Real Fortinet NSE7_EFW-6.4 Exam Questions Study Guide
Updated and Accurate NSE7_EFW-6.4 Questions for passing the exam Quickly
NEW QUESTION # 52
View the central management configuration shown in the exhibit, and then answer the question below.
Which server will FortiGate choose for antivirus and IPS updates if 10.0.1.243 is experiencing an outage?
- A. 10.0.1.242
- B. 10.0.1.244
- C. 10.0.1.240
- D. One of the public FortiGuard distribution servers
Answer: D
NEW QUESTION # 53
View the exhibit, which contains the partial output of an IKE real time debug, and then answer the question below.
The administrator does not have access to the remote gateway. Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?
- A. Change phase 1 encryption to 3DES and authentication to SHA256.
- B. Change phase 1 encryption to AESCBC and authentication to SHA128.
- C. Change phase 1 encryption to 3DES and authentication to CBC.
- D. Change phase 1 encryption to AES128 and authentication to SHA512.
Answer: C
NEW QUESTION # 54
What configuration changes can reduce the memory utilization in a FortiGate? (Choose two.)
- A. Increase the FortiGuard cache time to live.
- B. Reduce the maximum file size to inspect.
- C. Increase the TCP session timers.
- D. Reduce the session time to live.
Answer: B,D
NEW QUESTION # 55
Refer to the exhibit, which contains partial output from an IKE real-time debug.
Based on the debug output, which phase 1 setting is enabled in the configuration of this VPN?
- A. auto-discovery-receiver
- B. auto-discovery-shortcut
- C. auto-discovery-forwarder
- D. auto-discovery-sender
Answer: A
Explanation:
Reference:
First the Spoke receives SHORTCUT_OFFER, it respondes with sending shortcut-query. AT the end it receives SHORTCUT_REPLY and creates new dynamic tunnel (H2S_0_0).
NEW QUESTION # 56
Examine the output of the 'get router info ospf neighbor' command shown in the exhibit; then answer the question below.
Which statements are true regarding the output in the exhibit? (Choose two.)
Refer to the exhibit, which shows the output of a debug command.
Which statement about the output is true?
- A. The interface ToRemote is a point-to-point OSPF network.
- B. The OSPF router with the ID 0.0.0.2 is the designated router for the ToRemote network.
- C. TheOSPF routers with the IDs 0.0.0.69 and 0.0.0.117 are both designated routers for the war. l network.
- D. The local FortiGate is the designated router for the wan1 network.
Answer: A
Explanation:
https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/13685-13.html
NEW QUESTION # 57
What conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three.)
- A. OSPF costs match.
- B. IP addressesare in the same subnet.
- C. Hello and dead intervals match.
- D. OSPF peer IDs match.
- E. OSPF IP MTUs match.
Answer: B,C,E
Explanation:
Explanation
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-advanced-routing-54/Routing_OSPF/OSPF_Bac
NEW QUESTION # 58
Examine the output of the 'get router info ospf interface' command shown in the exhibit; then answer the question below.
Which statements are true regarding the above output? (Choose two.)
- A. There are at least 5 OSPF routers connected to the port4 network.
- B. The local FortiGate has been elected as the OSPF backup designated router.
- C. Two OSPF routers are down in the port4 network.
- D. The port4 interface is connected to the OSPF backbone area.
Answer: A,D
Explanation:
on BROADCAST network there are 4 neighbors, among which 1*DR +1*BDR. So our FG has 4 neighbors, but create adjacency only with 2 (with DR and BDR). 2 neighbors DRother (not down).
NEW QUESTION # 59
View the exhibit, which contains a session entry, and then answer the question below.
Which statement is correct regarding this session?
- A. It is a TCP session in ESTABLISHED state from 10.1.10.10 to 10.200.5.1.
- B. It is an ICMP session from 10.1.10.10 to 10.200.5.1.
- C. It is a TCP session in CLOSE_WAIT state from 10.1.10.10 to 10.200.1.1.
- D. It is an ICMP session from 10.1.10.10 to 10.200.1.1.
Answer: B
NEW QUESTION # 60
Examine the output of the 'diagnose sys session list expectation' command shown in the exhibit; than answer the question below.
Which statement is true regarding the session in the exhibit?
- A. It is for traffic originated from the FortiGate.
- B. It was created by the FortiGate kernel to allow push updates from FotiGuard.
- C. It is for management traffic terminating at the FortiGate.
- D. It was created by a session helper or ALG.
Answer: D
NEW QUESTION # 61
The CLI command set intelligent-mode <enable | disable> controls the IPS engine's adaptivescanning behavior. Which of the following statements describes IPS adaptive scanning?
- A. Downloads signatures on demand from FDS based on scanning requirements.
- B. Choose a matching algorithm based on available memory and the type of inspection being performed.
- C. Determines when it is secure enough to stop scanning session traffic.
- D. Determines the optimal number of IPS engines required based on system load.
Answer: C
Explanation:
Explanation
Configuring IPS intelligenceStarting with FortiOS 5.2,intelligent-mode is a new adaptive detection method. This command is enabled the default and it means that the IPS engine will perform adaptive scanning so that, for some traffic, the FortiGate can quickly finish scanning and offload the traffic to NPU orkernel. It is a balanced method which could cover all known exploits. When disabled, the IPS engine scans every single byte.
config ips globalset intelligent-mode {enable|disable}
NEW QUESTION # 62
Refer to the exhibit, which contains the output of a BGP debug command.
Which statement about the exhibit is true?
- A. The local router has not established a TCP session with 100.64.3.1.
- B. The local router BGP state is OpenConfirm with the 10.127.0.75 peer.
- C. The local router has received a total of three BGP prefixes from all peers.
- D. Since the counters were last reset, the 10.200.3.1 peer has never been down.
Answer: A
NEW QUESTION # 63
View the exhibit, which contains a partial output of an IKE real-time debug, and then answer the question below.
Based on the debug output, which phase-1 setting is enabled in the configuration of this VPN?
- A. auto-discovery-shortcut
- B. auto-discovery-receiver
- C. auto-discovery-sender
- D. auto-discovery-forwarder
Answer: D
NEW QUESTION # 64
View the exhibit, which contains the output of diagnose sys session list, and then answer the question below.
If the HA ID for the primary unit is zero (0), which statement is correct regarding the output?
- A. The inspection of this session has been offloaded to the slave unit.
- B. This session is for HA heartbeat traffic.
- C. This session is synced with the slave unit.
- D. This session cannot be synced with the slave unit.
Answer: C
NEW QUESTION # 65
The logs in a FSSO collector agent (CA) are showing the following error:
failed to connect to registry: PIKA1026 (192.168.12.232)
What can be the reason for this error?
- A. The FortiGate cannot resolve the name of the workstation.
- B. The remote registry service is not running in the workstation 192.168.12.232.
- C. The CA cannot resolve the name of the workstation.
- D. The CA cannot reach the FortiGate with the IP address192.168.12.232.
Answer: B
Explanation:
Explanation
https://kb.fortinet.com/kb/documentLink.do?externalID=FD30548
NEW QUESTION # 66
Exhibits:
Refer to the exhibits, which contain the network topology and BGP configuration for a hub.
An administrator is trying to configure ADVPN with a hub-spoke VPN setup using iBGP. All the VPNs are up and connected to the hub. The hub is receiving route information from both spokes over iBGP; however, the spokes are not receiving route information from each other.
What change must the administrator make to the hub BGP configuration so that the routes learned by one spoke are forwarded to the other spokes?
- A. Configure the hub as a route reflector client.
- B. Configure an individual neighbor and remove neighbor-range configuration.
- C. Make the configuration of remote-as different from the configuration of local-as.
- D. Change the router id to 10.1.0.254.
Answer: A
NEW QUESTION # 67
Refer to the exhibit, which contains the partial output of a diagnose command.
Based on the output, which two statements are correct? (Choose two.)
- A. The remote gateway IP is 10.200.4.1.
- B. Quick mode selectors are disabled.
- C. DPD is disabled.
- D. Anti-replay is enabled
Answer: A,D
NEW QUESTION # 68
View the exhibit, which contains a partial web filter profile configuration, and then answer the question below.
Which action will FortiGate take if a user attempts to access www.dropbox.com, which is categorized as File Sharing and Storage?
- A. FortiGate will block the connection based on the URL Filter configuration.
- B. FortiGate will block the connection as an invalid URL.
- C. FortiGate will allow the connection based on the FortiGuard category based filter configuration.
- D. FortiGate will exempt the connection based on the Web Content Filter configuration.
Answer: A
Explanation:
fortigate does it in order Static URL -> FortiGuard - > Content -> Advanced (java, cookie removal..) so block it in first step
NEW QUESTION # 69
......
Prepare Important Exam with NSE7_EFW-6.4 Exam Dumps: https://lead2pass.testvalid.com/NSE7_EFW-6.4-valid-exam-test.html