最新的Troubleshooting Professional認證 NSE7考試題庫

問題1

What conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three.)

A. Hello and dead intervals match.

B. IP addresses are in the same subnet.

C. OSPF costs match.

D. OSPF IP MTUs match.

E. OSPF peer IDs match.

正確答案: A,B,E

問題2

Examine the following traffic log; then answer the question below.
date-20xx-02-01 time=19:52:01 devname=master device_id="xxxxxxx" log_id=0100020007 type=event subtype=system pri critical vd=root service=kemel status=failure msg="NAT port is exhausted." What does the log mean?

A. There is not enough available memory in the system to create a new entry in the NAT port table.

B. FortiGate does not have any available NAT port for a new connection.

C. The limit for the maximum number of simultaneous sessions sharing the same NAT port has been reached.

D. The limit for the maximum number of entries in the NAT port table has been reached.

正確答案: C

問題3

Examine the IPsec configuration shown in the exhibit; then answer the question below.

An administrator wants to monitor the VPN by enabling the IKE real time debug using these commands:
diagnose vpn ike log-filter src-addr4 10.0.10.1
diagnose debug application ike -1
diagnose debug enable
The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are being interchanged between both IPsec gateways. However, the IKE real time debug does NOT show any output. Why isn't there any output?

A. The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.

B. The IKE real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.

C. The IKE real time shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.

D. The log-filter setting is set incorrectly. The VPN's traffic does not match this filter.

正確答案: C

問題4

View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.
ike 0: comes 10.0.0.2:500->10.0.0.1:500, ifindex=7....
ike 0: IKEv1 exchange=Aggressive id=baf47d0988e9237f/2f405ef3952f6fda len=430 ike 0: in BAF47D0988E9237F2F405EF3952F6FDA0110040000000000000001AE0400003C0000000100000001000000 ike 0:RemoteSite:4: initiator: aggressive mode get 1st response...
ike 0:RemoteSite:4: VID RFC 3947 4A131c81070358455C5728F20E95452F
ike 0:RemoteSite:4: VID DPD AFCAD71368A1F1C96B8696FC77570100
ike 0:RemoteSite:4: VID FORTIGATE 8299031757A36082C6A621DE000502D7
ike 0:RemoteSite:4: peer is FortiGate/Fortios (v5 b727)
ike 0:RemoteSite:4: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3
ike 0:RemoteSite:4: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3C0000000 ike 0:RemoteSite:4: received peer identifier FQDN 'remore' ike 0:RemoteSite:4: negotiation result ike 0:RemoteSite:4: proposal id = 1:
ike 0:RemoteSite:4: protocol id = ISAKMP:
ike 0:RemoteSite:4: trans_id = KEY_IKE.
ike 0:RemoteSite:4: encapsulation = IKE/none
ike 0:RemoteSite:4: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key -len=128
ike 0:RemoteSite:4: type=OAKLEY_HASH_ALG, val=SHA.
ike 0:RemoteSite:4: type-AUTH_METHOD, val=PRESHARED_KEY.
ike 0:RemoteSite:4: type=OAKLEY_GROUP, val=MODP1024.
ike 0:RemoteSite:4: ISAKMP SA lifetime=86400
ike 0:RemoteSite:4: ISAKMP SA baf47d0988e9237f/2f405ef3952f6fda key 16:
B25B6C9384D8BDB24E3DA3DC90CF5E73
ike 0:RemoteSite:4: PSK authentication succeeded
ike 0:RemoteSite:4: authentication OK
ike 0:RemoteSite:4: add INITIAL-CONTACT
ike 0:RemoteSite:4: enc
BAF47D0988E9237F405EF3952F6FDA081004010000000000000080140000181F2E48BFD8E9D603F ike 0:RemoteSite:4: out BAF47D0988E9237F405EF3952F6FDA08100401000000000000008C2E3FC9BA061816A396F009A12 ike 0:RemoteSite:4: sent IKE msg (agg_i2send): 10.0.0.1:500-10.0.0.2:500, len=140, id=baf47d0988e9237f/2 ike 0:RemoteSite:4: established IKE SA baf47d0988e9237f/2f405ef3952f6fda Which statements about this debug output are correct? (Choose two.)

A. The negotiation is using AES128 encryption with CBC hash.

B. The initiator has provided remote as its IPsec peer ID.

C. It shows a phase 1 negotiation.

D. The remote gateway IP address is 10.0.0.1.

正確答案: B,C

問題5

View the IPS exit log, and then answer the question below.
# diagnose test application ipsmonitor 3
ipsengine exit log"
pid = 93 (cfg), duration = 5605322 (s) at Wed Apr 19 09:57:26 2017
code = 11, reason: manual
What is the status of IPS on this FortiGate?

A. There are communication problems between the IPS engine and the management database.

B. IPS engine memory consumption has exceeded the model-specific predefined value.

C. IPS daemon experienced a crash.

D. All IPS-related features have been disabled in FortiGate's configuration.

正確答案: C

問題6

View the exhibit, which contains the partial output of an IKE real time debug, and then answer the question below.

The administrator does not have access to the remote gateway. Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?

A. Change phase 1 encryption to AESCBC and authentication to SHA128.

B. Change phase 1 encryption to AES128 and authentication to SHA512.

C. Change phase 1 encryption to 3DES and authentication to CBC.

D. Change phase 1 encryption to 3DES and authentication to SHA256.

正確答案: B

問題7

Examine the output of the 'get router info ospf interface' command shown in the exhibit; then answer the question below.

Which statements are true regarding the above output? (Choose two.)

A. There are at least 5 OSPF routers connected to the port4 network.

B. Two OSPF routers are down in the port4 network.

C. The local FortiGate has been elected as the OSPF backup designated router.

D. The port4 interface is connected to the OSPF backbone area.

正確答案: B,D

問題8

View the exhibit, which contains a session entry, and then answer the question below.

Which statement is correct regarding this session?

A. It is a TCP session in CLOSE_WAIT state from 10.1.10.10 to 10.200.1.1.

B. It is a TCP session in ESTABLISHED state from 10.1.10.10 to 10.200.5.1.

C. It is an ICMP session from 10.1.10.10 to 10.200.5.1.

D. It is an ICMP session from 10.1.10.10 to 10.200.1.1.

正確答案: D

問題9

An administrator has enabled HA session synchronization in a HA cluster with two members. Which flag is added to a primary unit's session to indicate that it has been synchronized to the secondary unit?

A. nds.

B. synced

C. redir.

D. dirty.

正確答案: B

最新的Fortinet NSE7 Enterprise Firewall - FortiOS 5.4 - NSE7免費考試真題

最新更新

站內鏈接

聯系我們