NSE7-EFW Practice Questions & Answers • ExamPrepare

29 questions in this view

Page 1 of 5

Question 1

An organization acquired multiple branches across different countries and must install FortiGate devices at each branch. However, their IT staff lacks the knowledge required to implement the initial configuration on the FortiGate devices.

Which three approaches can the organization take to successfully deploy advanced initial configurations on the FortiGate devices at their remote branches? (Choose three.)

Apply Jinja in the FortiManager scripts for large-scale and advanced deployments.
Use provisioning templates and install configuration settings at the device layer.
On FortiManager, add the FortiGate devices as model devices, and use zero-touch provisioning (ZTP) or low-touch provisioning (LTP) to connect to the FortiGate devices.
Use metadata variables to dynamically assign values according to each FortiGate device.
Use the global ADOM to deploy global object configurations to each FortiGate device.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

Refer to the exhibits.

The system administrator settings configured on a root FortiGate and the Security Fabric settings configured on a downstream FortiGate are shown.

When prompted to sign in with Security Fabric to the downstream FortiGate, a user enters the single sign-on (SSO) provider credentials.

What is the result?

Root FortiGate - System Administrator configuration

Downstream FortiGate - Security Fabric settings

The downstream FortiGate creates an SSO administrator account for AdminSSO with the super_admin profile.
The user is prompted to create an administrator account for AdminSSO.
The downstream FortiGate relies on the root FortiGate and does not create an administrator account.
The downstream FortiGate creates an SSO administrator account for AdminSSO with the super_admin_readonly profile.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

You must enable direct communication between multiple spokes in an organization's network.
Each spoke has more than one internet connection. Each spoke must connect directly without passing through the hub and the links must automatically switch to the best available connection.

How can you achieve automatic detection and optimal link utilization between spokes?

Set up OSPF routing over dynamic VPN tunnels between spokes.
Implement SD-WAN policies at the hub and the spokes.
Establish dynamic VPN tunnels between spokes with predefined backup routes.
Use ADVPN 2.0 to facilitate dynamic direct tunnels and automatic link optimization.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

Refer to the exhibits.

A network topology and a FortiGate routing table is shown.

What must you configure in the BGP section to add only the subnet 100.64.2.0/24 in the routing table of FortiGate_A?

Network topology

Routing table on FortiGate A

Configure connected routes redistribution on FortiGate_C.
Configure route-map-in on FortiGate_A.
Configure the 100.64.2.0/24 network on FortiGate_C.
Configure BGP route redistribution on FortiGate_B.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

To secure your enterprise network traffic, which step does FortiGate perform first, when handling the first packets of a session?

IP integrity header checking
Installation of the session key in the network processor (NP)
A reverse path forwarding (RPF) check
Decryption

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

Refer to the exhibit.

The network diagram shows the addition of Site 2 with an overlapping network segment to the existing VPN IPsec connection between the hub and Site 1.

Which IPsec phase 2 configuration must you make on the FortiGate hub to enable equal-cost multi-path (ECMP) routing when multiple remote sites connect with overlapping subnets?

Network topology

set net-device to ecmp
Set route-overlap to either use-new or use-old
Set multipath to enable
Set route-overlap to allow

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.