完全版NSE7_EFW-7.2練習テスト58特別な問題と解答が待ってます！
NSE 7 Network Security Architect問題集でNSE7_EFW-7.2試験完全版問題で試験学習ガイド
Fortinet NSE7_EFW-7.2 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 # 21
Refer to the exhibit, which shows a network diagram.
Which protocol should you use to configure the FortiGate cluster?
- A. VRRP
- B. FGSP
- C. FGCP in active-active mode
- D. FGCP in active-passive mode
正解：B
解説：
Given the network diagram and the presence of two FortiGate devices, the Fortinet Gate Clustering Protocol (FGCP) in active-passive mode is the most appropriate for setting up a FortiGate cluster. FGCP supports high availability configurations and is designed to allow one FortiGate to seamlessly take over if the other fails, providing continuous network availability. This is supported by Fortinet documentation for high availability configurations using FGCP.
質問 # 22
Exhibit.
Refer to the exhibit, which provides information on BGP neighbors.
Which can you conclude from this command output?
- A. BGP is attempting to establish a TCP connection with the BGP peer.
- B. The bfd configuration to set to enable.
- C. The router are in the number to match the remote peer.
- D. You must change the AS number to match the remote peer.
正解：A
解説：
The BGP state is "Idle", indicating that BGP is attempting to establish a TCP connection with the peer. This is the first state in the BGP finite state machine, and it means that no TCP connection has been established yet. If the TCP connection fails, the BGP state will reset to either active or idle, depending on the configuration. References: You can find more information about BGP states and troubleshooting in the following Fortinet Enterprise Firewall 7.2 documents:
* Troubleshooting BGP
* How BGP works
質問 # 23
Refer to the exhibit, which shows a routing table.
What two options can you configure in OSPF to block the advertisement of the 10.1.10.0 prefix? (Choose two.)
- A. Remove the 16.1.10.C prefix from the OSPF network
- B. Configure a distribute-list-out
- C. Configure a route-map out
- D. Disable Redistribute Connected
正解：B、C
解説：
To block the advertisement of the 10.1.10.0 prefix in OSPF, you can configure a distribute-list-out or a route- map out. A distribute-list-out is used to filter outgoing routing updates from being advertised to OSPF neighbors1. A route-map out can also be used for filtering and is applied to outbound routing updates2. References := Technical Tip: Inbound route filtering in OSPF usi ... - Fortinet Community, OSPF | FortiGate / FortiOS 7.2.2 - Fortinet Documentation
質問 # 24
Exhibit.
Refer to the exhibit, which contains an ADVPN network diagram and a partial BGP con figuration Which two parameters Should you configure in config neighbor range? (Choose two.)
- A. set prefix 10.1.0 255.255.255.0
- B. set route reflector-client enable
- C. set neighbor-group advpn
- D. set prefix 172.16.1.0 255.255.255.0
正解：A、C
解説：
The config neighbor range command is used to configure a range of IP addresses for BGP neighbors in an ADVPN scenario. The two parameters that should be configured are the neighbor-group and the prefix. The neighbor-group specifies the name of the neighbor group that the range belongs to, which in this case is "advpn". The prefix specifies the IP address range of the BGP neighbors, which in this case is 10.1.0.0/24, as shown in the network diagram. Reference: You can find more information about ADVPN and BGP configuration in the following Fortinet Enterprise Firewall 7.2 documents:
ADVPN
BGP
ADVPN with BGP as the routing protocol
質問 # 25
Exhibit.
Refer to the exhibit, which shows an ADVPN network.
The client behind Spoke-1 generates traffic to the device located behind Spoke-2.
Which first message floes the hub send to Spoke-110 bring up the dynamic tunnel?
- A. Shortcut forward
- B. Shortcut reply
- C. Shortcut query
- D. Shortcut offer
正解：C
解説：
In an ADVPN scenario, when traffic is initiated from a client behind one spoke to another spoke, the hub sends a shortcut query to the initiating spoke. This query is used to determine if there is a more direct path for the traffic, which can then trigger the establishment of a dynamic tunnel between the spokes.
質問 # 26
You created a VPN community using VPN Manager on FortiManager. You also added gateways to the VPN community. Now you are trying to create firewall policies to permit traffic over the tunnel however, the VPN interfaces do not appear as available options.
- A. Create interface mappings for the IPsec VPN interfaces before you use them in a policy.
- B. install the VPN community and gateway configuration on the fortiGate devices so that the VPN interfaces appear on the Policy Objects on fortiManager.
- C. Configure the phase 1 settings in the VPN community that you didnt initially configure. FortiGate automatically generates the interfaces after you configure the required settings
- D. Refresh the device status using the Device Manager so that FortiGate populates the IPSec interfaces
正解：B
解説：
To use the VPN interfaces in a policy, you need to install the VPN community and gateway configuration on the FortiGate devices first. This will create the VPN interfaces on the FortiGate and sync them with FortiManager. Reference:
Creating IPsec VPN communities
VPN | FortiGate / FortiOS 7.2.0
質問 # 27
How are bulk configuration changes made using FortiManager CLI scripts? (Choose two.)
- A. When run on the All FortiGate in ADOM, changes are automatically installed without the creation of a new revision history.
- B. When run on the Policy Package, ADOM database, you must use the installation wizard to apply the changes to the managed FortiGate device.
- C. When run on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.
- D. When run on the Device Database, changes are applied directly to the managed FortiGate device.
正解：B、C
質問 # 28
Exhibit.
Refer to the exhibit, which contains a partial VPN configuration.
What can you conclude from this configuration1?
- A. FortiGate creates separate virtual interfaces for each dial up client.
- B. Dead peer detection s disabled.
- C. The VPN should use the dynamic routing protocol to exchange routing information Through the tunnels.
- D. The routing table shows a single IPSec virtual interface.
正解：B
解説：
The configuration line "set dpd on-idle" indicates that dead peer detection (DPD) is set to trigger only when the tunnel is idle, not actively disabled1. References: FortiGate IPSec VPN User Guide - Fortinet Document Library From the given VPN configuration, dead peer detection (DPD) is set to 'on-idle', indicating that DPD is enabled and will be used to detect if the other end of the VPN tunnel is still alive when no traffic is detected.
Hence, option C is incorrect. The configuration shows the tunnel set to type 'dynamic', which does not create separate virtual interfaces for each dial-up client (A), and it is not specified that dynamic routing will be used (B). Since this is a phase 1 configuration snippet, the routing table aspect (D) cannot be concluded from this alone.
質問 # 29
Which two statements about IKE vision 2 are true? (Choose two.)
- A. Phase 1 includes main mode
- B. It supports the extensible authentication protocol (EAP)
- C. It exchanges a minimum of four messages to establish a secure tunnel
- D. It supports the XAuth protocol.
正解：B、C
質問 # 30
Refer to the exhibit, which contains a TCL script configuration on FortiManager.
An administrator has configured the TCL script on FortiManager, but the TCL script failed to apply any changes to the managed device after being run.
Why did the TCL script fail to make any changes to the managed device?
- A. The TCL procedure lacks the required loop statements to iterate through the changes.
- B. The TCL script must start with #include.
- C. The TCL procedure run_cmd has not been created.
- D. There is no corresponding #! to signify the end of the script.
正解：C
質問 # 31
Exhibit.
Refer to the exhibit, which shows the output from the webfilter fortiguard cache dump and webfilter categories commands.
Using the output, how can an administrator determine the category of the training.fortinet.com am website?
- A. The administrator can look up the hex value of 34 in the second command output.
- B. The administrator must convert the first three digits of the IP hex value to binary
- C. The administrator must convert the first two digits of the Domain hex value to a decimal value
- D. The administrator must add both the Pima in and Iphex values of 34 to get the category number
正解：A
解説：
Option B is correct because the administrator can determine the category of the training.fortinet.com website by looking up the hex value of 34 in the second command output. This is because the first command output shows that the domain and the IP of the website are both in category (Hex) 34, which corresponds to Information Technology in the second command output1.
Option A is incorrect because the administrator does not need to convert the first three digits of the IP hex value to binary. The IP hex value is already in the same format as the category hex value, so the administrator can simply compare them without any conversion2.
Option C is incorrect because the administrator does not need to add both the Pima in and Iphex values of 34 to get the category number. The Pima in and Iphex values are not related to the category number, but to the cache TTL and the database version respectively3.
Option D is incorrect because the administrator does not need to convert the first two digits of the Domain hex value to a decimal value. The Domain hex value is already in the same format as the category hex value, so the administrator can simply compare them without any conversion2. Reference: =
1: Technical Tip: Verify the webfilter cache content4
2: Hexadecimal to Decimal Converter5
3: FortiGate - Fortinet Community6
4: Web filter | FortiGate / FortiOS 7.2.0 - Fortinet Documentation7
質問 # 32
Refer to the exhibit, which shows config system central-management information.
Which setting must you configure for the web filtering feature to function?
- A. Configure server-type with the rating option.
- B. Set update-server-location to automatic.
- C. Add server. fortiguard. net to the server list.
- D. Configure securewf.fortiguard. net on the default servers.
正解：C
解説：
For the web filtering feature to function effectively, the FortiGate device needs to have a server configured for rating services. The rating option in the server-type setting specifies that the server is used for URL rating lookup, which is essential for web filtering. The displayed configuration does not list any FortiGuard web filtering servers, which would be necessary for web filtering. The setting set include-default-servers disable indicates that the default FortiGuard servers are not being used, and hence, a specific server for web filtering (like securewf.fortiguard.net) needs to be configured.
質問 # 33
You want to configure faster failure detection for BGP
Which parameter should you enable on both connected FortiGate devices?
- A. Ebgp-enforce-multihop
- B. Distribute-list-in
- C. Graceful-restart
- D. bfd
正解：D
解説：
BFD (Bidirectional Forwarding Detection) is a protocol that provides fast failure detection for BGP by sending periodic messages to verify the connectivity between two peers1. BFD can be enabled on both connected FortiGate devices by using the command set bfd enable under the BGP configuration2. Reference: = Technical Tip : FortiGate BFD implementation and examples ..., Configure BGP | FortiGate / FortiOS 7.0.2 - Fortinet Documentation
質問 # 34
Winch two statements about ADVPN are true? (Choose two)
- A. Routing is configured by enabling add-advpn-route
- B. auto-discovery receiver must be set to enable on the Spokes.
- C. Spoke to-spoke traffic never goes through the hub
- D. lt supports NAI for on-demand tunnels
正解：B、D
解説：
ADVPN (Auto Discovery VPN) is a feature that allows to dynamically establish direct tunnels (called shortcuts) between the spokes of a traditional Hub and Spoke architecture. The auto-discovery receiver must be set to enable on the spokes to allow them to receive NHRP messages from the hub and other spokes. NHRP (Next Hop Resolution Protocol) is used for on-demand tunnels, which are established when there is traffic between spokes. Routing is configured by enabling add-nhrp-route, not add-advpn-route. Reference := ADVPN | FortiGate / FortiOS 7.2.0 | Fortinet Document Library, Technical Tip: Fortinet Auto Discovery VPN (ADVPN)
質問 # 35
Which FortiGate in a Security I auric sends togs to FortiAnalyzer?
- A. Only the root FortiGate.
- B. The FortiGate devices performing network address translation (NAT) or unified threat management (UTM). if configured.
- C. Each FortiGate in the Security fabric.
- D. Only the last FortiGate that handled a session in the Security Fabric
正解：C
解説：
* Option B is correct because each FortiGate in the Security Fabric can send logs to FortiAnalyzer for centralized logging and analysis12. This allows you to monitor and manage the entire Security Fabric from a single console and view aggregated reports and dashboards.
* Option A is incorrect because the root FortiGate is not the only device that can send logs to FortiAnalyzer. The root FortiGate is the device that initiates the Security Fabric and acts as the central point of contact for other FortiGate devices3. However, it does not have to be the only log source for FortiAnalyzer.
* Option C is incorrect because the FortiGate devices performing NAT or UTM are not the only devices that can send logs to FortiAnalyzer. These devices can perform additional security functions on the traffic that passes through them, such as firewall, antivirus, web filtering, etc4. However, they are not the only devices that generate logs in the Security Fabric.
* Option D is incorrect because the last FortiGate that handled a session in the Security Fabric is not the only device that can send logs to FortiAnalyzer. The last FortiGate is the device that terminates the session and applies the final security policy5. However, it does not have to be the only device that reports the session information to FortiAnalyzer. References: =
* 1: Security Fabric - Fortinet Documentation1
* 2: FortiAnalyzer Demo6
* 3: Security Fabric topology
* 4: Security Fabric UTM features
* 5: Security Fabric session handling
質問 # 36
Exhibit.
Refer to the exhibit, which contains a partial VPN configuration.
What can you conclude from this configuration1?
- A. FortiGate creates separate virtual interfaces for each dial up client.
- B. Dead peer detection s disabled.
- C. The VPN should use the dynamic routing protocol to exchange routing information Through the tunnels.
- D. The routing table shows a single IPSec virtual interface.
正解：B
解説：
The configuration line "set dpd on-idle" indicates that dead peer detection (DPD) is set to trigger only when the tunnel is idle, not actively disabled1. References: FortiGate IPSec VPN User Guide - Fortinet Document Library From the given VPN configuration, dead peer detection (DPD) is set to 'on-idle', indicating that DPD is enabled and will be used to detect if the other end of the VPN tunnel is still alive when no traffic is detected.
Hence, option C is incorrect. The configuration shows the tunnel set to type 'dynamic', which does not create separate virtual interfaces for each dial-up client (A), and it is not specified that dynamic routing will be used (B). Since this is a phase 1 configuration snippet, the routing table aspect (D) cannot be concluded from this alone.
質問 # 37
Exhibit.
Refer to exhibit, which shows a central management configuration
Which server will FortiGate choose for web filler rating requests if 10.0.1.240 is experiencing an outage?
- A. Public FortiGuard servers
- B. 10.0.1.243
- C. 10.0.1.244
- D. 10.0.1.242
正解：C
解説：
In the event of an outage at 10.0.1.240, the FortiGate will choose the next server in the sequence for web filter rating requests, which is 10.0.1.244 according to the configuration shown in the exhibit. This is because the server list is ordered by priority, and the server with the lowest priority number is chosen first. If that server is unavailable, the next server with the next lowest priority number is chosen, and so on. The public FortiGuard servers are only used if the include-default-servers option is enabled and all the custom servers are unavailable. References := Fortinet Enterprise Firewall Study Guide for FortiOS 7.2, page 132.
質問 # 38
Refer to the exhibit, which shows a custom signature.
Which two modifications must you apply to the configuration of this custom signature so that you can save it on FortiGate? (Choose two.)
- A. Add attack_id.
- B. Add severity.
- C. Ensure that the header syntax is F-SBID.
- D. Start options with --.
正解：A、B
解説：
For a custom signature to be valid and savable on a FortiGate device, it must include certain mandatory fields.
Severity is used to specify the level of threat that the signature represents, and attack_id is a unique identifier for the signature. Without these, the signature would not be complete and could not be correctly utilized by the FortiGate's Intrusion Prevention System (IPS).
質問 # 39
Exhibit.
Refer to the exhibit, which contains a CLI script configuration on fortiManager. An administrator configured the CLI script on FortiManager rut the script tailed to apply any changes to the managed device after being executed.
What are two reasons why the script did not make any changes to the managed device? (Choose two)
- A. Incomplete commands can cause CLI scripts to fail.
- B. CLI scripts must start with #!.
- C. Static routes can be added using only TCI scripts.
- D. The commands that start with the # sign did not run.
正解：A、D
解説：
The commands that start with the # sign did not run because they are treated as comments in the CLI script.
Incomplete commands can cause CLI scripts to fail because they are not recognized by the FortiGate device.
The other options are incorrect because static routes can be added using CLI or GUI, and CLI scripts do not need to start with #!. References := Configuring custom scripts | FortiManager 7.2.0 - Fortinet Documentation, section "CLI script syntax".
質問 # 40
Exhibit.
Refer to the exhibit, which contains the partial interface configuration of two FortiGate devices.
Which two conclusions can you draw from this con figuration? (Choose two)
- A. On failover new primary device uses the same MAC address as the old primary
- B. 10.1.5.254 is the default gateway of the internal network
- C. By default FortiGate B is the primary virtual router
- D. The VRRP domain uses the physical MAC address of the primary FortiGate
正解：A、B
解説：
The Virtual Router Redundancy Protocol (VRRP) configuration in the exhibit indicates that 10.1.5.254 is set as the virtual IP (VRIP), commonly serving as the default gateway for the internal network (A). With vrrp- virtual-mac enabled, both FortiGates would use the same virtual MAC address, ensuring a seamless transition during failover (B). The VRRP domain does not use the physical MAC address (C), and the priority settings indicate that FortiGate-A would be the primary router by default due to its higher priority (D).
質問 # 41
......
NSE7_EFW-7.2正真正銘のベスト資料、オンライン練習試験：https://www.passtest.jp/Fortinet/NSE7_EFW-7.2-shiken.html
優れもの良質なNSE7_EFW-7.2問題集が待ってます：https://drive.google.com/open?id=117hM2xoySulEwloqFLcotqZZ1HO9OfDX