Is this exam completely free?

ExamCademy offers a free preview for every exam, covering around 20% of the total questions. Full access to all questions is available for free by signing up for an account. Optional supporters unlock AstroTutor (AI tutor) and advanced study modes.

Can I practice IT certification exams from Microsoft, AWS, or CompTIA?

Yes! ExamCademy supports a wide range of IT certification exams including Microsoft Azure, AWS Cloud Practitioner, and CompTIA A+ and Security+.

How accurate are the mock exams?

Our practice questions are community-created and moderator-reviewed to align with realistic exam objectives, style, and difficulty.

NSE7-EFW-7-0 by Fortinet - Page 1 | ExamCademy

Mode Selection

Question 1

Question 2

Question 3

What is the diagnose test application ipsmenitor 5 command used for?

A To enable IPS bypass mode
B To disable the IPS engine
C To restart all IPS engines and monitors
D To provide information regarding IPS sessions

Question 4

Refer to the exhibits, which show the configuration on FortiGate and partial session information for internet traffic from a user on the internal network.

Question Image

If the priority on route ID 2 were changed from 10 to 0, what would happen to traffic matching that user session?

A The session would remain in the session table, but its traffic would now egress from both port1 and port2.
B The session would remain in the session table, and its traffic would egress from port2.
C The session would be deleted, and the client would need to start a new session.
D The session would remain in the session table, and its traffic would egress from port1.

Question 5

Refer to the exhibit, which shows partial outputs from two routing debug commands.

Question Image

Which change must an administrator make on FortiGate to route web traffic from internal users to the internet, using ECMP?

A Set the priority of the static default route using port1 to 10.
B Set the priority of the static default route using port2 to 1.
C Set preserve-session-route to enable.
D Set snat-route-change to enable.

Question 6

Which statement about IKE and IKE NAT-T is true?

A IKE is used to encapsulate ESP traffic in some situations, and IKE NAT-T is used only when the local FortiGate is using NAT on the IPsec interface.
B IKE is the standard implementation for IKEv1 and IKE NAT-T is an extension added in IKEv2.
C They both use UDP as their transport protocol and the port number is configurable.
D They each use their own IP protocol number.

Question 7

Refer to the exhibit, which shows a partial routing table.

Question Image

Assuming all the appropriate firewall policies are configured, what two changes would an administrator need to make if they wanted to send traffic from a client directly connected to port3, to a server directly connected to port4? (Choose two.)

A Configure route leaking between VRF 12 and VRF 21.
B Disable auto-asic-offload as this is not supported between VRF instances.
C Configure RIPv2 to exchange route information between the VRF instances.
D Configure route leaking between port3 and port4.
E Enable SNAT on the relevant firewall policies to prevent RPF check drops.

Question 8

Refer to the exhibit, which contains the partial output of a diagnose command.

Question Image

Based on the output, which two statements are correct? (Choose two.)

A The remote gateway has quick mode selectors containing a destination subnet of 10.1.2.0/24.
B The remote gateway IP is 10.200.5.1.
C DPD is disabled.
D Anti-replay is enabled.

That's the end of the Preview

Create a free account to unlock all questions for this exam.

Log In / Sign Up

Page 1 of 2 • Questions 1-25 of 37

1 2

→

Know a question that should be here? Contribute to this exam

Which three conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three.)

A OSPF interface network types match.
B OSPF router IDs are unique.
C OSPF interface priority settings are unique.
D Authentication settings match.
E OSPF link costs match.

An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device.
What can the administrator do to fix this problem?

A Configure remote link monitoring to detect an issue in the forwarding path.
B Configure set send-garp-on-failover enable under config system ha on both cluster members.
C Verify that the speed and duplex settings match between the FortiGate interfaces and the connected switch ports.
D Configure set link-failed-signal enable under config system ha on both cluster members.

NSE7-EFW-7-0Preview

Mode Selection

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

That's the end of the Preview