NSE7_EFW-7.0無料問題集「Fortinet NSE 7

質問 1

Which two statements about the Security Fabric are true? (Choose two.)

（A）Branch FortiGate devices must be configured first.

（B）All FortiGate devices in the Security Fabric must have bidirectional FortiTelemetry connectivity.

（C）FortiGate uses FortiTelemetry protocol to communicate with FortiAnalyzer.

（D）Only the root FortiGate collects network information and forwards it to FortiAnalyzer.

正解：B、C 解答を投票する

質問 2

When using the SSL certificate inspection method for HTTPS traffic, how does FortiGate filter web requests when the browser client does not provide the server name indication (SNI) extension?

（A）FortiGate uses the requested URL from the user's web browser.

（B）FortiGate switches to the full SSL inspection method to decrypt the data.

（C）FortiGate uses CN information from the Subject field in the server's certificate.

（D）FortiGate blocks the request without any further inspection.

正解：C 解答を投票する

質問 3

A corporate network allows Internet Access to FSSO users only. The FSSO user student does not have Internet access after successfully logged into the Windows AD network. The output of the 'diagnose debug authd fsso list' command does not show student as an active FSSO user. Other FSSO users can access the Internet without problems. What should the administrator check? (Choose two.)

（A）The student workstation's IP subnet must be listed in the CA's trusted list.

（B）At least one of the student's user groups must be allowed by a FortiGate firewall policy.

（C）The user student must not be listed in the CA's ignore user list.

（D）The user student must belong to one or more of the monitored user groups.

正解：B、C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 4

Refer to the exhibit, which contains the debug output of diagnose dvm device list.

Which two statements about the output shown in the exhibit are correct? (Choose two.)

（A）The FortiGate configuration is in sync with latest running revision history.

（B）The policy package has been modified for Local-FortiGate.

（C）There are pending device-level changes yet to be installed on Local-FortiGate.

（D）ADOMs are disabled on the FortiManager

正解：A、C 解答を投票する

質問 5

Refer to the exhibit, which shows a session entry. Which statement about this session is true?

（A）It is an ICMP session from 10.1.10.10 to 10.200.5. 1.

（B）It is a TCP session in close_wait state, from 10. l. 10.10 to 10.200.1.1.

（C）It is an ICMP session from 10.1.10.10 to 10.200.1.1.

（D）It is a TCP session in the established state, from 10.1.10.10 to 10.200.5.1.

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 6

View the exhibit, which contains an entry in the session table, and then answer the question below.

Which one of the following statements is true regarding FortiGate's inspection of this session?

（A）FortiGate applied proxy-based inspection.

（B）FortiGate applied explicit proxy-based inspection.

（C）FortiGate forwarded this session without any inspection.

（D）FortiGate applied flow-based inspection.

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 7

An administrator has configured two FortiGate devices for an HA cluster. While testing the HA failover, the administrator noticed that some of the switches in the network continue to send traffic to the former primary unit. The administrator decides to enable the setting link-failed-signal to fix the problem. Which statement is correct regarding this command?

（A）Forces the former primary device to shut down all its non-heartbeat interfaces for one second while the failover occurs.

（B）Sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.

（C）Sends a link failed signal to all connected devices.

（D）Disables all the non-heartbeat interfaces in all the HA members for two seconds after a failover.

正解：A 解答を投票する

質問 8

Examine the output from the BGP real time debug shown in the exhibit, then the answer the question below:

Which statements are true regarding the output in the exhibit? (Choose two.)

（A）The state of the remote BGP peer is OpenConfirm.

（B）The state of the remote BGP peer will go to Connect after it confirms the received prefixes.

（C）Local BGP peer received a prefix for a default route.

（D）BGP peers have successfully interchanged Open and Keepalive messages.

正解：C、D 解答を投票する

質問 9

An administrator wants to capture encrypted phase 2 traffic between two FortiGate devices using the built-in sniffer.
If the administrator knows that there is no NAT device located between both FortiGate devices, which command should the administrator run?

（A）diagnose sniffer packet any 'udp port 500'

（B）diagnose sniffer packet any 'ah'

（C）diagnose sniffer packet any 'udp port 4500'

（D）diagnose sniffer packet any 'ip proto 50'

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 10

What configuration changes can reduce the memory utilization in a FortiGate? (Choose two.)

（A）Increase the TCP session timers.

（B）Increase the FortiGuard cache time to live.

（C）Reduce the session time to live.

（D）Reduce the maximum file size to inspect.

正解：C、D 解答を投票する

NSE7_EFW-7.0 無料問題集「Fortinet NSE 7 - Enterprise Firewall 7.0」

弊社を連絡する

関連リンク

トップ試験