NSE7_EFW-6.0 Online Practice Questions and Answers

View the exhibit, which contains the output of diagnose sys session list, and then answer the question below.

If the HA ID for the primary unit is zero (0), which one of the following statements about the output is true?

A. This session is for HA heartbeat traffic.

B. This session cannot be synced with the slave unit.

C. The master unit is processing this traffic.

D. The inspection of this session has been offloaded to the slave unit.

Which of the following tasks are automated using the Install Wizard on FortiManager? (Choose two.)

A. Install configuration changes to managed devices.

B. Preview pending configuration changes for managed devices.

C. Import policy packages from managed devices.

D. Add devices to FortiManager.

E. Import interface mappings from managed devices

View the exhibit, which contains a session table entry, and then answer the question below.

Which one of the following statements is true regarding FortiGates's inspection of this session?

A. FortiGate applied flow-based inspection.

B. FortiGate applied proxy-based inspection.

C. FortiGate forwarded this session without any inspection.

D. FortiGate applied NGFW flow-based inspection.

View the exhibit, which contains the output of a BGP debug command, and then answer the question below.

Which of the following statements about the exhibit are true? (Choose two.)

A. The local router's BGP state is Established with the 10.125.0.60 peer.

B. Since the counters were last reset; the 10.200.3.1 peer has never been down.

C. The local router has received a total of three BGP prefixes from all peers.

D. The local router has not established a TCP session with 100.64.3.1.

View the global IPS configuration, and then answer the question below.

Which of the following statements is true regarding this configuration? (Choose two.)

A. IPS will scan every byte in every session.

B. IPS acceleration is disabled in this FortiGate device's configuration.

C. New packets requiring IPS inspection will be passed through during conserve mode.

D. FortiGate will spawn IPS engine instances based on the system load.

When using the SSL certificate inspection method to inspect HTTPS traffic, how does FortiGate filler web requests when the client browser does not provide the server name indication (SNI) extension ?

A. FortiGate switches to the full SSL inspection method to decrypt the data.

B. FortiGate blocks the request without any further inspection.

C. FortiGate uses the Issued T: field in the server's certificate.

D. FortiGate uses the requested URL from the user's web browser.

View the following FortiGate configuration.

All traffic to the Internet currently egresses from port1. The exhibit shows partial session information for Internet traffic from a user on the internal network.

If the priority on route ID 1 were changed from 5 to 20, what would happen to traffic matching that user's session?

A. The session would be deleted, so the client would need to start a new session.

B. The session would remain in the session table, and its traffic would still egress from port1.

C. The session would remain in the session table, and its traffic would start to egress from port2.

D. The session would remain in the session table, but its traffic would now egress from both port1 and port2.

An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer. If the administrator knows that there is no NAT device located between both FortiGates, what command should the administrator execute?

A. diagnose sniffer packet any 'esp'

B. diagnose sniffer packet any 'tcp port 500 or tcp port 4500'

C. diagnose sniffer packet any 'udp port 4500'

D. diagnose sniffer packet any 'udp port 500'

View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

Which of the following statements about this debug output are correct? (Choose two.)

A. It shows a phase 1 negotiation.

B. The initiator has provided remote as its IPsec peer ID.

C. The negotiation is using AES128 encryption with CBC hash.

D. The remote gateway IP address is 10.0.0.1.

Which of the following statements are correct regarding application layer test commands? (Choose two.)

A. Some of them display statistics and configuration information about a feature or process.

B. They are used to filter real-time debugs.

C. They display real-time application debugs.

D. Some of them can be used to restart an application.