Latest NSE7_EFW-7.2 Actual Free Exam Questions Updated 82 Questions [Q34-Q55]

Rate this post

Latest NSE7_EFW-7.2 Actual Free Exam Questions Updated 82 Questions

Free NSE7_EFW-7.2 Exam Braindumps certification guide Q&A

Fortinet NSE7_EFW-7.2 Exam Syllabus Topics:

Topic	Details
Topic 1	Routing: It covers implementing OSPF to route enterprise traffic and Border Gateway Protocol (BGP) to route enterprise traffic.
Topic 2	System configuration: This topic discusses Fortinet Security Fabric and hardware acceleration. Furthermore, it delves into configuring various operation modes for an HA cluster.
Topic 3	Central management: The topic of Central management covers implementing central management.
Topic 4	Security profiles: Using FortiManager as a local FortiGuard server is discussed in this topic. Moreover, it delves into configuring web filtering, application control, and the intrusion prevention system (IPS) in an enterprise network.
Topic 5	VPN: Implementing IPsec VPN IKE version 2 is discussed in this topic. Additionally, it delves into implementing auto-discovery VPN (ADVPN) to enable on-demand VPN tunnels between sites.

NO.34 Which statement about network processor (NP) offloading is true?

For TCP traffic FortiGate CPU offloads the first packets of SYN/ACK and ACK of the three-way handshake to NP

The NP provides IPS signature matching

You can disable the NP for each firewall policy using the command np-acceleration st to loose.

The NP checks the session key or IPSec SA

NO.35 Refer to the exhibit, which contains a partial BGP combination.

You want to configure a loopback as the OGP source.
Which two parameters must you set in the BGP configuration? (Choose two)

ebgp-enforce-multihop

recursive-next-hop

ibgp-enfoce-multihop

update-source

NO.36 Refer to the exhibit which shows an OSPF network.

Which types of link-state advertisements (LSA) will NGFW-1 send if it is a backup designated router (BDR)

NGFW-1 will send type 1 and type 2 LSAs

NGFW-1 will send type 1 and type 4 LSAs.

NGFW-1 will send type 1 and type 3 LSAs

NGFW-1 will send type 1 and type 5 LSAs

NO.37 Refer to the exhibit, which shows a network diagram.

Which protocol should you use to configure the FortiGate cluster?

FGCP in active-passive mode

OFGSP

VRRP

FGCP in active-active mode

NO.38 An administrator configured the following command on FortiGate
config router ospf
sec reszart-mode graceful-restart
Which two statements correctly describe the result of the above command? (Choose two.)

FortiGate is configured with graceful restart and will exit graceful mode, if the network topology changes

After the default 40 seconds wait time the OSPF neighbors will resume communication with the restarting router

The OSPF neighbor that receives the grace link-state advertisement (LSA) will enter into helper mode

In an HA cluster FortiGate devices will keep the OSPF routes in their routing table to avoid traffic interruption during an HA failover

NO.39 Refer to the exhibit, which shows a partial routing table.

What two conclusions can you draw from the FortiGate output shown in the exhibit? (Choose two.)

FortiGate creates separate virtual interfaces for each VPN client.

add-route is enabled in the tunnel IPSec phase 1 configuration.

FortiGate is not using the destination subnets of the quick mode selectors to populate the routing table.

net-device is disabled in the tunnel IPSec phase 1 configuration.

NO.40 Refer to the exhibit, which contains information about an IPsec VPN tunnel.

What two conclusions can you draw from the command output? (Choose two.)

Dead peer detection is set to enable.

The IKE version is 2.

Both IPsec SAs are loaded on the kernel.

Forward error correction in phase 2 is set to enable.

NO.41 Refer to the exhibit.

which contains a partial configuration of the global system. What can you conclude from this output?

NPs and CPs are enabled

Only CPs arc disabled

Only NPs are disabled

NPs and CPs arc disabled

NO.42 Which two statements about metadata variables are true? (Choose two.)

You create them on FortiGate

They apply only to non-firewall objects.

The metadata format is $<metadata_variabie_name>.

They can be used as variables in scripts

NO.43 Exhibit.

Refer to the exhibit, which contains a partial policy configuration.
Which setting must you configure to allow SSH?

Specify SSH in the Service field

Configure pot 22 in the Protocol Options field.

Include SSH in the Application field

Select an application control profile corresponding to SSH in the Security Profiles section

NO.44 Refer to the exhibit, which shows a custom signature.

Which two modifications must you apply to the configuration of this custom signature so that you can save it on FortiGate? (Choose two.)

Add severity.

Add attack_id.

Ensure that the header syntax is F-SBID.

Start options with –.

NO.45 Which two statements about the Security fabric are true? (Choose two.)

FortiGate uses the FortiTelemetry protocol to communicate with FortiAnatyzer.

Only the root FortiGate sends logs to FortiAnalyzer

Only FortiGate devices with configuration-sync receive and synchronize global CMDB objects that the toot FortiGate sends

Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer

NO.46 You want to improve reliability over a lossy IPSec tunnel.
Which combination of IPSec phase 1 parameters should you configure?

fec-ingress and fsc-egrsss

dpd and dpd-retryinterval

fragmentation and fragmentation-mtu

keepalive and keylive

NO.47 Exhibit.

Refer to the exhibit, which contains a partial VPN configuration.
What can you conclude from this configuration1?

FortiGate creates separate virtual interfaces for each dial up client.

The VPN should use the dynamic routing protocol to exchange routing information Through the tunnels.

Dead peer detection s disabled.

The routing table shows a single IPSec virtual interface.

NO.48 Refer to the exhibit, which contains information about an IPsec VPN tunnel.

What two conclusions can you draw from the command output? (Choose two.)

Dead peer detection is set to enable.

The IKE version is 2.

Both IPsec SAs are loaded on the kernel.

Forward error correction in phase 2 is set to enable.

NO.49 An administrator is configuring two FortiGate devices in an HA cluster. While configuring the devices, the administrator issues the following commands on both HA cluster members:

In which two ways do these commands impact the HA cluster? (Choose two.)

They force the former primary to send gratuitous ARP packets when the failover happens to indicate that the virtual MAC address is now using a different device.

They force the former primary to shut down all ts interfaces for one second when failover happens, excluding the heartbeat and reserved management interfaces.

They force both HA devices for remote link monitoring to detect an issue in the forwarding path.

They force the switches to update their MAC forwarding tables, when failover happens.

NO.50 Which two statements about ADVPN are true? (Choose two.)

You must disable add-route in the hub.

AllFortiGate devices must be in the same autonomous system (AS).

The hub adds routes based on IKE negotiations.

You must configure phase 2 quick mode selectors to 0.0.0.0 0.0.0.0.

NO.51 Which statement about network processor (NP) offloading is true?

When NP acceleration is enabled, firewall sessions may not offload if proxy-based security profiles are included in the firewall policy.

You can disable the NP for each firewall policy using the command np-acceleration set to loose.

The FortiGate CPU offloads all firewall sessions that require FortiOS session helper to the network processing unit (NPU).

For UDP traffic, the FortiGate CPU offloads the first packet to identify it as fast-path traffic.

NO.52 Exhibit.

Refer to the exhibit, which shows an ADVPN network.
The client behind Spoke-1 generates traffic to the device located behind Spoke-2.
Which first message floes the hub send to Spoke-110 bring up the dynamic tunnel?

Shortcut query

Shortcut reply

Shortcut offer

Shortcut forward

NO.53 Refer to the exhibit, which shows the output of a BGP summary.

What two conclusions can you draw from this BGP summary? (Choose two.)

External BGP (EBGP) exchanges routing information.

The BGP session with peer 10. 127. 0. 75 is established.

The router 100. 64. 3. 1 has the parameter bfd set to enable.

The neighbors displayed are linked to a local router with the neighbor-range set to a value of 4.

NO.54 Which two statements about the neighbor-group command are true? (Choose two.)

You can configure it on the GUI.

It applies common settings in an OSPF area.

It is combined with the neighbor-range parameter.

You can apply it in Internal BGP (IBGP) and External BGP (EBGP).

NO.55 An administrator has created a VPN community within VPN Manager on FortiManager. They also added gateways to the VPN community and are now trying to create firewall policies to permit traffic over the tunnel; however, the VPN interfaces are not listed as available options.
What step must the administrator take to resolve this issue?

Install the VPN community and gateway configuration to the FortiGate devices, in order for the interfaces to be displayed within Policy & Objects on FortiManager

Set up all of the phase 1 settings in the VPN community that they neglected to set up initially. The interfaces will be automatically generated after the administrator configures all of the required settings.

Refresh the device status from the Device Manager so that FortiGate will populate the IPsec interfaces.

Create interface mappings for the IPsec VPN interfaces, before they can be used in a policy.

NSE7_EFW-7.2 Certification Overview Latest NSE7_EFW-7.2 PDF Dumps: https://www.prepawaytest.com/Fortinet/NSE7_EFW-7.2-practice-exam-dumps.html

Fortinet NSE7_EFW-7.2 Exam Syllabus Topics:

Leave a Reply Cancel reply