Apr 2016 updated: Examcollection Fortinet NSE7 exam cram 16-30

NSE7 Royal Pack Testengine pdf

100% Actual & Verified — 100% PASS

Unlimited access to the world's largest Dumps library! Try it Free Today!

Get it now →

Product Description:
Exam Number/Code: NSE7
Exam name: Fortinet Troubleshooting Professional
n questions with full explanations
Certification: Fortinet Certification
Last updated on Global synchronizing

Free Certification Real IT NSE7 Exam pdf Collection

Exam Code: NSE7 (Practice Exam Latest Test Questions VCE PDF)
Exam Name: Fortinet Troubleshooting Professional
Certification Provider: Fortinet
Free Today! Guaranteed Training- Pass NSE7 Exam.

2016 Apr NSE7 Study Guide Questions:

Q16. An administrator added the following Ipsec VPN to a FortiGate configuration: 

configvpn ipsec phasel -interface 

edit "RemoteSite" 

set type dynamic 

set interface "portl" 

set mode main 

set psksecret ENC LCVkCiK2E2PhVUzZe 

next 

end 

config vpn ipsec phase2-interface 

edit "RemoteSite" 

set phasel name "RemoteSite" 

set proposal 3des-sha256 

next 

end 

However, the phase 1 negotiation is failing. The administrator executed the IKF real time debug while attempting the Ipsec connection. The output is shown in the exhibit. 



What is causing the IPsec problem in the phase 1 ? 

A. The incoming IPsec connection is matching the wrong VPN configuration 

B. The phrase-1 mode must be changed to aggressive 

C. The pre-shared key is wrong 

D. NAT-T settings do not match 

Answer: C 


Q17. An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage. However, after thechanges, one network application started to have problems. During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets and before the arrival of the SYN/ACKs. When the SYN/ACK packetsarrive to the FortiGate, the unit has already deleted the respective sessions. Which TCP session timer must be increased to fix this problem? 

A. TCP half open. 

B. TCP half close. 

C. TCP time wait. 

D. TCP session time to live. 

Answer: D 


Q18. Examine the following routing table and BGP configuration; then answer the question below. 


TheBGP connection is up, but the local peer is NOT advertisingthe prefix 192.168.1.0/24. Which configuration change will make the local peer advertise this prefix? 

A. Enable the redistribution of connected routers into BGP. 

B. Enable the redistribution of static routers into BGP. 

C. Disable the setting network-import-check. 

D. Enable the setting ebgp-multipath. 

Answer: C 


Q19. An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage. However, after thechanges, one network application started to have problems. During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets and before the arrival of the SYN/ACKs. When the SYN/ACK packetsarrive to the FortiGate, the unit has already deleted the respective sessions. Which TCP session timer must be increased to fix this problem? 

A. TCP half open. 

B. TCP half close. 

C. TCP time wait. 

D. TCP session time to live. 

Answer: D 


Q20. Examine the following partial output from two system debug commands; then answer the question below. 



Which of the following statements are true regarding the aboveoutputs? (Choose two.) 

A. The unit is running a 32-bit FortiOS 

B. The unit is in kernel conserve mode 

C. The Cached value is always the Active value plus the Inactive value 

D. Kernel indirectly accesses the low memory (LowTotal) through memory paging 

Answer: A,C 


NSE7

Regenerate NSE7 free question:

Q21. What configuration changes can reduce the memory utilization in a FortiGate? (Choose two.) 

A. Reduce the session time to live. 

B. Increase the TCP session timers. 

C. Increase the FortiGuard cache time to live. 

D. Reduce the maximum file size to inspect. 

Answer: A,D


Q22. An LDAP user cannot authenticate against a FortiGate device. Examine the real time debug output shown in the exhibit when the user attempted the authentication; then answer thequestion below. 



Based on the output in the exhibit, what can cause this authentication problem? 

A. User student is not found in the LDAP server. 

B. User student is using a wrong password. 

C. The FortiGate has been configured with the wrongpassword for the LDAP administrator. 

D. The FortiGate has been configured with the wrong authentication schema. 

Answer: A 


Q23. Examine the following partial outputs from two routing debug commands; then answer the question below. 

# get router info routing-table database 

s 0.0.0.0/0 [20/0] via 10.200.2.254, port2, [10/0] s *> 0.0.0.0/0 [10/0] via 10.200.1.254, port1 

# get router info routing-table all 

s* 0.0.0.0/0 [10/0] via 10.200.1.254, port1 

Why the default route using port2 is not displayed in the output of the second command? 

A. it has a lower priority than the default route using port1. 

B. it has a higher priority than the default route using portl. 

C. it has a higher distance than the default route using portl. 

D. it is disabled in the FortiGate configuration. 

Answer: A 


Q24. An administrator has enabled HA session synchronization in a HA cluster with two members. Which flag is added to a primary unit's session to indicate that it has been synchronized to the secondary unit? 

A. redir 

B. dirty 

C. synced 

D. nds 

Answer: C 


Q25. Examine the IPsec configuration shown in the exhibit; then answer the question below. 


An administrator wants to monitor the VPN byenable the IKE real time debug using these commands: 

diagnose vpn ike log-filter src-addr4 10.0.10.1 diagnose debug application ike -1 diagnose debug enable 

The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are being interchanged between both Ipsec gateways. However, the IKE rea time debug does NOT show any output. Why isn't there any output? 

A. The IKE real time debug shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up. 

B. The log-filter setting is set incorrectly. The VPN's traffic does not match this filter. 

C. The IKF real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnosedebug application ipsec -1 

D. The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally. 

Answer: A 


NSE7 pdf

High value NSE7 bible:

Q26. Examine the partial output from the IKE realtime debugshown in the exhibit; then answer the question below. 



Why didn't the tunnel come up? 

A. IKE mode configuration is not enabled in the remote IPsec gateway. 

B. The remote gateway's Phase-2 configuration does not match the local gateway's phase-2configuration. 

C. The remote gateway's Phase-1 configuration does not match the local gateway's phase-1 configuration. 

D. One IPsec gateway is using main mode, while the other IPsec gateway is using aggressive mode. 

Answer: B 


Q27. Examine the partial output from the IKE realtime debugshown in the exhibit; then answer the question below. 



Why didn't the tunnel come up? 

A. IKE mode configuration is not enabled in the remote IPsec gateway. 

B. The remote gateway's Phase-2 configuration does not match the local gateway's phase-2configuration. 

C. The remote gateway's Phase-1 configuration does not match the local gateway's phase-1 configuration. 

D. One IPsec gateway is using main mode, while the other IPsec gateway is using aggressive mode. 

Answer: B 


Q28. A FortiGate device has the following LDAP configuration: 


Based on the output, what FortiGate LDAP setting is configured incorrectly? 

A. cnid. 

B. username. 

C. password. 

D. dn. 

Answer: B 


Q29. What configuration changes can reduce the memory utilization in a FortiGate? (Choose two.) 

A. Reduce the session time to live. 

B. Increase the TCP session timers. 

C. Increase the FortiGuard cache time to live. 

D. Reduce the maximum file size to inspect. 

Answer: A,D


Q30. Examine the partial output from the IKE realtime debugshown in the exhibit; then answer the question below. 



Why didn't the tunnel come up? 

A. IKE mode configuration is not enabled in the remote IPsec gateway. 

B. The remote gateway's Phase-2 configuration does not match the local gateway's phase-2configuration. 

C. The remote gateway's Phase-1 configuration does not match the local gateway's phase-1 configuration. 

D. One IPsec gateway is using main mode, while the other IPsec gateway is using aggressive mode. 

Answer: B 



see more http://www.pdfcollection.net/NSE7-pdf.html
http://www.exambible.com/NSE7-exam/