Online Access Free NSE7_EFW-6.2 Practice Test

What does the dirty flag mean in a FortiGate session?

• A.Traffic has been identified as from an application that is not allowed.
• B.Traffic has been blocked by the antivirus inspection.
• C.The next packet must be re-evaluated against the firewall policies.
• D.The session must be removed from the former primary unit after an HA failover.

View the exhibit, which contains the partial output of an IKE real time debug, and then answer the question below.

The administrator does not have access to the remote gateway. Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?

• A.Change phase 1 encryption to 3DES and authentication to CBC.
• B.Change phase 1 encryption to AES128 and authentication to SHA512.
• C.Change phase 1 encryption to AESCBC and authentication to SHA128.
• D.Change phase 1 encryption to 3DES and authentication to SHA256.

An administrator has configured a dial-up IPsec VPN with one phase 2, extended authentication (XAuth) and IKE mode configuration. The administrator has also enabled the IKE real time debug:
diagnose debug application ike-1
diagnose debug enable
In which order is each step and phase displayed in the debug output each time a new dial-up user is connecting to the VPN?

• A.Phase1; XAuth; phase 2; IKE mode configuration.
• B.Phase1; IKE mode configuration; XAuth; phase 2.
• C.Phase1; XAuth; IKE mode configuration; phase2.
• D.Phase1; IKE mode configuration; phase 2; XAuth.

A FortiGate is configured as an explicit web proxy. Clients using this web proxy are reposting DNS errors when accessing any website. The administrator executes the following debug commands and observes that the n-dns-timeout counter is increasing:

What should the administrator check to fix the problem?

• A.That DNS service is enabled in the explicit web proxy interface.
• B.The connectivity between the client workstations and the DNS server.
• C.The connectivity between the FortiGate unit and the DNS server.
• D.That DNS traffic from client workstations is allowed by the explicit web proxy policies.

An administrator has configured two FortiGate devices for an HA cluster. While testing the HA failover, the administrator noticed that some of the switches in the network continue to send traffic to the former primary unit. The administrator decides to enable the setting link-failed-signal to fix the problem. Which statement is correct regarding this command?

• A.Forces the former primary device to shut down all its non-heartbeat interfaces for one second while the failover occurs.
• B.Sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.
• C.Disables all the non-heartbeat interfaces in all the HA members for two seconds after a failover.
• D.Sends a link failed signal to all connected devices.