Logo ExamsQA
Exit
Official Bank 0/163

Fortinet NSE 7 – Enterprise Firewall 7.0 (NSE7_EFW-7.0) - Fortinet Exam Questions

Last updated on June 20, 2026

97% Exam Compliance
163 Total Questions
1
Question
Examine the following partial outputs from two routing debug commands; then answer the question below. # get router info kernel
tab=254 vf=0 scope=0type=1 proto=11 prio=0 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0
gwy=10.200.1.254 dev=2(port1)
tab=254 vf=0 scope=0type=1 proto=11 prio=10 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0
gwy=10.200.2.254 dev=3(port2)
tab=254 vf=0 scope=253type=1 proto=2 prio=0 0.0.0.0/0.0.0.0/.->10.0.1.0/24 pref=10.0.1.254
gwy=0.0.0.0 dev=4(port3)
# get router info routing-table all s*0.0.0.0/0 [10/0] via 10.200.1.254, portl [10/0] via 10.200.2.254, port2, [10/0] dO.0.1.0/24 is directly connected, port3 dO.200.1.0/24 is directly connected, portl d0.200.2.0/24 is directly connected, port2

Which outbound interface or interfaces will be used by this FortiGate to route web traffic from internal users to the Internet?
Options
A Both portl and port2.
B port!
C port2.
D port3.
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

2
Question
Examine the output of the ‘get router info ospf neighbor’ command shown in the exhibit; then
Reveal Only
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

3
Question
Refer to the exhibit, which contains partial outputs from two routing debug commands.

Exhibit

Why is the port2 default route not in the second command's output?
Options
A It has a lower priority value than the default route using port1.
B It has a higher priority value than the default route using port1.
C It is disabled in the FortiGate configuration.
D It has a higher distance than the default route using port1.
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

4
Question
View the exhibit, which contains the output of diagnose sys session stat, and then answer the question below.

Exhibit

Which statements are correct regarding the output shown? (Choose two.)
Select 2
Options
A No sessions have been deleted because of memory pages exhaustion.
B There are 0 ephemeral sessions.
C All the sessions in the session table are TCP sessions.
D There are 166 TCP sessions waiting to complete the three-way handshake.
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

5
Question
question below. Examine the partial output from the IKE real time debug shown in the exhibit; then answer the

Exhibit

#diagnose debug application ike -1 #diagnose debug enable ike 0:. : 75: responder: aggressive mode get 1* message... ike 0: :76: incoming proposal: ike 0: :76: proposal 1d = 0: ike 0: :76: trans_id - KEY IKE.
type= OAKLEY_ENCRYPT_ALG, val-AES_CBC.
type= OAKLEY_HASH_ALG, val=SHA2_256.
type-OAKLEY_GROUP, val-MODP2048. ike 0: :76: my proposal, gw Remote: ike 0: .:76: proposal id=l: ike 0: :76: trans id= KEY IKE. type-OAKLEY_ECRYPT_ALG, val-DES_CBC. ike O: : 76: ike O: :76:
type=OAKLEY_HASH_ALG, val-SHA2_256.
type-AUTH_METHOD, val- PRESHARED_KEY.
type=OAKLEY_GROUP, val =MODP2048.
ike 0: : 76: ISAKMP SA lifetime=86400 ike 0: 76: proposal id=1: ike 0: :76: protocol id= ISAKMP: ike 0: :76: protocol id= ISAKMP: ike 0: :76: protocol id= ISAKMP: ike 0: : 76: trans_id= KEY_IKE. 1ke O: : 76: encapsulation = IKE/none ike 0: : 76: encapsulation = IKE/none ike 0: : 76: encapsulation = IKE/none type-OAKLEY _ENCRYPT_ALG, val-DES_CBC.
type= OAKLEY_HASH_ALG, val-SHA2_256.
type=AUTH_METHOD, val-PRESHARED_KEY.
type=AUTH_METHOD, val-PRESHARED_KEY.
type=OAKLEY_GROUP, val=MODP1536.
1ke O: :76: ike 0: .:76: ike 0: :76: ike 0: : 76: ike 0: :76: ISAKMP SA lifetime=86400 ike 0: :76: ike 0: :76: ike 0: : 76: ike 0: : 76: ike 0: .:76: ike 0: :76: ike 0: :76: ISAKMP SA lifetime=86400 Why didn’t the tunnel come up?
Options
A The remote gateway’s Phase-1 configuration does not match the local gateway’s phase-1 configuration.
B IKE mode configuration is not enabled in the remote IPsec gateway.
C The remote gateway’s Phase-2 configuration does not match the local gateway’s phase-2 configuration.
D One IPsec gateway is using main mode, while the other IPsec gateway is using aggressive mode.
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

Finish Practice?

Are you sure you want to finish? This will end your practice session.