FCSS_NST_SE-7.4 practice questions 51–60

1. Question 51 · 71 in bank

   Which exchanges are the first two exchanges in IKEv2 negotiation?

   • AINIT_Req and Auth_Request
   • BIKE SA_INIT and IKE_Auth
   • CKey Exchange and Authentication
   • DInit_Req and Wait_Init_Req

   Show answer

   Answer: B

   Next question

2. Question 52 · 71 in bank

   Select 2

   What are two reasons you might see iprope_in_check() check failed, drop when using the debug flow? (Choose two.)

   • APacket was dropped because of policy route misconfiguration.
   • BVIP or IP pool misconfiguration.
   • CTrusted host list misconfiguration.
   • DPacket was dropped because of traffic shaping.

   Show answer

   Answer: BC

   Next question

3. Question 53 · 71 in bank

   Refer to the exhibit.

   

   FortiGate is showing continuous high CPU usage. During a maintenance window the CLI command diagnose sys top displays the output shown in the exhibit. The CLI command diagnose test application ipsmonitor 5 was run but the CPU usage by daemon ipsengine did not drop. What immediate action can you take to reduce the CPU usage effectively?

   • AMonitor if there is a traffic surge.
   • BRestart all IPS engines.
   • CDisable IPS on internal-to-internal policies.
   • DReview the IPS signatures enabled on the active IPS profiles.

   Show answer

   Answer: B

   Next question

4. Question 54 · 71 in bank

   Refer to the exhibit, which shows the output of a diagnose command.

   

   The administrator did not override the FortiGuard FQDN or IP address in the FortiGate configuration. Which IP address did FortiGate get when resolving the service.fortiguard.net name?

   • A121.111.236.179
   • B209.22.147.36
   • C208.91.112.194
   • D64.26.151.37

   Show answer

   Answer: C

   Next question

5. Question 55 · 71 in bank

   Refer to the exhibit, which displays the output of a real-time debug.

   

   Which statement accurately describes this output?

   • AAccess to the requested website was allowed by web filter profile ftgd-allow.
   • BThe server hostname was extracted either from the common name (CN) in the server certificate or the server name indication (SNI) in the client request.
   • CThe URL requested was detected to belong to FortiGuard category ID 255.
   • DThe urlfilter debug detected a category mismatch.

   Show answer

   Answer: B

   Next question

6. Question 56 · 71 in bank

   Refer to the exhibit, which shows the output of the get router info bgp summary command.

   

   Which statement regarding adjacencies between the local router and its neighbors is correct?

   • AThe local router and neighbor 100.64.2.254 are unable to establish adjacency because their BGP table versions are different.
   • BThe local router and neighbor 100.64.2.254 are unable to establish adjacency because the TCP session could not be established.
   • CThe local router and neighbor 100.64.2.254 are unable to establish adjacency because AS 100 is already used by neighbor 100.64.1.254.
   • DThe local router and neighbor 100.64.1.254 established adjacency because their BGP table versions are identical.

   Show answer

   Answer: B

   Next question

7. Question 57 · 71 in bank

   Select 3

   Refer to the exhibit, which shows routing table information.

   

   Assuming a default configuration, which three statements are correct? (Choose three.)

   • AUser C: Pass. Proxy arp configured on FortiGate will allow proper routing for the 10.0.4.0 subnet.
   • BUser B: Pass. FortiGate will use asymmetric routing using wan1 to reply to traffic for 95.56.234.24.
   • CUser B: Fail. There is no route to 95.56.234.24 using wan2 in the routing table.
   • DUser C: Fail. There is no route to 10.0.4.63 using port1 in the routing table.
   • EUser A: Pass. The default static route through wan1 passes the RPF check regardless of the source IP address.

   Show answer

   Answer: CDE

   Next question

8. Question 58 · 71 in bank

   Select 2

   Refer to the exhibit, which shows the partial output of diagnose hardware sysinfo memory.

   

   An administrator is troubleshooting a high memory issue. Which two memory allocations can help the administrator pinpoint the issue? (Choose two.)

   • AThe user space, which has 708880 kB of physical memory that is not used by the system.
   • BThe I/O cache, which has 641364 kB of memory allocated to it.
   • CThe 98908 kB of memory that will never be used.
   • DThe unused cache page, which is represented by the value indicated next to the Inactive heading.

   Show answer

   Answer: BD

   Next question

9. Question 59 · 71 in bank

   Select 2

   Refer to the exhibit, which shows the output of diagnose automation test.

   

   What can you observe from the output? (Choose two.)

   • AThe automation stitch test is not being logged.
   • BAn HA failover occurred.
   • CThe automation stitch test failed but the HA failover was successful.
   • DThe test was unsuccessful.

   Show answer

   Answer: AD

   Next question

10. Question 60 · 71 in bank

    Refer to the exhibit, which shows the output of a policy route table entry.

    

    Which type of policy route does the output show?

    • AA regular policy route, which is not associated with an active static route in the FIB
    • BAn ISDB route
    • CA regular policy route, which is associated with an active static route in the FIB
    • DAn SD-WAN rule

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCSS_NST_SE-7.4 practice, question 51. 71 questions available.