Fortinet FCSS_NST_SE-7.4 問題集

質問 1：
Refer to the exhibit, which shows the output of get router info ospf neighbor.

What can you conclude from the command output?
A. The local FortiGate is not a DROther.
B. All neighbors are in area 0.0.0.0.
C. The local FortiGate is the BDR.
D. The network type connecting the local Fortigate and OSPF neighbor 0.0.0.10 is point-to-point.
正解：D

質問 2：
Refer to the exhibit, which shows the partial output of a diagnose command.

Which two conclusions can you draw from the output shown in the exhibit? (Choose two.)
A. The session is checked against firewall policy ID 25.
B. This is a pinhole session to allow traffic for a TCP protocol that dynamically assigns TCP ports.
C. FortiGate will drop the expected traffic if it does not arrive within 23 seconds.
D. Clearing the master session has no impact on the expectation session.
正解：B,C

質問 3：
Refer to the exhibit, which shows the output of get router info bgp summary.

Which two statements are true? (Choose two.)
A. The local ForliGate has received one prefix from BGP neighbor 100.64.1.254.
B. The local FortiGate has received 18 packets from a BGP neighbor.
C. The TCP connection with BGP neighbor 100.64.2.254 was successful.
D. The local FortiGate is still calculating the prefixes received from BGP neighbor 100.64.2.264
正解：A,B

質問 4：
In the SAML negotiation process, which section does the Identity Provider (IdP) provide the SAML attributes utilized in the authentication process to the Service Provider (SP)?
A. Authentication Response
B. Assertion dump
C. Authentication Request
D. SP Login dump
正解：B

質問 5：
In which two slates is a given session categorized as ephemeral? (Choose two.)
A. A UDP session with only one packet received
B. A TCP session waiting for the SYN ACK
C. A TCP session waiting for FIN ACK
D. A UOP session with packets sent and received
正解：A,B

質問 6：
Exhibit.

Refer to the exhibit, which contains a screenshot of some phase 1 settings.
The VPN is not up. To diagnose the issue, the administrator enters the following CLI commands on an SSH session on FortiGate:

However, the IKE real-time debug does not show any output. Why?
A. Replace diagnose debug application ike -1 with diagnose debug application ipsec -1.
B. The administrator must also run the command diagnose debug enable.
C. The log-filter setting is incorrect. The VPN traffic does not match this filter.
D. The debug shows only error messages. If there is no output, then the phase 1 and phase 2 configurations match.
正解：B

質問 7：
Refer to the exhibit, which shows one way communication of the downstream FortiGate with the upstream FortiGate within a Security Fabric.

What three actions must you take to ensure successful communication? (Choose three.)
A. Ensure TCP port 8013 is not blocked along the way.
B. You must authorize the downstream FortiGate on the root FortiGate.
C. You must enable Security Fabric/Fortitelemetry on the receiving interface of the upstream FortiGate.
D. Ensure the port for Neighbor Discovery has been changed.
E. FortiGate must not be in NAT mode.
正解：A,B,C