Exam NSE7_EFW-7.0 All Questions

View all questions & answers for the NSE7_EFW-7.0 exam

Exam NSE7_EFW-7.0 topic 1 question 4 discussion

Actual exam question from Fortinet's NSE7_EFW-7.0

Question #: 4
Topic #: 1

Refer to the exhibits, which show the configuration on FortiGate and partial session information for internet traffic from a user on the internal network.

If the priority on route ID 2 were changed from 10 to 0, what would happen to traffic matching that user session?

A. The session would remain in the session table, but its traffic would now egress from both port1 and port2.
B. The session would remain in the session table, and its traffic would egress from port2.
C. The session would be deleted, and the client would need to start a new session.
D. The session would remain in the session table, and its traffic would egress from port1.

Show Suggested Answer

Suggested Answer: D 🗳️

by Canferno at Jan. 4, 2023, 12:48 p.m.

Comments

Submit Cancel

pcbbj

Highly Voted 2 years, 1 month ago

Selected Answer: D

With snat-route-change disable, sessions using SNAT keep using the same outbound interface, as long as the old route is still active.

upvoted 13 times

...

kocalin

Highly Voted 2 years, 1 month ago

Selected Answer: D

D is correct - Study Guide, page 146

upvoted 6 times

...

cbu_ch

Most Recent 1 year ago

Selected Answer: D

Same here, D.

upvoted 1 times

...

mikerss

1 year, 2 months ago

Selected Answer: D

D is correct. SNAT https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-SNAT-route-change-to-update-existing-NAT/ta-p/198439 config system global set snat-route-change enable end The option 'snat-route-change' can control what action the existing SNAT session needs to take after route change. By default, it is disabled. So after a routing change, sessions with SNAT keep using the same outbound interface, as long as the old route is still active. When 'snat-route-change' is enabled, after a routing change, routing information is flushed from existing SNAT sessions;.

upvoted 1 times

...

adiaz_

1 year, 3 months ago

D is the correct.

upvoted 1 times

...

Ral89

1 year, 3 months ago

How can we determine if snat-route-change is disabled or enabled by looking at this output ?

upvoted 1 times

J_Olin

9 months, 1 week ago

It says 'disable' on the second line of the Configuration screenshot

upvoted 1 times

...

Malasxd

1 year, 4 months ago

Selected Answer: B

In the session show the traffic using interface 2 as outbound. I don't know why, but it is.

upvoted 1 times

Malasxd

1 year, 4 months ago

Sorry. The interface number showed in session table is the interface index and not the interface number. I not sure if the index 2 own the port2. We need to trust that it's not a prank and there's not a policy route matching this traffic. I change my answer to"D"

upvoted 1 times

...

fy64

1 year, 4 months ago

Selected Answer: D

snat-route-change should be enabled in order to switch routing to port 2.

upvoted 1 times

...

lucient

1 year, 4 months ago

Selected Answer: D

"D" is correct. "When you disable snat-route-change, the behavior that occurs after a routing change is different for sessions using SNAT. Sessions using SNAT continue using the same outbound interface, as long as the old route is still active." Enterprise_Firewall_7.0_Study_Guide-Online.pdf - Page 146

upvoted 1 times

...

fnet007

1 year, 5 months ago

Took the test a few weeks ago, there is a variant on this question where the snat-route-change setting is enabled. So the answer would be B in that case.

upvoted 2 times

javim

1 year, 4 months ago

No, the answer would be C, the session is deleted and restablished.

upvoted 2 times

...

cedigger

1 year, 6 months ago

Selected Answer: D

D is correct

upvoted 1 times

...

Sanalthekken

1 year, 8 months ago

Selected Answer: D

With snat-route-change disable, sessions using SNAT keep using the same outbound interface, as long as the old route is still active.

upvoted 1 times

...

Dayvey

1 year, 8 months ago

Selected Answer: D

With snat-route-change enable will it perform the same action as non-natted traffic , aka it will flag the session as dirty and restablish. With snat-route-change disable it will stay on the current interface unless the interface has gone down.

upvoted 1 times

...