NSE7_EFW-6.4 Free Certification Exam Material from Exams4Collection with 104 Questions
Use Real NSE7_EFW-6.4 - 100% Cover Real Exam Questions
NEW QUESTION 37
View the exhibit, which contains an entry in the session table, and then answer the question below.
Which one of the following statements is true regarding FortiGate's inspection of this session?
- A. FortiGate applied explicit proxy-based inspection.
- B. FortiGate forwarded this session without any inspection.
- C. FortiGate applied flow-based inspection.
- D. FortiGate applied proxy-based inspection.
Answer: D
Explanation:
Explanation
https://kb.fortinet.com/kb/viewContent.do?externalId=FD30042
NEW QUESTION 38
What is the purpose of an internal segmentation firewall (ISFW)?
- A. It is the first line of defense at the network perimeter.
- B. It is anall-in-one security appliance that is placed at remote sites to extend the enterprise network.
- C. It inspects incoming traffic to protect services in the corporate DMZ.
- D. It splits the network into multiple security segments to minimize the impact of breaches.
Answer: D
Explanation:
Explanation
ISFW splits your network into multiple security segments. They serve as a breach containers from attacks that come from inside.
NEW QUESTION 39
Examine the IPsec configuration shown in the exhibit; then answer the question below.
An administrator wants to monitor the VPN by enabling theIKE real time debug using these commands:
diagnose vpn ike log-filter src-addr4 10.0.10.1
diagnose debug application ike -1
diagnose debug enable
The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are beinginterchanged between both IPsec gateways. However, the IKE real time debug does NOT show any output. Why isn't there any output?
- A. The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.
- B. The IKE real time shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.
- C. The IKE real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.
- D. The log-filter setting is set incorrectly. The VPN's traffic does not match this filter.
Answer: D
NEW QUESTION 40
What configuration changes can reduce the memory utilization in a FortiGate? (Choose two.)
- A. Increase the FortiGuard cache time to live.
- B. Reduce the maximum file size to inspect.
- C. Increase the TCP session timers.
- D. Reduce the session time to live.
Answer: B,D
NEW QUESTION 41
Examine the output ofthe 'get router info bgp summary' command shown in the exhibit; then answer the question below.
Which statement can explain why the state of the remote BGP peer 10.200.3.1 is Connect?
- A. The local peer is receiving the BGP keepalives from the remote peer but it has not received the OpenConfirm yet.
- B. The local peer is receiving the BGP keepalives from the remote peer but it has not received any BGP prefix yet.
- C. The local peer has received the BGP prefixed from the remote peer.
- D. The TCP session for the BGP connection to 10.200.3.1 is down.
Answer: D
Explanation:
Explanation
http://www.ciscopress.com/articles/article.asp?p=2756480
NEW QUESTION 42 
Refer to the exhibit, which contains the output ofget system ha status.
Which two statements about the output are true? (Choose two.)
- A. Master is selected based on the priority configured underconfig system ha.
- B. The slave configuration is synchronized with the master.
- C. port7is used as the HA heartbeat on all devices in the cluster.
- D. The HA management IP is 169.254.0.2.
Answer: A,C
NEW QUESTION 43
An administrator has configured two FortiGate devices for an HA cluster. While testing the HA failover, the administrator noticed that some of the switches in the network continue to send traffic to the former primary unit. The administrator decides to enable the setting link-failed-signal to fix the problem. Which statement is correct regarding this command?
- A. Sends a link failed signal to all connected devices.
- B. Forces the former primary device to shut down all its non-heartbeat interfaces forone second while the failover occurs.
- C. Disables all the non-heartbeat interfaces in all the HA members for two seconds after a failover.
- D. Sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.
Answer: B
NEW QUESTION 44
Examine the output of the 'get router info ospf interface' command shown in the exhibit; then answer the question below.
Which statements are true regarding the above output? (Choose two.)
- A. The local FortiGate has been elected as the OSPF backup designated router.
- B. Theport4 interface is connected to the OSPF backbone area.
- C. Two OSPF routers are down in the port4 network.
- D. There are at least 5 OSPF routers connected to the port4 network.
Answer: B,D
Explanation:
Explanation
on BROADCAST network there are 4 neighbors, among which 1*DR +1*BDR. So our FG has 4 neighbors, but create adjacency only with 2 (with DR and BDR). 2 neighbors DRother (not down).
NEW QUESTION 45
Anadministrator has configured a dial-up IPsec VPN with one phase 2, extended authentication (XAuth) and IKE mode configuration. The administrator has also enabled the IKE real time debug:
diagnose debug application ike-1
diagnose debug enable
In which order is each step and phase displayed in the debug output each time a new dial-up user is connecting to the VPN?
- A. Phase1; IKE mode configuration; phase 2; XAuth.
- B. Phase1; XAuth; phase 2; IKE mode configuration.
- C. Phase1; XAuth; IKE mode configuration; phase2.
- D. Phase1; IKE mode configuration; XAuth; phase 2.
Answer: C
Explanation:
Explanation
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-ipsecvpn-54/IPsec_VPN_Concepts/IKE_Packet_
NEW QUESTION 46
Examine the following partialoutput from a sniffer command; then answer the question below.
What is the meaning of the packets dropped counter at the end of the sniffer?
- A. Number of total packets dropped by the FortiGate.
- B. Number of packets that matched the sniffer filter but could not be captured by the sniffer.
- C. Number of packets that matched the sniffer filter and were dropped by the FortiGate.
- D. Number of packets that didn't match the sniffer filter.
Answer: B
Explanation:
Explanation
https://kb.fortinet.com/kb/documentLink.do?externalID=11655
NEW QUESTION 47
A FortiGate is configured as an explicit web proxy. Clients using this web proxy are reposting DNS errors when accessing any website. Theadministrator executes the following debug commands and observes that the n-dns-timeout counter is increasing:
What should the administrator check to fix the problem?
- A. That DNS traffic from client workstations is allowed by the explicit web proxy policies.
- B. Theconnectivity between the client workstations and the DNS server.
- C. That DNS service is enabled in the explicit web proxy interface.
- D. The connectivity between the FortiGate unit and the DNS server.
Answer: D
NEW QUESTION 48
Which statements about bulk configuration changes using FortiManager CLI scripts are correct? (Choose two.)
- A. When executed on the Device Database, you must use the installation wizard to apply the changes to the managed FortiGate.
- B. When executed on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.
- C. When executed on the All FortiGate in ADOM, changes are automatically installed without creating a new revision history.
- D. When executed on the Policy Package, ADOM database, changes are applied directly to the managed FortiGate.
Answer: A,B
Explanation:
Explanation
CLI scripts can be run in three different ways:Device Database: By default, a script is executed on the device database. It is recommend you run the changes on the device database (default setting), as this allows you to check what configuration changes you will send to the managed device. Once scripts are run on the device database, you can install these changes to a managed device using the installation wizard.
Policy Package, ADOM database: If a script contains changes related to ADOM level objects and policies, you can change the default selection to run on Policy Package, ADOM database and can then be installed using the installation wizard.
Remote FortiGate directly (through CLI): A script can be executed directly on the device and you don't need to install these changes using the installation wizard. As the changes are directly installed on the managed device, no option is provided to verify and check the configuration changes through FortiManager prior to executing it.
NEW QUESTION 49
View the exhibit, which contains a partial output of an IKE real-time debug, and then answer the question below.
Based on the debug output, which phase-1 setting is enabled in the configuration of this VPN?
- A. auto-discovery-shortcut
- B. auto-discovery-forwarder
- C. auto-discovery-receiver
- D. auto-discovery-sender
Answer: B
NEW QUESTION 50
Examine the output of the 'diagnose debug rating' command shown in the exhibit; then answer the question below.
Which statement are true regarding the output in the exhibit? (Choose two.)
- A. There are three FortiGuard serversthat are not responding to the queries sent by the FortiGate.
- B. FortiGate will send the FortiGuard queries to the server withhighest weight.
- C. A server's round trip delay (RTT) is not used to calculate its weight.
- D. The TZ value represents the delta between each FortiGuard server's time zone and the FortiGate's time zone.
Answer: B,D
NEW QUESTION 51
A FortiGate has two default routes:
All Internet traffic is currently using port1. The exhibit shows partial information for one sample session of Internet traffic from an internal user:
What would happen with the traffic matching the above session if the priority on the firstdefault route (IDd1) were changed from 5 to 20?
- A. Session would remain in the session table and its traffic would be shared between port1 and port2.
- B. Session would remain in the session table and its traffic would keep using port1 as the outgoing interface.
- C. Session would remain in the session table and its traffic would start using port2 as the outgoing interface.
- D. Session would be deleted, so the client would need to start a new session.
Answer: B
NEW QUESTION 52
Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)
- A. Add devices to FortiManager.
- B. Import policy packages from managed devices.
- C. Preview pending configuration changes for managed devices.
- D. Import interface mappings from managed devices.
- E. Install configuration changes to managed devices.
Answer: C,E
Explanation:
Explanation
https://help.fortinet.com/fmgr/50hlp/56/5-6-2/FortiManager_Admin_Guide/1000_Device%20Manager/1200_ins There are 4 main wizards:Add Device: is used to add devices to central management and import their configurations.
Install: is used to install configuration changes from Device Manager or Policies & Objects to the managed devices. It allows you to preview the changes and, if the administrator doesn't agree with the changes, cancel and modify them.
Import policy: is used to import interface mapping, policy database, and objects associated with the managed devices into a policy package under the Policy & Object tab. It runs with the Add Device wizard by default and may be run at any time from the managed device list.
Re-install policy: is used to perform a quick install of the policy package. It doesn't give the ability to preview the changes that will be installed to the managed device.
NEW QUESTION 53
View the exhibit, which contains the output of a BGP debug command, and then answer the question below.
Which ofthe following statements about the exhibit are true? (Choose two.)
- A. The local router has not established a TCP session with 100.64.3.1.
- B. The local router's BGP state is Established with the 10.125.0.60 peer.
- C. Since the counters were last reset; the 10.200.3.1 peer has never been down.
- D. The local router has received atotal of three BGP prefixes from all peers.
Answer: A,B
NEW QUESTION 54
View the exhibit, which contains the output of diagnose sys session list, and then answer the question below.
If the HA ID forthe primary unit is zero (0), which statement is correct regarding the output?
- A. This session cannot be synced with the slave unit.
- B. This session is for HA heartbeat traffic.
- C. The inspection of this session has been offloaded to the slave unit.
- D. This session is synced with the slave unit.
Answer: D
NEW QUESTION 55
AFortiGate's portl is connected to a private network. Its port2 is connected to the Internet. Explicit web proxy is enabled in port1 and only explicit web proxy users can access the Internet. Web cache is NOT enabled. An internal web proxy user is downloading a file from the Internet via HTTP. Which statements are true regarding the two entries in the FortiGate session table related with this traffic? (Choose two.)
- A. One of the sessions has the IP address of port2 as the source IP address.
- B. Both session have the local flag on.
- C. The destination IP addresses of both sessions are IP addresses assigned to FortiGate'sinterfaces.
- D. One session has the proxy flag on, the other one does not.
Answer: A,B
NEW QUESTION 56
View the exhibit, which contains the partial output of adiagnose command, and then answer the question below.
Based on the output, which of the following statements is correct?
- A. Anti-reply is enabled.
- B. Remote gateway IP is 10.200.5.1.
- C. Quick mode selectors are disabled.
- D. DPD is disabled.
Answer: A
NEW QUESTION 57
View theexhibit, which contains the output of a BGP debug command, and then answer the question below.
Which of the following statements about the exhibit are true? (Choose two.)
- A. For the peer 10.125.0.60, the BGP state of is Established.
- B. The local BGP peer has not established a TCP session to the BGP peer 10.200.3.1.
- C. Since the BGP counters were last reset, the BGP peer 10.200.3.1 has never been down.
- D. The local BGPpeer has received a total of three BGP prefixes.
Answer: A,B
NEW QUESTION 58
What is the diagnose test application ipsmonitor 99 command used for?
- A. To disable the IPS engine
- B. To provide information regarding IPS sessions
- C. To enable IPS bypass mode
- D. To restart all IPS engines and monitors
Answer: D
NEW QUESTION 59
In which two states is a given session categorized as ephemeral? (Choose two.)
- A. A UDP session with packets sent and received.
- B. A UDP session with only one packet received.
- C. A TCP session waiting to complete the three-way handshake.
- D. A TCP session waiting for FIN ACK.
Answer: A,D
NEW QUESTION 60
A corporate network allows Internet Access to FSSO users only. The FSSO user student does not have Internet access after successfully logged into the Windows AD network. The output of the 'diagnose debug authd fsso list' command does not show student as an active FSSO user. Other FSSO users can access the Internet without problems. What should the administrator check? (Choose two.)
- A. The student workstation's IP subnet must be listed in the CA's trusted list.
- B. The user student must belong to one or more of the monitored user groups.
- C. At least one of thestudent's user groups must be allowed by a FortiGate firewall policy.
- D. The user student must not be listed in the CA's ignore user list.
Answer: C,D
Explanation:
Explanation
https://kb.fortinet.com/kb/documentLink.do?externalID=FD38828
NEW QUESTION 61
An administrator has enabled HA session synchronization in a HA cluster with two members. Which flag is added to a primary unit's session to indicate that it has been synchronized to the secondary unit?
- A. dirty.
- B. nds.
- C. redir.
- D. synced
Answer: D
Explanation:
Explanation
The synced sessions have the 'synced' flag. The command 'diag sys session list' can be used to see the sessions on the member, with the associated flags.
NEW QUESTION 62
......
Dumps Brief Outline Of The NSE7_EFW-6.4 Exam: https://www.exams4collection.com/NSE7_EFW-6.4-latest-braindumps.html
