Which two statements about IKE vision 2 are true? (Choose two.)

It supports the extensible authentication protocol (EAP)

It exchanges a minimum of four messages to establish a secure tunnel

It supports the extensible authentication protocol (EAP)

It supports the XAuth protocol.

It exchanges a minimum of four messages to establish a secure tunnel

Which statement about network processor (NP) offloading is true?

The NP provides IPS signature matching

For TCP traffic FortiGate CPU offloads the first packets of SYN/ACK and ACK of the three-way handshake to NP

The NP provides IPS signature matching

You can disable the NP for each firewall policy using the command np-acceleration st to loose.

The NP checks the session key or IPSec SA

Exhibit. Refer to the exhibit, which contains the partial interface configuration of two FortiGate devices.Which two conclusions can you draw from this con figuration? (Choose two)

10.1.5.254 is the default gateway of the internal network

On failover new primary device uses the same MAC address as the old primary

10.1.5.254 is the default gateway of the internal network

On failover new primary device uses the same MAC address as the old primary

The VRRP domain uses the physical MAC address of the primary FortiGate

By default FortiGate B is the primary virtual router

Winch two statements about ADVPN are true? (Choose two)

auto-discovery receiver must be set to enable on the Spokes.

lt supports NAI for on-demand tunnels

auto-discovery receiver must be set to enable on the Spokes.

Spoke to-spoke traffic never goes through the hub

lt supports NAI for on-demand tunnels

Routing is configured by enabling add-advpn-route

Refer to the exhibit, which shows an ADVPN network. Which VPN phase 1 parameters must you configure on the hub for the ADVPN feature to function? (Choose two.)

set auto-discovery-forwarder enable

set auto-discovery-receiver enable

set auto-discovery-forwarder enable

set auto-discovery-receiver enable

set auto-discovery-sender enable

Refer to the exhibit, which shows an error in system fortiguard configuration. What is the reason you cannot set the protocol to udp in config system fortiguard?

FortiManager provides FortiGuard.

fortiguard-anycast is set to enable.

You do not have the corresponding write access.

Refer to the exhibit, which contains information about an IPsec VPN tunnel. What two conclusions can you draw from the command output? (Choose two.)

Both IPsec SAs are loaded on the kernel.

Dead peer detection is set to enable.

Both IPsec SAs are loaded on the kernel.

Forward error correction in phase 2 is set to enable.

Refer to the exhibit, which contains a partial OSPF configuration. What can you conclude from this output?

The router sends grace LSAs before it restarts.

Neighbors maintain communication with the restarting router.

The router sends grace LSAs before it restarts.

FortiGate restarts if the topology changes.

The restarting router sends gratuitous ARP for 30 seconds.

Which two statements about ADVPN are true? (Choose two.)

The hub adds routes based on IKE negotiations.

You must configure phase 2 quick mode selectors to 0.0.0.0 0.0.0.0.

You must disable add-route in the hub.

AllFortiGate devices must be in the same autonomous system (AS).

The hub adds routes based on IKE negotiations.

You must configure phase 2 quick mode selectors to 0.0.0.0 0.0.0.0.

You want to improve reliability over a lossy IPSec tunnel.Which combination of IPSec phase 1 parameters should you configure?

fragmentation and fragmentation-mtu

Which two statements about IKE version 2 fragmentation are true? (Choose two.)

Only some IKE version 2 packets are considered fragmentable.

The maximum number of IKE version 2 fragments is 128.

Only some IKE version 2 packets are considered fragmentable.

The reassembly timeout default value is 30 seconds.

It is performed at the IP layer.

The maximum number of IKE version 2 fragments is 128.

Which two statements about the BFD parameter in BGP are true? (Choose two.)

It allows failure detection in less than one second.

It is supported for neighbors over multiple hops.

It allows failure detection in less than one second.

The two routers must be connected to the same subnet.

It is supported for neighbors over multiple hops.

It detects only two-way failures.

Refer to the exhibit, which shows config system central-management information. Which setting must you configure for the web filtering feature to function?

Configure server-type with the rating option.

Add server. fortiguard. net to the server list.

Configure securewf.fortiguard. net on the default servers.

Set update-server-location to automatic.

Configure server-type with the rating option.

Which two statements about the neighbor-group command are true? (Choose two.)

It applies common settings in an OSPF area.

You can apply it in Internal BGP (IBGP) and External BGP (EBGP).

You can configure it on the GUI.

It applies common settings in an OSPF area.

It is combined with the neighbor-range parameter.

You can apply it in Internal BGP (IBGP) and External BGP (EBGP).

Refer to the exhibits, which show the configurations of two address objects from the same FortiGate. Why can you modify the Engineering address object, but not the Finance address object?

FortiGate joined the Security Fabric and the Finance address object was configured on the root FortiGate.

FortiGate is registered on FortiManager.

Another user is editing the Finance address object in workspace mode.

After enabling IPS you receive feedback about traffic being dropped.What could be the reason?

Traffic-submit is set to disable

Which, three conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three.)

OSPF interface network types match

OSPF interface priority settings are unique

Refer to the exhibit, which shows a network diagram. Which IPsec phase 2 configuration should you impalement so that only one remote site is connected at any time?

Set route-overlap to either use---new or use-old

Exhibit. Refer to the exhibit, which contains an ADVPN network diagram and a partial BGP con figuration Which two parameters Should you configure in config neighbor range? (Choose two.)

set prefix 172.16.1.0 255.255.255.0

set route reflector-client enable

set prefix 10.1.0 255.255.255.0

Which two statements about metadata variables are true? (Choose two.)

They can be used as variables in scripts

They apply only to non-firewall objects.

The metadata format is $<metadata_variabie_name>.

They can be used as variables in scripts

Exhibit. Refer to the exhibit, which shows a partial web filter profile conjurationWhat can you cone udo from this configuration about access to www.facebook.com, which is categorized as Social Networking?

The access is blocked based on the URL Filter configuration

The access is blocked based on the Content Filter configuration

The access is allowed based on the FortiGuard Category Based Filter configuration

The access is blocked based on the URL Filter configuration

The access is hocked if the local or the public FortiGuard server does not reply

An administrator has configured two fortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device What can the administrator do to fix this problem?

Configure set link -failed signal enable under-config system ha on both Cluster members

Verify that the speed and duplex settings match between me FortiGate interfaces and the connected switch ports

Configure set link -failed signal enable under-config system ha on both Cluster members

Configure remote Iink monitoring to detect an issue in the forwarding path

Configure set send-garp-on-failover enables under config system ha on both cluster members

Exhibit. Refer to the exhibit, which shows information about an OSPF interlaceWhat two conclusions can you draw from this command output? (Choose two.)

The port3 network has more man one OSPF router

The interfaces of the OSPF routers match the MTU value that is configured as 1500.

The port3 network has more man one OSPF router

The OSPF routers are in the area ID of 0.0.0.1.

The interfaces of the OSPF routers match the MTU value that is configured as 1500.

NGFW-1 is the designated router

In which two ways does fortiManager function when it is deployed as a local FDS? (Choose two)

lt can be configured as an update server a rating server or both

It provides VM license validation services

lt can be configured as an update server a rating server or both

It provides VM license validation services

It supports rating requests from non-FortiGate devices.

It caches available firmware updates for unmanaged devices

Refer to the exhibit, which shows a routing table. What two options can you configure in OSPF to block the advertisement of the 10.1.10.0 prefix? (Choose two.)

Configure a distribute-list-out

Remove the 16.1.10.C prefix from the OSPF network

Configure a distribute-list-out

Exhibit. Refer to the exhibit, which shows a partial touting tableWhat two concisions can you draw from the corresponding FortiGate configuration? (Choose two.)

net-device is enabled in the tunnel IPSec phase 1 configuration

add-route is disabled in the tunnel IPSec phase 1 configuration.

IPSec Tunnel aggregation is configured

net-device is enabled in the tunnel IPSec phase 1 configuration

OSPI is configured to run over IPSec.

add-route is disabled in the tunnel IPSec phase 1 configuration.

Exhibit. Refer to the exhibit, which contains a partial policy configuration.Which setting must you configure to allow SSH?

Specify SSH in the Service field

Configure pot 22 in the Protocol Options field.

Include SSH in the Application field

Select an application control profile corresponding to SSH in the Security Profiles section

Exhibit. Refer to the exhibit, which contains a partial VPN configuration.What can you conclude from this configuration1?

Dead peer detection s disabled.

FortiGate creates separate virtual interfaces for each dial up client.

The VPN should use the dynamic routing protocol to exchange routing information Through the tunnels.

Dead peer detection s disabled.

The routing table shows a single IPSec virtual interface.

You contoured an address object on the tool fortiGate in a Security Fabric. This object is not synchronized with a downstream device. Which two reasons could be the cause? (Choose two)

The address object on the tool FortiGate has fabric-object set to disable

The downstream TortiGate has fabric-object-unification set to local

The address object on the tool FortiGate has fabric-object set to disable

The root FortiGate has configuration-sync set to enable

The downstream TortiGate has fabric-object-unification set to local

The downstream FortiGate has configuration-sync set to local

Exhibit. Refer to the exhibit, which contains a CLI script configuration on fortiManager. An administrator configured the CLI script on FortiManager rut the script tailed to apply any changes to the managed device after being executed.What are two reasons why the script did not make any changes to the managed device? (Choose two)

The commands that start with the # sign did not run.

Incomplete commands can cause CLI scripts to fail.

The commands that start with the # sign did not run.

Incomplete commands can cause CLI scripts to fail.

Static routes can be added using only TCI scripts.

CLI scripts must start with #!.

You created a VPN community using VPN Manager on FortiManager. You also added gateways to the VPN community. Now you are trying to create firewall policies to permit traffic over the tunnel however, the VPN interfaces do not appear as available options.

install the VPN community and gateway configuration on the fortiGate devices so that the VPN interfaces appear on the Policy Objects on fortiManager.

Create interface mappings for the IPsec VPN interfaces before you use them in a policy.

Refresh the device status using the Device Manager so that FortiGate populates the IPSec interfaces

Configure the phase 1 settings in the VPN community that you didnt initially configure. FortiGate automatically generates the interfaces after you configure the required settings

install the VPN community and gateway configuration on the fortiGate devices so that the VPN interfaces appear on the Policy Objects on fortiManager.

Fortinet NSE7_EFW-7.2 Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 40

Exhibit.

Fortinet NSE7_EFW-7.2 image Question 1 26953 09182024190732000000

Refer to the exhibit, which contains an active-active toad balancing scenario.

During the traffic flow the primary FortiGate forwards the SYN packet to the secondary FortiGate.

What is the destination MAC address or addresses when packets are forwarded from the primary FortiGate to the secondary FortiGate?

Secondary physical MAC port1

Secondary virtual MAC port1

Secondary virtual MAC port1 then physical MAC port1

Secondary physical MAC port2 then virtual MAC port2

Comment (0)

Fortinet NSE7_EFW-7.2 Practice Test 1

Question

Fortinet NSE7_EFW-7.2 Practice Tests

Practice Tests