Fortinet NSE7_SSE_AR-26 問題集

質問 1：
Which two statements about on-ramp tunnels on FortiSASE are correct? (Choose two.)
A. A branch device can connect to two or more on-ramp locations.
B. SSL deep inspection for site-based users is fully functional without installing the FortiSASE certificate authority certificate.
C. The branch on-ramp and secure private access (SPA) features share the same BGP configuration.
D. Only FortiExtender and FortiAP devices are supported for on-ramp tunnels.
正解：A,C
解説: (Topexam メンバーにのみ表示されます)

質問 2：
The FortiGate devices are managed by FortiManager, and are configured for direct internet access (DIA). You confirm that DIA is working as expected for each branch, and check the SD-WAN zone configuration and firewall policies shown in the exhibits. Then, you use the SD-WAN overlay template to configure the IPsec overlay tunnels. You create the associated SD-WAN rules to connect existing branches to the company hub device and apply the changes on the branches. After those changes, users complain that they lost internet access. DIA is no longer working. Based on the exhibit, which statement best describes the possible root cause of this issue?

Exhibit 1

Exhibit 2

Exhibit 3
A. The SD-WAN overlay template didn't configure a firewall policy to allow traffic through the overlay.
B. The SD-WAN overlay template defines a zone for each underlay interface and moves the interfaces into those zones.
C. The SD-WAN overlay template redefines the interface gateway addresses if they are defined with metadata variables.
D. The SD-WAN overlay template updates the SD-WAN template and the rules.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Refer to the exhibit. The exhibit shows output of the command diagnose sys sdwan service4 collected on a FortiGate device. The administrator wants to know through which interface FortiGate will steer traffic from local users on subnet 10.0.1.0/255.255.255.192 and with a destination of the social media application Facebook. Based on the exhibits, which two statements are correct? (Choose two.)

Exhibit 1
A. FortiGate steers traffic for social media applications according to the service rule 2 and steers traffic through port2.
B. When FortiGate cannot recognize the application of the flow, it load balances the traffic through the tunnels HQ_T1. HQ_T2. HQ_T3.
C. When FortiGate cannot recognize the application of the flow, it steers the traffic through the preferred member of rule 3, HQ_T1.
D. There is no service defined for the Facebook application, so FortiGate appliesservice rule 3 and directs the traffic to headquarters.
正解：A,B
解説: (Topexam メンバーにのみ表示されます)

質問 4：
Refer to the exhibits. The exhibits show two IPsec templates to define Branch IPsec 1 and Branch_IPsec_2.
Each template defines a VPN tunnel. The error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device is also shown. Which statement best describes the cause of the issue?

Exhibit 1
A. You can assign only one IPsec template to each FortiGate device.
B. You can assign only one template with a tunnel type of static to each FortiGate device.
C. You should review the branch1_fgt configuration for configured tunnels in the rootVDOM.
D. You should use the same outgoing interface of both templates.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 5：
As an IT manager for a healthcare company, you want to delegate the installation and management of your SD-WAN deployment to a managed security service provider (MSSP). Each site must maintain direct internet access and ensure that it is secure. You expected significant traffic flow between the sites and want to delegate as much of the network administration and management as possible to the MSSP. Which two MSSP deployment blueprints best address the customer's requirements? (Choose two.)
A. Use a shared hub at the MSSP premises with a dedicated VDOM for the new customer, and install the spokes at the customer premises.
B. Install a dedicated hub at the MSSP premises for the new customer, and install the spokes at the customer premises.
C. Use a shared hub at the MSSP premises and a dedicated hub at the customer premises and install the spokes at the customer premises.
D. Install the hub and spokes at the customer premises and enable the MSSP to manage the SD-WAN deployment using FortiManager with a dedicated ADOM.
正解：A,B
解説: (Topexam メンバーにのみ表示されます)

質問 6：
When you deploy SD-WAN, you can choose from several common designs. Each design best applies to specific contexts. Which two statements correctly associate a common SD-WAN design with its main indication or constraint? Choose two answers.
A. Use a standalone design for sites with only one WAN link to the cloud.
B. Use a cloud on-ramp topology to improve the performance of cloud applications.
C. Use a direct internet access (DIA) design to increase the traffic security and allow local devices with limited capabilities.
D. Use remote breakout to centralize traffic inspection and limit local management requirements.
正解：B,D
解説: (Topexam メンバーにのみ表示されます)

質問 7：
You are using the FortiManager SD-WAN monitor menus to check the status of an SD-WAN topology. When you place the mouse next to branch1_fgt, you receive the output shown in the exhibit. Which two conclusions can you draw from the output shown in the exhibit? Choose two answers.

Exhibit 1
A. Three spokes have tunnels that are out of SLA.
B. branch1_fgt is configured with six SD-WAN overlay tunnels and three are down.
C. The template Corp-SOT defines a dual-hub topology.
D. branch3_fgt is configured with three SD-WAN overlay tunnels and one is down.
正解：A,B
解説: (Topexam メンバーにのみ表示されます)