Fortinet NSE7_EFW-7.2 問題集

質問 1：
Refer to the exhibit, which shows device registration on FortiManager.

What can you conclude about the Spoke-1 and Spoke-2 configurations with respect to the information cond:
Modified (recent auto-updated)?
A. On NGFW-A, the configuration was changed and spokes are wailing for an autoupdate.
B. On both Spoke-1 and Spoke-2, the configuration was changed directly on the FortiGate device, and the changes were automatically retrieved by the device database.
C. Spoke-1 and Spoke-2 are sharing the same security policy configuration and the same policy package.
D. Based on the policy configuration on NGFW-1, the configuration on both spokes is modified and automatically updated.
正解：A

質問 2：
Refer to the exhibit, which shows an ADVPN network,

An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2.
What must the administrator configure in the phase 1 VPN IPSEC configuration of the Hub2¢ub tunnels?
A. set auto-discovery-receiver enable
B. set add-route enable
C. set auto-discovery-sender enable
D. set auto-discovery-forwarder enable
正解：D

質問 3：
Exhibit.

Refer to the exhibit, which shows a partial web filter profile conjuration What can you cone udo from this configuration about access to www.facebook, com, which is categorized as Social Networking?
A. The access is blocked based on the URL Filter configuration
B. The access is blocked based on the Content Filter configuration
C. The access is allowed based on the FortiGuard Category Based Filter configuration
D. The access is hocked if the local or the public FortiGuard server does not reply
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 4：
Which two statements about the neighbor-group command are true? (Choose two.)
A. It applies common settings in an OSPF area.
B. It is combined with the neighbor-range parameter.
C. You can apply it in Internal BGP (IBGP) and External BGP (EBGP).
D. You can configure it on the GUI.
正解：A,C
解説: (Topexam メンバーにのみ表示されます)

質問 5：
Which two statements about IKE version 2 fragmentation are true? (Choose two.)
A. The reassembly timeout default value is 30 seconds.
B. The maximum number of IKE version 2 fragments is 128.
C. It is performed at the IP layer.
D. Only some IKE version 2 packets are considered fragmentable.
正解：B,D
解説: (Topexam メンバーにのみ表示されます)

質問 6：
You are testing the implementation of a new custom remote desktop application in your network In which two ways can you eliminate false positives in IPS during this testing phase? (Choose two)
A. Create an IP address exception
B. Adjust the rate-based signature threshold and its duration.
C. Enable the preserve source pore option in the firewall policy
D. Permanently bypass the affected endpoints
正解：B,D

質問 7：


Refer to the exhibit, which shows information about an OSPF interface
What two conclusions can you draw from this command output? (Choose two.)
A. NGFW-1 forms neighbor adjacency only if other OSPF routers match the wait time of 40 seconds
B. NGFW-1 sends its LSA updates to 224.0.0.6 address
C. NGFW-1 sends its LSA updates to 224.0.0. 5 address
D. NGFW-1 forms neighbor adjacency only with DR and BDR router.
正解：B,D

質問 8：
Refer to the exhibit, which shows a custom signature.

Which two modifications must you apply to the configuration of this custom signature so that you can save it on FortiGate? (Choose two.)
A. Start options with --.
B. Ensure that the header syntax is F-SBID.
C. Add severity.
D. Add attack_id.
正解：B,C
解説: (Topexam メンバーにのみ表示されます)