An administrator is configuring an IKEv2 VPN between two FortiGates. The Phase 2 configuration includes a traffic selector of 10.0.0.0/24 to 192.168.1.0/24. The tunnel establishes, but only some hosts in the 10.0.0.0/24 subnet can communicate with the remote subnet. The administrator checks the Phase 2 selector and sees that it is set to 10.0.0.0/24 to 192.168.1.0/24. What is the most likely cause of the partial connectivity?

The remote FortiGate has a more specific route for some hosts in the 10.0.0.0/24 subnet.

The traffic selector is too broad, causing the FortiGate to drop packets for hosts not in the selector.

The Phase 2 SA lifetime is too short, causing frequent rekeying.

The Phase 2 proposal uses AES-GCM, which is not supported by some hosts.

In IKEv2, what is the relationship between the IKE SA and child SAs?

The IKE SA protects the negotiation of child SAs, which protect actual data traffic.

The child SA is used to encrypt IKEv2 control messages.

The child SA is established first and then used to create the IKE SA.

The IKE SA and child SA are the same entity and are established simultaneously.

A FortiGate administrator is troubleshooting an IKEv2 VPN that fails to establish. The administrator runs 'diagnose vpn ike log' and sees the following message: 'IKE_SA_INIT: no proposal chosen'. The Phase 1 configuration on the local FortiGate uses AES256-SHA256-DH14, while the remote peer is configured with AES128-SHA1-DH2. What is the most likely cause of this error?

The remote peer is configured with a different IKE version.

The IKE SA lifetime is set to 86400 seconds on the local FortiGate and 28800 seconds on the remote peer.

The encryption, integrity, and DH group parameters do not match between the two peers.

The authentication method is set to pre-shared key on the local FortiGate and certificate on the remote peer.

FortinetNSE 7 - Enterprise Firewall Administrator

Domain 5Objective 1

Implement IPsec VPN IKE Version 2 NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR Practice Questions (Page 1)

Part of the VPN domain, which makes up ~7% of our current practice bank. Fortinet does not publish an official question count, but from its 70-minute exam (~30–45 total, ~2–3 in this domain), expect 1–2 from this objective — we provide 13 practice questions to prepare you well beyond it. (estimate)

13questions here

3free pages

5concepts

Questions 1–5

1foundation · easy
Which IKEv2 Phase 1 parameter defines the Diffie-Hellman group used for key exchange?
Select an answer first
2application · medium
An administrator is configuring an IKEv2 VPN between two FortiGates. The Phase 2 configuration includes a traffic selector of 10.0.0.0/24 to 192.168.1.0/24. The tunnel establishes, but only some hosts in the 10.0.0.0/24 subnet can communicate with the remote subnet. The administrator checks the Phase 2 selector and sees that it is set to 10.0.0.0/24 to 192.168.1.0/24. What is the most likely cause of the partial connectivity?
Select an answer first
3foundation · easy
In IKEv2, what is the relationship between the IKE SA and child SAs?
Select an answer first
4application · medium
A FortiGate administrator is troubleshooting an IKEv2 VPN that fails to establish. The administrator runs 'diagnose vpn ike log' and sees the following message: 'IKE_SA_INIT: no proposal chosen'. The Phase 1 configuration on the local FortiGate uses AES256-SHA256-DH14, while the remote peer is configured with AES128-SHA1-DH2. What is the most likely cause of this error?
Select an answer first
5foundation · easy
Which of the following is a valid authentication method for IKEv2 Phase 1 on a FortiGate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR” is a trademark of its owner, used for identification only.

Implement IPsec VPN IKE Version 2 NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR Practice Questions (Page 1)

Questions 1–5

Which IKEv2 Phase 1 parameter defines the Diffie-Hellman group used for key exchange?

In IKEv2, what is the relationship between the IKE SA and child SAs?

Which of the following is a valid authentication method for IKEv2 Phase 1 on a FortiGate?

Keep studying — VPN