Fortinet NSE7_EFW-7.0 問題集

質問 1：
Exhibits:


Refer to the exhibits, which contain the network topology and BGP configuration for a hub.
An administrator is trying to configure ADVPN with a hub-spoke VPN setup using iBGP. All the VPNs are up and connected to the hub. The hub is receiving route information from both spokes over iBGP; however, the spokes are not receiving route information from each other.
What change must the administrator make to the hub BGP configuration so that the routes learned by one spoke are forwarded to the other spokes?
A. Configure an individual neighbor and remove neighbor-range configuration.
B. Make the configuration of remote-as different from the configuration of local-as.
C. Change the router id to 10.1.0.254.
D. Configure the hub as a route reflector client.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 2：
View the IPS exit log, and then answer the question below.
# diagnose test application ipsmonitor 3
ipsengine exit log"
pid = 93 (cfg), duration = 5605322 (s) at Wed Apr 19 09:57:26 2017
code = 11, reason: manual
What is the status of IPS on this FortiGate?
A. IPS daemon experienced a crash.
B. There are communication problems between the IPS engine and the management database.
C. All IPS-related features have been disabled in FortiGate's configuration.
D. IPS engine memory consumption has exceeded the model-specific predefined value.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

Why didn't the tunnel come up?
A. The remote gateway's phase 1 configuration does not match the local gateway's phase 1 configuration.
B. The pre-shared keys do not match.
C. The remote gateway is using aggressive mode and the local gateway is configured to use man mode.
D. The remote gateway's phase 2 configuration does not match the local gateway's phase 2 configuration.
正解：A

質問 4：
Examine the following routing table and BGP configuration; then answer the question below.

TheBGP connection is up, but the local peer is NOT advertising the prefix 192.168.1.0/24. Which configuration change will make the local peer advertise this prefix?
A. Enable the redistribution of static routers into BGP.
B. Disable the setting network-import-check.
C. Enable the setting ebgp-multipath.
D. Enable the redistribution of connected routers into BGP.
正解：B

質問 5：
An administrator wants to capture encrypted phase 2 traffic between two FortiGate devices using the built-in sniffer.
If the administrator knows that there is no NAT device located between both FortiGate devices, which command should the administrator run?
A. diagnose sniffer packet any 'udp port 500'
B. diagnose sniffer packet any 'ah'
C. diagnose sniffer packet any 'udp port 4500'
D. diagnose sniffer packet any 'ip proto 50'
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 6：
What does the dirty flag mean in a FortiGate session?
A. Traffic has been blocked by the antivirus inspection.
B. The session must be removed from the former primary unit after an HA failover.
C. The next packet must be re-evaluated against the firewall policies.
D. Traffic has been identified as from an application that is not allowed.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 7：
Which two statements about the Security Fabric are true? (Choose two.)
A. Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer.
B. FortiGate uses FortiTelemetry protocol to communicate with FortiAnalyzer.
C. Only the root FortiGate sends logs to FortiAnalyzer.
D. Only FortiGate devices with fabric-object-unification set to default will receive and synchronize global CMDB objects sent by the root FortiGate.
正解：A,D
解説: (Topexam メンバーにのみ表示されます)

質問 8：
An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage. However, after the changes, one network application started to have problems. During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets, and before the arrival of the SYN/ACKs. When the SYN/ACK packets arrive to the FortiGate, the unit has already deleted the respective sessions. Which TCP session timer must be increased to fix this problem?
A. TCP time wait.
B. TCP session time to live.
C. TCP half open.
D. TCP half close.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 9：
Refer to the exhibit, which shows a session table entry.

Which statement about FortiGate behavior relating to this session is true?
A. FortiGate is performing security profile inspection using the CPU. Most Voted
B. FortiGate redirected the client to the captive portal to authenticate, so that a correct policy match could be made.
C. FortiGate forwarded this session without any inspection.
D. FortiGate applied only IPS inspection to this session.
正解：A
解説: (Topexam メンバーにのみ表示されます)