Get instant access to NSE7_EFW-6.4 Practice Tests 2023 Free Updated Today!
Welcome to download the newest PassLeader NSE7_EFW-6.4 PDF dumps ( 124 Q&As)
For more info read reference:
Exam Blueprint Preparatory Course
NEW QUESTION 24
Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)
- A. Installing configuration changes to managed devices
- B. Adding devices to FortiManager
- C. Importing interface mappings from managed devices
- D. Previewing pending configuration changes for managed devices
Answer: A,D
NEW QUESTION 25
Examine the output of the 'diagnose debug rating' command shown in the exhibit; then answer the question below.
Which statement are true regarding the output in the exhibit? (Choose two.)
- A. There are three FortiGuard servers that are not responding to the queries sent by the FortiGate.
- B. The TZ value represents the delta between each FortiGuard server's time zone and the FortiGate's time zone.
- C. FortiGate will send the FortiGuard queries to the server with highest weight.
- D. A server's round trip delay (RTT) is not used to calculate its weight.
Answer: B,C
NEW QUESTION 26
Refer to the exhibit, which shows a partial routing table.
Assuming all the appropriate firewall policies are configured, which two pings will FortiGate route? (Choose two.)
- A. Source IPaddress: 10.73.9.10, Destination IPaddress: 10.72.3.15
- B. Source IPaddress: 10.72.3.52. Destination IP address: 10.1.0.254
- C. Source IP address: 10.1.0.10. Destination IP address: 10.64.1.52
- D. Source IPaddress: 10.10.4.24, Destination IPaddress: 10.72.3.20
Answer: B,C
NEW QUESTION 27
View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.
The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel. To diagnose, the administrator enters these CLI commands:
However, the IKE real time debug does not show any output. Why?
- A. The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.
- B. The log-filter setting was set incorrectly. The VPN's traffic does not match this filter.
- C. The debug shows only error messages. If there is no output, then the tunnel is operating normally.
- D. The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.
Answer: B
NEW QUESTION 28
Examine the output from the 'diagnose debug authd fsso list' command; then answer the question below.
# diagnose debug authd fsso list-FSSO logons-IP: 192.168.3.1 User: STUDENT Groups: TRAINI NGAD/USERS Workstation: INTERNAL2. TRAINING. LAB The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.
What should the administrator check?
- A. The reserve DNS lookup forthe IP address 192.168.3.1.
- B. The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2.
TRAINING. LAB. - C. The DNS name resolution for the workstation name INTERNAL2. TRAINING. LAB.
- D. The IP address recorded in the logon event for the user STUDENT.
Answer: B
NEW QUESTION 29
Which of the following statements is true regarding a FortiGate configured as an explicit web proxy?
- A. FortiGate limits the number of simultaneous sessions per explicit web proxy user The limit CAN be modified by the administrator
- B. FortiGate limits the number of simultaneous sessions per explicit web proxy user. This limit CANNOT be modified by the administrator.
- C. FortiGate limits the total number of simultaneous explicit web proxy users.
- D. FortiGate limits the number of workstations that authenticate using the same web proxy user credentials. This limit CANNOT be modified by the administrator.
Answer: C
Explanation:
https://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-WAN-opt-52/web_proxy.htm#Explicit2
The explicit proxy does not limit the number of active sessions for each user. As a result the actual explicit proxy session count is usually much higher than the number of explicit web proxy users. If an excessive number of explicit web proxy sessions is compromising system performance you can limit the amount of users if the FortiGate unit is operating with multiple VDOMs.
NEW QUESTION 30
Which statement about memory conserve mode is true?
- A. A FortiGate enters conserve mode when the configured memory use threshold reaches red
- B. A FortiGate exits conserve mode when the configured memory use threshold reaches yellow.
- C. A FortiGate starts dropping new sessions when the configured memory use threshold reaches red
- D. A FortiGate starts dropping all the new and old sessions when the configured memory use threshold reaches extreme.
Answer: A
NEW QUESTION 31
Refer to the exhibit, which contains partial outputs from two routing debug commands.
Why is the port2 default route not in the second command's output?
- A. It is disabled in the FortiGate configuration.
- B. It has a higher distance than the default route using port1.
- C. It has a higher priority value than the default route using port1.
- D. It has a lowerpriority value than the default route using port1.
Answer: B
NEW QUESTION 32
Whendoes a RADIUS server send an Access-Challenge packet?
- A. The user account is not found in the server.
- B. The server requires more information from the user, such as the token code for two-factor authentication.
- C. The user credentials are wrong.
- D. The server does not have the user credentials yet.
Answer: B
NEW QUESTION 33
A FortiGate device has the following LDAP configuration:
The administrator executed the 'dsquery' command in the Windows LDAp server 10.0.1.10, and got the following output:
>dsquery user -samid administrator
"CN=Administrator, CN=Users, DC=trainingAD, DC=training, DC=lab"
Based on the output, what FortiGate LDAP setting is configured incorrectly?
- A. password.
- B. username.
- C. cnid.
- D. dn.
Answer: B
Explanation:
https://kb.fortinet.com/kb/viewContent.do?externalId=FD37516
NEW QUESTION 34
Examine thefollowing partial outputs from two routing debug commands; then answer the question below:
Why the default route using port2 is not displayed in the output of the second command?
- A. It hasa higher priority than the default route using port1.
- B. It is disabled in the FortiGate configuration.
- C. It has a higher distance than the default route using port1.
- D. It has a lower priority than the default route using port1.
Answer: C
Explanation:
Explanation
http://kb.fortinet.com/kb/viewContent.do?externalId=FD32103
NEW QUESTION 35
Which the following events can trigger the election of a new primary unit in a HA cluster? (Choose two.)
- A. A secondary unit is removed from the HA cluster.
- B. The FortiGuard license for the primary unit is updated.
- C. Primary unit stops sending HA heartbeat keepalives.
- D. One of the monitored interfaces in the primary unit is disconnected.
Answer: C,D
NEW QUESTION 36
View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.
The administrator does not have access to the remote gateway. Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?
- A. Change phase 1 encryption to AESCBC and authentication to SHA2.
- B. Change phase 1 encryption to AES128 and authentication to SHA512.
- C. Change phase 1 encryption to 3DES and authentication to SHA128.
- D. Change phase 1 encryption to AES256 and authentication to SHA256.
Answer: D
NEW QUESTION 37
In which two states is a given session categorized as ephemeral? (Choose two.)
- A. A TCP session waiting for FIN ACK.
- B. A UDP session with packets sent and received.
- C. A TCP session waiting to complete the three-way handshake.
- D. A UDP session with only one packet received.
Answer: C,D
NEW QUESTION 38
What global configuration setting changes the behavior for content-inspected traffic while FortiGate is in system conserve mode?
- A. mem-failopen
- B. ips-failopen
- C. av-failopen
- D. utm-failopen
Answer: C
Explanation:
Explanation
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-security-profiles-54/Other_Profile_Consideration
NEW QUESTION 39
Which real time debug should an administrator enable to troubleshoot RADIUS authentication problems?
- A. Diagnose debug application radius -1.
- B. Diagnose debug application fnbamd -1.
- C. Diagnose authd console -log enable.
- D. Diagnose radius console -log enable.
Answer: B
NEW QUESTION 40
Examine the output of the 'diagnose sys session list expectation' command shown in the exhibit; than answer the question below.
Which statement is true regarding the session in the exhibit?
- A. It was created by the FortiGate kernel to allow push updates from FotiGuard.
- B. It was created by a session helper or ALG.
- C. It is for traffic originated from the FortiGate.
- D. It is for managementtraffic terminating at the FortiGate.
Answer: B
NEW QUESTION 41
Examine the output from the BGP real time debug shown in the exhibit, then the answer the question below:
Which statements are true regarding the output in the exhibit? (Choose two.)
- A. The state of the remote BGP peer will go to Connect after it confirms the received prefixes.
- B. Local BGP peer received a prefix for a default route.
- C. The state of the remote BGP peer is OpenConfirm.
- D. BGP peers have successfully interchanged Open and Keepalive messages.
Answer: B,D
NEW QUESTION 42
An administrator cannot connect to the GIU of a FortiGate unit with the IP address 10.0.1.254. The administrator runs the debug flow while attempting the connection using HTTP. The output of the debug flow is shown in the exhibit:
Based on the error displayed by the debug flow, which are valid reasons for this problem? (Choose two.)
- A. HTTP administrative access is configured with a port number different than 80.
- B. HTTP administrative access is disabled in the FortiGate interface with the IP address 10.0.1.254.
- C. Redirection of HTTP to HTTPS administrative access is disabled.
- D. The packet is denied because of reverse path forwarding check.
Answer: A,B
NEW QUESTION 43
An administrator has configured a dial-up IPsec VPN with one phase 2, extended authentication (XAuth) and IKE mode configuration. The administrator has also enabled the IKE real time debug:
diagnose debug application ike-1
diagnose debug enable
In which order is each step and phase displayed in the debug output each time a new dial-up user is connecting to the VPN?
- A. Phase1; IKE mode configuration; XAuth; phase 2.
- B. Phase1; IKE mode configuration; phase 2; XAuth.
- C. Phase1; XAuth; phase 2; IKE mode configuration.
- D. Phase1; XAuth; IKE mode configuration; phase2.
Answer: D
Explanation:
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-ipsecvpn-54/IPsec_VPN_Concepts/IKE_Packet_Processing.htm
NEW QUESTION 44
View the exhibit, which contains the output of a real-time debug, Which statement about this output is true?
Which of the following statements is true regarding this output?
- A. The requested URL belongs to category ID 255.
- B. FortiGate found the requested URL in its local cache.
- C. This web request was inspected using the ftgd-allow web filler profile.
- D. The server hostname Is training, fortinet.com.
Answer: B
NEW QUESTION 45
Which two conditions must be met for a statistic route to be active in the routing table? (Choose two.)
- A. There is no other route, to the same destination, with a higherdistance.
- B. The next-hop IP address is up.
- C. The outgoing interface is up.
- D. The link health monitor (if configured) is up.
Answer: C,D
NEW QUESTION 46
Examine the partial output from the IKE real time debug shown in the exhibit; then answer the question below.
Why didn't the tunnel come up?
- A. The remote gateway's Phase-1 configuration does not match the local gateway's phase-1 configuration.
- B. One IPsec gateway is using main mode, while the other IPsec gateway is using aggressive mode.
- C. IKE mode configuration is not enabled in the remote IPsec gateway.
- D. The remote gateway's Phase-2 configuration does not match the local gateway's phase-2 configuration.
Answer: A
NEW QUESTION 47
View the exhibit, which contains the partial output of an IKE real time debug, and then answerthe question below.
The administrator does not have access to the remote gateway. Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?
- A. Change phase 1 encryption to AES128 and authentication to SHA512.
- B. Change phase 1encryption to AESCBC and authentication to SHA128.
- C. Change phase 1 encryption to 3DES and authentication to CBC.
- D. Change phase 1 encryption to 3DES and authentication to SHA256.
Answer: C
NEW QUESTION 48
......
Feb-2023 Latest Actualtests4sure NSE7_EFW-6.4 Exam Dumps with PDF and Exam Engine: https://examtorrent.actualtests4sure.com/NSE7_EFW-6.4-practice-quiz.html
