Free Fortinet NSE 7 – Enterprise Firewall 7.2 Exam NSE7_EFW-7.2 Exam Practice Test

Which statement about network processor (NP) ofloading is true?

• For TCP traffic FortiGate CPU ofloads the first packets of SYN/ACK and ACK of the three-way handshake to NP
• The NP provides IPS signature matching
• You can disable the NP for each firewall policy using the command np-acceleration st to loose.
• The NP checks the session key or IPSec SA

Which ADVPN configuration must be configured using a script on fortiManager, when using VPN Manager to manage fortiGate VPN tunnels?

• Enable AD-VPN in IPsec phase 1
• Disable add-route on hub
• Configure IP addresses on IPsec virtual interlaces
• Set protected network to all

Which two statements about the neighbor-group command are true? (Choose two.)

• You can configure it on the GUI.
• It applies common settings in an OSPF area.
• It is combined with the neighbor-range parameter.
• You can apply it in Internal BGP (IBGP) and External BGP (EBGP).

Which two statements about ADVPN are true? (Choose two.)

• You must disable add-route in the hub.
• AllFortiGate devices must be in the same autonomous system (AS).
• The hub adds routes based on IKE negotiations.
• You must configure phase 2 quick mode selectors to 0.0.0.0 0.0.0.0.

Which two statements about the Security fabric are true? (Choose two.)

• FortiGate uses the FortiTelemetry protocol to communicate with FortiAnatyzer.
• Only the root FortiGate sends logs to FortiAnalyzer
• Only FortiGate devices with configuration-sync receive and synchronize global CMDB objects that the toot FortiGate sends
• Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer

Which two statements about IKE vision 2 are true? (Choose two.)

• Phase 1 includes main mode
• It supports the extensible authentication protocol (EAP)
• It supports the XAuth protocol.
• It exchanges a minimum of four messages to establish a secure tunnel

You want to improve reliability over a lossy IPSec tunnel.Which combination of IPSec phase 1 parameters should you configure?

• fec-ingress and fec-egress
• Odpd and dpd-retryinterval
• fragmentation and fragmentation-mtu
• keepalive and keylive

You contoured an address object on the tool fortiGate in a Security Fabric. This object is not synchronized with a downstream device. Which two reasons could be the cause? (Choose two)

• The address object on the tool FortiGate has fabric-object set to disable
• The root FortiGate has configuration-sync set to enable
• The downstream TortiGate has fabric-object-unification set to local
• The downstream FortiGate has configuration-sync set to local

In which two ways does fortiManager function when it is deployed as a local FDS? (Choose two)

• lt can be configured as an update server a rating server or both
• It provides VM license validation services
• It supports rating requests from non-FortiGate devices.
• It caches available firmware updates for unmanaged devices

Which two statements about the BFD parameter in BGP are true? (Choose two.)

• It allows failure detection in less than one second.
• The two routers must be connected to the same subnet.
• It is supported for neighbors over multiple hops.
• It detects only two-way failures.