検証済みNSE7_EFW-7.2問題集と解答100%合格はここにPassTest
合格させるNSE7_EFW-7.2試験一発合格保証2025問題集！
質問 # 28
You want to improve reliability over a lossy IPSec tunnel.
Which combination of IPSec phase 1 parameters should you configure?
- A. fragmentation and fragmentation-mtu
- B. Odpd and dpd-retryinterval
- C. keepalive and keylive
- D. fec-ingress and fec-egress
正解：B
解説：
For improving reliability over a lossy IPSec tunnel, the fragmentation and fragmentation-mtu parameters should be configured. In scenarios where there might be issues with packet size or an unreliable network, setting the IPsec phase 1 to allow for fragmentation will enable large packets to be broken down, preventing them from being dropped due to size or poor network quality. The fragmentation-mtu specifies the size of the fragments. This is aligned with Fortinet's recommendations for handling IPsec VPN over networks with potential packet loss or size limitations.
質問 # 29
Exhibit.
Refer to the exhibit, which contains the partial interface configuration of two FortiGate devices.
Which two conclusions can you draw from this con figuration? (Choose two)
- A. 10.1.5.254 is the default gateway of the internal network
- B. By default FortiGate B is the primary virtual router
- C. The VRRP domain uses the physical MAC address of the primary FortiGate
- D. On failover new primary device uses the same MAC address as the old primary
正解：C、D
解説：
The configuration shows that VRRP (Virtual Router Redundancy Protocol) is enabled and both FortiGates have the vrrp-virtual-mac enable command, meaning they share the same MAC address. The primary FortiGate uses its physical MAC address as indicated by the set type physical command. The priority value determines which FortiGate is the primary virtual router, and in this case, FortiGate-A has a higher priority than FortiGate-B, so it is the primary by default. The IP address 10.1.5.254 is the virtual IP address of the VRRP group, not the default gateway of the internal network. Reference: You can find more information about VRRP configuration and troubleshooting in the following Fortinet Enterprise Firewall 7.2 documents:
VRRP
Technical Tip: FortiGate VRRP configuration and debug
Configuration Example: How to configure VRRP between a FortiGate and a Cisco router
質問 # 30
Refer to the exhibit, which shows an ADVPN network.
Which VPN phase 1 parameters must you configure on the hub for the ADVPN feature to function? (Choose two.)
- A. set auto-discovery-sender enable
- B. set auto-discovery-forwarder enable
- C. set auto-discovery-receiver enable
- D. set add-route enable
正解：B、C
解説：
For the ADVPN feature to function properly on the hub, the following phase 1 parameters must be configured:
A: set auto-discovery-forwarder enable: This enables the hub to forward shortcut information to the spokes, which is essential for them to establish direct tunnels.
C: set auto-discovery-receiver enable: This allows the hub to receive shortcut offers from the spokes.
This information is corroborated by the Fortinet documentation, which explains that in an ADVPN setup, the hub must be able to both forward and receive shortcut information for dynamic tunnel creation between spokes.
質問 # 31
You want to configure faster failure detection for BGP
Which parameter should you enable on both connected FortiGate devices?
- A. Distribute-list-in
- B. Ebgp-enforce-multihop
- C. Graceful-restart
- D. bfd
正解：D
解説：
BFD (Bidirectional Forwarding Detection) is a protocol that provides fast failure detection for BGP by sending periodic messages to verify the connectivity between two peers1. BFD can be enabled on both connected FortiGate devices by using the command set bfd enable under the BGP configuration2. Reference: = Technical Tip : FortiGate BFD implementation and examples ..., Configure BGP | FortiGate / FortiOS 7.0.2 - Fortinet Documentation
質問 # 32
Refer to the exhibit, which shows an error in system fortiguard configuration.
What is the reason you cannot set the protocol to udp in config system fortiguard?
- A. You do not have the corresponding write access.
- B. FortiManager provides FortiGuard.
- C. udp is not a protocol option.
- D. fortiguard-anycast is set to enable.
正解：C
解説：
The reason for the command failure when trying to set the protocol to UDP in theconfig system fortiguardis likely that UDP is not a protocol option in this context. The command syntax might be incorrect or the option to set a protocol for FortiGuard updates might not exist in this manner.
So the correct answer is D. udp is not a protocol option.
質問 # 33
Exhibit.
Refer to the exhibit, which provides information on BGP neighbors.
Which can you conclude from this command output?
- A. BGP is attempting to establish a TCP connection with the BGP peer.
- B. The router are in the number to match the remote peer.
- C. The bfd configuration to set to enable.
- D. You must change the AS number to match the remote peer.
正解：A
解説：
The BGP state is "Idle", indicating that BGP is attempting to establish a TCP connection with the peer. This is the first state in the BGP finite state machine, and it means that no TCP connection has been established yet. If the TCP connection fails, the BGP state will reset to either active or idle, depending on the configuration. References: You can find more information about BGP states and troubleshooting in the following Fortinet Enterprise Firewall 7.2 documents:
* Troubleshooting BGP
* How BGP works
質問 # 34
Exhibit.
Refer to the exhibit, which contains a CLI script configuration on fortiManager. An administrator configured the CLI script on FortiManager rut the script tailed to apply any changes to the managed device after being executed.
What are two reasons why the script did not make any changes to the managed device? (Choose two)
- A. Incomplete commands can cause CLI scripts to fail.
- B. Static routes can be added using only TCI scripts.
- C. CLI scripts must start with #!.
- D. The commands that start with the # sign did not run.
正解：A、D
解説：
The commands that start with the # sign did not run because they are treated as comments in the CLI script. Incomplete commands can cause CLI scripts to fail because they are not recognized by the FortiGate device. The other options are incorrect because static routes can be added using CLI or GUI, and CLI scripts do not need to start with #!. Reference := Configuring custom scripts | FortiManager 7.2.0 - Fortinet Documentation, section "CLI script syntax".
質問 # 35
Refer to the exhibit.
which contains a partial configuration of the global system. What can you conclude from this output?
- A. NPs and CPs arc disabled
- B. Only CPs arc disabled
- C. Only NPs are disabled
- D. NPs and CPs are enabled
正解：A
解説：
The configuration output shows various global settings for a FortiGate device. The terms NP (Network Processor) and CP (Content Processor) relate to FortiGate's hardware acceleration features. However, the provided configuration output does not directly mention the status (enabled or disabled) of NPs and CPs.
Typically, the command to disable or enable hardware acceleration features would specifically mention NP or CP in the command syntax. Therefore, based on the output provided, we cannot conclusively determine the status of NPs and CPs, hence option D is the closest answer since the output does not confirm that they are enabled.
References:
* FortiOS Handbook - CLI Reference for FortiOS 5.2
質問 # 36
Refer to the exhibit, which contains a partial OSPF configuration.
What can you conclude from this output?
- A. Neighbors maintain communication with the restarting router.
- B. The restarting router sends gratuitous ARP for 30 seconds.
- C. FortiGate restarts if the topology changes.
- D. The router sends grace LSAs before it restarts.
正解：A
解説：
From the partial OSPF (Open Shortest Path First) configuration output:
B: The router sends grace LSAs before it restarts: This is implied by the command 'set restart-mode graceful- restart'. When OSPF is configured with graceful restart, the router sends grace LSAs (Link State Advertisements) to inform its neighbors that it is restarting, allowing for a seamless transition without recalculating routes.
Fortinet documentation on OSPF configuration clearly states that enabling graceful restart mode allows the router to maintain its adjacencies and routes during a brief restart period.
質問 # 37
Exhibit.
Refer to the exhibit, which shows an ADVPN network.
The client behind Spoke-1 generates traffic to the device located behind Spoke-2.
Which first message floes the hub send to Spoke-110 bring up the dynamic tunnel?
- A. Shortcut query
- B. Shortcut offer
- C. Shortcut forward
- D. Shortcut reply
正解：A
解説：
In an ADVPN scenario, when traffic is initiated from a client behind one spoke to another spoke, the hub sends a shortcut query to the initiating spoke. This query is used to determine if there is a more direct path for the traffic, which can then trigger the establishment of a dynamic tunnel between the spokes.
質問 # 38
Which two statements about the Security fabric are true? (Choose two.)
- A. Only FortiGate devices with configuration-sync receive and synchronize global CMDB objects that the toot FortiGate sends
- B. Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer
- C. Only the root FortiGate sends logs to FortiAnalyzer
- D. FortiGate uses the FortiTelemetry protocol to communicate with FortiAnatyzer.
正解：B、D
解説：
In the Security Fabric, only the root FortiGate sends logs to FortiAnalyzer (B). Additionally, only FortiGate devices with configuration-sync enabled receive and synchronize global Central Management Database (CMDB) objects that the root FortiGate sends (C). FortiGate uses the FortiTelemetry protocol to communicate with other FortiGates, not FortiAnalyzer (A). The last option (D) is incorrect as all FortiGates can collect and forward network topology information to FortiAnalyzer.
References:
* FortiOS Handbook - Security Fabric
質問 # 39
Refer to the exhibit, which shows a routing table.
What two options can you configure in OSPF to block the advertisement of the 10.1.10.0 prefix? (Choose two.)
- A. Configure a route-map out
- B. Configure a distribute-list-out
- C. Disable Redistribute Connected
- D. Remove the 16.1.10.C prefix from the OSPF network
正解：A、B
解説：
To block the advertisement of the 10.1.10.0 prefix in OSPF, you can configure a distribute-list-out or a route-map out. A distribute-list-out is used to filter outgoing routing updates from being advertised to OSPF neighbors1. A route-map out can also be used for filtering and is applied to outbound routing updates2. References := Technical Tip: Inbound route filtering in OSPF usi ... - Fortinet Community, OSPF | FortiGate / FortiOS 7.2.2 - Fortinet Documentation
質問 # 40
Refer to the exhibit, which shows config system central-management information.
Which setting must you configure for the web filtering feature to function?
- A. Set update-server-location to automatic.
- B. Configure securewf.fortiguard. net on the default servers.
- C. Configure server-type with the rating option.
- D. Add server. fortiguard. net to the server list.
正解：D
解説：
For the web filtering feature to function effectively, the FortiGate device needs to have a server configured for rating services. The rating option in the server-type setting specifies that the server is used for URL rating lookup, which is essential for web filtering. The displayed configuration does not list any FortiGuard web filtering servers, which would be necessary for web filtering. The setting set include-default-servers disable indicates that the default FortiGuard servers are not being used, and hence, a specific server for web filtering (like securewf.fortiguard.net) needs to be configured.
質問 # 41
Exhibit.
Refer to the exhibit, which contains a CLI script configuration on fortiManager. An administrator configured the CLI script on FortiManager rut the script tailed to apply any changes to the managed device after being executed.
What are two reasons why the script did not make any changes to the managed device? (Choose two)
- A. Incomplete commands can cause CLI scripts to fail.
- B. Static routes can be added using only TCI scripts.
- C. CLI scripts must start with #!.
- D. The commands that start with the # sign did not run.
正解：A、D
解説：
The commands that start with the # sign did not run because they are treated as comments in the CLI script.
Incomplete commands can cause CLI scripts to fail because they are not recognized by the FortiGate device.
The other options are incorrect because static routes can be added using CLI or GUI, and CLI scripts do not need to start with #!. References := Configuring custom scripts | FortiManager 7.2.0 - Fortinet Documentation, section "CLI script syntax".
質問 # 42
What are two functions of automation stitches? (Choose two.)
- A. Automation stitches can be created to run diagnostic commands and email the results when CPU or memory usage exceeds specified thresholds.
- B. An automation stitch configured to execute actions in parallel can be set to insert a specific delay between actions.
- C. Automation stitches can be configured on any FortiGate device in a Security Fabric environment.
- D. An automation stitch configured to execute actions sequentially can take parameters from previous actions as input for the current action.
正解：A、D
質問 # 43
Which two statements about the Security fabric are true? (Choose two.)
- A. Only FortiGate devices with configuration-sync receive and synchronize global CMDB objects that the toot FortiGate sends
- B. Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer
- C. Only the root FortiGate sends logs to FortiAnalyzer
- D. FortiGate uses the FortiTelemetry protocol to communicate with FortiAnatyzer.
正解：B、D
解説：
FortiGate uses the FortiTelemetry protocol to communicate with FortiAnalyzer and other Security Fabric devices to exchange information such as device status, network topology, and security events1. Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer, where it can be viewed and analyzed2. Reference: = Security Fabric - Fortinet Documentation, Fortinet Security Fabric for Securing Digital Innovations
質問 # 44
Exhibit.
Refer to exhibit, which shows a central management configuration
Which server will FortiGate choose for web filler rating requests if 10.0.1.240 is experiencing an outage?
- A. 10.0.1.243
- B. 10.0.1.242
- C. Public FortiGuard servers
- D. 10.0.1.244
正解：D
解説：
In the event of an outage at 10.0.1.240, the FortiGate will choose the next server in the sequence for web filter rating requests, which is 10.0.1.244 according to the configuration shown in the exhibit. This is because the server list is ordered by priority, and the server with the lowest priority number is chosen first. If that server is unavailable, the next server with the next lowest priority number is chosen, and so on. The public FortiGuard servers are only used if the include-default-servers option is enabled and all the custom servers are unavailable. Reference := Fortinet Enterprise Firewall Study Guide for FortiOS 7.2, page 132.
質問 # 45
You want to improve reliability over a lossy IPSec tunnel.
Which combination of IPSec phase 1 parameters should you configure?
- A. Odpd and dpd-retryinterval
- B. keepalive and keylive
- C. fragmentation and fragmentation-mtu
- D. fec-ingress and fec-egress
正解：C
解説：
For improving reliability over a lossy IPSec tunnel, the fragmentation and fragmentation-mtu parameters should be configured. In scenarios where there might be issues with packet size or an unreliable network, setting the IPsec phase 1 to allow for fragmentation will enable large packets to be broken down, preventing them from being dropped due to size or poor network quality. The fragmentation-mtu specifies the size of the fragments. This is aligned with Fortinet's recommendations for handling IPsec VPN over networks with potential packet loss or size limitations.
質問 # 46
......
Fortinet NSE7_EFW-7.2 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
NSE7_EFW-7.2問題集完全版解答試験学習ガイド：https://www.passtest.jp/Fortinet/NSE7_EFW-7.2-shiken.html
リアルNSE7_EFW-7.2は100%カバー率でリアル試験解答を試そう：https://drive.google.com/open?id=117hM2xoySulEwloqFLcotqZZ1HO9OfDX