NSE7_EFW-6.2 Free Practice Test

Examine the following partial outputs from two routing debug commands; then answer the question below.
# get router info kernel
tab=254 vf=0 scope=0type=1 proto=11 prio=00.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=10.200.1.254 dev=2(port1)
tab=254 vf=0 scope=0type=1 proto=11 prio=10 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=10.200.2.254 dev=3(port2)
tab=254 vf=0 scope=253type=1 proto=2 prio=0 0.0.0.0/0.0.0.0/.->10.0.1.0/24 pref=10.0.1.254 gwy=0.0.0.0 dev=4(port3)
# get router info routing-table all s*0.0.0.0/0 [10/0] via 10.200.1.254, portl [10/0] via 10.200.2.254, port2, [10/0] dO.0.1.0/24 is directly connected, port3 dO.200.1.0/24 is directly connected, portl d0.200.2.0/24 is directly connected, port2
Which outbound interface or interfaces will be used by this FortiGate to route web traffic from internal users to the Internet?

1. A. port!
2. B. port2.
3. C. Both portl and port2.
4. D. port3.

Correct Answer: B

Examine the output of the ‘get router info ospf neighbor’ command shown in the exhibit; then answer the question below.
<>

1. A. The interface ToRemote is OSPF network type point-to-point.
2. B. The OSPF router with the ID 0.0.0.2 is the designated router for the ToRemote network.
3. C. The local FortiGate is the backup designated router for the wan1 network.
4. D. The OSPF routers with the IDs 0.0.0.69 and 0.0.0.117 are both designated routers for the wan1 network.

Correct Answer: AC
https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/13685-13.html

View the exhibit, which contains the output of get sys ha status, and then answer the question below.
<>

1. A. The slave configuration is not synchronized with the master.
2. B. The HA management IP is 169.254.0.2.
3. C. Master is selectedbecause it is the only device in the cluster.
4. D. port 7 is used the HA heartbeat on all devices in the cluster.

Correct Answer: AD

View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.
< ><>>< ><>

1. A. The debug output shows phases 1 and 2 negotiations onl
2. B. Once the tunnel is up, it does not show any more output.
3. C. The log-filter setting was setincorrectl
4. D. The VPN’s traffic does not match this filter.
5. E. The debug shows only error message
6. F. If there is no output, then the tunnel is operating normally.
7. G. The debug output shows phase 1 negotiation onl
8. H. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.

Correct Answer: D

What global configuration setting changes the behavior for content-inspected traffic while FortiGate is in system conserve mode?

1. A. av-failopen
2. B. mem-failopen
3. C. utm-failopen
4. D. ips-failopen

Correct Answer: A
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-security-profiles-54/Other_Profile_Consideratio