NSE7_FSN_AR-7.6_2

A partial output of diagnose npu up6 port-list on FortiGate 2000E is shown. An administrator is unable to analyze traffic flowing between port1 and port17 using the diagnose sniffer command. Which two commands allow the administrator to view the traffic? (Choose two.). diagnose npu np6 port-list disable 5 17. config firewall policy edit 5 set auto-asic-offload disable end next edit 17 set auto-asic-offload disable end. diagnose npu np6 fastpath disable 1. config system npu set fastpath disable end.

Refer to the exhibit, which shows the output of diagnose sys session stat. Which statement about the output shown in the exhibit is correct?. All the sessions in the session table are TCP sessions. 162 sessions have been deleted because of memory page exhaustion. There are 166 TCP sessions waiting to complete the three-way handshake. There are two sessions that have not been removed in case any out-of-order packets arrive.

Partial output of the fssod daemon real-time debug command is shown. Which two conclusions can you draw from the output? (Choose two answers). Fortinet Single Sign-On (FSSO) is using DC Agent mode to detect logon events. FortiGate is frequently polling the workstation in case the user has logged out. FSSO is using agentless polling mode to detect logon events. FortiGate polled this event through TCP port 8000. FSSO cannot verify if the user is still logged in.

which show the configuration on FortiGate and partial session information for internet traffic from a user on the internal network. If the priority on route ID 2 were changed from 10 to 0, what would happen to traffic matching that user session? (Choose one answer). The session would be deleted, and the client would need to start a new session. The session would remain in the session table, but its traffic would now egress from both port1 and port2. The session would remain in the session table, and its traffic would egress from port2. The session would remain in the session table, and its traffic would egress from port1.

What are two reasons that an OSPF router does not have any type 5 tank-state advertisements (LSAs) In its link-stale database (LSD6)? (Choose two.). There is no autonomous system border router (ASBR) in the network,. The peer of the local router is using a prefix-list-out. configuration to prevent all type 5 LSAs to be advertised. The local router is located in a stub area. IP protocol 89 is blocked between the local router and its peer.

An OSPF peer is advertising route 172.16.52.0/24. The local FortiGate is configured with an inbound distribution list that allows the 172.16.0.0/16 network to be injected into its routing table. However, the 1'2.16.52.0/24 subnet cannot be seen in the FIB. Which two stops can the administrator of the local FortiGate take to ensure that the advertised 172.16. 52.0/24 subnet will be injected into the routing table? (Choose two.). Add another entry to the prefix list to specifically allow the 172.16.52.0/24 network. Change the ge value to 17. Change the R- value lo 16. Modify the default prefix-list behavior from implicit deny to implicit allow.

Which statement about this session is true?. Return traffic to the initiator is sent to 10.1.0.1. Return traffic to the initiator is sent lo 10.200.1.254. It is an ICMP session from 10.1.10.10 to 10.200.1.1. It is an ICMP session from 10.1.10.1 to 10.200.5.1.

In the context of SD-WAN, the terms underlay and overlay are commonly used to categorize links. Which two statements about underlay and overlay links are correct? (Choose two.). Overlay links provide routing flexibility. Only wired connections can be used as underlay links. A VLAN is a type of overlay link. FortiLink interface is considered an underlay link. Wireless connections can be used to build overlay links.

You have a FortiGate configuration with three user-defined SD-WAN zones and two members in each of these zones. One SD-WAN member is no longer in use in health-check and SD-WAN rules. You want to delete it. What happens if you delete the SD-WAN member from the FortiGate GUI?. FortiGate accepts the SD-WAN member deletion with no further action. FortiGate displays an error message. SD-WAN zones must contain at least two members. FortiGate accepts the deletion and removes static routes as required. FortiGate accepts the deletion and places the member in the default SD-WAN zone.

An ADVPN network is shown. You must configure an ADVPN using IBGP for each local region and EBGP across regions to connect Overlay 1 with Overlay 2. Which two options must you configure in the Hub2Hub BGP peering? (Choose two.). set. ebgp-enforce-multihop enable. set. ibgp-enforce-multihop advpn. set. attribute-unchanged next-hop. set. next-hop-self enable.

You want to configure SD-WAN on a network, as shown in the exhibit. The network contains many FortiGate devices. Some are used as next-generation firewalls (NGFW), and some are installed with extensions such as FortiSwitch, FortiAP, or FortiExtender. Which factors should you consider when planning your deployment?. You should exclude the FortiGate devices with FortiLink connection from the SD-WAN topology. You should build multiple SD-WAN topologies. Each topology should contain only one type of extension. You can build an SD-WAN topology that includes all devices. The hubs can be FortiGate devices with FortiExtender. You can build an SD-WAN topology that includes all devices. The hubs must be devices without extensions.