FORTINET-NSE7-SPECIALTY Nse7 Enterprise Firewall Security And VPN — Timed 10 Questions

Question 1

Which command is used to troubleshoot connectivity by checking the routing table of a specific IP address on the FortiGate?

Accepted Answer

get router info routing-table detail <ip>. The 'get router info route detail' or 'execute router info routing-table' commands are standard for verifying paths.

Answer

diagnose sniffer packet

Answer

get system status

Answer

exec ping-options

Question 2

You are troubleshooting a high CPU issue on a FortiGate. Which utility should you use to identify which process is consuming the most resources?

Accepted Answer

diagnose sys top. The 'get system performance status' command is the primary tool to see process-level CPU usage.

Answer

get system hardware status

Answer

diagnose sniffer packet

Answer

get router info memory

Question 3

In a BGP deployment, your FortiGate is receiving routes from two different ISPs. You want to influence outbound traffic to prefer ISP1 for specific destinations. Which BGP attribute should you modify?

Accepted Answer

Local Preference. Local Preference is used to influence outbound traffic selection within an AS.

Answer

Weight

Answer

AS-Path

Answer

Multi-Exit Discriminator (MED)

Question 4

You are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?

Accepted Answer

Create an IPS sensor override for the specific signature ID. Using an IPS sensor override or a specific signature exemption allows you to modify the behavior for a single signature without disabling it globally.

Answer

Change the IPS mode from blocking to monitoring

Answer

Disable the entire IPS sensor profile

Answer

Increase the IPS packet buffer size

Question 5

You are implementing SSL VPN and need to ensure that only compliant corporate laptops can connect. Which feature should you use?

Accepted Answer

Host check. Host check allows the FortiGate to verify the presence of specific software like Antivirus before allowing the VPN connection.

Answer

SSL VPN portal settings

Answer

Two-factor authentication

Answer

PKI user authentication

Question 6

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

Accepted Answer

Use a route map in the OSPF redistribute configuration. A route map must be applied during redistribution to filter the prefixes being injected.

Answer

Configure a distribute-list in the OSPF process

Answer

Use an IP prefix list under the OSPF area command

Answer

Use an access list under the interface configuration

Question 7

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?

Accepted Answer

Mismatched Phase 2 selectors. Phase 2 failure is usually due to mismatched selectors (proxy IDs) or mismatched encryption/authentication algorithms.

Answer

Incorrect IKE version

Answer

Expired certificate

Answer

Mismatched pre-shared key

Question 8

In an OSPF setup, you have a redundant path. You want to ensure traffic prefers one link over another based on cost. Which OSPF command is used?

Accepted Answer

set ospf-cost. The OSPF cost is configured on the interface level to influence link preference.

Answer

set metric-type

Answer

set bandwidth-reference

Answer

set priority

Question 9

What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?

Accepted Answer

Implicit Deny. The implicit deny policy is the last rule in the firewall policy list and drops all non-matching traffic.

Answer

Send to local DNS

Answer

Route to DMZ

Answer

Allow

Question 10

A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?

Accepted Answer

The FortiGate CA certificate used for SSL inspection. The FortiGate acts as a man-in-the-middle, so the client must trust the CA certificate generated by the FortiGate.

Answer

The FortiGate's local device certificate

Answer

The Fortinet_Factory CA certificate

Answer

A third-party public CA certificate