最新的NSE 7 Network Security Architect認證 NSE7_EFW-7.0考試題庫

問題1

Examine the following partial output from two system debug commands; then answer the question below.

Which of the following statements are true regarding the above outputs? (Choose two.)

A. The Cached value is always the Active value plus the Inactive value

B. The unit is running a 32-bit FortiOS

C. The unit is in kernel conserve mode

D. Kernel indirectly accesses the low memory (LowTotal) through memory paging

正確答案: A,B

問題2

View the exhibit, which contains a partial web filter profile configuration, and then answer the question below.

Which action will FortiGate take if a user attempts to access www.dropbox.com, which is categorized as File Sharing and Storage?

A. FortiGate will block the connection based on the URL Filter configuration.

B. FortiGate will allow the connection based on the FortiGuard category based filter configuration.

C. FortiGate will block the connection as an invalid URL.

D. FortiGate will exempt the connection based on the Web Content Filter configuration.

正確答案: A

說明：（僅 VCESoft 成員可見）

問題3

Examine the output from the BGP real time debug shown in the exhibit, then the answer the question below:

Which statements are true regarding the output in the exhibit? (Choose two.)

A. The state of the remote BGP peer is OpenConfirm.

B. The state of the remote BGP peer will go to Connect after it confirms the received prefixes.

C. Local BGP peer received a prefix for a default route.

D. BGP peers have successfully interchanged Open and Keepalive messages.

正確答案: C,D

問題4

Refer to the exhibit, which shows the output of a debug command.

What can be concluded from the debug command output?

A. The interface ToRemote is a broadcast OSPF network.

B. The OSPF router with the ID 0.0.0.69 has its OSPF priority set to 0.

C. There are more than two OSPF routers on the wan2 network.

D. The local FortiGate has a different MTU value from the OSPF router with ID 0.0.0.2, based on the state information.

正確答案: C

說明：（僅 VCESoft 成員可見）

問題5

Refer to the exhibit, which shows the output of a debug command.

Which two statements about the output are true? (Choose two.)

A. There are a total of 5 OSPF routers attached to the Port4 network segment.

B. Based on the network type of port 4, OSPF hello packets will be sent to 224.0.0.5.

C. In the network connected to port 4, two OSPF routers are down.

D. Based on the network type of port 4, OSPF hello packets will be sent to 224.0.0.6.

正確答案: A,B

問題6

What does the dirty flag mean in a FortiGate session?

A. The next packet must be re-evaluated against the firewall policies.

B. The session must be removed from the former primary unit after an HA failover.

C. Traffic has been identified as from an application that is not allowed.

D. Traffic has been blocked by the antivirus inspection.

正確答案: A

說明：（僅 VCESoft 成員可見）

問題7

You have configured FortiManager as a local FDS to provide FortiGate AV and IPS updates, but FortiGate devices are not receiving updates to their AV signature databases, IPS engines, or IPS signature databases.
Which two settings need to be verified for these features to function? (Choose two.)

A. FortiGate needs to have include-default-servers disabled under config system central-management.

B. Service access needs to be enabled on FortiManager under System Settings > Network.

C. FortiManager needs to be the license validation server for FortiGate devices trying to retrieve updated AV and IPS packages.

D. FortiGate needs to have the server list entry for FortiManager set to server-type update under config system central-management.

正確答案: B,D

說明：（僅 VCESoft 成員可見）

問題8

A FortiGate device has the following LDAP configuration:

The LDAP user student cannot authenticate. The exhibit shows the output of the authentication real time debug while testing the student account:

Based on the above output, what FortiGate LDAP settings must the administer check? (Choose two.)

A. password.

B. dn.

C. username.

D. cnid.

正確答案: A,C

說明：（僅 VCESoft 成員可見）

問題9

Refer to the exhibit, which contains the partial output of the get vpn ipsec tunnel details command.

Based on the output, which two statements are correct? (Choose two.)

A. The npu_flag for this tunnel is 03.

B. Anti-replay is enabled.

C. The npu_flag for this tunnel is 02.

D. Different SPI values are a result of auto-negotiation being disabled for phase 2 selectors.

正確答案: A,B

問題10

View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

Which statements about this debug output are correct? (Choose two.)

A. The negotiation is using AES128 encryption with CBC hash.

B. The initiator has provided remote as its IPsec peer ID.

C. It shows a phase 1 negotiation.

D. The remote gateway IP address is 10.0.0.1.

正確答案: B,C

問題11

An administrator is running the following sniffer in a FortiGate:
diagnose sniffer packet any "host 10.0.2.10" 2
What information is included in the output of the sniffer? (Choose two.)

A. IP payload.

B. IP headers.

C. Ethernet headers.

D. Port names.

正確答案: A,B

說明：（僅 VCESoft 成員可見）

問題12

What does the dirty flag mean in a FortiGate session configured for NGFW policy mode?

A. The URL category for this session has been updated by FortiGuard and the session needs to be checked against the policy again to ensure proper web filtering is applied.

B. The existing session table entry has been updated with the app_id and the firewall policy table needs to be checked for a match.

C. Traffic has been identified as coming from an application that is not allowed and the relevant replacement message needs to be displayed to the user, if configured.

D. The application or URL category is unknown and needs to be rescanned by the IPS engine to try to identify the Layer 7 details.

正確答案: B

說明：（僅 VCESoft 成員可見）

問題13

View the exhibit, which contains the output of a diagnose command, and then answer the question below.

What statements are correct regarding the output? (Choose two.)

A. Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.200.1.1.

B. This is an expected session created by an application control profile.

C. Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.0.1.10.

D. This is an expected session created by a session helper.

正確答案: A,D

問題14

An administrator has configured two FortiGate devices for an HA cluster. While testing the HA failover, the administrator noticed that some of the switches in the network continue to send traffic to the former primary unit. The administrator decides to enable the setting link-failed-signal to fix the problem. Which statement is correct regarding this command?

A. Sends a link failed signal to all connected devices.

B. Forces the former primary device to shut down all its non-heartbeat interfaces for one second while the failover occurs.

C. Disables all the non-heartbeat interfaces in all the HA members for two seconds after a failover.

D. Sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.

正確答案: B

最新的Fortinet NSE 7 - Enterprise Firewall 7.0 - NSE7_EFW-7.0免費考試真題

最新更新

站內鏈接

聯系我們