Q5_NSE7

Question 1

One firewall policy in an enterprise firewall is essentially used for IPS. Which configuration must the administrator check in this firewall policy to validate optimum performance for IPS?

Accepted Answer

D. set np-acceleration enable

Answer

A. set cp-accel-mode enable

Answer

B. set inspection-mode proxy

Answer

C. set offload enable

Question 2

An administrator configured FGSP cluster members to encrypt the session synchronization. When the administrator takes a sniffer trace on the dedicated interface for the synchronization, the sniffer trace shows UDP packets only.

Which two reasons could cause the sniffer to capture only UDP packets?

(Choose two.)

Select all that apply.

Which two reasons could cause the sniffer to capture only UDP packets?

(Choose two.)

Select all that apply.

Accepted Answer

B. encryption is not set to enable on both members.

Accepted Answer

C. The psksecret value does not match.

Answer

A. The administration has not configured the SESSYNC_1 tunnel.

Answer

D. The encryption is encapsulated in UDP packets.

Question 3

Refer to the exhibit, which shows the device and policy layers for FortiGate key operations.

How can the administrator restore a previous FortiGate configuration, which had more policies than the current one, without the layer synchronization between the device and policy layers on FortiManager?

Accepted Answer

A. Locate the configuration ID in the FortiGate revision history, click revert, install the device settings, and import policies to sync the policy package.

Answer

B. Use the global ADOM to access the previous configurations and install policies on ADOM devices to synchronize all layers.

Answer

C. Find the configuration file by date and time in the provisioning templates, then reinstall the policy package to apply the configuration changes.

Answer

D. Retrieve the configuration, import system templates, and reinstall the policy package on FortiGate.

Question 4

An administrator must automate a weekly backup of all the FortiGate devices in an enterprise network. Which two steps must the administrator follow to implement this? (Choose two.)

Accepted Answer

A. Integrate all the FortiGate devices in a Security Fabric environment.

Accepted Answer

D. Create an automation stitch.

Answer

B. Create a script to be run in the device database.

Answer

C. Create metadata variables for all the FortiGate devices.

Question 5

What are two impacts on applications if adjusting the TCP Maximum Segment Size (MSS) on FortiGate? (Choose two.)

Select all that apply.

Accepted Answer

A. The MSS configuration is prone to errors since it requires a thorough understanding of the network path.

Accepted Answer

C. The overall data throughput is decreased when there is a decrease in MSS value.

Answer

B. The packet count increases adding unnecessary TCP headers when the MSS value is increased.

Answer

D. The network efficiency improves when there is a decrease in MSS value.

Question 6

Refer to the exhibit, which shows VDOM link interfaces.

For the VDOM link shown, what is the meaning of np0 and np1?

Accepted Answer

D. FortiGate automatically assigns unique names to VDOM links by appending 0 and 1.

Answer

A. They are the VRD ID numbers of each VDOM interface.

Answer

B. FortiGate automatically assigns a native ASIC network processor to available VDOM interfaces.

Answer

C. They represent the ID number of each VDOM for traffic management.

Question 7

An administrator wants to simplify a new hub-and-spoke network deployment with the BGP recommended configuration. Which two sections on FortiManager must the administrator use?

(Choose two.)

Accepted Answer

A. Provisioning Templates

Accepted Answer

C. Metadata Variables

Answer

B. Meta Fields

Answer

D. Automation Stitch

Question 8

What does hyperscale capability in data center firewalls typically support?

Accepted Answer

B. Network speeds ranging from 10 Gbps to 1000 Gbps

Answer

A. Application layer operations such as intrusion prevention

Answer

C. Enhanced encryption and decryption processes only

Answer

D. Bundling of multiple physical interfaces for a single logical interface

Question 9

An administrator must ensure that users cannot access sites containing malware and spyware, while also protecting them from phishing attempts. What is the most resource-efficient method to block access to these sites?

Accepted Answer

C. Configure FortiGuard Web Filtering and block the categories malware, spyware, and phishing to prevent access to such sites.

Answer

A. Set up a DNS filter and block domains related to these categories to stop users from reaching malicious content.

Answer

B. Create a custom IPS policy to monitor and block all outbound traffic related to malware, spyware, and phishing sites.

Answer

D. Enable antivirus profiles to scan all web traffic and block downloads from these malicious sites.

Question 10

Which statement about FortiGate behavior relating to this session is true?

Accepted Answer

C. FortiGate is performing security profile inspection using the CPU.

Answer

A. FortiGate redirected the client to the captive portal to authenticate, so that a correct policy match could be made.

Answer

B. FortiGate forwarded this session without any inspection.

Answer

D. FortiGate applied only IPS inspection to this session.

Question 11

Refer to the exhibit, which shows partial outputs from two routing debug commands.

Why is the port2 default route not in the second command output?

Accepted Answer

B. The port1 default route has a lower distance than the default route using port2.

Answer

A. The port2 interface is disabled in the FortiGate configuration.

Answer

C. The port1 default route has a higher priority value than the default route using port2.

Answer

D. The port1 default route has a lower priority value than the default route using port2.

Question 12

View the exhibit, which contains a partial output of an IKE real-time debug, and then answer the question below:
Based on the debug output, which phase-1 setting is enabled in the configuration of this VPN?

Accepted Answer

B. auto-discovery-forwarder

Answer

A. auto-discovery-sender

Answer

C. auto-discovery-shortcut

Answer

D. auto-discovery-receiver

Question 13

What is the diagnose test application ipsmonitor 99 command used for?

Accepted Answer

D. To restart all IPS engines and monitors

Answer

A. To enable IPS bypass mode

Answer

B. To provide information regarding IPS sessions

Answer

C. To disable the IPS engine

Question 14

Which of the following tasks are part of the manual registration process for adding a FortiGate to a FortiManager for central management? (Choose three.)

Accepted Answer

B. In the FortiManager, add the unregistered FortiGate.

Accepted Answer

C. Import the policy package from the managed FortiGate.

Accepted Answer

E. Add the FortiManager IP address to the FortiGate's central management configuration.

Answer

A. Wait for the rating databases to download on FortiManager.

Answer

D. Start the rating services on FortiManager.

Question 15

A FortiGate device has the following LDAP configuration:

The administrator executed the ‘dsquery’ command in the Windows LDAp server 10.0.1.10,

and got the following output:

>dsquery user -samid administrator

"CN-Administrator, CN-Users, DC=trainingAD, DC-training, DC-lab"

Based on the output, what FortiGate LDAP setting is configured incorrectly?

Accepted Answer

B. username.

Answer

A. cnid.

Answer

C. password.

Answer

D. dn.

Question 16

What can be concluded about the debug output in this scenario?

Accepted Answer

B. There is a natural correlation between the value in the Packets field and the value in the Weight field.

Answer

A. Servers with a negative TZ value are less preferred for rating requests.

Answer

C. FortiGate used 64.26.151.37 as the initial server to validate its contract.

Answer

D. The first server provided to FortiGate when it performed a DNS query looking for a list of rating servers, was 121.111.236.179.

Question 17

When does a RADIUS server send an Access-Challenge packet?

Accepted Answer

B. The server requires more information from the user, such as the token code for two-factor authentication.

Answer

A. The server does not have the user credentials yet.

Answer

C. The user credentials are wrong.

Answer

D. The user account is not found in the server.

Question 18

View the exhibit, which contains the output of a BGP debug command, and then answer the question below.

Which of the following statements about the exhibit are true? (Choose two.)

Accepted Answer

A. For the peer 10.125.0.60, the BGP state of is Established.

Accepted Answer

D. The local BGP peer has not established a TCP session to the BGP peer 10.200.3.1.

Answer

B. The local BGP peer has received a total of three BGP prefixes.

Answer

C. Since the BGP counters were last reset, the BGP peer 10.200.3.1 has never been down.

Question 19

An administrator wants to capture encrypted phase 2 traffic between two FortiGate devices using the built-in sniffer. If the administrator knows that there is no NAT device located between both FortiGate devices, which command should the administrator run?

Accepted Answer

B. diagnose sniffer packet any 'ip proto 50'

Answer

A. diagnose sniffer packet any 'ah'

Answer

C. diagnose sniffer packet any 'udp port 4500'

Answer

D. diagnose sniffer packet any 'udp port 500'

Question 20

View the exhibit, which of the contains the partial output of an IKE real-time debug, then answer the question below.

Which of the following statements about this debug output are true? (Choose two.)

Accepted Answer

A. The name of the tunnel being negotiated is VPN.

Accepted Answer

D. Phase 1 is using a pre-shared key for authentication.

Answer

B. Both phases 1 and 2 are up.

Answer

C. Both gateways are using aggressive mode.

Question 21

View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

Which statements about this debug output are correct? (Choose two.)

Select all that apply.

Accepted Answer

B. It shows a phase 1 negotiation.

Accepted Answer

D. The initiator has provided remote as its IPsec peer ID.

Answer

A. The remote gateway IP address is 10.0.0.1.

Answer

C. The negotiation is using AES128 encryption with CBC hash.

Question 22

Refer to the exhibit, which contains the partial output of a diagnose command.

Based on the output, which two statements are correct? (Choose two.)

Select all that apply.

Accepted Answer

A. The remote gateway has quick mode selectors containing a destination subnet of 10.1.2.0/24.

Accepted Answer

D. Anti-replay is enabled.

Answer

B. The remote gateway IP is 10.200.5.1.

Answer

C. DPD is disabled.

Question 23

Which two statements about bulk configuration changes using FortiManager CLI scripts are correct? (Choose two.)

Select all that apply.

Accepted Answer

B. When executed on the Device Database, you must use the installation wizard to apply the changes to the managed FortiGate

Accepted Answer

D. When executed on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.

Answer

A. When executed on the Policy Package, ADOM database, changes are applied directly to the managed FortiGate.

Answer

C. When executed on the All FortiGate in ADOM, changes are automatically installed without creating a new revision history.

Question 24

Examine the following partial outputs from two routing debug commands; then answer the question below.

# get router info kernel
 tab=254 vf=0 scope=0type=1 proto=11 prio=0 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0
 gwy=10.200.1.254 dev=2(port1)
 tab=254 vf=0 scope=0type=1 proto=11 prio=10 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0
 gwy=10.200.2.254 dev=3(port2)
 tab=254 vf=0 scope=253type=1 proto=2 prio=0 0.0.0.0/0.0.0.0/.->10.0.1.0/24 pref=10.0.1.254
 gwy=0.0.0.0 dev=4(port3)
 # get router info routing-table all s*0.0.0.0/0 [10/0] via 10.200.1.254, portl [10/0] via
10.200.2.254, port2, [10/0] dO.0.1.0/24 is directly connected, port3 dO.200.1.0/24 is directly
 connected, portl d0.200.2.0/24 is directly connected, port2
Which outbound interface or interfaces will be used by this FortiGate to route web traffic from internal users to the Internet?

Accepted Answer

C. port1

Answer

A. Both port1 and port2.

Answer

B. port2.

Answer

D. port3.

Question 25

View the partial crashlog output, and then answer the question below.

# diagnose debug crashlog read
2017-04-20 16:23:10 <00114> IPS enter fail open mode: engines=21 socketsize=123425682
2017-04-20 16:23:10 sessionact=pass
2017-04-20 16:24:09 <00114> IPS exit fail open mode
Which of the following statements are true regarding this FortiGate's fail-open configuration?

(Choose two.)

Select all that apply.

Accepted Answer

B. Fail-open is enabled in FortiGate's global IPS configuration.

Accepted Answer

D. FortiGate was passing traffic while fail-open mode was active.

Answer

A. FortiGate was dropping traffic while fail-open mode was active.

Answer

C. Fail-open is disabled in FortiGate's global IPS configuration.

Question 26

Examine the output from the 'diagnose debug authd fsso list' command; then answer the question below.

# diagnose debug authd fsso list--FSSO logons-IP: 192.168.3.1 User: STUDENT
 Groups:TRAININGAD/USERS Workstation: INTERNAL2. TRAINING. LAB The IP address
 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.
What should the administrator check?

Accepted Answer

C. The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2. TRAINING. LAB.

Answer

A. The IP address recorded in the logon event for the user STUDENT.

Answer

B. The DNS name resolution for the workstation name INTERNAL2. TRAINING. LAB.

Answer

D. The reserve DNS lookup forthe IP address 192.168.3.1

Question 27

Which of the following conditions must be met for a static route to be active in the routing table? (Choose three.)

Select all that apply.

Accepted Answer

C. The link health monitor (if configured) is up.

Accepted Answer

D. The next-hop IP address belongs to one of the outgoing interface subnets.

Accepted Answer

E. The outgoing interface is up.

Answer

A. The next-hop IP address is up.

Answer

B. There is no other route, to the same destination, with a higher distance.

Question 28

Which two configuration settings change the behavior for content-inspected traffic while FortiGate is in conserve mode? (Choose two.)

Select all that apply.

Accepted Answer

A. IPS failopen

Accepted Answer

C. AV failopen

Answer

B. mem failopen

Answer

D. UTM failopen

Question 29

An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer. If the administrator knows that there is no NAT device located between both FortiGates, What command should the administrator execute?

Accepted Answer

C. diagnose sniffer packet any ‘esp’

Answer

A. diagnose sniffer packet any ‘udp port 500’

Answer

B. diagnose sniffer packet any ‘udp port 4500’

Answer

D. diagnose sniffer packet any ‘udp port 500 or udp port 4500’

Question 30

View the exhibit, which contains the sniffer output for a passive mode FTP request, and then answer the question below.

An administrator has created the following custom IPS signature to block all FTP requests for passive mode:

F-SBID (--attack_id 1002; --name "Block.FTP "; --protocol tcp; --flow from_client; --pattern "PASV"; --no_case;)

Soon after the signature is enabled in an active IPS sensor, some false positive detections are generated. Which of the following option and value pairs will allow more specific detection?

Accepted Answer

D. --service ftp

Answer

A. --attack_id 1001

Answer

B. --protocol ftp

Answer

C. --name "Block.FTP.PASV

Question 31

View the IPS exit log, and then answer the question below.

What is the status of IPS on this FortiGate?

View the IPS exit log, and then answer the question below.

What is the status of IPS on this FortiGate?

Accepted Answer

D. All IPS-related features have been disabled in FortiGate’s configuration.

Answer

A. IPS engine memory consumption has exceeded the model-specific predefined value.

Answer

B. IPS daemon experienced a crash.

Answer

C. There are communication problems between the IPS engine and the management database.

Question 32

Refer to the exhibit, which contains the output of diagnose sys session list.

If the HA ID for the primary unit is zero (0), which statement about the output is true?

Accepted Answer

C. The master unit is processing this traffic.

Answer

A. This session cannot be synced with the slave unit.

Answer

B. The inspection of this session has been offloaded to the slave unit.

Answer

D. This session is for HA heartbeat traffic.

Question 33

The IT department discovered during the last network migration that all zero phase selectors in phase 2 IPsec configurations impacted network operations. What are two valid approaches to prevent this during future migrations? (Choose two.)

Accepted Answer

A. Use routing protocols to specify allowed subnets over the tunnel.

Accepted Answer

C. Clearly indicate to the VPN which segments will be encrypted in the phase two selectors.

Answer

B. Configure an IPsec-aggregate to create redundancy between each firewall peer.

Answer

D. Configure an IP address on the IPsec interface of each firewall to establish unique peer connections and avoid impacting network operations.

Question 34

A company's users on an IPsec VPN between FortiGate A and B have experienced intermittent issues since implementing VXLAN. The administrator suspects that packets exceeding the 1500-byte default MTU are causing the problems.

In which situation would adjusting the interface’s maximum MTU value help resolve issues caused by protocols that add extra headers to IP packets?

Accepted Answer

C. Adjust the MTU on interfaces in controlled environments where all devices along the path allow MTU interface changes.

Answer

A. Adjust the MTU on interfaces only if FortiGate has the FortiGuard enterprise bundle, which allows MTU modification.

Answer

B. Adjust the MTU on interfaces in all FortiGate devices that support the latest family of Fortinet SPUs: NP7, CP9 and SP5.

Answer

D. Adjust the MTU on interfaces only in wired connections like PPPoE, optic fiber, and ethernet cable.

Question 35

Users report that bulk file transfers and other large-packet flows stall or perform poorly across an IPsec overlay, while small-packet applications work fine. Path MTU discovery is being blocked somewhere in the provider network, so oversized packets after encapsulation are silently dropped.

Which two tuning actions on the tunnel directly mitigate this problem?

(Choose two.)

Select all that apply.

Which two tuning actions on the tunnel directly mitigate this problem?

(Choose two.)

Select all that apply.

Accepted Answer

A. Lower the tunnel interface MTU to account for the IPsec encapsulation overhead.

Accepted Answer

D. Clamp the TCP MSS on the tunnel so TCP segments stay small enough to fit within the tunnel path after IPsec overhead.

Answer

B. Switch the tunnel from IKEv2 to IKEv1 to reduce header overhead.

Answer

C. Increase the DPD probe frequency on the tunnel.

Answer

E. Enable FEC on the tunnel to raise its effective MTU.

Question 36

Refer to the exhibit, which shows a network diagram.

An administrator would like to modify the MED value advertised from FortiGate_1 to a BGP neighbor in the autonomous system 30.

What must the administrator configure on FortiGate_1 to implement this?

Accepted Answer

A. route-map-out

Answer

B. network-import-check

Answer

C. prefix-list-out

Answer

D. distribute-list-out

Question 37

Consider a FortiGate configured with an SD-WAN rule using the "Lowest Cost (SLA)" strategy. The SD-WAN rule has two member interfaces: WAN1 (Cost: 10) and WAN2 (Cost: 20). Currently, both WAN1 and WAN2 meet the configured Performance SLA criteria. Which interface will the FortiGate choose for routing the traffic matching this rule?

Accepted Answer

A. WAN1

Answer

B. WAN2

Answer

C. Both WAN1 and WAN2 simultaneously to load-balance the traffic

Answer

D. An interface selected dynamically at random from the SD-WAN database

Question 38

A company wants branch firewalls to inherit a common SD-WAN configuration while allowing each branch to use different WAN interface addresses.

Which FortiManager feature should be used?

Accepted Answer

C. CLI Templates with Variables

Answer

A. ADOM revisions

Answer

B. Policy packages

Answer

D. Device Database Locking

Question 39

An enterprise uses BGP over IPsec VPN tunnels in an SD-WAN deployment. The primary ISP experiences high latency but remains operational.

Which feature automatically prefers the secondary ISP without withdrawing BGP routes?

Accepted Answer

B. SD-WAN Performance SLA

Answer

A. ECMP

Answer

C. BGP Route Reflection

Answer

D. Static Route Priority

Question 40

An administrator notices that application identification is inconsistent for encrypted HTTPS traffic.

Which security profile must be correctly configured?

Accepted Answer

B. SSL/SSH Inspection

Answer

A. Antivirus

Answer

C. Web Filter

Answer

D. DNS Filter

Question 41

A FortiManager administrator modifies a policy package but does not want changes to affect production until after business hours.

What is the appropriate action?

Accepted Answer

D. Save the configuration and postpone the Install Wizard

Answer

A. Install the policy package immediately

Answer

B. Save only the ADOM revision

Answer

C. Lock the device database

Question 42

Several branch FortiGate devices successfully establish IPsec tunnels, but Security Fabric topology does not display downstream devices.

Which configuration should the administrator verify?

Accepted Answer

A. Security Fabric participation is enabled on the VPN interface.

Answer

B. OSPF authentication.

Answer

C. HA session synchronization.

Answer

D. NAT Traversal.

Question 43

A network uses SD-WAN rules that prioritise voice traffic. During testing, all traffic continues using the primary WAN even after latency exceeds the SLA threshold.

Which configuration issue most likely explains this behaviour?

Accepted Answer

C. The Performance SLA is not referenced by the SD-WAN rule.

Answer

A. The SD-WAN rule is configured in Manual mode.

Answer

B. The firewall policy is using the virtual-wan-link interface.

Answer

D. The static default route has a higher administrative distance.

Question 44

A large enterprise uses FortiManager to deploy a common SD-WAN configuration to hundreds of branch FortiGate devices. Each branch has different WAN interface names and ISP gateway addresses. The administrator wants to use a single policy package and a single CLI template for all branches while avoiding manual edits for each device.

Which FortiManager feature should the administrator use?

Which FortiManager feature should the administrator use?

Accepted Answer

B. Dynamic Interface Mapping and Device Variables

Answer

A. Metadata Variables

Answer

C. ADOM Revisions

Answer

D. Per-Device Mapping

Question 45

A company has deployed dual IPsec VPN tunnels from each branch to two data centres. OSPF advertises routes across both tunnels, while SD-WAN Performance SLA monitors latency, jitter, and packet loss.

During testing, one tunnel experiences excessive latency. The tunnel remains established, and OSPF adjacency stays up, but user traffic immediately shifts to the alternate tunnel.

Why did traffic move even though OSPF did not change the routing table?

Accepted Answer

B. The SD-WAN rule selected another healthy member because the Performance SLA threshold was exceeded.

Answer

A. OSPF automatically recalculated the shortest path based on latency.

Answer

C. Dead Peer Detection (DPD) restarted the IPsec tunnel.

Answer

D. BFD withdrew the OSPF routes after detecting latency.

Question 46

An architect is enabling ADVPN across an existing hub-and-spoke overlay so that spokes can form direct shortcuts on demand.

Which two elements are required for ADVPN shortcuts to form? (Choose two.)

Select all that apply.

Accepted Answer

A. A dynamic routing control plane across the overlay, typically BGP (often BGP-on-loopback), so spokes learn the routes and next-hop information needed to build and use shortcuts.

Accepted Answer

D. Shortcut signaling on the hub and spokes so the hub can detect inter-spoke traffic and broker a direct spoke-to-spoke tunnel.

Answer

B. A dedicated backup hub that terminates every shortcut tunnel on behalf of the spokes before they talk directly.

Answer

C. Deep SSL inspection enabled on the hub so it can decrypt and re-broker each shortcut before the spokes connect.

Answer

E. A static route on each spoke pointing at every other spoke's tunnel interface, defining the complete spoke-to-spoke mesh in advance.

Question 47

An architect is building an enterprise SD-WAN interface at a branch that has two WAN underlays plus overlay tunnels.

Which statements correctly describe how SD-WAN aggregates and uses these links? (Choose two.)

Select all that apply.

Accepted Answer

B. Traffic is steered across the members based on their health, so the SD-WAN interface can prefer or avoid a member according to measured link conditions.

Accepted Answer

D. Multiple WAN members, both underlays and overlay tunnels, are aggregated into a single logical SD-WAN interface that policies and routes can reference as one entity.

Answer

A. Each WAN member keeps a separate set of firewall policies that must be duplicated per member, because SD-WAN cannot present the members as one interface.

Answer

C. Only physical underlay ports can be SD-WAN members; IPsec overlay tunnels cannot participate in the SD-WAN interface.

Question 48

A team must build a single logical high-availability cluster from two identical FortiGates so that one unit takes over transparently if the other fails, presenting the pair as one device.

Which protocol is designed for this?

Accepted Answer

B. FGCP, which forms a single logical HA cluster from the two units, synchronizing configuration and sessions and failing over transparently.

Answer

A. VRRP, because it merges two FortiGates into one clustered device with a synchronized configuration and a shared session table across both units.

Answer

C. FGSP, because it forms a single managed cluster from two FortiGates and elects one primary for the whole device.

Answer

D. Inter-VDOM routing, because it links the two units into a shared control plane that fails over as a single unit with synchronized sessions.

Question 49

A global MSSP is designing an ADVPN overlay that spans several regions. Each region holds many spokes, most traffic is intra-region, and inter-region traffic must remain controlled and scalable.

Which design approach best fits this large multiregion deployment?

Accepted Answer

C. Tier the hubs by region so regional hubs serve their local spokes and interconnect at a higher tier for inter-region traffic.

Answer

A. Build a static full mesh between all spokes across all regions so that no hub is needed for any inter-region traffic.

Answer

B. Deploy one global hub that terminates every spoke worldwide, since a single hub is required for the BGP control plane to broker any shortcut.

Answer

D. Place every region's spokes in one BGP neighbor-group on a single hub and disable the regional hubs to keep the routing table small.

Question 50

You want to configure two static routes: one that references a zone and a second one that references an SD-WAN member that belongs to that zone.

Which statement about this scenario is true?

Accepted Answer

C. The destination subnets must be different.

Answer

A. You cannot create static routes for individual SD-WAN members.

Answer

B. You cannot create static routes that reference an SD-WAN zone.

Answer

D. The source subnets must be different.

Question 51

Refer to the exhibit, which shows partial outputs from two routing debug commands.

Which change must an administrator make on FortiGate to route web traffic from internal users to the internet, using ECMP?

Accepted Answer

D. Set the priority of the static default route using port1 to 10.

Answer

A. Set snat-route-change to enable.

Answer

B. Set the priority of the static default route using port2 to 1.

Answer

C. Set preserve-session-route to enable.

Question 52

Refer to the exhibit.

A partial output from an IKE real-time debug is shown

The administrator does not have access to (he remote gateway

Based on the debug output, which two conclusions can you draw? (Choose two.)

Accepted Answer

A. The remote peer is the initiating peer.

Accepted Answer

B. This is a phase1 negotiation.

Answer

C. There is a Diffie-Hellman group mismatch.

Answer

D. This is a phase2 negotiation

Question 53

Refer to the exhibit.

The output of a policy route table entry is shown.

Which type of policy route does the output show?

Accepted Answer

C. An SD-WAN rule

Answer

A. A regular policy route, which is not associated with an active static route in the FIB

Answer

B. An ISDB route

Answer

D. A regular policy route, which is associated with an active static route in the FIB

Question 54

What is the diagnose test application ipsmonitor 5 command used for?

Accepted Answer

D. To enable IPS bypass mode

Answer

A. To disable the IPS engine

Answer

B. To provide information regarding IPS sessions

Answer

C. To restart all IPS engines and monitors

Question 55

An enterprise network architect is designing an IPsec overlay structure across a dual-WAN branch network connected to two regional hubs (Hub-A and Hub-B).

The design requires:

Active-Active overlay tunnels from the branch to both hubs.

Equal-Cost Multi-Path (ECMP) routing across both tunnels for internal subnet traffic.

Fast failover if one WAN underlay degrades (high packet loss), without waiting for BGP timers to hold down or expire.

Preserving original source IP addresses without requiring SNAT on the overlay.

Which combination of configuration steps on the branch FortiGate meets these architectural requirements? (Choose two.)

Select all that apply.

Accepted Answer

A. Assign matching Administrative Distance and Priority to the static routes pointing to the IPsec tunnel interfaces connected to Hub-A and Hub-B.

Accepted Answer

C. Add both IPsec tunnel interfaces as members of an SD-WAN zone and configure Performance SLA probes with an SD-WAN rule set to the Best Quality or Lowest Cost (SLA) strategy.

Answer

B. Configure BGP neighbor keepalive and holdtime timers down to 1 second / 3 seconds on all overlay IPsec interfaces to trigger fast route withdrawal.

Answer

D. Enable set preserve-session-route enable on the firewall policies to force active sessions to immediately switch paths upon underlay link degradation.

Answer

E. Enable Link Health Monitor on the IPsec tunnel interfaces using the set health-check setting so that dead routes are removed from the FIB when packet loss exceeds threshold limits.

Q5_NSE7

Create a free account to finish this quiz

Questions in this quiz (55)

Information

Feedback

What do you think of the new look?