NSE7 - ENTERPRISE FIREWALL 7.0

1. 1. Which three conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three.)

• • D. Authentication settings match.

• • E. OSPF link costs match.

• • B. OSPF router IDs are unique.

• • A. OSPF interface network types match.

• • C. OSPF interface priority settings are unique.

2. 2. Refer to the exhibit, which contains partial output from an IKE real-time debug.
   -
   -
   -
   -
   -

3. The administrator does not have access to the remote gateway.
   Based on the debug output, which configuration change can the administrator make to the local gateway to resolve the phase 1 negotiation error?

• • B. In the phase 1 proposal configuration, add AES128-SHA128 to the list of encryption algorithms.

• • C. In the phase 1 proposal configuration, add AESCBC-SHA2 to the list of encryption algorithms.

• • A. In the phase 1 network configuration, set the IKE version to 2.

• • D. In the phase 1 proposal configuration, add AES256-SHA256 to the list of encryption algorithms.

3. 3. Refer to the exhibit, which shows the output of a web filtering diagnose command.
   -
   -
   -
   -
   -
   Which configuration change would result in non-zero results in the cache statistics section?

• • B. set webfilter-cache enable under config system fortiguard

• • D. set ngfw-mode policy-based under config system settings

• • A. set server-type rating under config system central-management

• • C. set webfilter-force-off disable under config system fortiguard

4. 4. Refer to the exhibits, which show the configuration on FortiGate and partial session information for internet traffic from a user on the internal network.
   -
   -

5. -

6. -

7. -
   If the priority on route ID 2 were changed from 10 to 0, what would happen to traffic matching that user session?

• • B. The session would remain in the session table, and its traffic would egress from port2.

• • D. The session would remain in the session table, and its traffic would egress from port1.

• • A. The session would remain in the session table, but its traffic would now egress from both port1 and port2.

• • C. The session would be deleted, and the client would need to start a new session.

5. 5. Refer to the exhibits, which show the configuration on FortiGate and partial internet session information from a user on the internal network.
   -
   -
   -

6. -

7. -

8. An administrator would like to test session failover between the two service provider connections.
   What changes must the administrator make to force this existing session to immediately start using the other interface? (Choose two.)

• • B. Change the priority of the port2 static route to 5.

• • C. Change the priority of the port1 static route to 11.

• • A. Configure set snat-route-change enable.

• • D. unset snat-route-change to return it to the default setting.

6. 6. What are two functions of automation stitches? (Choose two.)

• • B. An automation stitch configured to execute actions sequentially can take parameters from previous actions as input for the current action.

• • A. Automation stitches can be configured on any FortiGate device in a Security Fabric environment.

• • D. An automation stitch configured to execute actions in parallel can be set to insert a specific delay between actions.

• • C. Automation stitches can be created to run diagnostic commands and attach the results to an email message when CPU or memory usage exceeds specified thresholds.

7. 7. Refer to the exhibit, which shows a partial web filter profile configuration.

8. -

9. -

10. -

11. -

12. -

13. Which action will FortiGate take if a user attempts to access www.dropbox.com, which is categorized as File Sharing and Storage?

• • B. FortiGate will block the connection as an invalid URL.

• • A. FortiGate will block the connection, based on the FortiGuard category based filter configuration.

• • D. FortiGate will allow the connection, based onthe URL Filter configuration.

• • C. FortiGate will exempt the connection, based on the Web Content Filter configuration.

8. 8. Refer to the exhibit, which contains the partial output of the get vpn ipsec tunnel details command.

9. -

10. -

11. -

12. -

13. -

14. Based on the output, which two statements are correct? (Choose two.)

• • B. Different SPI values are a result of auto-negotiation being disabled for phase 2 selectors.

• • D. The npu_flag for this tunnel is 02.

• • A. The npu_flag for this tunnel is 03.

• • C. Anti-replay is enabled.

9. 9. Refer to the exhibit, which shows a session table entry.
   -

10. -

11. -

12. -

13. -

14. Which statement about FortiGate behavior relating to this session is true?

• • B. FortiGate forwarded this session without any inspection.

• • D. FortiGate applied only IPS inspection to this session.

• • A. FortiGate redirected the client to the captive portal to authenticate, so that a correct policy match could be made.

• • C. FortiGate is performing security profile inspection using the CPU.

10. 10. Refer to the exhibits, which contain the partial configurations of two VPNs on FortiGate.
    -

11. -

12. -

13. -

14. -

15. An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovered that FortiGate is not matching the user-2 VPN for members of the Users-2 group.
    Which two changes must the administrator make to fix the issue? (Choose two.)

• • B. Enable XAuth on both VPNs.

• • A. Use different pre-shared keys on both VPNs.

• • D. Change to aggressive mode on both VPNs.

• • C. Set up specific peer IDs on both VPNs.