Fortinet NSE7_EFW-6.4 問題集

質問 1：
Which statement about NGFW policy-based application filtering is true?
A. FortiGate will drop all packets until the application can be identified.
B. The IPS security profile is the only security option you can apply to the security policy with the action set to ACCEPT.
C. After the application has been identified, the kernel uses only the Layer 4 header to match the traffic.
D. After IPS identifies the application, it adds an entry to a dynamic ISDB table.
正解：A

質問 2：
View these partial outputs from two routing debug commands:

Which outbound interface will FortiGate use to route web traffic from internal users to the Internet?
A. Both port1 and port2
B. port3
C. port2
D. port1
正解：D

質問 3：
View the central management configuration shown in the exhibit, and then answer the question below.

Which server will FortiGate choose for antivirus and IPS updates if 10.0.1.243 is experiencing an outage?
A. 10.0.1.244
B. One of the public FortiGuard distribution servers
C. 10.0.1.240
D. 10.0.1.242
正解：B

質問 4：
Examine the following traffic log; then answer the question below.
date-20xx-02-01 time=19:52:01 devname=master device_id="xxxxxxx" log_id=0100020007 type=event subtype=system pri critical vd=root service=kemel status=failure msg="NAT port is exhausted."
What does the log mean?
A. FortiGate does not have any available NAT port for a new connection.
B. The limit for the maximum number of entries in the NAT port table has been reached.
C. There is not enough available memory in the system to create a new entry in the NAT port table.
D. The limit for the maximum number of simultaneous sessions sharing the same NAT port has been reached.
正解：D

質問 5：
Refer to the exhibit, which contains the output of a BGP debug command.

Which statement about the exhibit is true?
A. The local router has not established a TCP session with 100.64.3.1.
B. The local router BGP state is OpenConfirm with the 10.127.0.75 peer.
C. Since the counters were last reset, the 10.200.3.1 peer has never been down.
D. The local router has received a total of three BGP prefixes from all peers.
正解：A

質問 6：
Examine the output of the 'get router info ospf interface' command shown in the exhibit; then answer the question below.

Which statements are true regarding the above output? (Choose two.)
A. Two OSPF routers are down in the port4 network.
B. The local FortiGate has been elected as the OSPF backup designated router.
C. The port4 interface is connected to the OSPF backbone area.
D. There are at least 5 OSPF routers connected to the port4 network.
正解：C,D
解説: (Topexam メンバーにのみ表示されます)

質問 7：
View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.

The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel. To diagnose, the administrator enters these CLI commands:

However, the IKE real time debug does not show any output. Why?
A. The debug shows only error messages. If there is no output, then the tunnel is operating normally.
B. The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.
C. The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.
D. The log-filter setting was set incorrectly. The VPN's traffic does not match this filter.
正解：D