NSE7_EFW Exam Questions and Answers

System reboot required

Switching from no-vdom to multi-vdom restructures the entire configuration into multiple virtual domains, a fundamental change to how policies, interfaces and routing are stored, so FortiGate requires a reboot before the new mode takes effect.

Flood to all ports

In transparent mode the FortiGate forwards frames by MAC address without routing. When the destination MAC is unknown, it floods the frame out all ports except the ingress port, exactly as a learning bridge does, until the address is learned.

To isolate heartbeat traffic

Dedicated HA interfaces carry only synchronisation and heartbeat traffic between cluster members, keeping it off the data plane. This prevents production throughput from delaying or dropping heartbeat packets, satisfying the requirement for reliable failover detection without contending with user traffic.

Members are logical groups of interfaces

A member is a logical grouping that bundles multiple physical interfaces, allowing SD-WAN rules and health checks to reference the group rather than individual links. This abstraction satisfies the stem's question about how member configuration relates to the underlying physical interfaces.

Inter-VDOM Link

Inter-VDOM links create a dedicated virtual interface pair connecting two VDOMs, enabling traffic to route and be inspected by firewall policies between them. This satisfies the requirement to inspect inter-VDOM traffic, since VDOMs otherwise remain isolated and cannot pass traffic for policy enforcement without such a link.

diag sys top

`diagnose sys top` lists live processes with their CPU and memory percentages, letting you confirm whether the IPS engine (`ipsengine`) is consuming excessive CPU. This directly satisfies the stem's requirement to identify the process responsible for high CPU usage on the FortiGate.

Mismatched Phase 2 selectors

Phase 2 negotiates the encryption and authentication parameters, including the proxy IDs and subnet selectors. If the local and remote quick-mode selectors differ, the tunnel proposal is rejected and Phase 2 never reaches the up state.

Create an IPS sensor override for the specific signature ID

An IPS sensor override lets you disable or set the specific signature to monitor-only for the targeted server, clearing the false positive without weakening protection from other signatures. This is narrower than editing the whole profile, satisfying the requirement to maintain security while resolving the drop efficiently.

Use a route map in the OSPF redistribute configuration

A route map attached to the OSPF redistribute command filters which connected routes are advertised, matching only the specified subnet. This satisfies the constraint of redistributing connected routes selectively rather than all of them, which a plain redistribute statement cannot achieve.

Implicit Deny

FortiGate processes policies top-down and, absent any matching explicit rule, applies the built-in implicit deny that drops the traffic. This default satisfies the scenario's constraint of no explicit policy matching, ensuring unmatched sessions are blocked rather than permitted.

The FortiGate CA certificate used for SSL inspection

SSL inspection requires the FortiGate's inspection CA certificate, not the server's, to be trusted on endpoints. Installing this CA lets the FortiGate re-sign intercepted sessions, so browsers validate the substituted certificate and no warning appears.

Host check

Host check enforces endpoint compliance before granting SSL VPN access, verifying antivirus status, OS patches and firewall settings on the connecting device. It satisfies the stem's constraint that only compliant corporate laptops may connect, blocking non-compliant or unmanaged endpoints at authentication.

SD-WAN Zone

SD-WAN zones group multiple WAN interfaces into a single logical object, and FortiManager assigns members to that zone rather than to individual interfaces. This satisfies the stem's requirement for grouping WAN interfaces before SD-WAN member assignment, letting you reference one zone across policies and health checks.

To logically group devices for delegated administration and policy management

An ADOM partitions FortiManager into independent administrative domains, each holding its own devices, policies and objects. This satisfies the delegated administration constraint: administrators gain scoped access to only their assigned ADOM, while policy packages and objects remain isolated from other domains.

Use the 'Diff' feature in the Policy & Objects tab to compare the database and device config

The Diff feature compares the FortiManager policy database against the managed device's running configuration, exposing the exact object or setting causing the conflict. This directly identifies the root cause of the policy installation failure rather than merely reporting that a mismatch exists.

Normal mode

Normal mode lets the FortiGate be fully managed by FortiManager, which pushes configuration and policy packages to it. The alternative, backup mode, restricts FortiManager to read-only retrieval, so it cannot satisfy the requirement to manage configuration and policies.

Assign devices to a Device Group and push a common Policy Package

A Device Group with a shared Policy Package lets FortiManager install one consistent configuration to all 50 FortiGates in a single coordinated push, avoiding per-device drift and reducing the window of inconsistent policy states that sequential individual installs would create.

Create objects in the Global Database

Objects created in the Global Database are inherited by every ADOM, so a mail server or IP range defined once is available to all managed FortiGates without duplication. This directly satisfies the cross-ADOM sharing requirement, unlike per-ADOM objects, which remain isolated within their own administrative domain.