Last NSE7_EFW-7.2 practice test reviews: Practice Test Fortinet dumps
Try NSE7_EFW-7.2 Free Now! Real Exam Question Answers Updated [Sep 25, 2025]
NEW QUESTION # 18
Refer to the exhibit, which shows an SSL certification inspection configuration.
Which action does FortiGate take if the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate?
- A. FortiGate uses the CN information from the Subject field in the server certificate
- B. FortiGate uses the first entry listed in the SAN field in the server certificate
- C. FortiGate uses the SNI from the user's web browser.
- D. FortiGate closes the connection because this represents an invalid SSL/TLS configuration
Answer: A
Explanation:
If the domain in the SNI field does not match any of the domains listed in the CN and SAN fields, FortiGate uses the domain in the CN field instead of the domain in the SNI field.
NEW QUESTION # 19
Which two statements about metadata variables are true? (Choose two.)
- A. They can be used as variables in scripts
- B. They apply only to non-firewall objects.
- C. The metadata format is $<metadata_variabie_name>.
- D. You create them on FortiGate
Answer: A,C
Explanation:
Metadata variables in FortiGate are created to store metadata associated with different FortiGate features.
These variables can be used in various configurations and scripts to dynamically replace the variable with its actual value during processing. A: You create metadata variables on FortiGate. They are used to store metadata for FortiGate features and can be called upon in different configurations. D: They can be used as variables in scripts. Metadata variables are utilized within the scripts to dynamically insert values as per the context when the script runs.
Fortinet FortiOS Handbook: CLI Reference
NEW QUESTION # 20
Refer to the exhibit, which shows device registration on FortiManager.
What can you conclude about the Spoke-1 and Spoke-2 configurations with respect to the information cond:
Modified (recent auto-updated)?
- A. Based on the policy configuration on NGFW-1, the configuration on both spokes is modified and automatically updated.
- B. On both Spoke-1 and Spoke-2, the configuration was changed directly on the FortiGate device, and the changes were automatically retrieved by the device database.
- C. On NGFW-A, the configuration was changed and spokes are wailing for an autoupdate.
- D. Spoke-1 and Spoke-2 are sharing the same security policy configuration and the same policy package.
Answer: C
NEW QUESTION # 21
An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device.
What can the administrator do to fix this problem?
- A. Verify that the speed and duplex settings match between the FortiGate interfaces and the connected switch ports.
- B. Configure remote link monitoring to detect an issue in the forwarding path.
- C. Configure set send-garp-on-failover enable under config system ha on both cluster members.
- D. Configure set link-failed-signal enable under config system ha on both cluster members
Answer: D
Explanation:
Virtual MAC Address and Failover
- The new primary broadcasts Gratuitous ARP packets to notify the network that each virtual MAC is now reachable through a different switch port.
- Some high-end switches might not clear their MAC table correctly after a failover - Solution:
Force former primary to shut down all its interfaces for one second when the failover happens (excluding heartbeat and reserved management interfaces):
#Config system ha
set link-failed-signal enable
end
- This simulates a link failure that clears the related entries from MAC table of the switches.
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiGate-HA-link-failed-signal- and/ta-p/198050
NEW QUESTION # 22
Which two statements about the Security Fabric are true? (Choose two.)
- A. Only FortiGate devices with configuration-sync sel to Local receive and synchronize the global CMDB objects that the root FortiGate sends.
- B. FortiGate uses the FortiTelemetry protocol to communicate with FortiAnalyzer.
- C. Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer.
- D. Each member of the Security Fabric maintains the shared Security Fabric map.
- E. Each FortiGate device in the Security Fabric must have bidirectional FortiTelemetry connectivity.
Answer: C,E
NEW QUESTION # 23
While configuring the BGP protocol, an administrator applies the set network-import-check disable command under config network.
What will FortiGate do as a result of this command?
- A. FortiGate will not advertise any imported routes received from one BGP neighbor to another.
- B. FortiGate will not advertise the prefixes, if it is not in the routing table.
- C. FortiGate will advertise only the corresponding prefixes in the BGP network table to its BGP neighbor, even if it is not in the routing table.
- D. FortiGate will advertise all the prefixes in the BGP network table to its BGP neighbor, even if it is not in the routing table.
Answer: D
Explanation:
Fortigate doesn't advertise the prefix. You can change this behavior by disabling the network- import-check setting. After you disable the setting, Fortigate advertises all prefixes in the BGP network table, regardless of the active routes present in the routing table.
NEW QUESTION # 24
Exhibit.
Refer to the exhibit, which contains a partial policy configuration.
Which setting must you configure to allow SSH?
- A. Select an application control profile corresponding to SSH in the Security Profiles section
- B. Include SSH in the Application field
- C. Specify SSH in the Service field
- D. Configure pot 22 in the Protocol Options field.
Answer: C
Explanation:
Option A is correct because to allow SSH, you need to specify SSH in the Service field of the policy configuration. This is because the Service field determines which types of traffic are allowed by the policy1. By default, the Service field is set to App Default, which means that the policy will use the default ports defined by the applications. However, SSH is not one of the default applications, so you need to specify it manually or create a custom service for it2.
Option B is incorrect because configuring port 22 in the Protocol Options field is not enough to allow SSH. The Protocol Options field allows you to customize the protocol inspection and anomaly protection settings for the policy3. However, this field does not override the Service field, which still needs to match the traffic type.
Option C is incorrect because including SSH in the Application field is not enough to allow SSH. The Application field allows you to filter the traffic based on the application signatures and categories4. However, this field does not override the Service field, which still needs to match the traffic type.
Option D is incorrect because selecting an application control profile corresponding to SSH in the Security Profiles section is not enough to allow SSH. The Security Profiles section allows you to apply various security features to the traffic, such as antivirus, web filtering, IPS, etc. However, this section does not override the Service field, which still needs to match the traffic type. Reference: =
1: Firewall policies
2: Services
3: Protocol options profiles
4: Application control
NEW QUESTION # 25
Which, three conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three.)
- A. OSPF router IDs are unique
- B. OSPF interface priority settings are unique
- C. OSPF link costs match
- D. OSPF interface network types match
- E. Authentication settings match
Answer: A,D,E
Explanation:
* Option A is correct because the OSPF interface network types determine how the routers form adjacencies and exchange LSAs on a network segment. The network types must match for the routers to become neighbors1.
* Option B is correct because the OSPF router IDs are used to identify each router in the OSPF domain and to establish adjacencies. The router IDs must be unique for the routers to become neighbors2.
* Option E is correct because the authentication settings control how the routers authenticate each other before exchanging OSPF packets. The authentication settings must match for the routers to become neighbors3.
* Option C is incorrect because the OSPF interface priority settings are used to elect the designated router (DR) and the backup designated router (BDR) on a broadcast or non-broadcast multi-access network. The priority settings do not have to be unique for the routers to become neighbors, but they affect the DR/BDR election process4.
* Option D is incorrect because the OSPF link costs are used to calculate the shortest path to a destination network based on the bandwidth of the links. The link costs do not have to match for the routers to become neighbors, but they affect the routing decisions5. References: =
* 1: OSPF network types
* 2: OSPF router ID
* 3: OSPF authentication
* 4: OSPF interface priority
* 5: OSPF link cost
NEW QUESTION # 26
Which two statements about the Security Fabric are true? (Choose two.)
- A. FortiGate uses the FortiTelemetry protocol to communicate with FortiAnalyzer
- B. Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer
- C. Only the root FortiGate sends logs to FortiAnalyzer
- D. Only FortiGate devices with configuration-sync set to default receive and synchronize global CMDB objects that the root FortiGate sends
Answer: B,D
NEW QUESTION # 27
Refer to the exhibit, which shows a partial routing table.
What two conclusions can you draw from the FortiGate output shown in the exhibit? (Choose two.)
- A. net-device is disabled in the tunnel IPSec phase 1 configuration.
- B. FortiGate creates separate virtual interfaces for each VPN client.
- C. FortiGate is not using the destination subnets of the quick mode selectors to populate the routing table.
- D. add-route is enabled in the tunnel IPSec phase 1 configuration.
Answer: A,C
NEW QUESTION # 28
Exhibit.
Refer to the exhibit, which contains the partial interface configuration of two FortiGate devices.
Which two conclusions can you draw from this con figuration? (Choose two)
- A. The VRRP domain uses the physical MAC address of the primary FortiGate
- B. 10.1.5.254 is the default gateway of the internal network
- C. By default FortiGate B is the primary virtual router
- D. On failover new primary device uses the same MAC address as the old primary
Answer: A,D
Explanation:
The configuration shows that VRRP (Virtual Router Redundancy Protocol) is enabled and both FortiGates have the vrrp-virtual-mac enable command, meaning they share the same MAC address. The primary FortiGate uses its physical MAC address as indicated by the set type physical command. The priority value determines which FortiGate is the primary virtual router, and in this case, FortiGate-A has a higher priority than FortiGate-B, so it is the primary by default. The IP address 10.1.5.254 is the virtual IP address of the VRRP group, not the default gateway of the internal network. Reference: You can find more information about VRRP configuration and troubleshooting in the following Fortinet Enterprise Firewall 7.2 documents:
VRRP
Technical Tip: FortiGate VRRP configuration and debug
Configuration Example: How to configure VRRP between a FortiGate and a Cisco router
NEW QUESTION # 29
Refer to the exhibit, which shows an OSPF network.
Which types of ink-state advertisements (LSA) will NGFW-1 send, if itis a backup designated router (BDR)?
- A. ONGFW-1 will send type 1 and type 2 LSAs.
- B. ONGFW-1 will send type 1and type 5 LSA.
- C. NGFW-1 will send type 1and type 3 LSA.
- D. ONGFW-1 will send type 1 and type 4 LSA.
Answer: C
NEW QUESTION # 30
Exhibit.
Refer to the exhibit, which contains a CLI script configuration on FortiManager.
An administrator configured the CLI script on FortiManager Which statement is true based on the script configuration?
- A. CLI scripts must start with # l.
- B. The CLI scripts failed to execute because of an incomplete command
- C. The commands are missing d3_cmd at beginning
- D. The script successfully added a static route with gateway 10.20.121.2 on the manages device
Answer: B
NEW QUESTION # 31
Exhibit.
Refer to the exhibit, which contains a partial policy configuration.
Which setting must you configure to allow SSH?
- A. Select an application control profile corresponding to SSH in the Security Profiles section
- B. Include SSH in the Application field
- C. Specify SSH in the Service field
- D. Configure pot 22 in the Protocol Options field.
Answer: C
Explanation:
* Option A is correct because to allow SSH, you need to specify SSH in the Service field of the policy configuration. This is because the Service field determines which types of traffic are allowed by the policy1. By default, the Service field is set to App Default, which means that the policy will use the default ports defined by the applications. However, SSH is not one of the default applications, so you need to specify it manually or create a custom service for it2.
* Option B is incorrect because configuring port 22 in the Protocol Options field is not enough to allow SSH. The Protocol Options field allows you to customize the protocol inspection and anomaly protection settings for the policy3. However, this field does not override the Service field, which still needs to match the traffic type.
* Option C is incorrect because including SSH in the Application field is not enough to allow SSH. The Application field allows you to filter the traffic based on the application signatures and categories4.
However, this field does not override the Service field, which still needs to match the traffic type.
* Option D is incorrect because selecting an application control profile corresponding to SSH in the Security Profiles section is not enough to allow SSH. The Security Profiles section allows you to apply various security features to the traffic, such as antivirus, web filtering, IPS, etc. However, this section does not override the Service field, which still needs to match the traffic type. References: =
* 1: Firewall policies
* 2: Services
* 3: Protocol options profiles
* 4: Application control
NEW QUESTION # 32
Refer to the exhibit, which contains a partial policy configuration.
Which setting must you configure to allow SSH?
- A. Specify SSH in the Service field.
- B. Configure port 22 in the Protocol Options field.
- C. Select an application control profile corresponding to SSH in the Security Profiles section.
- D. Include SSH in the Application field.
Answer: D
NEW QUESTION # 33
An administrator configured the following command on FortiGate
config router ospf
sec reszart-mode graceful-restart
Which two statements correctly describe the result of the above command? (Choose two.)
- A. FortiGate is configured with graceful restart and will exit graceful mode, if the network topology changes
- B. In an HA cluster FortiGate devices will keep the OSPF routes in their routing table to avoid traffic interruption during an HA failover
- C. The OSPF neighbor that receives the grace link-state advertisement (LSA) will enter into helper mode
- D. After the default 40 seconds wait time the OSPF neighbors will resume communication with the restarting router
Answer: C,D
NEW QUESTION # 34
Refer to the exhibit which shows information about an OSPF interface.
What two conclusions can you draw from this command output? (Choose two.)
- A. The interfaces of the OSPF routers match the MTU value that is configured as 1500.
- B. NGFW-1 is the designated router.
- C. The port3 network has more than one OSPF router.
- D. The OSPF routers are in the area ID of 0.0.0.1.
Answer: A,C
Explanation:
From the OSPF interface command output, we can conclude that the port3 network has more than one OSPF router because the Neighbor Count is 2, indicating the presence of another OSPF router besides NGFW-1. Additionally, we can deduce that the interfaces of the OSPF routers match the MTU value configured as 1500, which is necessary for OSPF neighbors to form adjacencies. The MTU mismatch would prevent OSPF from forming a neighbor relationship.
NEW QUESTION # 35
......
Get Ready to Pass the NSE7_EFW-7.2 exam with Fortinet Latest Practice Exam : https://torrentpdf.exam4tests.com/NSE7_EFW-7.2-pdf-braindumps.html