Dec-2021 Latest Exam-Killer NSE7_EFW-6.4 Exam Dumps with PDF and Exam Engine Free Updated Today!
Following are some new NSE7_EFW-6.4 Real Exam Questions!
NEW QUESTION 15
Examine thefollowing partial outputs from two routing debug commands; then answer the question below:
Why the default route using port2 is not displayed in the output of the second command?
- A. It has a higher distance than the default route using port1.
- B. It hasa higher priority than the default route using port1.
- C. It is disabled in the FortiGate configuration.
- D. It has a lower priority than the default route using port1.
Answer: A
Explanation:
Explanation
http://kb.fortinet.com/kb/viewContent.do?externalId=FD32103
NEW QUESTION 16
View the exhibit, which contains a screenshot of some phase-1settings, and then answer the question below.
The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel. To diagnose, the administrator enters these CLI commands:
However, the IKE real time debug does not show any output. Why?
- A. The log-filter setting was set incorrectly. The VPN's traffic does not match thisfilter.
- B. The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.
- C. The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.
- D. The debug shows only error messages. If there is no output, then the tunnel is operating normally.
Answer: A
NEW QUESTION 17
A FortiGate is rebooting unexpectedly without any apparent reason. What troubleshooting tools could an administrator use to get more information about the problem? (Choose two.)
- A. Logs.
- B. Crashlogs.
- C. Policy monitor.
- D. Firewall monitor.
Answer: A,B
NEW QUESTION 18
Which of the following statements are true regardingthe SIP session helper and the SIP application layer gateway (ALG)? (Choose three.)
- A. SIP ALG supports SIP HA failover; SIP helper does not.
- B. SIP helper supports SIP over TCP and UDP; SIP ALG supports only SIP over UDP.
- C. SIP ALG can create expected sessions for media traffic; SIP helper does not.
- D. SIP ALG supports SIP over IPv6; SIP helper does not.
- E. SIP session helper runs in the kernel; SIP ALG runs as a user space process.
Answer: A,C,D
NEW QUESTION 19
An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer.If the administrator knows that there is no NAT device located between both FortiGates, what command should the administrator execute?
- A. diagnose snifferpacket any 'esp'
- B. diagnose sniffer packet any 'udp port 500 or udp port 4500'
- C. diagnose sniffer packet any 'udp port 4500'
- D. diagnose sniffer packet any 'udp port 500'
Answer: A
Explanation:
Explanation
Capture IKE Traffic without NAT:diagnose sniffer packet 'host and udp port 500'
--------------------------------------Capture ESP
Traffic without NAT:diagnose sniffer packet any 'host and esp'
--------------------------------------Capture IKE
and ESP with NAT-T:diagnose sniffer packet any 'host and (udp port 500 or udp port 4500)'
NEW QUESTION 20
How does FortiManager handle FortiGuard requests from FortiGate devices, when it is configured as a local FDS?
- A. FortiManager supports only FortiGuard push to managed devices.
- B. FortiManager does not support rating requests.
- C. FortiManager can download and maintain local copies of FortiGuard databases.
- D. FortiManager will respond to update requests only if they originate from a managed device.
Answer: C
NEW QUESTION 21
What is the diagnose test application ipsmonitor 99 command used for?
- A. To disable the IPS engine
- B. To provide information regarding IPS sessions
- C. To restart all IPS engines and monitors
- D. To enable IPS bypass mode
Answer: C
NEW QUESTION 22
The CLI command set intelligent-mode <enable | disable> controls the IPS engine's adaptivescanning behavior. Which of the following statements describes IPS adaptive scanning?
- A. Downloads signatures on demand from FDS based on scanning requirements.
- B. Determines the optimal number of IPS engines required based on system load.
- C. Determines when it is secure enough to stop scanning session traffic.
- D. Choose a matching algorithm based on available memory and the type of inspection being performed.
Answer: C
Explanation:
Explanation
Configuring IPS intelligenceStarting with FortiOS 5.2,intelligent-mode is a new adaptive detection method. This command is enabled the default and it means that the IPS engine will perform adaptive scanning so that, for some traffic, the FortiGate can quickly finish scanning and offload the traffic to NPU orkernel. It is a balanced method which could cover all known exploits. When disabled, the IPS engine scans every single byte.
config ips globalset intelligent-mode {enable|disable}
NEW QUESTION 23
Refer to the exhibit, which contains the output of a BGP debug command.
Which statement about the exhibit is true?
- A. The local router BGP state is OpenConfirm with the 10.127.0.75 peer.
- B. The local router has not established a TCP session with 100.64.3.1.
- C. The local router has received a total of three BGPprefixes from all peers.
- D. Since the counters were last reset, the 10.200.3.1 peer has never been down.
Answer: B
NEW QUESTION 24
Refer to the exhibit, which contains the partial output of a diagnose command.
Based on the output, which two statements arecorrect? (Choose two.)
- A. Quick mode selectors are disabled.
- B. Anti-replay is enabled.
- C. Remote gateway IP is 10.200.4.1.
- D. DPD is disabled.
Answer: B,C
NEW QUESTION 25
Which statements about bulk configuration changes using FortiManager CLI scripts are correct? (Choose two.)
- A. When executed on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.
- B. When executed on the Policy Package, ADOM database, changes are applied directly to the managed FortiGate.
- C. When executed on the Device Database, you must use the installation wizard to apply the changes to the managed FortiGate.
- D. When executed on the All FortiGate in ADOM, changes are automatically installed without creating a new revision history.
Answer: A,C
Explanation:
Explanation
CLI scripts can be run in three different ways:Device Database: By default, a script is executed on the device database. It is recommend you run the changes on the device database (default setting), as this allows you to check what configuration changes you will send to the managed device. Once scripts are run on the device database, you can install these changes to a managed device using the installation wizard.
Policy Package, ADOM database: If a script contains changes related to ADOM level objects and policies, you can change the default selection to run on Policy Package, ADOM database and can then be installed using the installation wizard.
Remote FortiGate directly (through CLI): A script can be executed directly on the device and you don't need to install these changes using the installation wizard. As the changes are directly installed on the managed device, no option is provided to verify and check the configuration changes through FortiManager prior to executing it.
NEW QUESTION 26
An administrator has configured two FortiGate devices for an HA cluster. While testing the HA failover, the administrator noticed that some of the switches in the network continue to send traffic to the former primary unit. The administrator decides to enable the setting link-failed-signal to fix the problem. Which statement is correct regarding this command?
- A. Forces the former primary device to shut down all its non-heartbeat interfaces forone second while the failover occurs.
- B. Disables all the non-heartbeat interfaces in all the HA members for two seconds after a failover.
- C. Sends a link failed signal to all connected devices.
- D. Sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.
Answer: A
NEW QUESTION 27
Examine the partial output from the IKE real time debug shown in the exhibit; then answer the question below.
Why didn't the tunnel come up?
- A. IKE mode configuration is not enabled in the remote IPsec gateway.
- B. Theremote gateway's Phase-2 configuration does not match the local gateway's phase-2 configuration.
- C. The remote gateway's Phase-1 configuration does not match the local gateway's phase-1 configuration.
- D. One IPsec gateway is using main mode, while theother IPsec gateway is using aggressive mode.
Answer: C
NEW QUESTION 28
View the exhibit, which contains the output of a diagnose command, and then answer the question below.
Which statements are true regarding the output in the exhibit? (Choose two.)
- A. Servers with a negative TZ value are experiencing a service outage.
- B. Servers with the D flag are considered to be down.
- C. FortiGate will probe 121.111.236.179 every fifteen minutes for a response.
- D. FortiGate used 209.222.147.3 as the initial server to validate its contract.
Answer: C,D
Explanation:
Explanation
A - because flag is Failed so fortigate will check if server is available every 15 minD-state is I , contact to validate contract info
NEW QUESTION 29
What conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three.)
- A. OSPF costs match.
- B. Hello and dead intervals match.
- C. IP addressesare in the same subnet.
- D. OSPF IP MTUs match.
- E. OSPF peer IDs match.
Answer: B,C,D
Explanation:
Explanation
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-advanced-routing-54/Routing_OSPF/OSPF_Bac
NEW QUESTION 30
View the exhibit, which contains the output of a diagnose command, and then answer the question below.
What statements are correct regarding the output? (Choose two.)
- A. Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.0.1.10.
- B. This is an expected session created by an application control profile.
- C. This is anexpected session created by a session helper.
- D. Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.200.1.1.
Answer: C,D
NEW QUESTION 31
......
Resources From:
- 2021 Latest Exam-Killer NSE7_EFW-6.4 Exam Dumps (PDF & Exam Engine) Free Share: https://www.exam-killer.com/NSE7_EFW-6.4-valid-questions.html
- 2021 Latest Exam-Killer NSE7_EFW-6.4 PDF and NSE7_EFW-6.4 Exam Dumps Free Share: https://drive.google.com/open?id=1sedGyvGKNqyqYuN_FhZNEae7M7XjzF7w
Free Resources from Exam-Killer, We Devoted to Helping You 100% Pass All Exams!
