NSE7_EFW-6.4 Sample Practice Exam Questions 2023 Updated Verified [Q46-Q66]

4.5/5 - (2 votes)

NSE7_EFW-6.4 Sample Practice Exam Questions 2023 Updated Verified

Exam Study Guide Free Practice Test LAST UPDATED NSE7_EFW-6.4

NEW QUESTION 46
When using the SSL certificate inspection method for HTTPS traffic, how does FortiGate filter web requests when the browser client does not provide the server name indication (SNI) extension?

FortiGate uses CN information from the Subject field in the server’s certificate.

FortiGate switches to the full SSL inspection method to decrypt the data.

FortiGate blocks the request without any further inspection.

FortiGate uses the requested URL from the user’s web browser.

NEW QUESTION 47
AFortiGate’s portl is connected to a private network. Its port2 is connected to the Internet. Explicit web proxy is enabled in port1 and only explicit web proxy users can access the Internet. Web cache is NOT enabled. An internal web proxy user is downloading a file from the Internet via HTTP. Which statements are true regarding the two entries in the FortiGate session table related with this traffic? (Choose two.)

Both session have the local flag on.

The destination IP addresses of both sessions are IP addresses assigned to FortiGate’sinterfaces.

One session has the proxy flag on, the other one does not.

One of the sessions has the IP address of port2 as the source IP address.

NEW QUESTION 48
An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device. The administrator decides to enable the setting link-failed-signal to fix the problem.
Which statement about this setting is true?

It sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.

It sends a link failed signal to all connected devices.

It disabled all the non-heartbeat interfaces in all HA members for two seconds after a failover.

It forces the former primary device to shut down all its non-heartbeat interfaces for one second, while the failover occurs.

NEW QUESTION 49
An administrator has configured two FortiGate devices for an HA cluster. While testing the HA failover, the administrator noticed that some of the switches in the network continue to send traffic to the former primary unit. The administrator decides to enable the setting link-failed-signal to fix the problem. Which statement is correct regarding this command?

Forces the former primary device to shut down all its non-heartbeat interfaces forone second while the failover occurs.

Sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.

Sends a link failed signal to all connected devices.

Disables all the non-heartbeat interfaces in all the HA members for two seconds after a failover.

NEW QUESTION 50
How does FortiManager handle FortiGuard requests from FortiGate devices, when it is configured as a local FDS?

FortiManager can download and maintain local copies of FortiGuard databases.

FortiManager supports only FortiGuard push to managed devices.

FortiManager will respond to update requests only if they originate from a managed device.

FortiManager does not support rating requests.

NEW QUESTION 51
A FortiGate device has the following LDAP configuration:

The LDAP user student cannot authenticate. The exhibit shows the output of the authentication real time debug while testing the student account:

Based on the above output, what FortiGate LDAP settings must the administer check? (Choose two.)

cnid.

username.

password.

dn.

NEW QUESTION 52
Which of the following conditions must be met fora static route to be active in the routing table? (Choose three.)

The next-hop IP address is up.

There is no other route, to the same destination, with a higher distance.

The link health monitor (if configured) is up.

The next-hop IP address belongs to one of the outgoing interface subnets.

The outgoing interface is up.

NEW QUESTION 53
Four FortiGate devices configured for OSPF connected to the same broadcast domain. The first unit is elected as the designated router The second unit is elected as the backup designated router Under normal operation, how many OSPFfull adjacencies are formed to each of the other two units?

NEW QUESTION 54
View the exhibit, which contains the output of a diagnose command, and then answer the question below.

Which statements are true regarding the output in the exhibit? (Choose two.)

FortiGate will probe 121.111.236.179 every fifteen minutes for a response.

Servers with the D flag are considered to be down.

Servers with a negative TZ value are experiencing a service outage.

FortiGate used 209.222.147.3 as the initial server to validate its contract.

NEW QUESTION 55
Examine the IPsec configuration shown in the exhibit; then answer the question below.

An administrator wants to monitor the VPN by enabling the IKE real time debug using these commands:
diagnose vpn ike log-filter src-addr4 10.0.10.1
diagnose debug application ike -1
diagnose debug enable
The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are being interchanged between both IPsec gateways. However, the IKE real time debug does NOT show any output. Why isn’t there any output?

The IKE real time shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.

The log-filter setting is set incorrectly. The VPN’s traffic does not match this filter.

The IKE real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.

The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.

NEW QUESTION 56
Which configuration can be used to reduce the number of BGP sessions in an IBGP network?

Neighbor range

Route reflector

Next-hop-self

Neighbor group

NEW QUESTION 57
Which of the following conditions must be met for a static route to be active in the routing table? (Choose three.)

The next-hop IP address is up.

There is no other route, to the same destination, with a higher distance.

The link health monitor (if configured) is up.

The next-hop IP address belongs to one of the outgoing interface subnets.

The outgoing interface is up.

NEW QUESTION 58
Which statement about NGFW policy-based application filtering is true?

After the application has been identified, the kernel uses only the Layer 4 header to match the traffic.

The IPS security profile is the only security option you can apply to the security policy with the action set to ACCEPT.

After IPS identifies the application, it adds an entry to a dynamic ISDB table.

FortiGate will drop all packets until the application can be identified.

NEW QUESTION 59
An administrator cannot connect to the GIU of a FortiGate unit with the IP address 10.0.1.254. The administrator runs the debug flow while attempting the connection using HTTP. The output of the debug flow is shown in the exhibit:

Based on the error displayed by the debug flow, which are valid reasons for this problem? (Choose two.)

HTTP administrative access is disabled in the FortiGate interface with the IP address 10.0.1.254.

Redirection of HTTP to HTTPS administrative access is disabled.

HTTP administrative access is configured with a port number different than 80.

The packet is denied because of reverse path forwarding check.

NEW QUESTION 60
Examine the output from the BGP real time debug shown in the exhibit, then the answer the question below:

Which statements are true regarding the output in the exhibit? (Choose two.)

BGP peers have successfully interchanged Open and Keepalive messages.

Local BGP peer received a prefix for a default route.

The state of the remote BGP peer is OpenConfirm.

The state of the remote BGP peer will go to Connect after it confirms the received prefixes.

NEW QUESTION 61
Examine the output of the ‘get router info ospf neighbor’ command shown in the exhibit; then answer the question below.

Which statements are true regarding the output in the exhibit? (Choose two.)
Refer to the exhibit, which shows the output of a debug command.
Which statement about the output is true?

TheOSPF routers with the IDs 0.0.0.69 and 0.0.0.117 are both designated routers for the war. l network.

The OSPF router with the ID 0.0.0.2 is the designated router for the ToRemote network.

The local FortiGate is the designated router for the wan1 network.

The interface ToRemote is a point-to-point OSPF network.

NEW QUESTION 62
Viewthe exhibit, which contains the output of a real-time debug, and then answer the question below.

Which of the following statements is true regarding this output? (Choose two.)

This web request was inspected using the root web filter profile.

FortiGate found the requested URL in its local cache.

The requested URL belongs to category ID 52.

The web request was allowed by FortiGate.

NEW QUESTION 63
Examine the output of the ‘diagnose debug rating’ command shown in the exhibit; then answer the question below.

Which statement are true regarding the output in the exhibit? (Choose two.)

There are three FortiGuard serversthat are not responding to the queries sent by the FortiGate.

The TZ value represents the delta between each FortiGuard server’s time zone and the FortiGate’s time zone.

FortiGate will send the FortiGuard queries to the server withhighest weight.

A server’s round trip delay (RTT) is not used to calculate its weight.

NEW QUESTION 64
A FortiGate device has the following LDAP configuration:

The administrator executed the ‘dsquery’ command in the Windows LDAp server 10.0.1.10, and got the following output:
>dsquery user -samid administrator
“CN=Administrator, CN=Users, DC=trainingAD, DC=training, DC=lab”
Based on the output, what FortiGate LDAP setting is configured incorrectly?

cnid.

username.

password.

dn.

NEW QUESTION 65
View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

Why didn’t the tunnel come up?

The pre-shared keys do not match.

The remote gateway’s phase 2configuration does not match the local gateway’s phase 2 configuration.

The remote gateway’s phase 1 configuration does not match the local gateway’s phase 1 configuration.

The remote gateway is using aggressive mode and the local gateway is configured to use man mode.

NEW QUESTION 66
When using the SSL certificate inspection method to inspect HTTPS traffic, how does FortiGate filter web requests when the client browser does notprovide the server name indication (SNI) extension?

FortiGate uses the requested URL from the user’s web browser.

FortiGate uses the CN information from the Subject field in the server certificate.

FortiGate blocks the request without any furtherinspection.

FortiGate switches to the full SSL inspection method to decrypt the data.

The New NSE7_EFW-6.4 2023 Updated Verified Study Guides & Best Courses: https://www.actualcollection.com/NSE7_EFW-6.4-exam-questions.html

Leave a comment Cancel reply