Study Online NSE7_EFW-7.2 Exam Dumps to Pass

NSE7_EFW-7.2 dumps questions can help you identify areas where you need to focus your studies. As you answer questions, you will be able to see which topics you are comfortable with and which ones you need to spend more time studying. Fortinet NSE7_EFW-7.2 dumps questions provide realistic practice for the certification exam. NSE7_EFW-7.2 dumps are designed to simulate the actual exam environment, and they will give you a chance to practice answering questions under time pressure. Study free Fortinet NSE7_EFW-7.2 online dumps below.

Page 1 of 2

1. Exhibit.





Refer to the exhibit, which contains an active-active toad balancing scenario.

During the traffic flow the primary FortiGate forwards the SYN packet to the secondary FortiGate.

What is the destination MAC address or addresses when packets are forwarded from the primary FortiGate to the secondary FortiGate?

Secondary physical MAC port1

Secondary virtual MAC port1

Secondary virtual MAC port1 then physical MAC port1

Secondary physical MAC port2 then virtual MAC port2

 Loading...

2. Which statement about network processor (NP) offloading is true?

For TCP traffic FortiGate CPU offloads the first packets of SYN/ACK and ACK of the three-way handshake to NP

The NP provides IPS signature matching

You can disable the NP for each firewall policy using the command np-acceleration st to loose.

The NP checks the session key or IPSec SA

 Loading...

3. Refer to the exhibit, which shows two configured FortiGate devices and peering over FGSP.





The main link directly connects the two FortiGate devices and is configured using the set session-syn-dev command.

What is the primary reason to configure the main link?

A. To have both sessions and configuration synchronization in layer 2

B. To load balance both sessions and configuration synchronization between layer 2 and 3

C. To have only configuration synchronization in layer 3

D. To have both sessions and configuration synchronization in layer 3

 Loading...

4. You want to improve reliability over a lossy IPSec tunnel.

Which combination of IPSec phase 1 parameters should you configure?

fec-ingress and fec-egress

Odpd and dpd-retryinterval

fragmentation and fragmentation-mtu

keepalive and keylive

 Loading...

5. Exhibit.





Refer to the exhibit, which shows an ADVPN network.

The client behind Spoke-1 generates traffic to the device located behind Spoke-2.

Which first message floes the hub send to Spoke-110 bring up the dynamic tunnel?

Shortcut query

Shortcut reply

Shortcut offer

Shortcut forward

 Loading...

6. Exhibit.





Refer to the exhibit, which contains the partial ADVPN configuration of a spoke.

Which two parameters must you configure on the corresponding single hub? (Choose two.)

Set auto-discovery-sender enable

Set ike-version 2

Set auto-discovery-forwarder enable

Set auto-discovery-receiver enable

 Loading...

7. You created a VPN community using VPN Manager on FortiManager. You also added gateways to the VPN community. Now you are trying to create firewall policies to permit traffic over the tunnel however, the VPN interfaces do not appear as available options.

Create interface mappings for the IPsec VPN interfaces before you use them in a policy.

Refresh the device status using the Device Manager so that FortiGate populates the IPSec interfaces

Configure the phase 1 settings in the VPN community that you didnt initially configure. FortiGate automatically generates the interfaces after you configure the required settings

install the VPN community and gateway configuration on the fortiGate devices so that the VPN interfaces appear on the Policy Objects on fortiManager.

 Loading...

8. Refer to the exhibit, which shows an SSL certification inspection configuration.





Which action does FortiGate take if the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate?

FortiGate uses the first entry listed in the SAN field in the server certificate

FortiGate uses the CN information from the Subject field in the server certificate

FortiGate uses the SNI from the user's web browser.

FortiGate closes the connection because this represents an invalid SSL/TLS configuration

 Loading...

9. What are two functions of automation stitches? (Choose two.)

Automation stitches can be created to run diagnostic commands and email the results when CPU or memory usage exceeds specified thresholds.

An automation stitch configured to execute actions in parallel can be set to insert a specific delay between actions.

Automation stitches can be configured on any FortiGate device in a Security Fabric environment.

An automation stitch configured to execute actions sequentially can take parameters from previous actions as input for the current action.

 Loading...

10. Refer to the exhibit, which shows a routing table.





What two options can you configure in OSPF to block the advertisement of the 10.1.10.0 prefix? (Choose two.)

Remove the 16.1.10.C prefix from the OSPF network

Configure a distribute-list-out

Configure a route-map out

Disable Redistribute Connected

 Loading...

Page 2 of 2

11. An administrator has configured two fortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device.

What can the administrator do to fix this problem?

Verify that the speed and duplex settings match between me FortiGate interfaces and the connected switch ports

Configure set link -failed signal enable under-config system ha on both Cluster members

Configure remote Iink monitoring to detect an issue in the forwarding path

Configure set send-garp-on-failover enables under config system ha on both cluster members

 Loading...

12. Winch two statements about ADVPN are true? (Choose two)

auto-discovery receiver must be set to enable on the Spokes.

Spoke to-spoke traffic never goes through the hub

lt supports NAI for on-demand tunnels

Routing is configured by enabling add-advpn-route

 Loading...

13. You want to block access to the website ww.eicar.org using a custom IPS signature.

Which custom IPS signature should you configure?

A)





B)





C)





D)

Option A

Option B

Option C

Option D

 Loading...

14. Refer to the exhibit, which shows config system central-management information.





Which setting must you configure for the web filtering feature to function?

Add server. fortiguard. net to the server list.

Configure securewf.fortiguard. net on the default servers.

Set update-server-location to automatic.

Configure server-type with the rating option.

 Loading...

15. Exhibit.





Refer to the exhibit, which contains the partial interface configuration of two FortiGate devices.

Which two conclusions can you draw from this con figuration? (Choose two)

10.1.5.254 is the default gateway of the internal network

On failover new primary device uses the same MAC address as the old primary

The VRRP domain uses the physical MAC address of the primary FortiGate

By default FortiGate B is the primary virtual router

 Loading...

16. Refer to the exhibit, which contains a partial OSPF configuration.





What can you conclude from this output?

Neighbors maintain communication with the restarting router.

The router sends grace LSAs before it restarts.

FortiGate restarts if the topology changes.

The restarting router sends gratuitous ARP for 30 seconds.

 Loading...

17. Exhibit.





Refer to the exhibit, which contains a partial VPN configuration.

What can you conclude from this configuration1?

FortiGate creates separate virtual interfaces for each dial up client.

The VPN should use the dynamic routing protocol to exchange routing information Through the tunnels.

Dead peer detection s disabled.

The routing table shows a single IPSec virtual interface.

 Loading...

18. Refer to the exhibit, which contains a TCL script configuration on FortiManager.





An administrator has configured the TCL script on FortiManager, but the TCL script failed to apply any changes to the managed device after being run.

Why did the TCL script fail to make any changes to the managed device?

The TCL procedure run_cmd has not been created.

The TCL script must start with #include.

There is no corresponding #! to signify the end of the script.

The TCL procedure lacks the required loop statements to iterate through the changes.

 Loading...

19. While configuring the BGP protocol, an administrator applies the set netuork-inport-check disable command under config network.

What will FortiGate do as a result of this command?

FortiGate will advertise only the corresponding prefixes in the BGP network table to its BGP neighbor, even if itis not in the routing table.

FortiGate will advertise all the prefixes in the BGP network table to its BGP neighbor, even f itis not in the routing table.

FortiGate will not advertise any imported routes received from one BGP neighbor to another.

FortiGate will not advertise the prefixes, if it is not in the routing table.

 Loading...

20. Refer to the exhibit, which shows an error in system fortiguard configuration.





What is the reason you cannot set the protocol to udp in config system fortiguard?

FortiManager provides FortiGuard.

fortiguard-anycast is set to enable.

You do not have the corresponding write access.

udp is not a protocol option.

 Loading...

 Loading...