NSE7 Enterprise Firewall - FortiOS 5.4 (NSE7) Free Practice Test

Question 1

View the exhibit, which contains the output of a diagnose command, and then answer the question below.

What statements are correct regarding the output? (Choose two.)

A. This is an expected session created by a session helper.

B. Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.0.1.10.

C. This is an expected session created by an application control profile.

D. Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.200.1.1.

Correct Answer: A,D

Question 2

What does the dirty flag mean in a FortiGate session?

A. The session must be removed from the former primary unit after an HA failover.

B. The next packet must be re-evaluated against the firewall policies.

C. Traffic has been identified as from an application that is not allowed.

D. Traffic has been blocked by the antivirus inspection.

Correct Answer: B

Question 3

When using the SSL certificate inspection method for HTTPS traffic, how does FortiGate filter web requests when the browser client does not provide the server name indication (SNI)?

A. FortiGate uses the requested URL from the user's web browser.

B. FortiGate switches to the full SSL inspection method to decrypt the data.

C. FortiGate blocks the request without any further inspection.

D. FortiGate uses the Issued To: field in the server's certificate.

Correct Answer: A

Question 4

An administrator has configured a FortiGate device with two VDOMs: root and internal. The administrator has also created and inter-VDOM link that connects both VDOMs. The objective is to have each VDOM advertise some routes to the other VDOM via OSPF through the inter-VDOM link. What OSPF configuration settings must match in both VDOMs to have the OSPF adjacency successfully forming? (Choose three.)

A. OSPF interface MTU.

B. OSPF interface area.

C. Interface subnet mask.

D. OSPF interface cost.

E. Router ID.

Correct Answer: A,B,C

Question 5

Examine the following traffic log; then answer the question below.
date-20xx-02-01 time=19:52:01 devname=master device_id="xxxxxxx" log_id=0100020007 type=event subtype=system pri critical vd=root service=kemel status=failure msg="NAT port is exhausted." What does the log mean?

A. FortiGate does not have any available NAT port for a new connection.

B. The limit for the maximum number of simultaneous sessions sharing the same NAT port has been reached.

C. The limit for the maximum number of entries in the NAT port table has been reached.

D. There is not enough available memory in the system to create a new entry in the NAT port table.

Correct Answer: B

Question 6

Examine the output of the 'get router info bgp summary' command shown in the exhibit; then answer the question below.

Which statements are true regarding the output in the exhibit? (Choose two.)

A. The local BGP peer has received a total of 3 BGP prefixes.

B. BGP state of the peer 10.125.0.60 is Established.

C. Local BGP peer has not received an OpenConfirm from 10.200.3.1.

D. BGP peer 10.200.3.1 has never been down since the BGP counters were cleared.

Correct Answer: B,C

Question 7

Examine the output of the 'get router info ospf interface' command shown in the exhibit; then answer the question below.

Which statements are true regarding the above output? (Choose two.)

A. The local FortiGate has been elected as the OSPF backup designated router.

B. The port4 interface is connected to the OSPF backbone area.

C. There are at least 5 OSPF routers connected to the port4 network.

D. Two OSPF routers are down in the port4 network.

Correct Answer: B,D

Question 8

Which of the following conditions must be met for a static route to be active in the routing table? (Choose three.)

A. The link health monitor (if configured) is up.

B. There is no other route, to the same destination, with a higher distance.

C. The next-hop IP address belongs to one of the outgoing interface subnets.

D. The next-hop IP address is up.

E. The outgoing interface is up.

Correct Answer: B,D,E

Question 9

View the exhibit, which contains the output of diagnose sys session list, and then answer the question below.

If the HA ID for the primary unit is zero (0), which statement is correct regarding the output?

A. The inspection of this session has been offloaded to the slave unit.

B. This session cannot be synced with the slave unit.

C. This session is for HA heartbeat traffic.

D. This session is synced with the slave unit.

Correct Answer: D

Welcome to TestSimulate

Fortinet NSE7 Enterprise Firewall - FortiOS 5.4 (NSE7) Free Practice Test