NSE7 ENTERPRISES

1 ) You want to have faster detection for OSPF.
Which parameter should you enable on both connected FortiGate devices?

• A. distribute-list-in

• B. rfc1583-compatible

• C. restart-on-topology-change

• D. bfd 

2) Refer to the exhibit, which shows a central management configuration.

Which server will FortiGate choose for web filter rating requests, if 10.0.1.240 is experiencing an outage?

• A. 10.0.1.244

• B. 10.0.1.242

• C. Public FortiGuard servers

•   D. 10.0.1.243

3) An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device.
What can the administrator do to fix this problem?

• A. Configure remote link monitoring to detect an issue in the forwarding path.

• B. Configure set send-garp-on-failover enable under config system ha on both cluster members.

• C. Verify that the speed and duplex settings match between the FortiGate interfaces and the connected switch ports.

• D. Configure set link-failed-signal enable under config system ha on both cluster members.

4) Refer to the exhibit, which contains a partial configuration of the global system.

What can you conclude from this output?

•   A. Only NPs are disabled

• B. Only CPs are disabled

• C. NPs and CPs are enable

• D. NPs and CPs are disabled

5) Refer to the exhibits, which contain the network topology and BGP configuration for a hub.

An administrator is trying to configure ADVPN with a hub and spoke VPN setup using iBGP. All the VPNs are up and connected to the hub. The hub is receiving route information from both spokes over iBGP; however, the spokes are not receiving route information from each other.

What change must the administrator make to the hub BGP configuration so that the routes learned from one spoke are forwarded to the other spoke?

• A. Configure the hub as a route reflector 

• B. Configure auto-discovery-sender on the hub

• C. Add a prefix list to the hub that permits routes to be shared between the spokes

• D. Enable route redistribution under config router bgp

6) Refer to the exhibit, which shows a network diagram.

Which protocol should you use to configure the FortiGate cluster?

• A. FGCP in active-passive mode

• B. FGCP in active-active mode

• C. FGSP

• D. VRRP

7 ) Refer to the exhibit, which contains a TCL script configuration on FortiManager.

An administrator has configured the TCL script on FortiManager, but the TCL script failed to apply any changes to the managed device after being run.

Why did the TCL script fail to make any changes to the managed device?

• A. The TCL procedure run_cmd has not been created.

• B. The TCL script must start with #include.

• C. There is no corresponding #! to signify the end of the script

• D. The TCL procedure lacks the required loop statements to iterate through the

8) Which two modifications must you apply to the configuration of this custom signature so that you can save it on FortiGate? (Choose two.)

• A. Ensure that the header syntax is F-SBID.

• B. Add severity.

• C. Add attack_id.

• D. Start options with

9) Refer to the exhibit, which provides information on BGP neighbors

What can you conclude from this command output?

• A. You must change the AS number to match the remote peer.

• B. BGP is attempting to establish a TCP connection with the BGP peer.

• C. The bfd configuration is set to enable.

• D. The routers are in the same area ID of 0.0.0.0.

10) Which action does FortiGate take if the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate?

Refer to the exhibit, which shows an SSL certification inspection configuration.

• A. FortiGate uses the first entry listed in the SAN field in the server certificate

• B. FortiGate uses the CN information from the Subject field in the server certificate

• C. FortiGate uses the SNI from the user's web browser.

• D. FortiGate closes the connection because this represents an invalid SSL/TLS configuration