NSE7-FSN-AR-7-6_3

Refer to the exhibit. The packet capture output of a client hello message is shown. You are updating a firewall policy that includes SSL certificate inspection. You are capturing packets from the traffic passing through this firewall policy. Which two statements about the packet capture are correct? (Choose two answers). You can effectively apply a web filtering profile to this traffic. The subject alternative name (SAN) is necessary to apply security profiles. The client supports only TLS versions 1.2 and 1.3. You can effectively apply an antivirus security profile to this traffic.

Refer to the exhibits. A policy package conflict status and information from the import device wizard in the Core1 VDOM are shown. When you import a policy package, the following message appears for the Web_restrictions web filter profile and the deep-inspection SSL-SSH profile: The following objects were found having conflicts. Please confirm your settings, then continue. The Web_restrictions and deep-inspection profiles are used by other FortiGate devices within FortiManager. Which step must you take to resolve the issue? (Choose one answer). Retrieve the FortiGate configuration to automatically export correct objects and policies. Create uniquely named objects on FortiGate and reimport them into the policy package. Select the FortiManager configuration that accepts changes on FortiManager and preserves existing configurations on FortiGate devices. Use non-default object values because FortiManager is unable to alter default values.

You are setting up an ADVPN configuration and want to ensure that peer IDs are not exposed during VPN establishment. Which protocol can the administrator use to enhance security? (Choose one answer). Use IKEv2, which encrypts peer IDs and prevents exposure. Use IKEv1 main mode with AES-GCM security proposal. Use IKEv1 aggressive mode with certificates. Use SSL VPN tunnel mode with certificates.

Refer to the exhibit. The ADVPN IPsec interface represents the VPN IPsec phase 1 from Hub A to Spoke 1 and Spoke 2, and from Hub B to Spoke 3 and Spoke 4. You must configure an ADVPN using IBGP and EBGP to connect Overlay 1 with Overlay 2. Which parameters must you configure in the phase 1 VPN IPsec configuration of the ADVPN tunnels? (Choose one answer). set auto-discovery-forwarder enable and set remote-as x. set auto-discovery-sender enable and set network-id x. set auto-discovery-receiver enable and set remote-ip x. set auto-discovery-crossover enable and set enforce-multihop enable.

Refer to the exhibit. A partial VPN configuration is shown. Which statement about this VPN IPsec phase 1 configuration is correct? (Choose one answer). FortiGate will not add a route to its routing information base (RIB) or forwarding information base (FIB) when the dynamic tunnel is negotiated. This configuration is the best for networks with regular traffic intervals, providing a balance between connectivity assurance and resource utilization. A separate interface is created for each dial-up tunnel, which can be slower and more resource intensive, especially in large networks. This configuration must include certificates associated peer IDs to enhance security.

Refer to the exhibit. A revision history window at the FortiManager device layer is shown. The IT team is trying to identify the administrator responsible for the most recent update to the FortiGate device database. What can the IT team conclude? (Choose one answer). To identify the user who created the event, in the FortiManager system logs, they must use the type=script filter in the user field. The user script_manager, an API user from the Fortinet Developer Network (FDN), is retrieving a configuration. The retrieve process was automatically triggered by a Remote FortiGate Directly (via CLI) script. To identify the user who created the event, they must view it on the Configuration and Installation widget on FortiGate at the FortiManager device layer.

To secure your enterprise network traffic, which step does FortiGate perform first, when handling the first packets of a session? (Choose one answer). Installation of the session key in the network processor (NP). Decryption. A reverse path forwarding (RPF) check. IP integrity header checking.

A vulnerability scan report has revealed that a user has generated traffic to the website example.com using a weak SSL/TLS version supported by the HTTPS web server. What can you do to block all outdated SSL/TLS versions on any HTTPS web server to prevent possible attacks on user traffic? (Choose one answer). Enable server certificate SNI check in the SSL/SSH inspection profile. Enable auto-detection of outdated SSL/TLS versions in the SSL/SSH inspection profile to block vulnerable websites. Block invalid SSL certificates in the SSL/SSH inspection profile. Configure the unsupported SSL version and set the minimum allowed SSL version in the HTTPS settings of the SSL/SSH inspection profile.

In a transparent VDOM interface, what does the command set forward-domain <domain_ID> do? (Choose one answer). It allows the interface to access the configured admin domain. It restricts the interface to managing traffic from only the specified VLAN, effectively segregating network traffic. It isolates traffic within a specific VLAN by assigning a broadcast domain to an interface based on the VLAN ID. It assigns a unique domain ID to the interface, allowing it to operate across multiple VLANs within the same VDOM.

Refer to the exhibits. The configuration of Windows PC, PC 1, with a default MTU of 1500 bytes, FortiGate interfaces with an MTU of 1000 bytes, and the results of PC 1 pinging over server 172.16.0.251 are shown. Why is the PC1 user unable to ping server 172.16.0.254 and seeing the message: Packet needs to be fragmented but DF set? (Choose one answer). FortiGate honors the do not fragment bit and the packets are dropped. The user must adjust the ping MTU to 972 to succeed. The ip.flags.mf option must be enabled on FortiGate. The user must adjust the ping MTU to 1000 to succeed. The user must adjust the TCP maximum segment size (MSS) to 1000 for the ping to succeed. The user must account for the size of the Ethernet header when configuring the MTU value.