2021 Latest Fortinet NSE7_EFW-6.4 Real Exam Dumps PDF
NSE7_EFW-6.4 Exam Dumps, NSE7_EFW-6.4 Practice Test Questions
Topics of Fortinet NSE7_EFQ-6.4: Fortinet NSE 7 - Enterprise Firewall 6.4 Exam
Following are the objectives and agenda for this certification exam. A detailed practice for these contents could be done via the NSE7 EFW-6.4 practice exams as they are made on the same contents and offer the same environment for students to experience as the real exam does:
System and session troubleshooting
- Security Fabric
- FortiOS architecture
- Implement the Fortinet Security Fabric
- Perform initial configuration
- Traffic and session monitoring
- High availability
Central management
- Central management and analysis using FortiManager and FortiAnalyzer
Content inspection
- Antivirus
- Intrusion Prevention System (IPS)
- FortiGuard
- Web filtering
Routing and Layer 2 switching
- Dynamic routing: OSPF, Border Gateway Protocol (BGP)
- Static routing
VPN
- IPsec
- Autodiscovery VPN (ADVPN)
NEW QUESTION 13
Refer to the exhibit, which contains a TCL script configuration on FortiManager.
An administrator has configured the TCL script onFortiManager, but failed to apply any changes to the managed device after being executed.
Why did the TCL script fail to make any changes to the managed device?
- A. Incomplete commands are ignored in TCL scripts.
- B. The TCL command run_cmd has not been created.
- C. The TCLscript must start with #include <>.
- D. Changes in an interface configuration can only be done by CLI script.
Answer: B
NEW QUESTION 14
Which configuration can be used to reduce the number of BGP sessions in an IBGP network?
- A. Neighbor range
- B. Next-hop-self
- C. Route reflector
- D. Neighbor group
Answer: C
Explanation:
Explanation
Route reflectors help to reduce the number of IBGP sessions inside an AS. A route reflector forwards the routers learned from one peer to the other peers. If you configure route reflectors, you dont' need to create a full mesh IBGP network. All clients in a cluster only talck to route reflector to get sync routing updates. Route reflectors pass the routing updates to other route reflectors and border routers within the AS.
NEW QUESTION 15
The logs in a FSSO collector agent (CA) are showing the following error:
failed to connect to registry: PIKA1026 (192.168.12.232)
What can be the reason for this error?
- A. The remote registry service is not running in the workstation 192.168.12.232.
- B. The FortiGate cannot resolve the name of the workstation.
- C. The CA cannot reach the FortiGate with the IP address192.168.12.232.
- D. The CA cannot resolve the name of the workstation.
Answer: A
Explanation:
Explanation
https://kb.fortinet.com/kb/documentLink.do?externalID=FD30548
NEW QUESTION 16
What is the diagnose test application ipsmonitor 99 command used for?
- A. To restart all IPS engines and monitors
- B. To provide information regarding IPS sessions
- C. To disable the IPS engine
- D. To enable IPS bypass mode
Answer: A
NEW QUESTION 17
An administrator cannot connect to the GIU of a FortiGate unit with the IP address 10.0.1.254. The administrator runs thedebug flow while attempting the connection using HTTP. The output of the debug flow is shown in the exhibit:
Based on the error displayed by the debug flow, which are valid reasons for this problem? (Choose two.)
- A. Redirection of HTTP to HTTPS administrative access is disabled.
- B. HTTP administrative access is disabled in the FortiGate interface with the IP address 10.0.1.254.
- C. HTTP administrative access is configured with a port number different than 80.
- D. The packet is denied because of reverse path forwarding check.
Answer: B,C
NEW QUESTION 18
View the exhibit, which contains the partial output of adiagnose command, and then answer the question below.
Based on the output, which of the following statements is correct?
- A. Quick mode selectors are disabled.
- B. DPD is disabled.
- C. Anti-reply is enabled.
- D. Remote gateway IP is 10.200.5.1.
Answer: C
NEW QUESTION 19
View the exhibit, which contains the output of a diagnose command, and then answer the question below.
What statements are correct regarding the output? (Choose two.)
- A. Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.0.1.10.
- B. Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.200.1.1.
- C. This is anexpected session created by a session helper.
- D. This is an expected session created by an application control profile.
Answer: B,C
NEW QUESTION 20
When using the SSL certificate inspection method for HTTPS traffic, how does FortiGate filter web requests when the browser client does not provide the server name indication (SNI) extension?
- A. FortiGate switches to the full SSL inspection method to decrypt the data.
- B. FortiGate blocks the request without any further inspection.
- C. FortiGate uses the requested URL from the user's web browser.
- D. FortiGate uses CN information from the Subject field in the server's certificate.
Answer: D
NEW QUESTION 21
View the exhibit, which contains the output of a diagnose command, and then answer the question below.
Which statements are true regarding the output in the exhibit? (Choose two.)
- A. FortiGate will probe 121.111.236.179 every fifteen minutes for a response.
- B. Servers with a negative TZ value are experiencing a service outage.
- C. Servers with the D flag are considered to be down.
- D. FortiGate used 209.222.147.3 as the initial server to validate its contract.
Answer: A,D
Explanation:
Explanation
A - because flag is Failed so fortigate will check if server is available every 15 minD-state is I , contact to validate contract info
NEW QUESTION 22
Which statements about bulk configuration changes using FortiManager CLI scripts are correct? (Choose two.)
- A. When executed on the All FortiGate in ADOM, changes are automatically installed without creating a new revision history.
- B. When executed on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.
- C. When executed on the Device Database, you must use the installation wizard to apply the changes to the managed FortiGate.
- D. When executed on the Policy Package, ADOM database, changes are applied directly to the managed FortiGate.
Answer: B,C
Explanation:
Explanation
CLI scripts can be run in three different ways:Device Database: By default, a script is executed on the device database. It is recommend you run the changes on the device database (default setting), as this allows you to check what configuration changes you will send to the managed device. Once scripts are run on the device database, you can install these changes to a managed device using the installation wizard.
Policy Package, ADOM database: If a script contains changes related to ADOM level objects and policies, you can change the default selection to run on Policy Package, ADOM database and can then be installed using the installation wizard.
Remote FortiGate directly (through CLI): A script can be executed directly on the device and you don't need to install these changes using the installation wizard. As the changes are directly installed on the managed device, no option is provided to verify and check the configuration changes through FortiManager prior to executing it.
NEW QUESTION 23
View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.
Which statements about this debug output are correct? (Choose two.)
- A. The remote gateway IP address is 10.0.0.1.
- B. It showsa phase 1 negotiation.
- C. The negotiation is using AES128 encryption with CBC hash.
- D. The initiator has provided remote as its IPsec peer ID.
Answer: B,D
NEW QUESTION 24
Examine the output of the 'get router info ospfneighbor' command shown in the exhibit; then answer the question below.
Which statements are true regarding the output in the exhibit? (Choose two.)
- A. The OSPF routers with the IDs 0.0.0.69 and 0.0.0.117 are both designated routers for the wan1 network.
- B. The OSPF router with the ID 0.0.0.2is the designated router for the ToRemote network.
- C. The interface ToRemote is OSPF network type point-to-point.
- D. The local FortiGate is the backup designated router for the wan1 network.
Answer: C,D
Explanation:
Explanation
https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/13685-13.html
NEW QUESTION 25
Examine the output of the 'diagnose debug rating' command shown in the exhibit; then answer the question below.
Which statement are true regarding the output in the exhibit? (Choose two.)
- A. There are three FortiGuard serversthat are not responding to the queries sent by the FortiGate.
- B. FortiGate will send the FortiGuard queries to the server withhighest weight.
- C. The TZ value represents the delta between each FortiGuard server's time zone and the FortiGate's time zone.
- D. A server's round trip delay (RTT) is not used to calculate its weight.
Answer: B,C
NEW QUESTION 26
A FortiGate device hasthe following LDAP configuration:
The administrator executed the 'dsquery' command in the Windows LDAp server 10.0.1.10, and got the following output:
>dsquery user -samid administrator
"CN=Administrator, CN=Users, DC=trainingAD, DC=training, DC=lab"
Based on the output, what FortiGate LDAP setting is configured incorrectly?
- A. dn.
- B. password.
- C. username.
- D. cnid.
Answer: C
Explanation:
Explanation
https://kb.fortinet.com/kb/viewContent.do?externalId=FD37516
NEW QUESTION 27
An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer.If the administrator knows that there is no NAT device located between both FortiGates, what command should the administrator execute?
- A. diagnose sniffer packet any 'udp port 500'
- B. diagnose sniffer packet any 'udp port 500 or udp port 4500'
- C. diagnose snifferpacket any 'esp'
- D. diagnose sniffer packet any 'udp port 4500'
Answer: C
Explanation:
Explanation
Capture IKE Traffic without NAT:diagnose sniffer packet 'host and udp port 500'
--------------------------------------Capture ESP
Traffic without NAT:diagnose sniffer packet any 'host and esp'
--------------------------------------Capture IKE
and ESP with NAT-T:diagnose sniffer packet any 'host and (udp port 500 or udp port 4500)'
NEW QUESTION 28
View these partial outputs from two routing debug commands:
Which outbound interface will FortiGate use to route webtraffic from internal users to the Internet?
- A. port3
- B. Both port1 and port2
- C. port2
- D. port1
Answer: D
NEW QUESTION 29
View the exhibit, which contains theoutput of get sys ha status, and then answer the question below.
Which statements are correct regarding the output? (Choose two.)
- A. The slave configuration is not synchronized with the master.
- B. port 7 is used the HA heartbeat on all devices in the cluster.
- C. The HA management IP is 169.254.0.2.
- D. Master is selected because it is the only device in the cluster.
Answer: A,B
NEW QUESTION 30
Which of the following conditions must be met fora static route to be active in the routing table? (Choose three.)
- A. The next-hop IP address belongs to one of the outgoing interface subnets.
- B. The link health monitor (if configured) is up.
- C. The outgoing interface is up.
- D. There is no other route, to the same destination, with a higher distance.
- E. The next-hop IP address is up.
Answer: A,B,C
Explanation:
Explanation
A configured static route only goes to routing table from routing database when all the following are met :
* The outgoing interface is up
* There isno other matching route with a lower distance
* The link health monitor (if configured) is successful
* The next-hop IP address belongs to one of the outgoing interface subnets
NEW QUESTION 31
Which two conditions must be met for a statistic route to be active in the routing table? (Choose two.)
- A. The link health monitor (if configured) is up.
- B. The outgoing interface is up.
- C. The next-hop IP address is up.
- D. There is no other route, to the same destination, with a higherdistance.
Answer: A,B
NEW QUESTION 32
Which real time debug should an administrator enable to troubleshoot RADIUS authentication problems?
- A. Diagnose debug application fnbamd -1.
- B. Diagnose radius console -log enable.
- C. Diagnose debug application radius -1.
- D. Diagnose authd console -log enable.
Answer: A
Explanation:
Explanation
https://kb.fortinet.com/kb/documentLink.do?externalID=FD32838
NEW QUESTION 33
Examine the output from the 'diagnose vpn tunnel list' command shown in the exhibit; then answer the question below.
Which command can beused to sniffer the ESP traffic for the VPN DialUP_0?
- A. diagnose sniffer packet any 'esp'
- B. diagnose sniffer packet any 'port 500'
- C. diagnose sniffer packet any 'port 4500'
- D. diagnose sniffer packet any 'host 10.0.10.10'
Answer: C
Explanation:
Explanation
NAT-Tis enabled. natt: mode=silentProtocol ESP is used. ESP is encapsulated in UDP port 4500 when NAT-T is enabled.
NEW QUESTION 34
......
What is the duration, language, and format of the Fortinet NSE7_EFQ-6.4: Fortinet NSE 7 - Enterprise Firewall 6.4 Exam
- Examination platform: Online proctored
- Number of questions: 30
- Language of Exam: English and Japanese
- Duration of Exam: 60 minutes
PDF (New 2021) Actual Fortinet NSE7_EFW-6.4 Exam Questions: https://www.actual4exams.com/NSE7_EFW-6.4-valid-dump.html
Dumps Moneyack Guarantee - NSE7_EFW-6.4 Dumps UpTo 90% Off: https://drive.google.com/open?id=1uSENYSG9G8bnyPNVjkctlrGxCL8gcIQa