NSE7_EFW Practice Test 12 — 15 Questions

Question 1

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?

Accepted Answer

Mismatched Phase 2 selectors. Phase 2 failures in IPsec VPN are commonly caused by mismatched Phase 2 selectors (also known as proxy IDs or encryption domains). If the local and remote subnets or selectors do not match exactly, the tunnel will fail to establish.

Answer

Incorrect IKE version

Answer

Expired certificate

Answer

Mismatched pre-shared key

Question 2

In a VDOM-enabled environment, how are administrative accounts managed?

Accepted Answer

Admins can be scoped to specific VDOMs. In a VDOM-enabled FortiGate, administrative accounts can be scoped to specific VDOMs, restricting each admin's visibility and management scope to only the VDOMs assigned to them. This is a core benefit of VDOMs for multi-tenant or departmental management separation. The root admin retains global scope, but other admins can be limited.

Answer

Only the root VDOM admin can change settings

Answer

Admins must be global

Answer

All admins see all VDOMs

Question 3

A FortiManager administrator is configuring a new ADOM for a region. The administrator wants to restrict the ADOM to only manage FortiGate devices running FortiOS 7.0. Which ADOM version should be selected?

Accepted Answer

7.0. ADOM version must match the FortiOS version of the managed devices to ensure compatibility and access to appropriate features. Selecting 7.0 restricts the ADOM to manage only FortiGates running FortiOS 7.0, which is exactly what the administrator needs.

Answer

7.2

Answer

6.4

Answer

7.4

Question 4

Which THREE aspects of the FortiGate system are affected by changing the global 'set vdom-mode' to 'multi-vdom'?

Accepted Answer

CLI command hierarchy. Changing the global 'set vdom-mode' to 'multi-vdom' restructures the CLI command hierarchy (A), because commands become nested under 'config vdom' and you must enter a VDOM context to configure most objects, so option A is correct. It also changes the management of system resources (C), since each VDOM maintains its own separate routing table, firewall objects, administrators, and resource limits, allowing per-VDOM management and isolation, making option C correct. It additionally changes how firewall policies are applied (E), because policies are created and evaluated within each VDOM rather than globally, so inter-VDOM traffic requires explicit VDOM links and policies, confirming option E. The HA cluster size (B) is not affected by VDOM mode, as HA operates at the device level regardless of VDOM configuration. The physical port order (D) is also unaffected, since port numbering and interface naming remain the same whether in NAT/global or multi-VDOM mode.

Answer

The HA cluster size

Answer

The physical port order

Question 5

You need to inspect traffic between two VDOMs. Which mechanism is required?

Accepted Answer

Inter-VDOM Link. An Inter-VDOM Link is a virtual point-to-point interface pair that connects two VDOMs inside the same FortiGate, allowing traffic to be inspected by firewall policies as it passes between them. It is the only supported mechanism for routing and inspecting traffic between VDOMs on a single device. Without it, VDOMs are isolated routing domains and traffic cannot flow between them.

Answer

Policy-based routing

Answer

Physical loopback cable

Answer

Static NAT

Question 6

Which THREE items are included in the configuration file of a FortiGate?

Accepted Answer

User certificates. The FortiGate configuration file is a plain-text dump of the device's persistent configuration, and it includes user certificates (Option A), which are stored under config vpn certificate local/user and are part of the saved config so they survive reboots. Network interface settings (Option B) are also included, appearing under config system interface with IP addresses, VLANs, and administrative access settings. Firewall policies (Option E) are likewise part of the configuration, stored under config firewall policy with their source/destination, service, and action definitions. In contrast, FortiGuard cached updates (Option C) are transient cached content stored on disk (e.g., in the FortiGuard cache) rather than in the config file, and real-time session tables (Option D) are dynamic runtime state held in memory and visible via commands like 'get system session list', not persisted in the configuration.

Answer

FortiGuard cached updates

Answer

Real-time session tables

Question 7

What is the default behavior for 'override' in FortiGate HA?

Accepted Answer

Disabled. The default setting for 'override' in FortiGate HA is disabled. This means that the device with the highest priority does not automatically become the primary if it joins the cluster later; the current primary remains primary unless a failover occurs.

Answer

Depends on the model

Answer

Enabled

Answer

Always enabled

Question 8

Which TWO of the following can be used to optimize IPsec VPN performance?

Accepted Answer

Ensure the configuration uses AES-NI supported ciphers. Option C is correct because selecting AES-NI supported ciphers (such as AES-GCM or AES-CBC) allows the CPU to use dedicated AES-NI instruction sets, dramatically accelerating symmetric encryption and integrity processing for IPsec traffic. Option D is correct because hardware acceleration via ASIC offloading moves IPsec encryption, hashing, and encapsulation from the general-purpose CPU to dedicated crypto hardware, increasing throughput and reducing latency for VPN tunnels. Option A is not appropriate because a 24-hour Phase 1 (IKE SA) lifetime is unusually long and does not optimize performance; it mainly affects rekey frequency and can weaken security without improving throughput. Option B is incorrect because DES is a weak, legacy cipher and is actually slower and less secure than AES on modern hardware. Option E is incorrect because disabling NAT-Traversal does not improve performance and can break IPsec connectivity when NAT devices are present.

Answer

Increase the Phase 1 lifetime to 24 hours

Answer

Use DES encryption for speed

Answer

Disable NAT-Traversal

Question 9

Which THREE factors influence log storage efficiency on a FortiAnalyzer/FortiManager?

Accepted Answer

Log compression settings. Log compression settings (A) directly influence storage efficiency because FortiAnalyzer/FortiManager can compress logs (e.g., using gzip-style compression) before writing them to disk, reducing the bytes consumed per log entry. Log retention days (B) determine how long logs are kept before being purged, so a longer retention period increases the total volume of logs stored and thus affects overall storage efficiency and capacity planning. Disk quota for specific devices (D) limits how much storage each device's logs may consume, directly governing how efficiently the available disk space is allocated and preventing one device from exhausting the shared repository. The firewall firmware version (C) is not a storage-efficiency factor, since it does not change how FortiAnalyzer compresses, retains, or quotas logs. The number of active users (E) is likewise irrelevant to log storage efficiency, as it is not a FortiAnalyzer/FortiManager storage configuration or capacity parameter.

Answer

The firewall firmware version

Answer

The number of active users

Question 10

Which TWO of the following are necessary to successfully deploy an SSL VPN in tunnel mode?

Accepted Answer

A valid SSL certificate for the VPN portal. Option C is correct because tunnel-mode SSL VPN requires the FortiGate (or equivalent SSL VPN gateway) to present a valid server certificate to the client during the TLS handshake; without a trusted certificate, browsers and FortiClient will reject the portal connection. Option D is correct because after the TLS tunnel is established, traffic from the SSL VPN interface (ssl.root / sslvpn) must be permitted by a firewall policy into the Internal zone to reach protected resources; without this policy, the tunnel comes up but no internal traffic flows. Option A is wrong because IPSec phase 1 applies to IPSec VPNs, not SSL/TLS-based VPNs. Option B is wrong because BGP is a dynamic routing protocol and is not required for SSL VPN client connectivity. Option E is wrong because SSL VPN tunnel mode can run on any supported FortiGate model or virtual appliance; dedicated hardware is not a requirement.

Answer

An IPSec phase 1 configuration

Answer

A BGP session with the client

Answer

A dedicated hardware switch

Question 11

Which TWO administrative actions require a 'Workspace Mode' enabled in FortiManager?

Accepted Answer

Locking policies for editing. Workspace Mode in FortiManager enables a workflow where administrators lock objects (such as policies) for editing and then review changes before publishing them to managed devices, so options D (locking policies for editing) and E (reviewing changes before publishing) are the two actions that require Workspace Mode to be enabled. In Workspace Mode, an admin must lock a policy package or object before modifying it, and the changes are staged in a workspace until the admin reviews and commits them, which is exactly what D and E describe. The other options do not depend on Workspace Mode: automatic log rotation (A) is a logging/disk-management setting, creating new ADOMs (B) is an administrative function performed from the ADOM management interface regardless of workspace workflow, and forcing a reboot (C) is a device-management action available outside Workspace Mode.

Answer

Automatic log rotation

Answer

Creating new ADOMs

Answer

Forcing a reboot

Question 12

A network administrator is using FortiManager to manage a FortiGate. The administrator wants to make a change to a firewall policy that is currently installed on the FortiGate. After editing the policy in FortiManager, what must the administrator do to make the change take effect on the FortiGate?

Accepted Answer

Install the policy package to the FortiGate. After editing a policy in FortiManager, the administrator must install the policy package to the FortiGate. This operation transfers the updated configuration to the device, making the new policy active. Saving only commits changes to the FortiManager database, while refreshing retrieves device status. Rebooting does not apply configuration changes. Installation is the definitive step to enforce policy updates on managed devices.

Answer

Save the policy package

Answer

Reboot the FortiGate

Answer

Refresh the FortiGate status

Question 13

A FortiGate is configured with a firewall policy that includes multiple security profiles: antivirus, IPS, and web filter. The administrator notices that some traffic that should be blocked by the IPS is being allowed. The IPS sensor is set to 'Monitor' mode. What is the most likely reason for this behavior?

Accepted Answer

The IPS sensor is in Monitor mode, so it only logs detected attacks and does not block them.. The IPS sensor mode determines whether detected attacks are blocked or only logged. In Monitor mode, the sensor does not block traffic; it only records events. Therefore, traffic that matches an IPS signature will be allowed. To enforce blocking, the sensor must be set to Protect mode. The observed behavior is consistent with Monitor mode being active.

Answer

The antivirus profile is overriding the IPS action and allowing the traffic.

Answer

The IPS sensor is in Protect mode, but the signature is disabled.

Answer

The firewall policy is configured with 'action' set to 'deny', so no traffic is inspected.

Question 14

An administrator is setting up a new FortiManager to manage several FortiGates. The administrator wants to ensure that only authorized personnel can make changes to firewall policies. Which FortiManager feature should be used to control administrative access and permissions?

Accepted Answer

Administrator profiles. Administrator profiles are the correct feature to control administrative access and permissions in FortiManager. They allow you to define granular permissions, such as read-only or full access, and can be scoped to specific ADOMs. By assigning appropriate profiles to users, you ensure that only authorized personnel can make changes to firewall policies, meeting the security requirement.

Answer

ADOMs

Answer

FortiManager HA

Answer

Workspace mode

Question 15

A FortiGate administrator configured a redundant interface named 'RED1' using 'config system interface' with 'set type redundant'. The interface is up, but traffic is not passing. Which additional step is required to make the redundant interface operational?

Accepted Answer

Add member interfaces using 'set member' under the redundant interface configuration.. A redundant interface in FortiGate is a logical interface that groups multiple physical interfaces for redundancy. It requires at least one physical member interface to be assigned. Without members, the interface remains down or non-functional. Adding members via 'set member' is the essential step to make it operational.

Answer

Set the redundant interface's IP address to 0.0.0.0 to allow DHCP.

Answer

Configure a virtual MAC address for the redundant interface to avoid ARP conflicts.

Answer

Enable LACP on the redundant interface to allow link aggregation.