which command can be used to sniffer the ESP traffic for the VPN DialUP_0?
- A. diagnose sniffer packet any 'port 4500'
- B. diagnose sniffer packet any 'port 500'
- C. diagnose sniffer packet any 'esp'
- D. diagnose sniffer packet any 'host 10.0.10.10'
Answer: A
NEW QUESTION 72
Examine the IPsec configuration shown in the exhibit; then answer the question below.
An administrator wants to monitor the VPN by enabling the IKE real time debug using these commands:
diagnose vpn ike log-filter src-addr4 10.0.10.1
diagnose debug application ike -1
diagnose debug enable
The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are being interchanged between both IPsec gateways. However, the IKE real time debug does NOT show any output .
Why isn't there any output?
- A. The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.
- B. The IKE real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.
- C. The IKE real time shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.
- D. The log-filter setting is set incorrectly. The VPN's traffic does not match this filter.
Answer: D
NEW QUESTION 73
An administrator cannot connect to the GIU of a FortiGate unit with the IP address 10.0.1.254. The administrator runs the debug flow while attempting the connection using HTTP.
The output of the debug flow is shown in the exhibit:
Based on the error displayed by the debug flow, which are valid reasons for this problem? (Choose two.)
- A. Redirection of HTTP to HTTPS administrative access is disabled.
- B. HTTP administrative access is disabled in the FortiGate interface with the IP address 10.0.1.254.
- C. HTTP administrative access is configured with a port number different than 80.
- D. The packet is denied because of reverse path forwarding check.
Answer: B,C
NEW QUESTION 74
Examine the output of the 'get router info ospf interface' command shown in the exhibit; then answer the question below.
Which statements are true regarding the above output? (Choose two.)
- A. The local FortiGate has been elected as the OSPF backup designated router.
- B. Two OSPF routers are down in the port4 network.
- C. The port4 interface is connected to the OSPF backbone area.
- D. There are at least 5 OSPF routers connected to the port4 network.
Answer: C,D
NEW QUESTION 75
Which of the following statements is true regarding a FortiGate configured as an explicit web proxy?
- A. FortiGate limits the number of simultaneous sessions per explicit web proxy user The limit CAN be modified by the administrator
- B. FortiGate limits the number of workstations that authenticate using the same web proxy user credentials. This limit CANNOT be modified by the administrator.
- C. FortiGate limits the number of simultaneous sessions per explicit web proxy user. This limit CANNOT be modified by the administrator.
- D. FortiGate limits the total number of simultaneous explicit web proxy users.
Answer: D
NEW QUESTION 76
An administrator has enabled HA session synchronization in a HA cluster with two members .
Which flag is added to a primary unit's session to indicate that it has been synchronized to the secondary unit?
- A. dirty.
- B. synced
- C. redir.
- D. nds.
Answer: B
NEW QUESTION 77
Refer to the exhibit, which contains a TCL script configuration on FortiManager.
An administrator has configured the TCL script on FortiManager, but failed to apply any changes to the managed device after being executed.
Why did the TCL script fail to make any changes to the managed device?
- A. Changes in an interface configuration can only be done by CLI script.
- B. The TCL script must start with #include <>.
- C. The TCL command run_cmd has not been created.
- D. Incomplete commands are ignored in TCL scripts.
Answer: C
NEW QUESTION 78
What is the diagnose test application ipsmonitor 99 command used for?
- A. To provide information regarding IPS sessions
- B. To enable IPS bypass mode
- C. To restart all IPS engines and monitors
- D. To disable the IPS engine
Answer: C
NEW QUESTION 79
Examine the output of the 'diagnose ips anomaly list' command shown in the exhibit; then answer the question below.
Which IP addresses are included in the output of this command?
- A. Those whose traffic matches an IPS sensor.
- B. Those whose traffic exceeded a threshold of a matching DoS policy.
- C. Those whose traffic was detected as an anomaly by an IPS sensor.
- D. Those whose traffic matches a DoS policy.
Answer: D
NEW QUESTION 80
A FortiGate's portl is connected to a private network. Its port2 is connected to the Internet. Explicit web proxy is enabled in port1 and only explicit web proxy users can access the Internet. Web cache is NOT enabled. An internal web proxy user is downloading a file from the Internet via HTTP .
Which statements are true regarding the two entries in the FortiGate session table related with this traffic? (Choose two.)
- A. One of the sessions has the IP address of port2 as the source IP address.
- B. The destination IP addresses of both sessions are IP addresses assigned to FortiGate's interfaces.
- C. Both session have the local flag on.
- D. One session has the proxy flag on, the other one does not.
Answer: A,C
NEW QUESTION 81
......
NSE7_EFW-7.0 Exam Dumps Contains FREE Real Quesions from the Actual Exam: https://testking.exams-boost.com/NSE7_EFW-7.0-valid-materials.html