NSE7_EFW-7.0 Online Practice Questions and Answers

Examine the partial output from the IKE real time debug shown in the exhibit; then answer the question below. Why didn't the tunnel come up?

A. IKE mode configuration is not enabled in the remote IPsec gateway.

B. The remote gateway's Phase-2 configuration does not match the local gateway's phase- 2 configuration.

C. The remote gateway's Phase-1 configuration does not match the local gateway's phase- 1 configuration.

D. One IPsec gateway is using main mode, while the other IPsec gateway is using aggressive mode.

Refer to the exhibit, which contains partial output from an IKE real-time debug.

The administrator does not have access to the remote gateway.

Based on the debug output, which configuration change can the administrator make to the local gateway to resolve the phase 1 negotiation error?

A. In the phase 1 network configuration, set the IKE version to 2.

B. In the phase 1 proposal configuration, add AES128-SHA128 to the list of encryption algorithms.

C. In the phase 1 proposal configuration, add AESCBC-SHA2 to the list of encryption algorithms.

D. In the phase 1 proposal configuration, add AES256-SHA256 to the list of encryption algorithms.

View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

The administrator does not have access to the remote gateway. Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?

A. Change phase 1 encryption to 3DES and authentication to SHA128.

B. Change phase 1 encryption to AES128 and authentication to SHA512.

C. Change phase 1 encryption to AESCBC and authentication to SHA2.

D. Change phase 1 encryption to AES256 and authentication to SHA256.

Which statement about the designated router (DR) and backup designated router (BDR) in an OSPF multi-access network is true?

A. Only the DR receives link state information from non-DR routers.

B. Non-DR and non-BDR routers form full adjacencies to DR only.

C. Non-DR and non-BDR routers send link state updates and acknowledgements to 224.0.0.6.

D. FortiGate first checks the OSPF ID to elect a DR.

Which two conditions would prevent a static route from being added to the routing table? (Choose two.)

A. There is another other route to the same destination, with a lower distance.

B. The route has a lower priority value than another route to the same destination.

C. The next-hop IP address is unreachable.

D. The interface specified in the route configuration is down

View the exhibit, which contains the output of a real-time debug, Which statement about this output is true?

Which of the following statements is true regarding this output?

A. The requested URL belongs to category ID 255.

B. The server hostname Is training, fortinet.com.

C. FortiGate found the requested URL in its local cache.

D. This web request was inspected using the ftgd-allow web filler profile.

View the exhibit, which contains the output of a web diagnose command, and then answer the question below.

Which one of the following statements explains why the cache statistics are all zeros?

A. The administrator has reallocated the cache memory to a separate process.

B. There are no users making web requests.

C. The FortiGuard web filter cache is disabled in the FortiGate's configuration.

D. FortiGate is using a flow-based web filter and the cache applies only to proxy-based inspection.

View these partial outputs from two routing debug commands:

Which outbound interface will FortiGate use to route web traffic from internal users to the Internet?

A. Both port1 and port2

B. port3

C. port1

D. port2

View the exhibit, which contains a partial output of an IKE real-time debug, and then answer the question below.

Based on the debug output, which phase-1 setting is enabled in the configuration of this VPN?

A. auto-discovery-sender

B. auto-discovery-forwarder

C. auto-discovery-shortcut

D. auto-discovery-receiver

Refer to the exhibit, which contains partial output from an IKE real-time debug.

Why did the tunnel not come up?

A. The local gateway has configured less secure encryption and hashing algorithms compared to the remote gateway.

B. The Diffie-Hellman group does not match on the local and remote gateways.

C. The proposal ID does not match between local and remote gateways.

D. The encapsulation method for phase 2 is set to none on local and remote gateways.