Free Fortinet NSE 7 – Enterprise Firewall 7.2 Exam NSE7_EFW-7.2 Exam Practice Test

After enabling IPS you receive feedback about traffic being dropped. What could be the reason?

• Np-accel-mode is set to enable
• Traffic-submit is set to disable
• IPS is configured to monitor
• Fail-open is set to disable

Which two statements about the neighbor-group command are true? (Choose two.)

• You can configure it on the GUI.
• It applies common settings in an OSPF area.
• It is combined with the neighbor-range parameter.
• You can apply it in Internal BGP (IBGP) and External BGP (EBGP).

Which two statements about metadata variables are true? (Choose two.)

• You create them on FortiGate
• They apply only to non-firewall objects.
• The metadata format is $.
• They can be used as variables in scripts

You contoured an address object on the tool fortiGate in a Security Fabric. This object is not synchronized with a downstream device. Which two reasons could be the cause? (Choose two)

• The address object on the tool FortiGate has fabric-object set to disable
• The root FortiGate has configuration-sync set to enable
• The downstream TortiGate has fabric-object-unification set to local
• The downstream FortiGate has configuration-sync set to local

Which FortiGate in a Security I auric sends togs to FortiAnalyzer?

• Only the root FortiGate.
• Each FortiGate in the Security fabric.
• The FortiGate devices performing network address translation (NAT) or unified threat management (UTM). if configured.
• Only the last FortiGate that handled a session in the Security Fabric

In which two ways does fortiManager function when it is deployed as a local FDS? (Choose two)

• lt can be configured as an update server a rating server or both
• It provides VM license validation services
• It supports rating requests from non-FortiGate devices.
• It caches available firmware updates for unmanaged devices

Which two statements about IKE version 2 fragmentation are true? (Choose two.)

• Only some IKE version 2 packets are considered fragmentable.
• The reassembly timeout default value is 30 seconds.
• It is performed at the IP layer.
• The maximum number of IKE version 2 fragments is 128.

An administrator has configured two fortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device What can the administrator do to fix this problem?

• Verify that the speed and duplex settings match between me FortiGate interfaces and the connected switch ports
• Configure set link -failed signal enable under-config system ha on both Cluster members
• Configure remote Iink monitoring to detect an issue in the forwarding path
• Configure set send-garp-on-failover enables under config system ha on both cluster members

Which two statements about IKE vision 2 are true? (Choose two.)

• Phase 1 includes main mode
• It supports the extensible authentication protocol (EAP)
• It supports the XAuth protocol.
• It exchanges a minimum of four messages to establish a secure tunnel

You created a VPN community using VPN Manager on FortiManager. You also added gateways to the VPN community. Now you are trying to create firewall policies to permit traffic over the tunnel however, the VPN interfaces do not appear as available options.

• Create interface mappings for the IPsec VPN interfaces before you use them in a policy.
• Refresh the device status using the Device Manager so that FortiGate populates the IPSec interfaces
• Configure the phase 1 settings in the VPN community that you didnt initially configure. FortiGate automatically generates the interfaces after you configure the required settings
• install the VPN community and gateway configuration on the fortiGate devices so that the VPN interfaces appear on the Policy Objects on fortiManager.