NSE7_EFW-6.2 Free Practice Test

What is the purpose of an internal segmentation firewall (ISFW)?

1. A. It inspects incoming traffic to protect services in the corporate DMZ.
2. B. It is the first line of defense at the network perimeter.
3. C. It splits the network into multiple security segments to minimize the impact of breaches.
4. D. It is an all-in-one security appliance that is placed at remotesites to extend the enterprise network.

Correct Answer: C
ISFW splits your network into multiple security segments. They serve as a breach containers from attacks that come from inside.

View these partial outputs from two routing debug commands:
<>

1. A. Both port1 and port2
2. B. port3
3. C. port1
4. D. port2

Correct Answer: A

Examine the output of the ‘get router info ospf interface’ command shown in the exhibit; then answer the question below.
<>

1. A. The port4 interface is connected to the OSPF backbone area.
2. B. The local FortiGate has been elected as theOSPF backup designated router.
3. C. There are at least 5 OSPF routers connected to the port4 network.
4. D. Two OSPF routers are down in the port4 network.

Correct Answer: AC
on BROADCAST network there are 4 neighbors, among which 1*DR +1*BDR. So ourFG has 4 neighbors, but create adjacency only with 2 (with DR and BDR). 2 neighbors DRother (not down).

Which configuration can be used to reduce the number of BGP sessions in an IBGP network?

1. A. Neighbor range
2. B. Route reflector
3. C. Next-hop-self
4. D. Neighbor group

Correct Answer: B
Route reflectors help to reduce the number of IBGP sessions inside an AS. A route reflector forwards the routers learned from one peer to the other peers. If you configure route reflectors, you dont’ need to create a full mesh IBGP network. All clients in a cluster only talck to route reflector to get sync routing updates. Route reflectors pass the routing updates to other route reflectors and border routers within the AS.

When using the SSL certificate inspection method for HTTPS traffic, how does FortiGate filter web requests when the browser client does not provide the server name indication (SNI) extension?

1. A. FortiGate uses CN information from the Subject field in the server’s certificate.
2. B. FortiGate switches to the full SSL inspection method to decrypt the data.
3. C. FortiGate blocks the request without any further inspection.
4. D. FortiGate uses the requested URL from the user’s web browser.

Correct Answer: A