Online Access Free NSE7_EFW-7.0 Practice Test

Refer to the exhibit, which contains a TCL script configuration on FortiManager.
An administrator has configured the TCL script on FortiManager, but the TCL script failed to apply any changes to the managed device after being run.

Why did the TCL script fail to make any changes to the managed device?

• A.Changes to an interface configuration can be made only by a CLI script.
• B.Incomplete commands are ignored in TCL scripts.
• C.The TCL command run_cmd has not been created.
• D.The TCL script must start with tinclude <>.

View the exhibit, which contains the partial output of a diagnose command, and then answer the question below.

Based on the output, which of the following statements is correct?

• A.Anti-reply is enabled.
• B.Remote gateway IP is 10.200.5.1.
• C.DPD is disabled.
• D.Quick mode selectors are disabled.

The CLI command set intelligent-mode <enable | disable> controls the IPS engine's adaptive scanning behavior. Which of the following statements describes IPS adaptive scanning?

• A.Choose a matching algorithm based on available memory and the type of inspection being performed.
• B.Determines the optimal number of IPS engines required based on system load.
• C.Downloads signatures on demand from FDS based on scanning requirements.
• D.Determines when it is secure enough to stop scanning session traffic.

Examine the IPsec configuration shown in the exhibit; then answer the question below.

An administrator wants to monitor the VPN by enabling the IKE real time debug using these commands:
diagnose vpn ike log-filter src-addr4 10.0.10.1
diagnose debug application ike -1
diagnose debug enable
The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are being interchanged between both IPsec gateways. However, the IKE real time debug does NOT show any output. Why isn't there any output?

• A.The IKE real time shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.
• B.The IKE real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.
• C.The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.
• D.The log-filter setting is set incorrectly. The VPN's traffic does not match this filter.

Refer to the exhibit, which shows the output of get system ha status. NGFW-1 and NGFW-2 have been up for a week.

Which two statements about the output are true? (Choose two.)

• A.If a configuration change is made to the primary FortiGate at this time, the secondary will initiate a synchronization reset.
• B.If port7 becomes disconnected on the secondary, both FortiGate devices will elect itself the primary.
• C.If no action is taken, the primary FortiGate will leave the cluster due to the current sync status.
• D.If FGVM...649 is rebooted, FGVM...650 will become the primary and retain that role, even after FGVM...649 rejoins the cluster.