NSE7_EFW-7.0 Free Practice Test

In which two states is a given session categorized as ephemeral? (Choose two.)

1. A. A TCP session waiting to complete the three-way handshake.
2. B. A TCP session waiting for FIN ACK.
3. C. A UDP session with packets sent and received.
4. D. A UDP session with only one packet received.

Correct Answer: AD

Examine the output of the ‘get router info bgp summary’ command shown in the exhibit; then answer the question below.

Which statement can explain why the state of the remote BGP peer 10.200.3.1 is Connect?

1. A. The local peer is receiving the BGP keepalives from the remote peer but it has not received any BGP prefix yet.
2. B. The TCP session for the BGP connection to 10.200.3.1 is down.
3. C. The local peer has received the BGP prefixed from the remote peer.
4. D. The local peer is receiving the BGP keepalives from the remote peer but it has not received the OpenConfirm yet.

Correct Answer: B
http://www.ciscopress.com/articles/article.asp?p=2756480&seqNum=4

Refer to the exhibit, which contains the output of diagnose sys session list.

If the HA ID for the primary unit is zero (0), which statement about the output is true?

1. A. This session cannot be synced with the slave unit.
2. B. The inspection of this session has been offloaded to the slave unit.
3. C. The master unit is processing this traffic.
4. D. This session is for HA heartbeat traffic.

Correct Answer: C

An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device. The administrator decides to enable the setting link-failed-signal to fix the problem.
Which statement about this setting is true?

1. A. It sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.
2. B. It sends a link failed signal to all connected devices.
3. C. It disabled all the non-heartbeat interfaces in all HA members for two seconds after a failover.
4. D. It forces the former primary device to shut down all its non-heartbeat interfaces for one second, while the failover occurs.

Correct Answer: D

Refer to the exhibit, which contains the partial output of the get vpn ipsec tunnel details command.

Based on the output, which two statements are correct? (Choose two.)

1. A. Phase 2 authentication is set to sha1 on both sides.
2. B. Anti-replay is disabled.
3. C. Hub2Spoke1 is a policy-based VPN.
4. D. Hub2Spoke1 is configured on interface wan2.

Correct Answer: AD