Free Fortinet NSE7 Exam Dumps Questions & Answers

Examine the output from the 'diagnose vpn tunnel list' command shown in the exhibit; then answer the question below.

Which command can be used to sniffer the ESP traffic for the VPN DialUP_0?

• A.  diagnose sniffer packet any 'esp'
• B.  diagnose sniffer packet any 'port 4500'
• C.  diagnose sniffer packet any 'host 10.0.10.10'
• D.  diagnose sniffer packet any 'port 500'

View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

Why didn't the tunnel come up?

• A.  The remote gateway is using aggressive mode and the local gateway is configured to use man mode.
• B.  The pre-shared keys do not match.
• C.  The remote gateway's phase 1 configuration does not match the local gateway's phase 1 configuration.
• D.  The remote gateway's phase 2 configuration does not match the local gateway's phase 2 configuration.

A corporate network allows Internet Access to FSSO users only. The FSSO user student does not have Internet access after successfully logged into the Windows AD network. The output of the 'diagnose debug authd fsso list' command does not show student as an active FSSO user. Other FSSO users can access the Internet without problems. What should the administrator check? (Choose two.)

• A.  The user student must belong to one or more of the monitored user groups.
• B.  The student workstation's IP subnet must be listed in the CA's trusted list.
• C.  At least one of the student's user groups must be allowed by a FortiGate firewall policy.
• D.  The user student must not be listed in the CA's ignore user list.

What does the dirty flag mean in a FortiGate session?

• A.  Traffic has been blocked by the antivirus inspection.
• B.  Traffic has been identified as from an application that is not allowed.
• C.  The session must be removed from the former primary unit after an HA failover.
• D.  The next packet must be re-evaluated against the firewall policies.

Examine the following routing table and BGP configuration; then answer the question below.

TheBGP connection is up, but the local peer is NOT advertising the prefix 192.168.1.0/24. Which configuration change will make the local peer advertise this prefix?

• A.  Enable the redistribution of static routers into BGP.
• B.  Disable the setting network-import-check.
• C.  Enable the redistribution of connected routers into BGP.
• D.  Enable the setting ebgp-multipath.