[2026] Fortinet NSE7 Enterprise Firewall - FortiOS 5.4

문제1

When does a RADIUS server send an Access-Challenge packet?

A. The user account is not found in the server.

B. The user credentials are wrong.

C. The server does not have the user credentials yet.

D. The server requires more information from the user, such as the token code for two-factor authentication.

정답: D

문제2

View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.
ike 0: comes 10.0.0.2:500->10.0.0.1:500, ifindex=7....
ike 0: IKEv1 exchange=Aggressive id=baf47d0988e9237f/2f405ef3952f6fda len=430 ike 0: in BAF47D0988E9237F2F405EF3952F6FDA0110040000000000000001AE0400003C0000000100000001000000 ike 0:RemoteSite:4: initiator: aggressive mode get 1st response...
ike 0:RemoteSite:4: VID RFC 3947 4A131c81070358455C5728F20E95452F
ike 0:RemoteSite:4: VID DPD AFCAD71368A1F1C96B8696FC77570100
ike 0:RemoteSite:4: VID FORTIGATE 8299031757A36082C6A621DE000502D7
ike 0:RemoteSite:4: peer is FortiGate/Fortios (v5 b727)
ike 0:RemoteSite:4: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3
ike 0:RemoteSite:4: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3C0000000 ike 0:RemoteSite:4: received peer identifier FQDN 'remore' ike 0:RemoteSite:4: negotiation result ike 0:RemoteSite:4: proposal id = 1:
ike 0:RemoteSite:4: protocol id = ISAKMP:
ike 0:RemoteSite:4: trans_id = KEY_IKE.
ike 0:RemoteSite:4: encapsulation = IKE/none
ike 0:RemoteSite:4: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key -len=128
ike 0:RemoteSite:4: type=OAKLEY_HASH_ALG, val=SHA.
ike 0:RemoteSite:4: type-AUTH_METHOD, val=PRESHARED_KEY.
ike 0:RemoteSite:4: type=OAKLEY_GROUP, val=MODP1024.
ike 0:RemoteSite:4: ISAKMP SA lifetime=86400
ike 0:RemoteSite:4: ISAKMP SA baf47d0988e9237f/2f405ef3952f6fda key 16:
B25B6C9384D8BDB24E3DA3DC90CF5E73
ike 0:RemoteSite:4: PSK authentication succeeded
ike 0:RemoteSite:4: authentication OK
ike 0:RemoteSite:4: add INITIAL-CONTACT
ike 0:RemoteSite:4: enc
BAF47D0988E9237F405EF3952F6FDA081004010000000000000080140000181F2E48BFD8E9D603F ike 0:RemoteSite:4: out BAF47D0988E9237F405EF3952F6FDA08100401000000000000008C2E3FC9BA061816A396F009A12 ike 0:RemoteSite:4: sent IKE msg (agg_i2send): 10.0.0.1:500-10.0.0.2:500, len=140, id=baf47d0988e9237f/2 ike 0:RemoteSite:4: established IKE SA baf47d0988e9237f/2f405ef3952f6fda Which statements about this debug output are correct? (Choose two.)

A. It shows a phase 1 negotiation.

B. The negotiation is using AES128 encryption with CBC hash.

C. The initiator has provided remote as its IPsec peer ID.

D. The remote gateway IP address is 10.0.0.1.

정답: A,C

문제3

A corporate network allows Internet Access to FSSO users only. The FSSO user student does not have Internet access after successfully logged into the Windows AD network. The output of the 'diagnose debug authd fsso list' command does not show student as an active FSSO user. Other FSSO users can access the Internet without problems. What should the administrator check? (Choose two.)

A. At least one of the student's user groups must be allowed by a FortiGate firewall policy.

B. The student workstation's IP subnet must be listed in the CA's trusted list.

C. The user student must belong to one or more of the monitored user groups.

D. The user student must not be listed in the CA's ignore user list.

정답: A,C

문제4

An administrator has configured a dial-up IPsec VPN with one phase 2, extended authentication (XAuth) and IKE mode configuration. The administrator has also enabled the IKE real time debug:
diagnose debug application ike-1
diagnose debug enable
In which order is each step and phase displayed in the debug output each time a new dial-up user is connecting to the VPN?

A. Phase1; IKE mode configuration; phase 2; XAuth.

B. Phase1; XAuth; IKE mode configuration; phase2.

C. Phase1; XAuth; phase 2; IKE mode configuration.

D. Phase1; IKE mode configuration; XAuth; phase 2.

정답: A

문제5

View the exhibit, which contains the output of a BGP debug command, and then answer the question below.

Which of the following statements about the exhibit are true? (Choose two.)

A. Since the BGP counters were last reset, the BGP peer 10.200.3.1 has never been down.

B. The local BGP peer has not established a TCP session to the BGP peer 10.200.3.1.

C. The local BGP peer has received a total of three BGP prefixes.

D. For the peer 10.125.0.60, the BGP state of is Established.

정답: A,C

문제6

Examine the following partial output from two system debug commands; then answer the question below.

Which of the following statements are true regarding the above outputs? (Choose two.)

A. The Cached value is always the Active value plus the Inactive value

B. Kernel indirectly accesses the low memory (LowTotal) through memory paging

C. The unit is in kernel conserve mode

D. The unit is running a 32-bit FortiOS

정답: A,D

문제7

Examine the following routing table and BGP configuration; then answer the question below.

TheBGP connection is up, but the local peer is NOT advertising the prefix 192.168.1.0/24. Which configuration change will make the local peer advertise this prefix?

A. Disable the setting network-import-check.

B. Enable the redistribution of connected routers into BGP.

C. Enable the redistribution of static routers into BGP.

D. Enable the setting ebgp-multipath.

정답: A

문제8

What conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three.)

A. OSPF IP MTUs match.

B. OSPF peer IDs match.

C. OSPF costs match.

D. IP addresses are in the same subnet.

E. Hello and dead intervals match.

정답: B,D,E

문제9

A FortiGate is configured as an explicit web proxy. Clients using this web proxy are reposting DNS errors when accessing any website. The administrator executes the following debug commands and observes that the n-dns-timeout counter is increasing:

What should the administrator check to fix the problem?

A. That DNS traffic from client workstations is allowed by the explicit web proxy policies.

B. The connectivity between the client workstations and the DNS server.

C. The connectivity between the FortiGate unit and the DNS server.

D. That DNS service is enabled in the explicit web proxy interface.

정답: B,C

Fortinet NSE7 Enterprise Firewall - FortiOS 5.4 - NSE7무료 덤프문제 풀어보기

우리와 연락하기

유용한 링크

최신 업데이트