Free Fortinet NSE 7 – Enterprise Firewall 6.4 Exam NSE7_EFW-6.4 Exam Practice Test

View the IPS exit log, and then answer the question below.# diagnose test application ipsmonitor 3ipsengine exit log''pid = 93 (cfg), duration = 5605322 (s) at Wed Apr 19 09:57:26 2017code = 11, reason: manualWhat is the status of IPS on this FortiGate?

• IPS engine memory consumption has exceeded the model-specific predefined value.
• IPS daemon experienced a crash.
• There are communication problems between the IPS engine and the management database.
• All IPS-related features have been disabled in FortiGate's configuration.

Examine the following partial outputs from two routing debug commands; then answer the question below.# get router info kerneltab=254 vf=0 scope=0type=1 proto=11 prio=0 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0gwy=10.200.1.254 dev=2(port1)tab=254 vf=0 scope=0type=1 proto=11 prio=10 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0gwy=10.200.2.254 dev=3(port2)tab=254 vf=0 scope=253type=1 proto=2 prio=0 0.0.0.0/0.0.0.0/.->10.0.1.0/24 pref=10.0.1.254gwy=0.0.0.0 dev=4(port3)# get router info routing-table all s*0.0.0.0/0 [10/0] via 10.200.1.254, portl [10/0] via 10.200.2.254, port2, [10/0] dO.0.1.0/24 is directly connected, port3 dO.200.1.0/24 is directly connected, portl d0.200.2.0/24 is directly connected, port2Which outbound interface or interfaces will be used by this FortiGate to route web traffic from internal users to the Internet?

• port!
• port2.
• Both portl and port2.
• port3.

Which statement about memory conserve mode is true?

• A FortiGate exits conserve mode when the configured memory use threshold reaches yellow.
• A FortiGate starts dropping all the new and old sessions when the configured memory use threshold reaches extreme.
• A FortiGate starts dropping new sessions when the configured memory use threshold reaches red
• A FortiGate enters conserve mode when the configured memory use threshold reaches red

Which statements about bulk configuration changes using FortiManager CLI scripts are correct? (Choose two.)

• When executed on the Policy Package, ADOM database, changes are applied directly to the managed FortiGate.
• When executed on the Device Database, you must use the installation wizard to apply the changes to the managed FortiGate.
• When executed on the All FortiGate in ADOM, changes are automatically installed without creating a new revision history.
• When executed on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.

Which of the following statements are correct regarding application layer test commands? (Choose two.)

• They are used to filter real-time debugs.
• They display real-time application debugs.
• Some of them display statistics and configuration information about a feature or process.
• Some of them can be used to restart an application.

Examine the following traffic log; then answer the question below.date-20xx-02-01 time=19:52:01 devname=master device_id='xxxxxxx' log_id=0100020007 type=event subtype=system pri critical vd=root service=kemel status=failure msg='NAT port is exhausted.'What does the log mean?

• There is not enough available memory in the system to create a new entry in the NAT port table.
• The limit for the maximum number of simultaneous sessions sharing the same NAT port has been reached.
• FortiGate does not have any available NAT port for a new connection.
• The limit for the maximum number of entries in the NAT port table has been reached.

How does FortiManager handle FortiGuard requests from FortiGate devices, when it is configured as a local FDS?

• FortiManager can download and maintain local copies of FortiGuard databases.
• FortiManager supports only FortiGuard push to managed devices.
• FortiManager will respond to update requests only if they originate from a managed device.
• FortiManager does not support rating requests.

Which of the following conditions must be met for a static route to be active in the routing table? (Choose three.)

• The next-hop IP address is up.
• There is no other route, to the same destination, with a higher distance.
• The link health monitor (if configured) is up.
• The next-hop IP address belongs to one of the outgoing interface subnets.
• The outgoing interface is up.

What does the dirty flag mean in a FortiGate session?

• Traffic has been blocked by the antivirus inspection.
• The next packet must be re-evaluated against the firewall policies.
• The session must be removed from the former primary unit after an HA failover.
• Traffic has been identified as from an application that is not allowed.

Which of the following statements are true regarding the SIP session helper and the SIP application layer gateway (ALG)? (Choose three.)

• SIP session helper runs in the kernel; SIP ALG runs as a user space process.
• SIP ALG supports SIP HA failover; SIP helper does not.
• SIP ALG supports SIP over IPv6; SIP helper does not.
• SIP ALG can create expected sessions for media traffic; SIP helper does not.
• SIP helper supports SIP over TCP and UDP; SIP ALG supports only SIP over UDP.