Fortinet NSE7_EFW-7.0 問題集

質問 1：
View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.

The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel. To diagnose, the administrator enters these CLI commands:

However, the IKE real time debug does not show any output. Why?
A. The debug shows only error messages. If there is no output, then the tunnel is operating normally.
B. The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.
C. The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.
D. The log-filter setting was set incorrectly. The VPN's traffic does not match this filter.
正解：D

質問 2：
Refer to the exhibit, which shows the output of a BGP debug command.

What can be concluded about the router in this scenario?
A. The State/PfxRcd for neighbor 100.64.3.1 will not change until an administrator on the local router adjusts the inbound route filtering so that prefixes received can be added to the RIB.
B. All of the neighbors displayed are part of a single BGP configuration on the local router with the neighbor-range set to a value of 4.
C. The BGP session with peer 10.127.0.75 is up.
D. The router 100.64.3.1 needs to update the local AS number in its BGP configuration in order to bring up the BGP session with the local router.
正解：C

質問 3：
Examine the output of the 'get router info ospf interface' command shown in the exhibit; then answer the question below.

Which statements are true regarding the above output? (Choose two.)
A. Two OSPF routers are down in the port4 network.
B. The local FortiGate has been elected as the OSPF backup designated router.
C. The port4 interface is connected to the OSPF backbone area.
D. There are at least 5 OSPF routers connected to the port4 network.
正解：C,D
解説: (Topexam メンバーにのみ表示されます)

質問 4：
View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

Which statements about this debug output are correct? (Choose two.)
A. It shows a phase 1 negotiation.
B. The initiator has provided remote as its IPsec peer ID.
C. The negotiation is using AES128 encryption with CBC hash.
D. The remote gateway IP address is 10.0.0.1.
正解：A,B

質問 5：
View the exhibit, which contains the output of a BGP debug command, and then answer the question below.

Which of the following statements about the exhibit are true? (Choose two.)
A. Since the counters were last reset; the 10.200.3.1 peer has never been down.
B. The local router has not established a TCP session with 100.64.3.1.
C. The local router's BGP state is Established with the 10.125.0.60 peer.
D. The local router has received a total of three BGP prefixes from all peers.
正解：B,C

質問 6：
Refer to the exhibits.

Which contain the partial configurations of two VPNs on FortiGate.
An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovered that FortiGate is not matching the user-2 VPN for members of the Users-2 group.
Which two changes must administrator make to fix the issue? (Choose two.)
A. Set up specific peer IDs on both VPNs.
B. Change to aggressive mode on both VPNs.
C. Enable Mode Config on both VPNs.
D. Use different pre-shared keys on both VPNs
正解：A,B
解説: (Topexam メンバーにのみ表示されます)

質問 7：
Examine the output from the 'diagnose debug authd fsso list' command; then answer the question below.
# diagnose debug authd fsso list -FSSO logons-IP: 192.168.3.1 User: STUDENT Groups: TRAININGAD/USERS Workstation: INTERNAL2. TRAINING. LAB The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.
What should the administrator check?
A. The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2. TRAINING. LAB.
B. The IP address recorded in the logon event for the user STUDENT.
C. The reserve DNS lookup forthe IP address 192.168.3.1.
D. The DNS name resolution for the workstation name INTERNAL2. TRAINING. LAB.
正解：A

質問 8：
Refer to the exhibit, which shows the output of a debug command.

What can be concluded from the debug command output?
A. There are more than two OSPF routers on the wan2 network.
B. The interface ToRemote is a broadcast OSPF network.
C. The OSPF router with the ID 0.0.0.69 has its OSPF priority set to 0.
D. The local FortiGate has a different MTU value from the OSPF router with ID 0.0.0.2, based on the state information.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 9：
View the central management configuration shown in the exhibit, and then answer the question below.

Which server will FortiGate choose for antivirus and IPS updates if 10.0.1.243 is experiencing an outage?
A. 10.0.1.244
B. One of the public FortiGuard distribution servers
C. 10.0.1.240
D. 10.0.1.242
正解：B