NSE7無料問題集「Fortinet NSE7 Enterprise Firewall

質問 1

Examine the following traffic log; then answer the question below.
date-20xx-02-01 time=19:52:01 devname=master device_id="xxxxxxx" log_id=0100020007 type=event subtype=system pri critical vd=root service=kemel status=failure msg="NAT port is exhausted." What does the log mean?

（A）The limit for the maximum number of simultaneous sessions sharing the same NAT port has been reached.

（B）The limit for the maximum number of entries in the NAT port table has been reached.

（C）There is not enough available memory in the system to create a new entry in the NAT port table.

（D）FortiGate does not have any available NAT port for a new connection.

正解：A 解答を投票する

質問 2

View the exhibit, which contains a partial web filter profile configuration, and then answer the question below.

Which action will FortiGate take if a user attempts to access www.dropbox.com, which is categorized as File Sharing and Storage?

（A）FortiGate will block the connection based on the URL Filter configuration.

（B）FortiGate will exempt the connection based on the Web Content Filter configuration.

（C）FortiGate will allow the connection based on the FortiGuard category based filter configuration.

（D）FortiGate will block the connection as an invalid URL.

正解：A 解答を投票する

質問 3

An administrator has enabled HA session synchronization in a HA cluster with two members. Which flag is added to a primary unit's session to indicate that it has been synchronized to the secondary unit?

（A）synced

（B）nds.

（C）redir.

（D）dirty.

正解：A 解答を投票する

質問 4

View the IPS exit log, and then answer the question below.
# diagnose test application ipsmonitor 3
ipsengine exit log"
pid = 93 (cfg), duration = 5605322 (s) at Wed Apr 19 09:57:26 2017
code = 11, reason: manual
What is the status of IPS on this FortiGate?

（A）IPS engine memory consumption has exceeded the model-specific predefined value.

（B）IPS daemon experienced a crash.

（C）All IPS-related features have been disabled in FortiGate's configuration.

（D）There are communication problems between the IPS engine and the management database.

正解：B 解答を投票する

質問 5

View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.

The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel. To diagnose, the administrator enters these CLI commands:

However, the IKE real time debug does not show any output. Why?

（A）The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.

（B）The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.

（C）The log-filter setting was set incorrectly. The VPN's traffic does not match this filter.

（D）The debug shows only error messages. If there is no output, then the tunnel is operating normally.

正解：A 解答を投票する

質問 6

Examine the output from the 'diagnose debug authd fsso list' command; then answer the question below.
# diagnose debug authd fsso list FSSO logons-IP: 192.168.3.1 User: STUDENT Groups:
TRAININGAD/USERS Workstation: INTERNAL2. TRAINING. LAB The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.
What should the administrator check?

（A）The DNS name resolution for the workstation name INTERNAL2. TRAINING. LAB.

（B）The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2.
TRAINING. LAB.

（C）The reserve DNS lookup forthe IP address 192.168.3.1.

（D）The IP address recorded in the logon event for the user STUDENT.

正解：B 解答を投票する

質問 7

View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

Why didn't the tunnel come up?

（A）The remote gateway's phase 1 configuration does not match the local gateway's phase 1 configuration.

（B）The pre-shared keys do not match.

（C）The remote gateway's phase 2 configuration does not match the local gateway's phase 2 configuration.

（D）The remote gateway is using aggressive mode and the local gateway is configured to use man mode.

正解：A 解答を投票する

質問 8

Two independent FortiGate HA clusters are connected to the same broadcast domain. The administrator has reported that both clusters are using the same HA virtual MAC address. This creates a duplicated MAC address problem in the network. What HA setting must be changed in one of the HA clusters to fix the problem?

（A）Session pickup.

（B）Group name.

（C）Group ID.

（D）Gratuitous ARPs.

正解：C 解答を投票する

質問 9

Examine the following partial outputs from two routing debug commands; then answer the question below: