Fortinet NSE7_SDW-7.2 問題集

質問 1：
Refer to the exhibits.

Exhibit A shows two IPsec templates to define Branch_IPsec_1 and Branch_IPsec_2. Each template defines a VPN tunnel.
Exhibit B shows the error message that FortiManager displayed when the administrator tried to assign the second template to the FortiGate device.
Which statement best explain the cause for this issue?
A. You can define only one IPsec tunnel from branch devices to HUB1.
B. You should review the branch1_fgt configuration for the already configured tunnel with the name HUB1-VPN2.
C. You can assign only one IPsec template to each FortiGate device.
D. You can assign only one template with a tunnel of fype static to each FortiGate device
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 2：
Refer to the exhibit.

Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2.
Which two configuration settings are required for Toronto and London spokes to establish an ADVPN shortcut? (Choose two.)
A. On the spokes, auto-discovery-receiver must be enabled on the IPsec VPN to the hub.
B. auto-discovery-forwarder must be enabled on all IPsec VPNs.
C. On the hubs, auto-discovery-sender must be enabled on the IPsec VPNs to spokes.
D. On the hubs, net-device must be enabled on all IPsec VPNs.
正解：A,C

質問 3：
Refer to the exhibits.
Exhibit A -

Exhibit B -

Exhibit A shows a site-to-site topology between two FortiGate devices: branch1_fgt and dc1_fgt. Exhibit B shows the system global and system settings configuration on dc1_fgt.
When branch1_client establishes a connection to dc1_host, the administrator observes that, on dc1_fgt, the reply traffic is routed over T_INET_0_0, even though T_INET_1_0 is the preferred member in the matching SD-WAN rule.
Based on the information shown in the exhibits, what configuration change must be made on dc1_fgt so dc1_fgt routes the reply traffic over T_INET_1_0?
A. Disable allow-subnet-overlap under config system settings.
B. Enable auxiliary-session under config system settings.
C. Enable snat-route-change under config system global.
D. Disable t#p-session-without-syn under config system settings.
正解：B

質問 4：
Refer to the exhibit.

The exhibit shows the details of a session and the index numbers of some relevant interfaces on a FortiGate appliance that supports hardware offloading. Based on the information shown in the exhibits, which two statements about the session are true? (Choose two.)
A. The auxiliary session can be offloaded to hardware.
B. The reply direction of the asymmetric traffic flows from port2 to port3.
C. The original direction of the symmetric traffic flows from port3 to port2.
D. The main session cannot be offloaded to hardware.
正解：A,B

質問 5：
Refer to the exhibit.

Which conclusion about the packet debug flow output is correct?
A. The reply traffic exceeded the maximum bandwidth configured in the traffic shaper, and the packet was dropped.
B. The original traffic exceeded the maximum packets per second of the outgoing interface, and the packet was dropped.
C. The original traffic exceeded the maximum bandwidth of the outgoing interface, and the packet was dropped.
D. The original traffic exceeded the maximum bandwidth configured in the traffic shaper, and the packet was dropped.
正解：D