NSE7_EFW Practice Test 10 — 10 Questions

Question 1

A network administrator is configuring an IPsec VPN between two FortiGates. The administrator wants to ensure that only specific subnets are allowed through the tunnel, and that traffic to other subnets is dropped. Which configuration element directly defines the traffic selectors for the VPN?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Phase 2 selector. The phase 2 selector defines the source and destination subnets that are allowed through the IPsec tunnel. It acts as a traffic filter, ensuring only matching traffic is encrypted and sent over the VPN. Other elements like phase 1 proposals, firewall address objects, and static routes serve different purposes and do not directly define the selectors. Therefore, the phase 2 selector is the correct answer.

Answer

Phase 1 proposal

Answer

Firewall address objects

Answer

Static route entries

Question 2

A FortiGate is configured with two VDOMs: 'root' and 'internal'. The administrator wants to assign a physical interface to the 'internal' VDOM and then create a VLAN subinterface on that physical interface within the same VDOM. Which VDOM mode must be enabled, and what is the correct sequence of steps?

Accepted Answer

Enable Multi-VDOM mode, assign the physical interface to the 'internal' VDOM, then create the VLAN subinterface on the physical interface from within the 'internal' VDOM.. Multi-VDOM mode is required to assign a physical interface to a VDOM and then create VLAN subinterfaces on that interface within the same VDOM. The correct sequence is to first assign the physical interface to the target VDOM, then create the subinterface while in that VDOM's context. This ensures proper interface hierarchy and isolation.

Answer

Enable Multi-VDOM mode, create the VLAN subinterface on the physical interface in the 'root' VDOM, then reassign both the physical interface and the subinterface to the 'internal' VDOM.

Answer

Enable Split-Task VDOM mode, create the VLAN subinterface on the physical interface in the 'root' VDOM, then move the subinterface to the 'internal' VDOM.

Answer

Enable Split-Task VDOM mode, assign the physical interface to the 'internal' VDOM, then create the VLAN subinterface from the global configuration.

Question 3

A FortiManager administrator is configuring a new ADOM for a multi-tenant environment. The administrator needs to ensure that each tenant's FortiGates are isolated and that tenants cannot view or modify each other's configurations. Which two actions should the administrator take to achieve this? (Choose two.)

Accepted Answer

Configure each tenant's FortiGates in a separate ADOM and assign the tenant's administrative user to only that ADOM.. To achieve multi-tenant isolation, the administrator must create separate ADOMs for each tenant and assign tenant-specific administrative users with custom profiles limited to their respective ADOM. This ensures that tenants cannot access or modify other tenants' configurations. ADOM locking and FortiManager Fabric do not provide isolation, and using a Super_User profile would grant excessive privileges.

Answer

Enable 'ADOM Locking' to prevent concurrent modifications by different tenants.

Answer

Use the 'Super_User' profile for all tenant administrators and rely on ADOM assignments to restrict access.

Answer

Enable 'FortiManager Fabric' to automatically isolate tenant configurations.

Question 4

A FortiManager administrator needs to ensure that when a new firmware version is released, it is automatically downloaded to FortiManager and made available for installation on managed FortiGates. The administrator wants to minimize manual intervention. Which FortiManager feature should be configured?

Accepted Answer

Firmware management with scheduled updates. FortiManager's firmware management feature includes the ability to schedule automatic downloads of firmware images from FortiGuard. This ensures that new firmware versions are available in the FortiManager repository without manual intervention. Administrators can then use the firmware upgrade wizard to install the downloaded firmware on managed devices in a controlled manner.

Answer

Script scheduling for configuration changes

Answer

Centralized licensing for FortiGate devices

Answer

FortiGuard update service for security profiles

Question 5

A FortiManager administrator needs to delegate management of a specific ADOM to a subordinate administrator. The subordinate should only be able to view and modify firewall addresses and policies within that ADOM, and should not have access to other ADOMs or system settings. Which FortiManager feature should the administrator configure?

Accepted Answer

Create a new administrative user with a custom admin profile that includes read-write access to Firewall Objects and Policy & Objects, and assign the user to the specific ADOM.. The correct solution is to create a custom administrative profile with granular permissions limited to Firewall Objects and Policy & Objects, and assign it to the subordinate for the specific ADOM. This ensures the subordinate can perform their duties without gaining excessive privileges. Built-in profiles are too permissive, and other features like ADOM locking or ownership do not provide the required granularity.

Answer

Assign the subordinate the built-in 'Super_User' admin profile and restrict their access by ADOM assignment.

Answer

Configure a new ADOM with restricted visibility and assign the subordinate as the ADOM owner, giving them full control over that ADOM.

Answer

Use the 'ADOM Locking' feature to lock the ADOM to the subordinate administrator, preventing others from accessing it.

Question 6

An administrator is configuring a FortiGate in transparent mode. The FortiGate is placed between a router and a switch, and it must inspect traffic without changing IP addresses. The administrator wants to enable broadcast forwarding to allow DHCP broadcasts to pass through. Which statement is correct regarding broadcast forwarding in transparent mode?

Accepted Answer

Broadcast forwarding is enabled globally, and the FortiGate forwards broadcasts to all interfaces except the ingress interface.. In transparent mode, broadcast forwarding is a global setting that forwards broadcasts received on one interface to all other interfaces except the ingress. This allows DHCP and other broadcast-based protocols to work across the FortiGate. It does not require a firewall policy and is not limited to NAT/route mode; it is a key feature of transparent mode.

Answer

Broadcast forwarding is only supported in NAT/route mode, not in transparent mode.

Answer

Broadcast forwarding requires a firewall policy to allow broadcast traffic, and it is configured per VDOM.

Answer

Broadcast forwarding must be enabled on the ingress interface, and the destination MAC address is used to forward broadcasts.

Question 7

A network administrator is setting up a new FortiGate and needs to configure the device to send alert emails for high-severity events. The administrator wants to use the FortiGate's built-in email client and ensure that emails are sent from a specific address. Which configuration step is required to enable email notifications?

Accepted Answer

Configure an SMTP server under System Settings > Alert Email.. Alert emails are sent by the FortiGate's built-in email client, which requires an SMTP server to relay messages. Configuring the SMTP server under System Settings > Alert Email is the necessary step. Syslog, FortiAnalyzer, and SNMP are all logging or monitoring mechanisms, but none of them enable the FortiGate to send email alerts directly.

Answer

Configure an SNMP community under System > SNMP.

Answer

Configure a syslog server under Log & Report > Log Settings.

Answer

Configure a FortiAnalyzer device under Log & Report > FortiAnalyzer.

Question 8

A FortiManager administrator needs to delegate management of a specific ADOM to a junior administrator. The junior administrator should be able to create firewall policies and install them to devices, but must not be able to modify ADOM-level settings or manage other ADOMs. Which FortiManager feature should the administrator configure to achieve this?

Accepted Answer

Administrative profiles with ADOM restrictions. Administrative profiles define what actions a user can perform and which ADOMs they can access. By assigning a profile that grants policy creation and installation rights only for the designated ADOM, the junior administrator can work within that ADOM without being able to modify ADOM-level settings or manage other ADOMs. This follows the principle of least privilege.

Answer

Device groups within the ADOM

Answer

Workspace modes with per-ADOM locking

Answer

JSON API access tokens with scoped permissions

Question 9

An administrator is deploying a FortiGate in Transparent mode between an internal router and the ISP edge router. The FortiGate must forward IPv4 traffic without modifying source or destination addresses, and must be reachable at 10.10.10.1 for management from the internal network. Which configuration step is required?

Accepted Answer

Set the management IP address to 10.10.10.1 with a matching subnet mask and default gateway on the management interface.. Transparent mode forwards traffic at Layer 2 without changing IP addresses, so data interfaces do not need IP addresses. To manage the device, a management IP address with subnet mask and default gateway must be configured. This lets the FortiGate be reached at 10.10.10.1 while still acting as a transparent bridge between the internal router and the ISP edge router.

Answer

Enable VDOM mode and place the internal and external interfaces in separate VDOMs to isolate the transparent bridge.

Answer

Create a firewall policy with NAT enabled so that internal hosts appear as the FortiGate management IP.

Answer

Configure the internal and external interfaces with IP addresses in the same subnet as the adjacent routers.

Question 10

A FortiGate is configured as a dial-up IPsec VPN server for remote users. The administrator notices that some users connect successfully, but their traffic is not being routed to the internal network. The administrator has verified that the phase 2 selectors are correct and that the firewall policy allowing the tunnel traffic is present. Which configuration step is most likely missing to allow the remote users to access internal resources?

Accepted Answer

Enable 'mode-cfg' in the phase 1 configuration to assign IP addresses to the dial-up clients.. For dial-up IPsec VPN clients to access internal resources, they must receive IP addresses from the FortiGate. Enabling mode-cfg in phase 1 allows the FortiGate to assign addresses, typically from a defined range. Without this, clients may have tunnels but no routable internal IP, causing traffic to fail. The other options do not address the missing address assignment.

Answer

Configure a static route on the FortiGate for the remote clients' public IP addresses.

Answer

Enable 'auto-negotiate' in the phase 1 configuration to automatically establish the tunnel.

Answer

Set the phase 2 selector to 0.0.0.0/0 on both ends to allow all traffic.