別格で売上ナンバーワンNSE7_EFW-6.4試験にはは2022年最新のFortinet練習問試験合格させます
NSE 7 Network Security Architect問題集でNSE7_EFW-6.4試験完全版問題で試験学習ガイド
質問 51
View the exhibit, which contains the output of a debug command, and then answer the question below.
What statement is correct about this FortiGate?
- A. It iscurrently in system conserve mode because of high CPU usage.
- B. It is currently in system conserve mode because of high memory usage.
- C. It is currently in kernel conserve mode because of high memory usage.
- D. It is currently in FD conserve mode.
正解: B
質問 52
An administrator has configured the following CLI script on FortiManager, which failed to apply any changes to the managed device after being executed.
Why didn't the script make any changes to the managed device?
- A. Commands that start with the # sign are not executed.
- B. Incomplete commands are ignored in CLI scripts.
- C. CLI scripts will add objects only if they are referenced by policies.
- D. Static routes can only be added using TCL scripts.
正解: A
解説:
https://help.fortinet.com/fmgr/50hlp/56/5-6-2/FortiManager_Admin_Guide/1000_Device%20Manager/2400_Scripts/1000_Script%20samples/0200_CLI%20scripts+.htm#Error_Messages A sequence of FortiGate CLI commands, as you would type them at the command line. A comment line starts with the number sign (#). A comment line will not be executed.
質問 53
Which two conditions must be met for a statistic route to be active in the routing table? (Choose two.)
- A. There is no other route, to the same destination, with a higherdistance.
- B. The outgoing interface is up.
- C. The next-hop IP address is up.
- D. The link health monitor (if configured) is up.
正解: B,D
質問 54
When using the SSL certificate inspection method to inspect HTTPS traffic, how does FortiGate filter web requests when the client browser does notprovide the server name indication (SNI) extension?
- A. FortiGate uses the CN information from the Subject field in the server certificate.
- B. FortiGate uses the requested URL from the user's web browser.
- C. FortiGate switches to the full SSL inspection method to decrypt the data.
- D. FortiGate blocks the request without any furtherinspection.
正解: A
質問 55
When using the SSL certificate inspection method for HTTPS traffic, how does FortiGate filter web requests when the browser client does not provide the server name indication (SNI) extension?
- A. FortiGate uses the requested URL from the user's web browser.
- B. FortiGate blocks the request without any further inspection.
- C. FortiGate switches to the full SSL inspection method to decrypt the data.
- D. FortiGate uses CN information from the Subject field in the server's certificate.
正解: D
質問 56
An administrator has enabled HA session synchronization in a HA cluster with two members. Which flag is added to a primary unit's session to indicate that it has been synchronized to the secondary unit?
- A. redir.
- B. nds.
- C. dirty.
- D. synced
正解: D
解説:
The synced sessions have the 'synced' flag. The command 'diag sys session list' can be used to see the sessions on the member, with the associated flags.
質問 57
View the exhibit, which contains the output of a BGP debug command, and then answer the question below.
Which of the following statements about the exhibit are true? (Choose two.)
- A. The local BGP peer has not established a TCP session to the BGP peer 10.200.3.1.
- B. The local BGP peer has received a total of three BGP prefixes.
- C. Since the BGP counters were last reset, the BGP peer 10.200.3.1 has never been down.
- D. For the peer 10.125.0.60, the BGP state of is Established.
正解: A,D
質問 58
Examine the partial output from the IKE real time debug shown in the exhibit; then answer the question below.
Why didn't the tunnel come up?
- A. One IPsec gateway is using main mode, while the other IPsec gateway is using aggressive mode.
- B. The remote gateway's Phase-1 configuration does not match the local gateway's phase-1 configuration.
- C. The remote gateway's Phase-2 configuration does not match the local gateway's phase-2 configuration.
- D. IKE mode configuration is not enabled in the remote IPsec gateway.
正解: B
質問 59
Examine the output of the 'get router info ospf interface' command shown in the exhibit; then answer the question below.
Which statements are true regarding the above output? (Choose two.)
- A. The port4 interface is connected to the OSPF backbone area.
- B. There are at least 5 OSPF routers connected to the port4 network.
- C. Two OSPF routers are down in the port4 network.
- D. The local FortiGate has been elected as the OSPF backup designated router.
正解: A,B
解説:
on BROADCAST network there are 4 neighbors, among which 1*DR +1*BDR. So our FG has 4 neighbors, but create adjacency only with 2 (with DR and BDR). 2 neighbors DRother (not down).
質問 60
Which the following events can trigger the election of a new primary unit in a HA cluster? (Choose two.)
- A. One of the monitored interfaces in the primary unit is disconnected.
- B. Primary unit stops sending HA heartbeat keepalives.
- C. The FortiGuard license for the primary unit is updated.
- D. A secondary unit is removed from the HA cluster.
正解: A,B
質問 61
Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)
- A. Preview pending configuration changes for managed devices.
- B. Import interface mappings from managed devices.
- C. Import policy packages from managed devices.
- D. Add devices to FortiManager.
- E. Install configuration changes to managed devices.
正解: A,E
解説:
Explanation
https://help.fortinet.com/fmgr/50hlp/56/5-6-2/FortiManager_Admin_Guide/1000_Device%20Manager/1200_ins There are 4 main wizards:Add Device: is used to add devices to central management and import their configurations.
Install: is used to install configuration changes from Device Manager or Policies & Objects to the managed devices. It allows you to preview the changes and, if the administrator doesn't agree with the changes, cancel and modify them.
Import policy: is used to import interface mapping, policy database, and objects associated with the managed devices into a policy package under the Policy & Object tab. It runs with the Add Device wizard by default and may be run at any time from the managed device list.
Re-install policy: is used to perform a quick install of the policy package. It doesn't give the ability to preview the changes that will be installed to the managed device.
質問 62
AFortiGate's portl is connected to a private network. Its port2 is connected to the Internet. Explicit web proxy is enabled in port1 and only explicit web proxy users can access the Internet. Web cache is NOT enabled. An internal web proxy user is downloading a file from the Internet via HTTP. Which statements are true regarding the two entries in the FortiGate session table related with this traffic? (Choose two.)
- A. Both session have the local flag on.
- B. One of the sessions has the IP address of port2 as the source IP address.
- C. One session has the proxy flag on, the other one does not.
- D. The destination IP addresses of both sessions are IP addresses assigned to FortiGate'sinterfaces.
正解: A,B
質問 63
Refer to exhibit, which contains the output of a BGP debug command.
Which statement explains why the state of the 10.200.3.1 peer is Connect?
- A. The local router has received the BGP prefixes from the remote peer.
- B. The local router is receiving BGP keepalives from theremote peer, but the local peer has not received the OpenConfirm yet.
- C. The local router is receiving the BGP keepalives from the peer, but it has not received a BGP prefix yet.
- D. The TCP session to 10.200.3.1 has not completed the 3-way handshake.
正解: D
解説:
Explanation
BGP neighbor states and how they change:* Idle: Initial state* Connect: Waiting for a successful three-way TCP connection* Active: Unable to establish the TCP session* OpenSent: Waiting for an OPEN message from the peer* OpenConfirm: Waiting for the keepalive message from the peer* Established: Peers have successfully exchanged OPEN and keepalive messages
質問 64
An administrator has configured the following CLIscript on FortiManager, which failed to apply any changes to the managed device after being executed.
Why didn't the script make any changes to the managed device?
- A. Commands that start with the # sign are not executed.
- B. Incomplete commands are ignored in CLI scripts.
- C. Static routes can only be added using TCL scripts.
- D. CLI scripts will add objectsonly if they are referenced by policies.
正解: A
解説:
Explanation
https://help.fortinet.com/fmgr/50hlp/56/5-6-2/FortiManager_Admin_Guide/1000_Device%20Manager/2400_Scr A sequence of FortiGate CLI commands, as you would type them at the command line. A comment line starts with the number sign (#). A comment line will not be executed.
質問 65
Which of the following statements is trueregarding a FortiGate configured as an explicit web proxy?
- A. FortiGate limits the number of simultaneous sessions per explicit web proxy user The limit CAN be modified by the administrator
- B. FortiGate limits the total number of simultaneous explicit web proxy users.
- C. FortiGate limits the number of simultaneous sessions per explicit web proxy user. This limit CANNOT be modified by the administrator.
- D. FortiGate limits the number of workstations that authenticate using the same web proxy usercredentials.
This limit CANNOT be modified by the administrator.
正解: B
解説:
Explanation
https://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-WAN-opt-52/web_proxy.htm#Explicit2 The explicit proxy does not limit the number of active sessions for each user. As a result the actual explicit proxy session count is usually much higherthan the number of explicit web proxy users. If an excessive number of explicit web proxy sessions is compromising system performance you can limit the amount of users if the FortiGate unit is operating with multiple VDOMs.
質問 66
What is the purpose of an internal segmentation firewall (ISFW)?
- A. It is the first line of defense at the network perimeter.
- B. It splits the network into multiple security segments to minimize the impact of breaches.
- C. It inspects incoming traffic to protect services in the corporate DMZ.
- D. It is an all-in-one security appliance that is placed at remote sites to extend the enterprise network.
正解: B
解説:
ISFW splits your network into multiple security segments. They serve as a breach containers from attacks that come from inside.
質問 67
......
最適な道は練習テストFortinet NSE7_EFW-6.4問題集：https://www.passtest.jp/Fortinet/NSE7_EFW-6.4-shiken.html
NSE7_EFW-6.4問題集が待ってます試験問題解答：https://drive.google.com/open?id=1GnPRg8-9_KgsWzQY9szv3hFXHTnHrX8H