Which two statements about FortiSwitch trunks are true? (Choose two.)

A trunk is a link aggregation group interface.

By default, when connecting two FortiSwitch devices to each other, a trunk is automatically created between the switches.

A trunk is a link aggregation group interface.

By default, when connecting two FortiSwitch devices to each other, a trunk is automatically created between the switches.

Trunks do not support tagged Ethernet frames.

Refer to the exhibit.Examine the FortiGate logs, widget, and CLI output shown in the exhibit. An administrator is testing the Security Fabric quarantine automation. The test device (10.0.2.2) is connected to a managed FortiSwitch device.A few seconds after trying to access a malicious website from the test device, the test device can no longer access the internet and other VLANs in the network. However, the device is still able to access other devices in the same VLAN.Based on the information shown in the exhibit, which modification should the administrator make to fix the problem?

Enable the access layer quarantine action on the Quarantine_Devices automation stitch.

Configure a firewall policy on FortiGate to block the intra-VLAN traffic.

Change the quarantine mode to by VLAN mode.

Enable the access layer quarantine action on the Quarantine_Devices automation stitch.

Change the quarantine mode to by redirect mode.

Which two statements about the use of digital certificates are true? (Choose two.)

A chain of trust may include one or more intermediate CAs.

An intermediate CA can sign other certificates.

A chain of trust may include one or more intermediate CAs.

In a chain of trust, the root CA is signed by another certificate.

To validate the signature on a certificate, an endpoint does not need to know the CA of that certificate.

An intermediate CA can sign other certificates.

Refer to the exhibit. Examine the partial debug output shown in the exhibit. Which two statements about the debug output are true? (Choose1 two.)

The credentials provided for student are correct.

The Training-Lab LDAP server is configured to use regular bind.

The LDAP DN search did not match any LDAP user.

The credentials provided for student are correct.

The Training-Lab LDAP server is configured to use regular bind.

The connection to the Training-Lab LDAP server timed out.

Refer to the exhibits. The CLI output shows a FortiGate configuration supporting a remote AP in an employee's home. The employee requires access to resources located on the company network, including the database server and AD server. The employee is trying to print to a printer connected in their home, but is not able to.Which two solutions would resolve the issue? (Choose two.)

Configure the FAPU431F-EmployeeHome WTP profile to enable split tunneling to the AP subnet using the command set split-tunneling-acl-local-ap-subnet enable.

Configure the FARU431F-EmployeeHome wtp-profile to add a split tunneling ACL with a destination subnet of 192.168.1.1/24, using the command set dest-ip 192.168.1.1/24.

Configure the EmployeeHome VAP profile for local bridging using the command set local-bridging enable.

Configure the EmployeeHome VAP profile to disable host isolation using the command set intra-vap-privacy disable.

Configure the FAPU431F-EmployeeHome WTP profile to enable split tunneling to the AP subnet using the command set split-tunneling-acl-local-ap-subnet enable.

Configure the FARU431F-EmployeeHome wtp-profile to add a split tunneling ACL with a destination subnet of 192.168.1.1/24, using the command set dest-ip 192.168.1.1/24.

Refer to the exhibits. In the WTP profile configuration shown in the exhibit, the AP profile is assigned to two FAP-320 APs that are installed in an open plan office. The first AP has 32 clients associated with the 5 GHz radios and 22 clients associated with the 2.4 GHz radio. The second AP has 12 clients associated with the 5 GHz radios and 20 clients associated with the 2.4 GHz radio.A dual-band-capable client enters the office near the first AP and the first AP measures the new client at -33 dBm signal strength. The second AP measures the new client at 2 -43 dBm signal strength.If the new client attempts to connect to the corporate wireless network, with which AP radio will the client be associated?

The second AP 2.4 GHz interface.

The first AP 2.4 GHz interface.

An administrator is deploying a new FortiGate device using zero-touch provisioning. Before deployment, the administrator added the FortiGate serial number on FortiManager and configured all the FortiGate settings FortiGate has a factory default configuration. However, when the administrator connects FortiGate to the network, FortiManager does not start the installation automatically. Which two scenarios are likely to cause this issue? (Choose two.)

The serial number added on FortiManager does not match the FortiGate serial number.

The DHCP server that serves FortiGate is not configured with options 240 and 241.

The serial number added on FortiManager does not match the FortiGate serial number.

The DHCP server that serves FortiGate is not configured with options 240 and 241.

Zero-touch provisioning is disabled on FortiManager.

The pre-shared key set on FortiManager does not match the one set on FortiGate.

Which statement correctly describes the guest portal behavior on FortiAuthenticator?

FortiAuthenticator uses POST parameters and a RADIUS client configuration to map the request to a guest portal for authentication.

Sponsored accounts cannot authenticate using guest portals.

All self-registered and sponsored accounts are listed on the local Users GUI page on FortiAuthenticator.

All guest accounts must be activated using SMS or email activation codes.

Refer to the exhibit. The exhibit shows a network topology and SSID settings. FortiGate is configured to use an external captive portal.However, wireless users are not able to see the captive portal login page.Which configuration change should the administrator make to fix the problem?

Create a firewall policy to allow traffic from the Guest SSID to FortiAuthenticator and Windows AD devices.

Remove the guest.portal user group in the firewall policy.

Enable the captive-portal-exempt option in the firewall policy with the ID 10.

Create a firewall policy to allow traffic from the Guest SSID to FortiAuthenticator and Windows AD devices.

Add the FortiAuthenticator and WindowsAD address objects as exempt sources.

Refer to the exhibits. Examine the debug output and the SSL VPN configuration shown in the exhibits. An administrator has configured SSL VPN on FortiGate. To improve security, the administrator enabled Required Client Certificate on the SSL VPN configuration page. However, a user is unable to successfully authenticate to SSL VPN.Which configuration change should the administrator make to fix the problem?

Import the CA that signed the user certificate to FortiGate.

Enable Redirect HTTP to SSL-VPN on the SSL VPN configuration page.

Import the CA that signed the SSL VPN Server Certificate to FortiGate.

Set the user certificate as the Server Certificate on the SSL VPN configuration page.

Import the CA that signed the user certificate to FortiGate.

Refer to the exhibits. Examine the VAP configuration and the Wi-Fi zones table shown in the exhibits. Which two statements describe the FortiGate behavior regarding assignment of VLANs to wireless clients? (Choose two.)

Clients connecting to APs in the Office group will be assigned to VLAN 102.

Clients connecting to APs in the Floor group will not be able to receive an IP address.

FortiGate will load balance clients using VLAN 101 and VLAN 102 and assign them an IP address from the 10.0.3.0/24 subnet.

Clients connecting to APs in the Office group will be assigned to VLAN 102.

All clients connecting to the Corp SSID will receive an IP address from the 10.0.3.1/24 subnet.

Clients connecting to APs in the Floor group will not be able to receive an IP address.

Which three FortiOS tools can you use to troubleshoot RADIUS authentication issues? (Choose three.)

You can use the diagnose test authserver radius command to verify RADIUS server configuration, user credentials, and user group membership.

You can enable debug for the fnbamd process to view RADIUS authentication details.

You can use the diagnose test application radiusd command to verify the RADIUS server configuration, user credentials, and user group membership.

You can enable debug for the fssod process to view RADIUS authentication details.

You can use the diagnose test authserver radius command to verify RADIUS server configuration, user credentials, and user group membership.

You can check the Firewall Users widget to view the list of active RADIUS users.

You can enable debug for the fnbamd process to view RADIUS authentication details.

You can use the diagnose test application radiusd command to verify the RADIUS server configuration, user credentials, and user group membership.

Refer to the exhibit. An administrator wants to telnet into the S224EPTF19005867 switch over the FortiGate FortiLink interface.Which configuration change should the administrator make?

On the default local-access profile, add telnet to the list of allowed protocols for internal-allowaccess.

Enable telnet access on the FortiLink interface.

On the default local-access profile, add telnet to the list of allowed protocols for mgmt-allowaccess.

On the default local-access profile, add telnet to the list of allowed protocols for internal-allowaccess.

Factory reset the switch to enable telnet access.

Refer to the exhibits. An administrator has configured FortiGate with an SSID (Corp) with dynamic VLAN assignment, and also configured a RADIUS server to send IETF 64, IETF 65, and IETF 81 VSAs.The administrator has verified that the RADIUS server is sending all the required information to FortiGate. However, FortiGate is not assigning correct VLANs to the wireless clients.What is causing the problem?

The RADIUS server must send the framed-ip attribute to assign wireless clients an IP address.

Wireless clients must be assigned an IP address from the 10.0.3.0/24 subnet.

The RADIUS server must send the framed-ip attribute to assign wireless clients an IP address.

The administrator must define the corresponding VLANs that are sent by the RADIUS server.

The administrator must configure a firewall policy to allow wireless clients to communicate with the RADIUS server.

Refer to the exhibit. Examine the FortiSwitch port configuration and the FortiGate interface configuration shown in the exhibit. Based on the configuration shown in the exhibit, which two statements about how port2 handles tagged and untagged traffic are true? (Choose two.)

Port2 accepts ingress untagged traffic for VLAN IDs 10, 4091, and 4093 only.

Port2 assigns ingress untagged traffic to VLAN 10.

Port2 accepts ingress untagged traffic for VLAN IDs 10, 4091, and 4093 only.

Port2 assigns ingress untagged traffic to VLAN 10.

Port2 tags egress traffic for VLAN 10.

Port2 accepts ingress tagged traffic for VLAN IDs 4091 and 4093 only.

Which CLI command should an administrator use on FortiGate to view the RSSO authentication process in real time?

diagnose debug application fnbamd -1

diagnose debug application authd -1

diagnose debug application radiusd -1

diagnose debug application foauthd -1

Refer to the exhibit. Examine the FortiSwitch security policy shown in the exhibit.A device that does not support 802.1X authentication is connected to a port using the Port-Security security policy.What action does the FortiSwitch take on the port?

FortiSwitch assigns the port to the onboarding VLAN.

FortiSwitch shuts down the port.

FortiSwitch assigns the port to the quarantine VLAN.

FortiSwitch authenticates the device using the device MAC address as username and password.

Refer to the exhibit.Examine the FortiGate RSSO configuration shown in the exhibit. FortiGate is configured to receive RADIUS accounting messages on port3 to authenticate RSSO users. The incoming RADIUS accounting messages contain the username and group membership information in the User-Name and Class RADIUS attributes, respectively.Which three settings must you configure on FortiGate to successfully authenticate RSSO users and match them to the existing RSSO user groups? (Choose three)

The rasc-endpoint-attribute CLI setting in the RSSO agent configuration should be set to User-Name.

The RADIUS Attribute Value setting configured for an RSSO user group should match the Class RADIUS attribute value in the RADIUS accounting message.

The sso-attribute CLI setting in the RSSO agent configuration should be set to Class.

The rasc-endpoint-attribute CLI setting in the RSSO agent configuration should be set to User-Name.

Device detection and Security Fabric Connection should be enabled on port3.

The RADIUS Attribute Value setting configured for an RSSO user group should match the Class RADIUS attribute value in the RADIUS accounting message.

RSSO user groups should be assigned to all firewall policies.

The sso-attribute CLI setting in the RSSO agent configuration should be set to Class.

An administrator is deploying AP's that are connecting over an IPsec network. All APs have been configured to connect to FortiGate manually. FortiGate can discover the APs and authorize them. However, FortiGate is unable to establish CAPWAP tunnels to manage the APs.Which configuration setting can the administrator perform to resolve the problem?

Decrease the CAPWAP tunnel MTU size for APs to prevent fragmentation.

Upgrade the FortiAP firmware image to ensure compatibility with the FortiOS version.

Decrease the CAPWAP tunnel MTU size for APs to prevent fragmentation.

Enable CAPWAP administrative access on the IPsec interface.

Assign a custom AP profile for the remote APs with the set mpls-connection option enabled.

Fortinet NSE7_LED-7.0 Practice Test 2 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Fortinet NSE7_LED-7.0 Practice Test 2

Question

Fortinet NSE7_LED-7.0 Practice Tests

Practice Tests