NSE7_SDW-7.2 試験問題を無料オンラインアクセス

Refer to the exhibit.

Based on the exhibit, which statement about FortiGate re-evaluating traffic is true?

• A.Changes have been made on firewall policy ID 1 on FortiGate.
• B.Firewall policy ID 1 has source NAT disabled.
• C.The type of traffic defined and allowed on firewall policy ID 1 is UDP.
• D.FortiGate has terminated the session after a change on policy ID 1.

What are two advantages of using an IPsec recommended template to configure an IPsec tunnel in an hub-and- spoke topology? (Choose two.)

• A.It guides the administrator to use Fortinet recommended settings.
• B.It automatically install IPsec tunnels to every spoke when they are added to the FortiManager ADOM.
• C.The VPN monitor tool provides additional statistics for tunnels defined with an IPsec recommended template.
• D.It ensures consistent settings between phase1 and phase2.

What is a benefit of using application steering in SD-WAN?

• A.You do not need to enable SSL inspection.
• B.You steer traffic based on the detected application.
• C.You do not need to configure firewall policies that accept the SD-WAN traffic.
• D.The traffic always skips the regular policy routes.

Refer to the exhibit, which shows the IPsec phase 1 configuration of a spoke.

What must you configure on the IPsec phase 1 configuration for ADVPN to work with SD-WAN?

• A.You must enable auto-discovery-sender.
• B.You must set ike-version to 1.
• C.You must enable net-device.
• D.You must disable idle-timeout.

Refer to the exhibits.
Exhibit A -

Exhibit B -

Exhibit A shows a site-to-site topology between two FortiGate devices: branch1_fgt and dc1_fgt. Exhibit B shows the system global and system settings configuration on dc1_fgt.
When branch1_client establishes a connection to dc1_host, the administrator observes that, on dc1_fgt, the reply traffic is routed over T_INET_0_0, even though T_INET_1_0 is the preferred member in the matching SD-WAN rule.
Based on the information shown in the exhibits, what configuration change must be made on dc1_fgt so dc1_fgt routes the reply traffic over T_INET_1_0?

• A.Disable allow-subnet-overlap under config system settings.
• B.Enable auxiliary-session under config system settings.
• C.Enable snat-route-change under config system global.
• D.Disable t#p-session-without-syn under config system settings.