Fortinet NSE7_EFW-6.4 問題集

質問 1：
A FortiGate has two default routes:

All Internet traffic is currently using port1. The exhibit shows partial information for one sample session of Internet traffic from an internal user:

What would happen with the traffic matching the above session if the priority on the first default route (IDd1) were changed from 5 to 20?
A. The session would remain in the session table, and its traffic would start to egress from port2.
B. The session would remain in the session table, but its traffic would now egress from both port1 and port2.
C. The session would remain in the session table, and its traffic would still egress from port1.
D. The session would be deleted, and the client would need to start a new session.
正解：C

質問 2：
An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage. However, after the changes, one network application started to have problems. During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets, and before the arrival of the SYN/ACKs. When the SYN/ACK packets arrive to the FortiGate, the unit has already deleted the respective sessions. Which TCP session timer must be increased to fix this problem?
A. TCP time wait.
B. TCP session time to live.
C. TCP half open.
D. TCP half close.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Which statement about NGFW policy-based application filtering is true?
A. FortiGate will drop all packets until the application can be identified.
B. The IPS security profile is the only security option you can apply to the security policy with the action set to ACCEPT.
C. After the application has been identified, the kernel uses only the Layer 4 header to match the traffic.
D. After IPS identifies the application, it adds an entry to a dynamic ISDB table.
正解：A

質問 4：
Four FortiGate devices configured for OSPF connected to the same broadcast domain. The first unit is elected as the designated router The second unit is elected as the backup designated router Under normal operation, how many OSPF full adjacencies are formed to each of the other two units?
A. 2
B. 3
C. 4
D. 1
正解：A

質問 5：
Refer to the exhibit, which contains partial outputs from two routing debug commands.

Why is the port2 default route not in the second command's output?
A. It is disabled in the FortiGate configuration.
B. It has a higher distance than the default route using port1.
C. It has a lower priority value than the default route using port1.
D. It has a higher priority value than the default route using port1.
正解：B

質問 6：
View the exhibit, which contains a partial routing table, and then answer the question below.

Assuming all the appropriate firewall policies are configured, which of the following pings will FortiGate route? (Choose two.)
A. Source IP address 10.73.9.10, Destination IP address 10.72.3.15.
B. Source IP address 10.1.0.24, Destination IP address 10.72.3.20.
C. Source IP address 10.72.3.52, Destination IP address 10.1.0.254.
D. Source IP address 10.72.3.27, Destination IP address 10.1.0.52.
正解：C,D

質問 7：
When does a RADIUS server send an Access-Challenge packet?
A. The server requires more information from the user, such as the token code for two-factor authentication.
B. The server does not have the user credentials yet.
C. The user credentials are wrong.
D. The user account is not found in the server.
正解：A