ExamTopics Logo
Mail Us[email protected]
Menu
Fortinet Discussions
exam questions

Exam NSE7_NST-7.2 All Questions

View all questions & answers for the NSE7_NST-7.2 exam
Go to Exam

Exam NSE7_NST-7.2 topic 1 question 51 discussion

Actual exam question from Fortinet's NSE7_NST-7.2
Question #: 51
Topic #: 1
[All NSE7_NST-7.2 Questions]

An administrator wants to capture encrypted phase 2 traffic between two FortiGate devices using the built-in sniffer.

If the administrator knows that there is no NAT device located between both FortiGate devices, which command should the administrator run?

  • A. diagnose sniffer packet any ‘udp port 500’
  • B. diagnose sniffer packet any ‘ip proto 50’
  • C. diagnose sniffer packet any ‘udp port 4500’
  • D. diagnose sniffer packet any ‘ah’
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️
by Ic3Box at March 18, 2025, 10:30 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
Ic3Box
1 month ago
Selected Answer: B
Correct answer is B because: IP Protocol 50 is used for ESP (Encapsulated Security Payload), which is the protocol that carries encrypted Phase 2 traffic in an IPsec VPN. Since there is no NAT device between the FortiGate devices, NAT Traversal (NAT-T) is not in use; hence, capturing ESP traffic directly with IP protocol 50 is appropriate.
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago