Fortinet NSE7_EFW-6.4 問題集

質問 1：
Examine the output from the 'diagnose debug authd fsso list' command; then answer the question below.
# diagnose debug authd fsso list -FSSO logons-IP: 192.168.3.1 User: STUDENT Groups: TRAININGAD/USERS Workstation: INTERNAL2. TRAINING. LAB The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.
What should the administrator check?
A. The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2. TRAINING. LAB.
B. The IP address recorded in the logon event for the user STUDENT.
C. The reserve DNS lookup forthe IP address 192.168.3.1.
D. The DNS name resolution for the workstation name INTERNAL2. TRAINING. LAB.
正解：A

質問 2：
What is the diagnose test application ipsmonitor 99 command used for?
A. To enable IPS bypass mode
B. To restart all IPS engines and monitors
C. To provide information regarding IPS sessions
D. To disable the IPS engine
正解：B

質問 3：
View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.

The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel. To diagnose, the administrator enters these CLI commands:

However, the IKE real time debug does not show any output. Why?
A. The debug shows only error messages. If there is no output, then the tunnel is operating normally.
B. The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.
C. The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.
D. The log-filter setting was set incorrectly. The VPN's traffic does not match this filter.
正解：D

質問 4：
Refer to the exhibit, which contains the output of a BGP debug command.

Which statement about the exhibit is true?
A. The local router has not established a TCP session with 100.64.3.1.
B. The local router BGP state is OpenConfirm with the 10.127.0.75 peer.
C. Since the counters were last reset, the 10.200.3.1 peer has never been down.
D. The local router has received a total of three BGP prefixes from all peers.
正解：A

質問 5：
What does the dirty flag mean in a FortiGate session?
A. Traffic has been blocked by the antivirus inspection.
B. The session must be removed from the former primary unit after an HA failover.
C. The next packet must be re-evaluated against the firewall policies.
D. Traffic has been identified as from an application that is not allowed.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 6：
An administrator has configured a FortiGate device with two VDOMs: root and internal. The administrator has also created and inter-VDOM link that connects both VDOMs. The objective is to have each VDOM advertise some routes to the other VDOM via OSPF through the inter-VDOM link. What OSPF configuration settings must match in both VDOMs to have the OSPF adjacency successfully forming? (Choose three.)
A. OSPF interface cost.
B. OSPF interface MTU.
C. OSPF interface area.
D. Router ID.
E. Interface subnet mask.
正解：B,C,E

質問 7：
When using the SSL certificate inspection method to inspect HTTPS traffic, how does FortiGate filter web requests when the client browser does not provide the server name indication (SNI) extension?
A. FortiGate uses the requested URL from the user's web browser.
B. FortiGate blocks the request without any further inspection.
C. FortiGate switches to the full SSL inspection method to decrypt the data.
D. FortiGate uses the CN information from the Subject field in the server certificate.
正解：D