NSE7-FSN-AR-7-6_4

The FortiGuard security services on a FortiGate device is shown. You need to find the web filter database signature on FortiGate to resolve issues with websites not being filtered correctly in a flow-mode web filter profile. Why is the web filter database version not visible on the GUI, like it is with the intrusion prevention system (IPS) definitions? (Choose one answer). The web filter database is stored locally on FortiGate, but you must enable Web Filter in the Feature Visibility section to see the web filter database version. The web filter database is accessible only after you add a web filter security profile in a firewall policy. The web filter database is stored locally, but you must use the CLI command diagnose autoupdate versions to see the web filter database version. The web filter database is not hosted on FortiGate; FortiGate queries FortiGuard or FortiManager for web filter ratings on demand.

An ADVPN network is shown. You must configure an ADVPN using IBGP for each local region and EBGP across regions to connect Overlay 1 with Overlay 2. Which two options must you configure in the Hub2Hub BGP peering? (Choose two answers). set next-hop-self enable. set attribute-unchanged next-hop. set ibgp-enforce-multihop advpn. set ebgp-enforce-multihop enable.

The template is not assigned even though the configuration is already installed on FortiGate. Which statement about this scenario is true? (Choose one answer). The administrator did not assign the template correctly when they added the model device because prerun CLI templates remain permanently assigned to the firewall. Prerun CLI templates are automatically unassigned after the quick install process. The administrator must use postrun CLI templates that are designed for ZTP and LTP. Prerun CLI templates for ZTP and LTP must be unassigned manually after the first installation, to avoid conflicting error objects when importing a policy package.

Refer to the exhibit, which shows the packet capture output of a three-way handshake between FortiGate and FortiManager Cloud. What two conclusions can you draw from the exhibit? (Choose two answers). FortiGate is connecting to the same IP server and will receive an independent certificate for its connection between FortiGate and FortiManager Cloud. If the TLS handshake contains 17 cipher suites it means the TLS version must be 1.0 on this three-way handshake. FortiGate will receive a certificate that supports multiple domains because FortiManager operates in a cloud computing environment. The wildcard for the domain *.fortinet-ca2.support.fortinet.com must be supported by FortiManager Cloud.

Refer to the exhibit. A LAN interface connected from FortiGate to two FortiSwitch devices is shown. Which two statements about the LAN interface connection shown in the exhibit are correct? (Choose two answers). You must enable Spanning Tree Protocol (STP) or Rapid STP (RSTP) on FortiGate and FortiSwitch to avoid layer 2 loopbacks. FortiGate is using an SD-WAN-type interface to connect to one FortiSwitch device with MCLAG. The connection is using a FortiLink interface. The LAN interface must use an 802.3ad type interface.

Refer to the exhibit, which shows the HA status of an active-passive cluster. An administrator wants FortiGate_B to handle the Core2 VDOM traffic. Which modification must the administrator apply to achieve this? (Choose one answer). The administrator must disable override on FortiGate_A. The administrator must change the priority from 100 to 160 for FortiGate_B. The administrator must change the load balancing method on FortiGate_B. The administrator must change the priority from 128 to 200 for FortiGate_B.

Refer to the exhibit. You need to modify the MED value advertised from FortiGate_1 to a BGP neighbor in the autonomous system, AS 30. Which parameter must you configure on FortiGate_1 to implement this? (Choose one answer). prefix-list-out. route-map-out. distribute-list-out. route-overlap.

You configured the FortiGate devices in an enterprise network to join the Fortinet Security Fabric. You have a list of IP addresses that must be blocked by the data center firewall. This list is updated daily. How can you automate updates to the firewall policy to add the IP addresses from the daily updated list? (Choose one answer). With a CLI script in FortiManager. With a Security Fabric automation. With an external connector from External Feeds. With metadata variables in FortiManager.

If you configure set tcp-mss-sender and set tcp-mss-receiver in a firewall policy, how does it affect the size and handling of TCP packets in the network? (Choose one answer). Applying commands in a firewall policy determines the largest payload a device can handle in a single TCP segment. The maximum segment size permitted in the firewall policy determines whether TCP packets are allowed or denied. The TCP packet modifies the packet size only if no fragmentation occurs. The commands affect the payload size of the packet and the size of the IP header for handling TCP packets.

What is the effect of configuring tcp-mss-sender and tcp-mss-receiver?. Fragment only. Header change. Largest payload. Allow/Deny.

A network topology, firewall policy, and SSL/SSH inspection profile configuration are shown. What must you configure on firewall policy ID 2 to detect HTTPS attacks that target a Linux server hosting the website www.acmetest.com? (Choose one answer). Enable HTTPS in the protocol port mapping of the deep-inspection SSL/SSH inspection profile. Set inspection-mode to flow to analyze the HTTPS packets and make sure that they are as expected. Set ips-sensor to IPS_block in the firewall policy. Enable SSL inspection of the SSL server and upload the certificate of the Linux server website to the SSL/SSH inspection profile.

An administrator is designing an ADVPN network for a large enterprise with spokes that have varying numbers of internet links. They want to avoid a high number of routes and peer connections at the hub. Which method should be used to simplify routing and peer management? (Choose one answer). Deploy a full-mesh VPN topology to eliminate hub dependency. Implement static routing over IPsec interfaces for each spoke. Use a dynamic routing protocol using loopback interfaces to streamline peers and routes. Establish a traditional hub-and-spoke VPN topology with policy routes.

A FortiGate device using unified threat management (UTM) profiles is reaching resource limits, and you expect traffic in your enterprise network to increase. You received an additional FortiGate of the same model. Which two options should you consider using to integrate the additional FortiGate into your enterprise network? (Choose two answers). FortiGate Clustering Protocol (FGCP) in active-passive (A-P) mode with VDOM disabled. FortiGate Session Life Support Protocol (FGSP) with external load balancers. FortiGate Clustering Protocol (FGCP) in active-active (A-A) mode with switches. Virtual Router Redundancy Protocol (VRRP) with switches.

The routing tables of FortiGate A and FortiGate B are shown. FortiGate_A and FortiGate_B are in the same autonomous system. You want to add only route 172.16.1.248/30 on FortiGate_A by updating the BGP configuration. Which configuration must you apply? (Choose one answer). A BGP route map out for 172.16.1.248/30 on FortiGate_B. Enable Redistribute Connected in the BGP section on FortiGate_B. A BGP route map in for 172.16.1.248/30 on FortiGate_A. The prefix 172.16.1.248/30 in the BGP Networks section on FortiGate_B.

Refer to the exhibit. The network diagram shows the addition of Site 2 with an overlapping network segment to the existing VPN IPsec connection between the hub and Site 1. Which IPsec phase 2 configuration must you make on the FortiGate hub to enable equal-cost multi-path (ECMP) routing when multiple remote sites connect with overlapping subnets? (Choose one answer). Set route-overlap to either use-new or use-old. Set multipath to enable. Set net-device to ecmp. Set route-overlap to allow.

**You want to scale the IBGP sessions and optimize the routing table in an IBGP network.** Which parameter should you configure? (Choose one answer). route-reflector-client. neighbor-range. neighbor-group. recursive-next-hop.

Refer to the exhibit. An administrator is deploying a hub and spokes network and using OSPF as dynamic protocol. Which configuration is mandatory for neighbor adjacency? (Choose one answer). Set bfd enable in the router configuration. Set network-type point-to-multipoint in the hub interface. Set rfc1583-compatible enable in the router configuration. Set virtual-link enable in the hub interface.

You must segment an enterprise network. Which two features could you use? (Choose two answers). VLAN. VDOM. Zero Trust Network Access (ZTNA). IPsec.

You are trying to efficiently deploy ADVPN within the enterprise network. Which two approaches can facilitate this deployment? (Choose two answers). On FortiGate, connect only the links with the best status. On FortiManager, activate the recommended IPsec tunnel provisioning templates and enable ADVPN. On FortiGate, utilize loopback interfaces to reduce the number of routes and peers. On FortiManager, enable ADVPN on VPN Manager.

The system administrator settings configured on a root FortiGate and the Security Fabric settings configured on a downstream FortiGate are shown. When prompted to sign in with Security Fabric to the downstream FortiGate, a user enters the single sign-on (SSO) provider credentials. What is the result? (Choose one answer). The downstream FortiGate creates an SSO administrator account for AdminSSO with the super_admin profile. The user is prompted to create an administrator account for AdminSSO. The downstream FortiGate creates an SSO administrator account for AdminSSO with the super_admin_readonly profile. The downstream FortiGate relies on the root FortiGate and does not create an administrator account.

A FortiGate segmented into VDOMs is shown. You must ensure effective and accelerated internet access for all of the VDOMs in this enterprise network. How can you achieve this? (Choose one answer). Connect a physical interface from each VDOM to the root VDOM. Create VDOM links. Configure network processing unit (NPU) vlinks. Create VLANs over network processing unit (NPU) vlinks.

The firewall policy ID 1 of the DCFW policy package and the reinstall preview window for the DCFW policy package installation are shown. Why is FortiManager installing set srcaddr "SSLVPN_TUNNEL_ADDR1" on firewall policy ID 1 when the policy package DCFW has the source address 10.0.5.0 on the firewall policy ID 1? (Choose one answer). The firewall policy and reinstall preview use the same addresses, but they have different names because of per-device mapping. FortiManager is installing the global policy package, which has higher priority than the ADOM policy package. The reinstall policy package ignores recent changes to the policy layer. The administrator must run the Install Wizard. FortiManager has assigned firewall HQ-DCFW a CLI template that can overwrite configurations at the policy layer.

Refer to the exhibit. The partial output of an OSPF command is shown. You are checking the OSPF status of a FortiGate device when you receive the output shown in the exhibit. Based on the output, which two statements about FortiGate are correct? (Choose two answers). FortiGate is a backup designated router. FortiGate supports OSPF ECMP. FortiGate is in the area 0.0.0.5. FortiGate can inject external routing information.

Refer to the exhibits. The routing tables of FortiGate_A and FortiGate_B and a network topology are shown. Why does FortiGate_B have only one external route available to 100.75.5.1/32? (Choose one answer). rfc-1583-compatible is not set to enable on FortiGate_B. The route to 100.75.5.1/32 shown on FortiGate_B has the lowest cost. FortiGate_A advertises only one external route to FortiGate_B. The subnet 10.0.11.0/24 is not located in the FortiGate_B area.

**Which two parameters must you configure in neighbor-range for ADVPN iBGP deployment?**. route-reflector-client. neighbor-group. remote-as. update-source.

Which two options integrate an additional FortiGate for scaling?. FGSP. FGCP Active-Active. VRRP. FGCP Active-Passive.

How can FortiGate analyze HTTPS traffic on non-standard port 8443?. Proxy mode. TLS 1.2. Add 443 and 8443 mapping. Enable IP.

Why do the firewall policy and reinstall preview show different address names during installation?. Address mismatch. Per-device mapping. Object corruption. Policy conflict.

How should you adjust MTU values to resolve encapsulation issues?. All interfaces. Wired only. FortiGate only. Controlled environment.

Based on the TLS handshake shown, what can be inferred about the client?. Supports TLS 1.0 only. Supports TLS 1.2 and TLS 1.3. Supports SSLv3. Supports DTLS.

How do you allow IPS inspection of inbound HTTPS traffic?. Enable HTTP. Enable HTTPS mapping. Enable SMTPS. Disable inspection.

What happens when an SSO user logs into a downstream FortiGate?. Denied. Readonly admin. Super admin. No account.

In which two ways does FortiGate utilize the Internet Service Database (ISDB)?. Blocks IPs and ports. Limits by URL. Works in proxy mode. Provides predefined IPs and ports.

Why is the web filter database version not shown in the FortiGuard Security Services dashboard?. Flow mode disables the database. The database failed to update. The web filter database is cloud hosted. FortiGate does not support web filtering.

What is the initial step performed by FortiGate when handling the first packets of a session?. Installation of the session key in the network processor (NP). Data encryption and decryption. Security inspections such as ACL, HPE, and IP integrity header checking. Offloading the packets directly to the content processor (CP).

**Which parameter must be configured to modify the MED value?**. route-overlap. distribute-list-out. prefix-list-out. route-map-out.