NSE7_EFW-7.2 Exam Questions and Answers

QUESTION: 11

Exhibit.

Refer to the exhibit, which provides information on BGP neighbors.

Which can you conclude from this command output?

The router are in the number to match the remote peer.
You must change the AS number to match the remote peer.
BGP is attempting to establish a TCP connection with the BGP peer.
The bfd configuration to set to enable.

Answer(s): C

Explanation:

The BGP state is "Idle", indicating that BGP is attempting to establish a TCP connection with the peer. This is the first state in the BGP finite state machine, and it means that no TCP connection has been established yet. If the TCP connection fails, the BGP state will reset to either active or idle, depending on the configuration.

Reference:

You can find more information about BGP states and troubleshooting in the following Fortinet Enterprise Firewall 7.2 documents:

Troubleshooting BGP

How BGP works

Reveal Solution Next Question

QUESTION: 12

Exhibit.

Refer to the exhibit, which contains the partial ADVPN configuration of a spoke.

Which two parameters must you configure on the corresponding single hub? (Choose two.)

Set auto-discovery-sender enable
Set ike-version 2
Set auto-discovery-forwarder enable
Set auto-discovery-receiver enable

Answer(s): A,B

Explanation:

For an ADVPN spoke configuration shown, the corresponding hub must have auto-discovery-sender enabled to send shortcut advertisement messages to the spokes. Also, the hub would need to have auto-discovery-forwarder enabled if it is to forward on those shortcut advertisements to other spokes. This allows the hub to inform all spokes about the best path to reach each other. The ike- version does not need to be reconfigured on the hub if it's already set to version 2 and auto- discovery-receiver is not necessary on the hub because it's the one sending the advertisements, not receiving.

Reference:

FortiOS Handbook - ADVPN

Reveal Solution Next Question

QUESTION: 13

Which FortiGate in a Security I auric sends togs to FortiAnalyzer?

Only the root FortiGate.
Each FortiGate in the Security fabric.
The FortiGate devices performing network address translation (NAT) or unified threat management (UTM). if configured.
Only the last FortiGate that handled a session in the Security Fabric

Answer(s): B

Explanation:

Option B is correct because each FortiGate in the Security Fabric can send logs to FortiAnalyzer for centralized logging and analysis12. This allows you to monitor and manage the entire Security Fabric from a single console and view aggregated reports and dashboards.

Option A is incorrect because the root FortiGate is not the only device that can send logs to FortiAnalyzer. The root FortiGate is the device that initiates the Security Fabric and acts as the central point of contact for other FortiGate devices3. However, it does not have to be the only log source for FortiAnalyzer.

Option C is incorrect because the FortiGate devices performing NAT or UTM are not the only devices that can send logs to FortiAnalyzer. These devices can perform additional security functions on the traffic that passes through them, such as firewall, antivirus, web filtering, etc4. However, they are not the only devices that generate logs in the Security Fabric.

Option D is incorrect because the last FortiGate that handled a session in the Security Fabric is not the only device that can send logs to FortiAnalyzer. The last FortiGate is the device that terminates the session and applies the final security policy5. However, it does not have to be the only device that reports the session information to FortiAnalyzer.

Reference:

=

1: Security Fabric - Fortinet Documentation1

2: FortiAnalyzer Demo6

3: Security Fabric topology

4: Security Fabric UTM features

5: Security Fabric session handling

Reveal Solution Next Question

QUESTION: 14

Which configuration can be used to reduce the number of BGP sessions in on IBGP network?

Route-reflector-peer enable
Route-reflector-client enable
Route-reflector enable
Route-reflector-server enable

Answer(s): B

Explanation:

To reduce the number of BGP sessions in an IBGP network, you can use a route reflector, which acts as a focal point for IBGP sessions and readvertises the prefixes to all other peers. To configure a route reflector, you need to enable the route-reflector-client option on the neighbor-group settings of the hub device. This will make the hub device act as a route reflector server and the other devices as route reflector clients. Reference := Route exchange | FortiGate / FortiOS 7.2.0 - Fortinet Documentation

Reveal Solution Next Question

QUESTION: 15

Exhibit.

Refer to the exhibit, which contains an active-active toad balancing scenario.

During the traffic flow the primary FortiGate forwards the SYN packet to the secondary FortiGate.

What is the destination MAC address or addresses when packets are forwarded from the primary FortiGate to the secondary FortiGate?

Secondary physical MAC port1
Secondary virtual MAC port1
Secondary virtual MAC port1 then physical MAC port1
Secondary physical MAC port2 then virtual MAC port2

Answer(s): A

Explanation:

In an active-active load balancing scenario, when the primary FortiGate forwards the SYN packet to the secondary FortiGate, the destination MAC address would be the secondary's physical MAC on port1, as the packet is being sent over the network and the physical MAC is used for layer 2 transmissions.

Reveal Solution Next Question

Fortinet NSE7_EFW-7.2 Exam (page: 3) Fortinet NSE 7 - Enterprise Firewall 7.2 Updated on: 11-Dec-2025

QUESTION: 11

Explanation:

Reference:

QUESTION: 12

Explanation:

Reference:

QUESTION: 13

Explanation:

Reference:

QUESTION: 14

Explanation:

QUESTION: 15

Explanation:

Fortinet NSE7_EFW-7.2 Exam (page: 3)
Fortinet NSE 7 - Enterprise Firewall 7.2
Updated on: 11-Dec-2025