Fortinet NSE7_EFW-7.2 Exam Questions Instant Access

Question 1

Refer to the exhibit, which contains a partial OSPF configuration.

What can you conclude from this output?

ANeighbors maintain communication with the restarting router.

BThe router sends grace LSAs before it restarts.

CFortiGate restarts if the topology changes.

DThe restarting router sends gratuitous ARP for 30 seconds.

Answer : C

From the partial OSPF (Open Shortest Path First) configuration output:

B . The router sends grace LSAs before it restarts: This is implied by the command 'set restart-mode graceful-restart'. When OSPF is configured with graceful restart, the router sends grace LSAs (Link State Advertisements) to inform its neighbors that it is restarting, allowing for a seamless transition without recalculating routes.

Fortinet documentation on OSPF configuration clearly states that enabling graceful restart mode allows the router to maintain its adjacencies and routes during a brief restart period.

Question 2

Exhibit.

Refer to the exhibit, which shows information about an OSPF interlace

What two conclusions can you draw from this command output? (Choose two.)

AThe port3 network has more man one OSPF router

BThe OSPF routers are in the area ID of 0.0.0.1.

CThe interfaces of the OSPF routers match the MTU value that is configured as 1500.

DNGFW-1 is the designated router

Answer : A, C

From the OSPF interface command output, we can conclude that the port3 network has more than one OSPF router because the Neighbor Count is 2, indicating the presence of another OSPF router besides NGFW-1. Additionally, we can deduce that the interfaces of the OSPF routers match the MTU value configured as 1500, which is necessary for OSPF neighbors to form adjacencies. The MTU mismatch would prevent OSPF from forming a neighbor relationship.

Fortinet FortiOS Handbook: OSPF Configuration

Question 3

Refer to the exhibit, which shows an ADVPN network,

An administrator must configure an ADVPN using IBGP and EBGP to connect

overlay network 1 with 2.

What must the administrator configure in the phase 1 VPN IPSEC configuration

of the Hub2ub tunnels?

Aset auto-discovery-sender enable

Bset auto-discovery-forwarder enable

Cset add-route enable

Dset auto-discovery-receiver enable

Answer : B

Question 4

Refer to the exhibit, which shows a routing table.

What two options can you configure in OSPF to block the advertisement of the 10.1.10.0 prefix? (Choose two.)

ARemove the 16.1.10.C prefix from the OSPF network

BConfigure a distribute-list-out

CConfigure a route-map out

DDisable Redistribute Connected

Answer : B, C

To block the advertisement of the 10.1.10.0 prefix in OSPF, you can configure a distribute-list-out or a route-map out.A distribute-list-out is used to filter outgoing routing updates from being advertised to OSPF neighbors1.A route-map out can also be used for filtering and is applied to outbound routing updates2.Reference:=Technical Tip: Inbound route filtering in OSPF usi ... - Fortinet Community,OSPF | FortiGate / FortiOS 7.2.2 - Fortinet Documentation

Question 5

Which statement is true regarding the Bidirectional Forwarding Detection protocol in BGP?

ABFD is only supported when two FortiGate devices are directly connected on the same network

BBFD is using BGP keepalive messages to check the status of BGP peer

CBFD is used to detect one way device failure

DBFD is enabled under config router bfd configuration

Answer : C

Question 6

Which statement about network processor (NP) offloading is true?

AFor TCP traffic FortiGate CPU offloads the first packets of SYN/ACK and ACK of the three-way handshake to NP

BThe NP provides IPS signature matching

CYou can disable the NP for each firewall policy using the command np-acceleration st to loose.

DThe NP checks the session key or IPSec SA

Answer : D

Network processors (NPs) are specialized hardware within FortiGate devices that accelerate certain security functions. One of the primary functions of NPs is to provide IPS signature matching (B), allowing for high-speed inspection of traffic against a database of known threat signatures.

Question 7

Refer to the exhibit, which shows config system central-management information.

Which setting must you configure for the web filtering feature to function?

AAdd server. fortiguard. net to the server list.

BConfigure securewf.fortiguard. net on the default servers.

CSet update-server-location to automatic.

DConfigure server-type with the rating option.

Answer : D

For the web filtering feature to function effectively, the FortiGate device needs to have a server configured for rating services. The rating option in the server-type setting specifies that the server is used for URL rating lookup, which is essential for web filtering. The displayed configuration does not list any FortiGuard web filtering servers, which would be necessary for web filtering. The setting set include-default-servers disable indicates that the default FortiGuard servers are not being used, and hence, a specific server for web filtering (like securewf.fortiguard.net) needs to be configured.

Fortinet NSE 7 - Enterprise Firewall 7.2 NSE7_EFW-7.2 Exam Questions