Online Access Free NSE7_EFW-6.2 Exam Questions

View the exhibit, which contains a partial routing table, and then answer the question below.

Assuming all the appropriate firewall policies are configured, which of the following pings will FortiGate route? (Choose two.)

• A.Source IP address 10.73.9.10, Destination IP address 10.72.3.15.
• B.Source IP address 10.1.0.24, Destination IP address 10.72.3.20.
• C.Source IP address 10.72.3.27, Destination IP address 10.1.0.52.
• D.Source IP address 10.72.3.52, Destination IP address 10.1.0.254.

Two independent FortiGate HA clusters are connected to the same broadcast domain. The administrator has reported that both clusters are using the same HA virtual MAC address. This creates a duplicated MAC address problem in the network. What HA setting must be changed in one of the HA clusters to fix the problem?

• A.Gratuitous ARPs.
• B.Session pickup.
• C.Group ID.
• D.Group name.

What does the dirty flag mean in a FortiGate session?

• A.Traffic has been blocked by the antivirus inspection.
• B.Traffic has been identified as from an application that is not allowed.
• C.The next packet must be re-evaluated against the firewall policies.
• D.The session must be removed from the former primary unit after an HA failover.

Examine the output from the 'diagnose vpn tunnel list' command shown in the exhibit; then answer the question below.

Which command can be used to sniffer the ESP traffic for the VPN DialUP_0?

• A.diagnose sniffer packet any 'esp'
• B.diagnose sniffer packet any 'port 4500'
• C.diagnose sniffer packet any 'host 10.0.10.10'
• D.diagnose sniffer packet any 'port 500'

An administrator added the following Ipsec VPN to a FortiGate configuration:
configvpn ipsec phasel -interface
edit "RemoteSite"
set type dynamic
set interface "portl"
set mode main
set psksecret ENC LCVkCiK2E2PhVUzZe
next
end
config vpn ipsec phase2-interface
edit "RemoteSite"
set phasel name "RemoteSite"
set proposal 3des-sha256
next
end
However, the phase 1 negotiation is failing. The administrator executed the IKF real time debug while attempting the Ipsec connection. The output is shown in the exhibit.


What is causing the IPsec problem in the phase 1 ?

• A.The incoming IPsec connection is matching the wrong VPN configuration
• B.The phrase-1 mode must be changed to aggressive
• C.The pre-shared key is wrong
• D.NAT-T settings do not match