Fortinet NSE7_SDW-7.2 Exam Practice Test Instant Access

Question 1

Which two statements describe how IPsec phase 1 main mode id different from aggressive mode when performing IKE negotiation? (Choose two.)

AA peer ID is included in the first packet from the initiator, along with suggested security policies.

BXAuth is enabled as an additional level of authentication, which requires a username and password.

CThree packets are exchanged between an initiator and a responder instead of six packets.

DThe use of Diffie Hellman keys is limited by the responder and needs initiator acceptance.

Answer : A, C

Question 2

Refer to the exhibit.

Based on the exhibit, which two statements are correct about the health of the selected members? (Choose two.)

AAfter FortiGate switches to active mode, FortiGate never fails back to passive monitoring.

BDuring passive monitoring, FortiGate can't detect dead members.

CFortiGate can offload the traffic that is subject to passive monitoring to hardware.

DFortiGate passively monitors the member if TCP traffic is passing through the member.

Answer : B, D

Question 3

Which statement is correct about SD-WAN and ADVPN?

ARoutes for ADVPN shortcuts must be manually configured.

BSD-WAN can steer traffic to ADVPN shortcuts, established over IPsec overlays, configured as SD-WAN members.

CSD-WAN does not monitor the health and performance of ADVPN shortcuts.

DYou must use IKEv2 on IPsec tunnels.

Answer : B

Question 4

Refer to the exhibits.

Exhibit A

Exhibit B

Exhibit A shows an SD-WAN event log and exhibit B shows the member status and the SD-WAN rule configuration.

Based on the exhibits, which two statements are correct? (Choose two.)

AFortiGate updated the outgoing interface list on the rule so it prefers port2.

BPort2 has the highest member priority.

CPort2 has a lower latency than port1.

DSD-WAN rule ID 1 is set to lowest cost (SLA) mode.

Answer : A, C

Question 5

Refer to the exhibit.

FortiGate has multiple dial-up VPN interfaces incoming on port1 that match only FIRST_VPN.

Which two configuration changes must be made to both IPsec VPN interfaces to allow incoming connections to match all possible IPsec dial-up interfaces? (Choose two.)

ASpecify a unique peer ID for each dial-up VPN interface.

BUse different proposals are used between the interfaces.

CConfigure the IKE mode to be aggressive mode.

DUse unique Diffie Hellman groups on each VPN interface.

Answer : A, C

Question 6

Refer to the exhibit.

The exhibit shows the SD-WAN rule status and configuration.

Based on the exhibit, which change in the measured latency will make T_MPLS_0 the new preferred member?

AWhen T_INET_0_0 and T_MPLS_0 have the same latency.

BWhen T_MPLS_0 has a latency of 100 ms.

CWhen T_INET_0_0 has a latency of 250 ms.

DWhen T_N1PLS_0 has a latency of 80 ms.

Answer : D

Question 7

Exhibit.

Which conclusion about the packet debug flow output is correct?

AThe total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.

BThe packet size exceeded the outgoing interface MTU.

CThe number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.

DThe number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the firewall policy, and the packet was dropped.

Answer : C

In a Per-IP shaper configuration, if an IP address exceeds the configured concurrent session limit, the message 'Denied by quota check' appears. SD-WAN 7.0 Study Guide page 287

Fortinet NSE7_SDW-7.2 Fortinet NSE 7 - SD-WAN 7.2 Exam Practice Test