• ホーム
  • ブログ
  • [2023年04月] 更新されたのはNSE7_EFW-7.0問題集PDFオンラインエンジン [Q49-Q72]

[2023年04月] 更新されたのはNSE7_EFW-7.0問題集PDFオンラインエンジン [Q49-Q72]

Share

[2023年04月] 更新されたのはFortinet NSE7_EFW-7.0問題集PDFオンラインエンジン

NSE7_EFW-7.0.PDFで問題解答PDFサンプル問題は信頼され続ける

質問 # 49
An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage. However, after the changes, one network application started to have problems. During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets, and before the arrival of the SYN/ACKs. When the SYN/ACK packets arrive to the FortiGate, the unit has already deleted the respective sessions .
Which TCP session timer must be increased to fix this problem?

  • A. TCP half close.
  • B. TCP time wait.
  • C. TCP half open.
  • D. TCP session time to live.

正解：C


質問 # 50
Refer to the exhibit, which contains the partial output of a diagnose command.

Based on the output, which two statements are correct? (Choose two.)

  • A. Quick mode selectors are disabled.
  • B. The remote gateway IP is 10.200.4.1.
  • C. Anti-replay is enabled
  • D. DPD is disabled.

正解：B、C


質問 # 51
View the exhibit, which contains the output of diagnose sys session stat, and then answer the question below.

Which statements are correct regarding the output shown? (Choose two.)

  • A. There are 0 ephemeral sessions.
  • B. There are 166 TCP sessions waiting to complete the three-way handshake.
  • C. No sessions have been deleted because of memory pages exhaustion.
  • D. All the sessions in the session table are TCP sessions.

正解：A、C

解説：
https://kb.fortinet.com/kb/documentLink.do?externalID=FD40578


質問 # 52
Refer to the exhibit, which contains the output of diagnose sys session list.

If the HA ID for the primary unit is zero (0), which statement about the output is true?

  • A. The master unit is processing this traffic.
  • B. This session is for HA heartbeat traffic.
  • C. The inspection of this session has been offloaded to the slave unit.
  • D. This session cannot be synced with the slave unit.

正解：A


質問 # 53
View the exhibit, which contains an entry in the session table, and then answer the question below.

Which one of the following statements is true regarding FortiGate's inspection of this session?

  • A. FortiGate forwarded this session without any inspection.
  • B. FortiGate applied explicit proxy-based inspection.
  • C. FortiGate applied proxy-based inspection.
  • D. FortiGate applied flow-based inspection.

正解：C


質問 # 54
An administrator has been assigned the task of creating a set of firewall policies which must be evaluated before any custom policies defined within the policy packages of managed FortiGate devices, across all 25 ADOMSs in FortiManager.
How should the administrator accomplish this task?

  • A. Create a footer policy in the Global ADOM containing the firewall policies that must be evaluated first, and then assign this footer policy to all other ADOMs.
  • B. Move the FortiGate devices into a single globally scoped ADOM, and merge policy packages, inserting the new firewall policies at the top.
  • C. Use a CLI script from the root ADOM on FortiManager to push these new policies to all FortiGate devices, through the FGFM tunnel.
  • D. Create a header policy in the Global ADOM containing the firewall policies that must be evaluated first, and then assign this header policy to all other ADOMs.

正解：D

解説：
Enterprise_Firewall_7.0_Study_Guide-Online.pdf p 244


質問 # 55
Refer to exhibit, which contains the output of a BGP debug command.

Which statement explains why the state of the 10.200.3.1 peer is Connect?

  • A. The local router has received the BGP prefixes from the remote peer.
  • B. The local router is receiving the BGP keepalives from the peer, but it has not received a BGP prefix yet.
  • C. The TCP session to 10.200.3.1 has not completed the three-way handshake.
  • D. The local router is receiving BGP keepalives from the remote peer, but the local peer has not received the OpenConfirm yet.

正解：C


質問 # 56
An administrator is running the following sniffer in a FortiGate:
diagnose sniffer packet any "host 10.0.2.10" 2
What information is included in the output of the sniffer? (Choose two.)

  • A. IP payload.
  • B. Port names.
  • C. Ethernet headers.
  • D. IP headers.

正解：A、D

解説：
https://kb.fortinet.com/kb/documentLink.do?externalID=11186


質問 # 57
Examine the partial output from the IKE real time debug shown in the exhibit; then answer the question below.

Why didn't the tunnel come up?

  • A. The remote gateway's Phase-2 configuration does not match the local gateway's phase-2 configuration.
  • B. The remote gateway's Phase-1 configuration does not match the local gateway's phase-1 configuration.
  • C. One IPsec gateway is using main mode, while the other IPsec gateway is using aggressive mode.
  • D. IKE mode configuration is not enabled in the remote IPsec gateway.

正解：B


質問 # 58
Examine the IPsec configuration shown in the exhibit; then answer the question below.

An administrator wants to monitor the VPN by enabling the IKE real time debug using these commands:
diagnose vpn ike log-filter src-addr4 10.0.10.1
diagnose debug application ike -1
diagnose debug enable
The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are being interchanged between both IPsec gateways. However, the IKE real time debug does NOT show any output .
Why isn't there any output?

  • A. The IKE real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.
  • B. The IKE real time shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.
  • C. The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.
  • D. The log-filter setting is set incorrectly. The VPN's traffic does not match this filter.

正解：D


質問 # 59
View the exhibit, which contains a session entry, and then answer the question below.

Which statement is correct regarding this session?

  • A. It is an ICMP session from 10.1.10.10 to 10.200.5.1.
  • B. It is a TCP session in CLOSE_WAIT state from 10.1.10.10 to 10.200.1.1.
  • C. It is an ICMP session from 10.1.10.10 to 10.200.1.1.
  • D. It is a TCP session in ESTABLISHED state from 10.1.10.10 to 10.200.5.1.

正解：A


質問 # 60
Refer to the exhibit, which contains a TCL script configuration on FortiManager.

An administrator has configured the TCL script on FortiManager, but failed to apply any changes to the managed device after being executed.
Why did the TCL script fail to make any changes to the managed device?

  • A. The TCL command run_cmd has not been created.
  • B. The TCL script must start with #include <>.
  • C. Incomplete commands are ignored in TCL scripts.
  • D. Changes in an interface configuration can only be done by CLI script.

正解：A


質問 # 61
View the exhibit, which contains the output of a debug command, and then answer the question below.

Which one of the following statements about this FortiGate is correct?

  • A. It is currently in system conserve mode because of high CPU usage.
  • B. It is currently in extreme conserve mode because of high memory usage.
  • C. It is currently in memory conserve mode because of high memory usage.
  • D. It is currently in proxy conserve mode because of high memory usage.

正解：C


質問 # 62
Examine the following partial outputs from two routing debug commands; then answer the question below.
# get router info kernel
tab=254 vf=0 scope=0type=1 proto=11 prio=0 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=10.200.1.254 dev=2(port1)
tab=254 vf=0 scope=0type=1 proto=11 prio=10 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=10.200.2.254 dev=3(port2)
tab=254 vf=0 scope=253type=1 proto=2 prio=0 0.0.0.0/0.0.0.0/.->10.0.1.0/24 pref=10.0.1.254 gwy=0.0.0.0 dev=4(port3)
# get router info routing-table all s*0.0.0.0/0 [10/0] via 10.200.1.254, portl [10/0] via 10.200.2.254, port2, [10/0] dO.0.1.0/24 is directly connected, port3 dO.200.1.0/24 is directly connected, portl d0.200.2.0/24 is directly connected, port2
Which outbound interface or interfaces will be used by this FortiGate to route web traffic from internal users to the Internet?

  • A. port2.
  • B. Both portl and port2.
  • C. port3.
  • D. port!

正解：B


質問 # 63
How does FortiManager handle FortiGuard requests from FortiGate devices, when it is configured as a local FDS?

  • A. FortiManager does not support rating requests.
  • B. FortiManager supports only FortiGuard push to managed devices.
  • C. FortiManager can download and maintain local copies of FortiGuard databases.
  • D. FortiManager will respond to update requests only if they originate from a managed device.

正解：C


質問 # 64
Examine the output of the 'get router info ospf interface' command shown in the exhibit; then answer the question below.

Which statements are true regarding the above output? (Choose two.)

  • A. There are at least 5 OSPF routers connected to the port4 network.
  • B. The local FortiGate has been elected as the OSPF backup designated router.
  • C. Two OSPF routers are down in the port4 network.
  • D. The port4 interface is connected to the OSPF backbone area.

正解：A、D

解説：
on BROADCAST network there are 4 neighbors, among which 1*DR +1*BDR. So our FG has 4 neighbors, but create adjacency only with 2 (with DR and BDR). 2 neighbors DRother (not down).


質問 # 65
View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.

The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel. To diagnose, the administrator enters these CLI commands:

However, the IKE real time debug does not show any output. Why?

  • A. The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.
  • B. The log-filter setting was set incorrectly. The VPN's traffic does not match this filter.
  • C. The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.
  • D. The debug shows only error messages. If there is no output, then the tunnel is operating normally.

正解：B


質問 # 66
A corporate network allows Internet Access to FSSO users only. The FSSO user student does not have Internet access after successfully logged into the Windows AD network. The output of the 'diagnose debug authd fsso list' command does not show student as an active FSSO user. Other FSSO users can access the Internet without problems .
What should the administrator check? (Choose two.)

  • A. At least one of the student's user groups must be allowed by a FortiGate firewall policy.
  • B. The student workstation's IP subnet must be listed in the CA's trusted list.
  • C. The user student must not be listed in the CA's ignore user list.
  • D. The user student must belong to one or more of the monitored user groups.

正解：A、C


質問 # 67
Examine the following routing table and BGP configuration; then answer the question below.

The BGP connection is up, but the local peer is NOT advertising the prefix 192.168.1.0/24 .
Which configuration change will make the local peer advertise this prefix?

  • A. Enable the setting ebgp-multipath.
  • B. Enable the redistribution of connected routers into BGP.
  • C. Enable the redistribution of static routers into BGP.
  • D. Disable the setting network-import-check.

正解：D


質問 # 68
Refer to the exhibit, which shows partial outputs from two routing debug commands.

Which change must an administrator make on FortiGate to route web traffic from internal users to the internet, using ECMP?

  • A. Set snat-route-change to enable.
  • B. Set the priority of the static default route using port1 to 10. Most Voted
  • C. Set preserve-session-route to enable.
  • D. Set the priority of the static default route using port2 to 1.

正解：B

解説：
ECMP pre-requisite is "routes must have the same destination and costs. In the case of static routes, costs include distance and priority". In this case traffic is routed through port 1 because of the lower priority. If we raise priority on port 1 to the value of 10 the traffic should be routed through both ports 1 and 2.
https://docs.fortinet.com/document/fortigate/7.0.1/administration-guide/25967/equal-cost-multi-path


質問 # 69
An administrator has created a VPN community within VPN Manager on FortiManager. They also added gateways to the VPN community and are now trying to create firewall policies to permit traffic over the tunnel; however, the VPN interfaces are not listed as available options.
What step must the administrator take to resolve this issue?

  • A. Create interface mappings for the IPsec VPN interfaces, before they can be used in a policy.
  • B. Refresh the device status from the Device Manager so that FortiGate will populate the IPsec interfaces.
  • C. Set up all of the phase 1 settings in the VPN community that they neglected to set up initially. The interfaces will be automatically generated after the administrator configures all of the required settings.
  • D. Install the VPN community and gateway configuration to the FortiGate devices, in order for the interfaces to be displayed within Policy & Objects on FortiManager

正解：D

解説：
1- Create a VPN Community
2- Install VPN Configuration
3- Add IPsec Firewall Policies
4- Install the Policies


質問 # 70
An administrator added the following Ipsec VPN to a FortiGate configuration:
configvpn ipsec phasel -interface
edit "RemoteSite"
set type dynamic
set interface "portl"
set mode main
set psksecret ENC LCVkCiK2E2PhVUzZe
next
end
config vpn ipsec phase2-interface
edit "RemoteSite"
set phasel name "RemoteSite"
set proposal 3des-sha256
next
end
However, the phase 1 negotiation is failing. The administrator executed the IKF real time debug while attempting the Ipsec connection.
The output is shown in the exhibit.


What is causing the IPsec problem in the phase 1?

  • A. The phrase-1 mode must be changed to aggressive
  • B. NAT-T settings do not match
  • C. The incoming IPsec connection is matching the wrong VPN configuration
  • D. The pre-shared key is wrong

正解：D


質問 # 71
Which two statements about the Security Fabric are true? (Choose two.)

  • A. All FortiGate devices in the Security Fabric must have bidirectional FortiTelemetry connectivity.
  • B. FortiGate uses FortiTelemetry protocol to communicate with FortiAnalyzer.
  • C. Branch FortiGate devices must be configured first.
  • D. Only the root FortiGate collects network information and forwards it to FortiAnalyzer.

正解：A、B


質問 # 72
......

Fortinet NSE7_EFW-7.0問題集PDFのベストを目指すなら問題集を使おう 目指そう高得点：https://www.passtest.jp/Fortinet/NSE7_EFW-7.0-shiken.html

NSE 7 Network Security Architect NSE7_EFW-7.0試験と認定テストエンジン：https://drive.google.com/open?id=1QGsG4g4sFwfApa4j0heKFIpO77iUIX_0

関するブログ

もっと
NSE7_EFW-7.0 無料問題集