Online Questions - Valid Practice To your NSE7_EFW-6.4 Exam (Updated 104 Questions)
Practice To NSE7_EFW-6.4 - Remarkable Practice On your Fortinet NSE 7 - Enterprise Firewall 6.4 Exam
What is the duration, language, and format of the Fortinet NSE7_EFQ-6.4: Fortinet NSE 7 - Enterprise Firewall 6.4 Exam
- Language of Exam: English and Japanese
- Number of questions: 30
- Examination platform: Online proctored
- Duration of Exam: 60 minutes
NEW QUESTION 57
Examine thefollowing partial outputs from two routing debug commands; then answer the question below:
Why the default route using port2 is not displayed in the output of the second command?
- A. It has a higher distance than the default route using port1.
- B. It hasa higher priority than the default route using port1.
- C. It is disabled in the FortiGate configuration.
- D. It has a lower priority than the default route using port1.
Answer: A
Explanation:
Explanation
http://kb.fortinet.com/kb/viewContent.do?externalId=FD32103
NEW QUESTION 58
Which of the following statements is trueregarding a FortiGate configured as an explicit web proxy?
- A. FortiGate limits the number of workstations that authenticate using the same web proxy usercredentials.
This limit CANNOT be modified by the administrator. - B. FortiGate limits the total number of simultaneous explicit web proxy users.
- C. FortiGate limits the number of simultaneous sessions per explicit web proxy user. This limit CANNOT be modified by the administrator.
- D. FortiGate limits the number of simultaneous sessions per explicit web proxy user The limit CAN be modified by the administrator
Answer: B
Explanation:
Explanation
https://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-WAN-opt-52/web_proxy.htm#Explicit2 The explicit proxy does not limit the number of active sessions for each user. As a result the actual explicit proxy session count is usually much higherthan the number of explicit web proxy users. If an excessive number of explicit web proxy sessions is compromising system performance you can limit the amount of users if the FortiGate unit is operating with multiple VDOMs.
NEW QUESTION 59
A FortiGate has two default routes:
All Internet traffic is currently using port1. The exhibit shows partial information for one sample session of Internet traffic from an internal user:
What would happen with the traffic matching the above session if the priority on the firstdefault route (IDd1) were changed from 5 to 20?
- A. Session would remain in the session table and its traffic would keep using port1 as the outgoing interface.
- B. Session would be deleted, so the client would need to start a new session.
- C. Session would remain in the session table and its traffic would be shared between port1 and port2.
- D. Session would remain in the session table and its traffic would start using port2 as the outgoing interface.
Answer: A
NEW QUESTION 60
View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.
Why didn't the tunnel come up?
- A. The pre-shared keys do not match.
- B. The remote gateway's phase 1 configuration does not match the local gateway's phase 1 configuration.
- C. The remote gateway's phase 2configuration does not match the local gateway's phase 2 configuration.
- D. The remote gateway is using aggressive mode and the local gateway is configured to use man mode.
Answer: B
NEW QUESTION 61
An administrator has configured two FortiGate devices for an HA cluster. While testing the HA failover, the administrator noticed that some of the switches in the network continue to send traffic to the former primary unit. The administrator decides to enable the setting link-failed-signal to fix the problem. Which statement is correct regarding this command?
- A. Forces the former primary device to shut down all its non-heartbeat interfaces forone second while the failover occurs.
- B. Disables all the non-heartbeat interfaces in all the HA members for two seconds after a failover.
- C. Sends a link failed signal to all connected devices.
- D. Sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.
Answer: A
NEW QUESTION 62
View the IPS exit log, and then answer the question below.
# diagnose test application ipsmonitor 3
ipsengine exit log"
pid = 93 (cfg), duration = 5605322 (s) at Wed Apr19 09:57:26 2017
code = 11, reason: manual
What is the status of IPS on this FortiGate?
- A. IPS engine memory consumption has exceeded the model-specific predefined value.
- B. There are communication problems between theIPS engine and the management database.
- C. IPS daemon experienced a crash.
- D. All IPS-related features have been disabled in FortiGate's configuration.
Answer: D
Explanation:
Explanation
The command diagnose test application ipsmonitor includes many options that are useful for troubleshooting purposes.Option 3 displays the log entries generated every time an IPS engine process stopped. There are various reasons why these logs are generated:Manual: Because of the configuration, IPS no longer needs to run (that is, all IPS-releated features have been disabled)
NEW QUESTION 63
An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer.If the administrator knows that there is no NAT device located between both FortiGates, what command should the administrator execute?
- A. diagnose snifferpacket any 'esp'
- B. diagnose sniffer packet any 'udp port 500 or udp port 4500'
- C. diagnose sniffer packet any 'udp port 4500'
- D. diagnose sniffer packet any 'udp port 500'
Answer: A
Explanation:
Explanation
Capture IKE Traffic without NAT:diagnose sniffer packet 'host and udp port 500'
--------------------------------------Capture ESP
Traffic without NAT:diagnose sniffer packet any 'host and esp'
--------------------------------------Capture IKE
and ESP with NAT-T:diagnose sniffer packet any 'host and (udp port 500 or udp port 4500)'
NEW QUESTION 64
A FortiGate device has the following LDAP configuration:
The LDAP user student cannot authenticate. The exhibit shows the output of the authentication real time debug while testing the student account:
Based on the above output, what FortiGate LDAP settings must the administer check? (Choose two.)
- A. password.
- B. username.
- C. dn.
- D. cnid.
Answer: A,B
Explanation:
Explanation
https://kb.fortinet.com/kb/viewContent.do?externalId=13141
NEW QUESTION 65
Which two configuration settings change the behavior for content-inspected traffic while FortiGate is in conserve mode? (Choose two.)
- A. IPS failopen
- B. AV failopen
- C. UTM failopen
- D. mem failopen
Answer: A,B
NEW QUESTION 66
View the exhibit, which contains a session entry, and then answer the question below.
Which statement is correct regarding this session?
- A. It is an ICMP session from 10.1.10.10 to 10.200.5.1.
- B. It is a TCP session in ESTABLISHED state from 10.1.10.10 to 10.200.5.1.
- C. It is a TCP session in CLOSE_WAIT state from 10.1.10.10 to 10.200.1.1.
- D. It is an ICMP session from 10.1.10.10 to 10.200.1.1.
Answer: A
NEW QUESTION 67 
Refer to the exhibit, which contains the output ofget system ha status.
Which two statements about the output are true? (Choose two.)
- A. The slave configuration is synchronized with the master.
- B. port7is used as the HA heartbeat on all devices in the cluster.
- C. The HA management IP is 169.254.0.2.
- D. Master is selected based on the priority configured underconfig system ha.
Answer: B,D
NEW QUESTION 68
An administrator cannot connect to the GIU of a FortiGate unit with the IP address 10.0.1.254. The administrator runs thedebug flow while attempting the connection using HTTP. The output of the debug flow is shown in the exhibit:
Based on the error displayed by the debug flow, which are valid reasons for this problem? (Choose two.)
- A. Redirection of HTTP to HTTPS administrative access is disabled.
- B. The packet is denied because of reverse path forwarding check.
- C. HTTP administrative access is configured with a port number different than 80.
- D. HTTP administrative access is disabled in the FortiGate interface with the IP address 10.0.1.254.
Answer: C,D
NEW QUESTION 69
Examine the output from the 'diagnose debug authd fsso list' command; then answer the question below.
# diagnose debug authd fsso list-FSSO logons-IP: 192.168.3.1 User: STUDENT Groups: TRAINI NGAD/USERS Workstation: INTERNAL2. TRAINING. LAB The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.
What should the administrator check?
- A. The DNS name resolution for the workstation name INTERNAL2. TRAINING. LAB.
- B. The IP address recorded in the logon event for the user STUDENT.
- C. The reserve DNS lookup forthe IP address 192.168.3.1.
- D. The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2.
TRAINING. LAB.
Answer: D
NEW QUESTION 70
The logs in a FSSO collector agent (CA) are showing the following error:
failed to connect to registry: PIKA1026 (192.168.12.232)
What can be the reason for this error?
- A. The remote registry service is not running in the workstation 192.168.12.232.
- B. The CA cannot reach the FortiGate with the IP address192.168.12.232.
- C. The CA cannot resolve the name of the workstation.
- D. The FortiGate cannot resolve the name of the workstation.
Answer: A
Explanation:
Explanation
https://kb.fortinet.com/kb/documentLink.do?externalID=FD30548
NEW QUESTION 71
Which the following events can trigger the election of a new primary unit in a HA cluster? (Choose two.)
- A. One of the monitored interfaces in the primary unit is disconnected.
- B. A secondary unit is removed from the HA cluster.
- C. The FortiGuard license for the primary unit is updated.
- D. Primary unit stops sending HA heartbeat
Answer: A,D
NEW QUESTION 72
In which two states is a given session categorized as ephemeral? (Choose two.)
- A. A UDP session with packets sent and received.
- B. A UDP session with only one packet received.
- C. A TCP session waiting for FIN ACK.
- D. A TCP session waiting to complete the three-way handshake.
Answer: A,C
NEW QUESTION 73
An LDAP user cannot authenticate against a FortiGate device. Examine the real time debug output shown in the exhibit when the user attempted the authentication; thenanswer the question below.
Based on the output in the exhibit, what can cause this authentication problem?
- A. The FortiGate has been configured with the wrong authentication schema.
- B. User student is using a wrong password.
- C. User student is not found in the LDAP server.
- D. The FortiGate has been configured with thewrong password for the LDAP administrator.
Answer: C
NEW QUESTION 74
View the exhibit, which contains the output of a diagnose command, and the answer the question below.
Which statements are true regarding the Weight value?
- A. Its value is incremented with each packet lost.
- B. Its initial value is statically set to 10.
- C. It determines which FortiGuard server is used for license validation.
- D. Its initial value is calculated based on the round trip delay (RTT).
Answer: A
NEW QUESTION 75
......
True NSE7_EFW-6.4 Exam Extraordinary Practice For the Exam: https://www.guidetorrent.com/NSE7_EFW-6.4-pdf-free-download.html