Which two statements about the Security fabric are true? (Choose two.)

Only the root FortiGate sends logs to FortiAnalyzer

Only FortiGate devices with configuration-sync receive and synchronize global CMDB objects that the toot FortiGate sends

FortiGate uses the FortiTelemetry protocol to communicate with FortiAnatyzer.

Only the root FortiGate sends logs to FortiAnalyzer

Only FortiGate devices with configuration-sync receive and synchronize global CMDB objects that the toot FortiGate sends

Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer

Exhibit. Refer to the exhibit, which shows the output from the webfilter fortiguard cache dump and webfilter categories commands.Using the output, how can an administrator determine the category of the training.fortinet.com am website?

The administrator can look up the hex value of 34 in the second command output.

The administrator must convert the first three digits of the IP hex value to binary

The administrator can look up the hex value of 34 in the second command output.

The administrator must add both the Pima in and Iphex values of 34 to get the category number

The administrator must convert the first two digits of the Domain hex value to a decimal value

Which two statements about bfd are true? (Choose two)

You can disable it at the protocol level

It can support neighbor only over the next hop in BGP

You can disable it at the protocol level

You must configure n globally only

Refer to the exhibit, which shows a custom signature. Which two modifications must you apply to the configuration of this custom signature so that you can save it on FortiGate? (Choose two.)

Ensure that the header syntax is F-SBID.

Refer to the exhibit, which shows the output of a BGP summary. What two conclusions can you draw from this BGP summary? (Choose two.)

External BGP (EBGP) exchanges routing information.

The BGP session with peer 10. 127. 0. 75 is established.

External BGP (EBGP) exchanges routing information.

The BGP session with peer 10. 127. 0. 75 is established.

The router 100. 64. 3. 1 has the parameter bfd set to enable.

The neighbors displayed are linked to a local router with the neighbor-range set to a value of 4.

Refer to the exhibit, which shows two configured FortiGate devices and peering over FGSP. The main link directly connects the two FortiGate devices and is configured using the set session-syn-dev <interface> command.What is the primary reason to configure the main link?

To have both sessions and configuration synchronization in layer 3

To have both sessions and configuration synchronization in layer 2

To load balance both sessions and configuration synchronization between layer 2 and 3

To have only configuration synchronization in layer 3

To have both sessions and configuration synchronization in layer 3

Which ADVPN configuration must be configured using a script on fortiManager, when using VPN Manager to manage fortiGate VPN tunnels?

Configure IP addresses on IPsec virtual interlaces

Exhibit. Refer to the exhibit, which provides information on BGP neighbors.Which can you conclude from this command output?

BGP is attempting to establish a TCP connection with the BGP peer.

The router are in the number to match the remote peer.

You must change the AS number to match the remote peer.

BGP is attempting to establish a TCP connection with the BGP peer.

The bfd configuration to set to enable.

Exhibit. Refer to the exhibit, which contains the partial ADVPN configuration of a spoke.Which two parameters must you configure on the corresponding single hub? (Choose two.)

Set auto-discovery-sender enable

Set auto-discovery-forwarder enable

Set auto-discovery-sender enable

Set auto-discovery-forwarder enable

Set auto-discovery-receiver enable

Which FortiGate in a Security I auric sends togs to FortiAnalyzer?

Each FortiGate in the Security fabric.

The FortiGate devices performing network address translation (NAT) or unified threat management (UTM). if configured.

Only the last FortiGate that handled a session in the Security Fabric

Refer to the exhibits, which contain the network topology and BGP configuration for a hub.Exhibit A. Exhibit B. An administrator is trying to configure ADVPN with a hub and spoke VPN setup using iBGP. All the VPNs are up and connected to the hub. The hub is receiving route information from both spokes over iBGP; however the spokes are not receiving route information from each other.What change must the administrator make to the hub BGP configuration so that the routes learned from one spoke are forwarded to the other spoke?

Configure auto-discovery-sender on the hub

Configure the hub as a route reflector

Configure auto-discovery-sender on the hub

Add a prefix list to the hub that permits routes to be shared between the spokes

Enable route redistribution under config router bgp

How are bulk configuration changes made using FortiManager CLI scripts? (Choose two.)

When run on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.

When run on the Policy Package, ADOM database, you must use the installation wizard to apply the changes to the managed FortiGate device.

When run on the Device Database, changes are applied directly to the managed FortiGate device.

When run on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.

When run on the All FortiGate in ADOM, changes are automatically installed without the creation of a new revision history.

When run on the Policy Package, ADOM database, you must use the installation wizard to apply the changes to the managed FortiGate device.

Which statement about the designated router (DR) and backup designated router (BDR) in an OSPF multi-access network is true?

Non-DR and non-BDR routers form full adjacencies to DR only.

Only the DR receives link state information from non-DR routers.

Non-DR and non-BDR routers form full adjacencies to DR only.

FortiGate first checks the OSPF ID to elect a DR.

Non-DR and non-BDR routers send link state updates and acknowledgements to 224.0.0.6.

Refer to the exhibit, which shows an SSL certification inspection configuration. Which action does FortiGate take if the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate?

FortiGate closes the connection because this represents an invalid SSL/TLS configuration

FortiGate uses the first entry listed in the SAN field in the server certificate

FortiGate uses the CN information from the Subject field in the server certificate

FortiGate uses the SNI from the user's web browser.

FortiGate closes the connection because this represents an invalid SSL/TLS configuration

Refer to the exhibit, which contains a TCL script configuration on FortiManager. An administrator has configured the TCL script on FortiManager, but the TCL script failed to apply any changes to the managed device after being run.Why did the TCL script fail to make any changes to the managed device?

The TCL procedure run_cmd has not been created.

The TCL script must start with #include.

There is no corresponding #! to signify the end of the script.

The TCL procedure lacks the required loop statements to iterate through the changes.

What are two functions of automation stitches? (Choose two.)

Automation stitches can be created to run diagnostic commands and email the results when CPU or memory usage exceeds specified thresholds.

An automation stitch configured to execute actions sequentially can take parameters from previous actions as input for the current action.

Automation stitches can be created to run diagnostic commands and email the results when CPU or memory usage exceeds specified thresholds.

An automation stitch configured to execute actions in parallel can be set to insert a specific delay between actions.

Automation stitches can be configured on any FortiGate device in a Security Fabric environment.

An automation stitch configured to execute actions sequentially can take parameters from previous actions as input for the current action.

How would =c-ingress and fec-sgress IPsec configuration affect an IPsec tunnel?

FortiGate will add additional redundant information to reconstruct any lost or erratically received packets.

When an FGSP member in FortiGate fails, FortiGate flushes the corresponding tunnels and sends out dead peer detection probes to find unavailable remote peers.

FortiGate will consider all IKEV2 packets as fragmentable.

If fragmentation occurs, FortiGate will allow the packets at the IKE layer.

FortiGate will add additional redundant information to reconstruct any lost or erratically received packets.

Refer to the exhibit, which shows a partial routing table. What two conclusions can you draw from the FortiGate output shown in the exhibit? (Choose two.)

FortiGate is not using the destination subnets of the quick mode selectors to populate the routing table.

net-device is disabled in the tunnel IPSec phase 1 configuration.

FortiGate creates separate virtual interfaces for each VPN client.

add-route is enabled in the tunnel IPSec phase 1 configuration.

FortiGate is not using the destination subnets of the quick mode selectors to populate the routing table.

net-device is disabled in the tunnel IPSec phase 1 configuration.

Refer to the exhibit, which shows device registration on FortiManager. What can you conclude about the Spoke-1 and Spoke-2 configurations with respect to the information cond: Modified (recent auto-updated)?

On NGFW-A, the configuration was changed and spokes are wailing for an autoupdate.

Based on the policy configuration on NGFW-1, the configuration on both spokes is modified and automatically updated.

On NGFW-A, the configuration was changed and spokes are wailing for an autoupdate.

On both Spoke-1 and Spoke-2, the configuration was changed directly on the FortiGate device, and the changes were automatically retrieved by the device database.

Spoke-1 and Spoke-2 are sharing the same security policy configuration and the same policy package.

Refer to the exhibit, which shows an OSPF network. Which types of ink-state advertisements (LSA) will NGFW-1 send, if itis a backup designated router (BDR)?

NGFW-1 will send type 1and type 3 LSA.

ONGFW-1 will send type 1 and type 2 LSAs.

NGFW-1 will send type 1and type 3 LSA.

ONGFW-1 will send type 1 and type 4 LSA.

ONGFW-1 will send type 1and type 5 LSA.

While configuring the BGP protocol, an administrator applies the set netuork-inport-check disable command under config network.What will FortiGate do as a result of this command?

FortiGate will advertise all the prefixes in the BGP network table to its BGP neighbor, even f itis not in the routing table.

FortiGate will advertise only the corresponding prefixes in the BGP network table to its BGP neighbor, even if itis not in the routing table.

FortiGate will advertise all the prefixes in the BGP network table to its BGP neighbor, even f itis not in the routing table.

FortiGate will not advertise any imported routes received from one BGP neighbor to another.

FortiGate will not advertise the prefixes, if it is not in the routing table.

An administrator is configuring two FortiGate devices in an HA cluster. While configuring the devices, the administrator issues the following commands on both HA cluster members: In which two ways do these commands impact the HA cluster? (Choose two.)

They force the former primary to send gratuitous ARP packets when the failover happens to indicate that the virtual MAC address is now using a different device.

They force the former primary to shut down all ts interfaces for one second when failover happens, excluding the heartbeat and reserved management interfaces.

They force the former primary to send gratuitous ARP packets when the failover happens to indicate that the virtual MAC address is now using a different device.

They force the former primary to shut down all ts interfaces for one second when failover happens, excluding the heartbeat and reserved management interfaces.

They force both HA devices for remote link monitoring to detect an issue in the forwarding path.

They force the switches to update their MAC forwarding tables, when failover happens.

Which two statements about the Security Fabric are true? (Choose two.)

Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer.

Each FortiGate device in the Security Fabric must have bidirectional FortiTelemetry connectivity.

Each member of the Security Fabric maintains the shared Security Fabric map.

Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer.

FortiGate uses the FortiTelemetry protocol to communicate with FortiAnalyzer.

Each FortiGate device in the Security Fabric must have bidirectional FortiTelemetry connectivity.

Only FortiGate devices with configuration-sync sel to Local receive and synchronize the global CMDB objects that the root FortiGate sends.

Refer to the exhibit, which shows an ADVPN network, An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2.What must the administrator configure in the phase 1 VPN IPSEC configuration of the Hub2ub tunnels?

set auto-discovery-forwarder enable

Oset auto-discovery-sender enable

set auto-discovery-forwarder enable

Oset auto-discovery-receiver enable

Refer to the exhibit which shows an OSPF network. Which types of link-state advertisements (LSA) will NGFW-1 send if it is a backup designated router (BDR)

NGFW-1 will send type 1 and type 3 LSAs

NGFW-1 will send type 1 and type 2 LSAs

NGFW-1 will send type 1 and type 4 LSAs.

NGFW-1 will send type 1 and type 3 LSAs

NGFW-1 will send type 1 and type 5 LSAs

An administrator configured the following command on FortiGateconfig router ospfsec reszart-mode graceful-restartWhich two statements correctly describe the result of the above command? (Choose two.)

After the default 40 seconds wait time the OSPF neighbors will resume communication with the restarting router

The OSPF neighbor that receives the grace link-state advertisement (LSA) will enter into helper mode

FortiGate is configured with graceful restart and will exit graceful mode, if the network topology changes

After the default 40 seconds wait time the OSPF neighbors will resume communication with the restarting router

The OSPF neighbor that receives the grace link-state advertisement (LSA) will enter into helper mode

In an HA cluster FortiGate devices will keep the OSPF routes in their routing table to avoid traffic interruption during an HA failover

Exhibit. ISFW is installed in the access layer NGFW is performing SNAT and web tittering DCFW is running IPS Which two statements are true regarding the Security Fabric logging? (Choose two.)

DCFW is responsible for generating UTM logs for file server sessions initiated by Client-1. only if an IPS inspection is triggered

ISFW is responsible for generating traffic logs for only Web traffic and SMB traffic from Client-1.

DCFW is responsible for generating UTM logs for file server sessions initiated by Client-1. only if an IPS inspection is triggered

ISFW is responsible for generating traffic logs for only Web traffic and SMB traffic from Client-1.

The SMB session which is forwarded to NGFW logs that event

DCFW generates traffic logs for all sessions from Corporate File Server

The web session forwarded to the NGFW generates the relevant UTM logs along with initial traffic log

Exhibit. Refer to the exhibit which provides information on BGP neighborsWhat can you conclude from this command output?

The local FortiGate has initiated a TCP connection, but there is no response from its BGP peer

The local FortiGate starts sending its routing table with its iBGP peer

The local FortiGate is having a fully established and active BGP connection with its peer

The local FortiGate is missing the config neighbor command in its BGP configuration

Which two features are true regarding IPS hardware acceleration? (Choose two.)

cp-accel-iaode advanced option is available only on FortiGate devices that have one or more CP8 processors

set np-access-mode basic will provide last path for IPS inspected traffic

cp-accel-iaode advanced option is available only on FortiGate devices that have one or more CP8 processors

set np-access-mode basic will provide last path for IPS inspected traffic

FortiGate does not support IPSA if the cp-accel-mode is configured as none.

Network processors provide pre-IPS anomaly filtering and logging

Exhibit. Refer to the exhibit, which contains a CLI script configuration on FortiManager.An administrator configured the CLI script on FortiManager Which statement is true based on the script configuration?

The CLI scripts failed to execute because of an incomplete command

The script successfully added a static route with gateway 10.20.121.2 on the manages device

CLI scripts must start with # l.

The commands are missing d3_cmd at beginning

The CLI scripts failed to execute because of an incomplete command

In which two ways does FortiManager function when it is deployed as a local FDS? (Choose two.)

It can be configured as an update server a rating server or both

It functions as rating server only for web filtering and antispam services

It caches available firmware updates for both managed and unmanaged devices

It can be configured as an update server a rating server or both

It functions as rating server only for web filtering and antispam services

It downloads license information for registered and unregistered devices

Which statement about ADVPN is true?

lt is a combination of hub-and spoke and full-mesh topologies

lt only uses BGP for dynamic routing

It requires all the devices must be on the same AS for inter-region ADVPN topology

lt is a combination of hub-and spoke and full-mesh topologies

It supports only on single hub-and spoke architecture

Refer to the exhibit. Refer to the exhibit, which shows information about an OSPF interfaceWhat two conclusions can you draw from this command output? (Choose two.)

NGFW-1 sends its LSA updates to 224.0.0.6 address

NGFW-1 forms neighbor adjacency only with DR and BDR router.

NGFW-1 sends its LSA updates to 224.0.0.6 address

NGFW-1 sends its LSA updates to 224.0.0. 5 address

NGFW-1 forms neighbor adjacency only with DR and BDR router.

NGFW-1 forms neighbor adjacency only if other OSPF routers match the wait time of 40 seconds

Refer to the exhibit. The partial interlace configurator! of two FortiGate devices is shownWhich two conclusions can you draw from this configuration? (Choose two.)

At the time of failover, FortiGate_A will change its priority to 30

By default, preemption mode is enabled

You can include 4.4.4.4 and 4.4.4.2 IP addresses using sat vrdst command

At the time of failover, FortiGate_A will change its priority to 30

By default, preemption mode is enabled

In VRRP, you are restricted to add a third FortiGate into VRRP group 1.

Which three conditions are required (or two FortiGate devices to form an OSPF adjacency? (Choose three.)

OSPF peer interface must have same MTU size

OSPF peer interface must have same Hello and Dead time

OSPF peer interfaces must have same network and mask

OSPF peer interface must have same cost value

OSPF peer interface must have same MTU size

OSPF peer interface must have same Hello and Wait time

OSPF peer interface must have same Hello and Dead time

OSPF peer interfaces must have same network and mask

Refer to the exhibit. The exhibit shows a prefix list configurationWhat can you conclude from the above prefix-list configuration?

The prefix 10.10.10.0/24 will be permitted

The prefix 10.10.0.0/16 will be denied

The prefixes 10.10.0/16 and 10.0.0.0/16 will be denied

The prefix 10.10.10.0/24 will be permitted

The prefix 10.0.0.0/8 will be permitted

What is true about the Fitter override option in the application control profile?

Helps to categorize applications based on behavior risk or on technology

Helps to configure actions for predefined categories

Helps to categorize applications based on behavior risk or on technology

Helps to view the application control signatures for a specific category

Helps to control specific signature and applications

Which statement is true regarding the Bidirectional Forwarding Detection protocol in BGP?

BFD is used to detect one way device failure

BFD is only supported when two FortiGate devices are directly connected on the same network

BFD is using BGP keepalive messages to check the status of BGP peer

BFD is used to detect one way device failure

BFD is enabled under config router bfd configuration

You are testing the implementation of a new custom remote desktop application in your network In which two ways can you eliminate false positives in IPS during this testing phase? (Choose two)

Adjust the rate-based signature threshold and its duration.

Permanently bypass the affected endpoints

Adjust the rate-based signature threshold and its duration.

Enable the preserve source pore option in the firewall policy

Permanently bypass the affected endpoints

Refer to the exhibit, which contains a partial configuration of the global system. What can you conclude from the output?

set check-protocol-header loose command enables hardware acceleration on this FortiGate device.

set strict-d^rty-session-check enable command instructs the FortiGate to offload all dirty session traffic to its SPU

set check-protocol-header loose command enables hardware acceleration on this FortiGate device.

set av-failopen pass command instructs the FortiGate to offload all traffic that uses the antivirus proxy to NP.

set memory-use-threshoId-extreme command instructs the FortiGate to disable hardware acceleration if the memory extreme threshold reaches 95%

Fortinet NSE7_EFW-7.2 Practice Test 2 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Fortinet NSE7_EFW-7.2 Practice Test 2

Question

Fortinet NSE7_EFW-7.2 Practice Tests

Practice Tests