NSE7_EFW Practice Test 13 — 15 Questions

Question 1

An administrator is troubleshooting an IPsec VPN tunnel that frequently goes down. The logs show 'NO_PROPOSAL_CHOSEN' errors during phase 2 negotiations. Which action should the administrator take to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the phase 2 proposals on both peers match exactly, including encryption, authentication, and PFS settings.. The 'NO_PROPOSAL_CHOSEN' error during phase 2 indicates a mismatch in the phase 2 proposals between the two VPN peers. The administrator must ensure that the encryption, authentication, and PFS settings match on both sides. This is the definitive fix for this specific error.

Answer

Check that the phase 1 proposal includes a matching pre-shared key.

Answer

Ensure that the local and remote subnets in the phase 2 selectors are identical.

Answer

Restart the IKE daemon on both FortiGates to clear stale security associations.

Question 2

An administrator needs to ensure that a FortiGate can be managed via SSH only from the internal network, while also allowing SNMP polling from a management server. The administrator wants to restrict access to the management interface. Which configuration should be applied?

Accepted Answer

Use 'set allowaccess' on the management interface to enable only SSH and SNMP, and configure trusted hosts on the administrator accounts.. Management access to a FortiGate is controlled by the administrative access settings on each interface. Enabling only SSH and SNMP on the management interface restricts the protocols. Trusted hosts on administrator accounts further restrict SSH to specific source IPs. SNMP access can be limited by configuring allowed hosts in the SNMP community settings.

Answer

Enable SSH and SNMP on the management interface and use a firewall policy to restrict access based on source IP.

Answer

Create a loopback interface with SSH and SNMP enabled and assign it to a management VDOM.

Answer

Configure an administrator account with a trusted host IP range for the internal network and a separate account for SNMP with the management server IP.

Question 3

A company uses FortiManager to manage a large number of FortiGates. They want to enforce a strict change control process where any configuration change must be reviewed and approved before being deployed. Which FortiManager feature should they use?

Accepted Answer

Workspace Mode. Workspace Mode provides a private staging area where administrators can make changes without affecting the live configuration. Changes are saved in the workspace and can be reviewed before being committed and installed. This supports a change control process where changes must be approved before deployment. Other features like Policy Check or Revision History do not provide this pre-deployment review capability.

Answer

Policy Check

Answer

Revision History

Answer

ADOM Revisions

Question 4

A network administrator is using FortiManager to manage a FortiGate. The administrator needs to make a configuration change that requires immediate effect on the FortiGate, but the change is currently in a workspace and not yet committed. What should the administrator do to apply the change?

Accepted Answer

Commit the workspace changes, then install the policy package.. With workspace mode enabled, changes are isolated until committed. Committing writes the changes to the FortiManager database, making them part of the configuration. To apply them to the managed FortiGate, the administrator must then install the policy package. This sequence ensures that the FortiManager and FortiGate configurations remain consistent and that changes take effect as intended.

Answer

Retrieve the configuration from the FortiGate to overwrite the workspace.

Answer

Install the policy package to the FortiGate.

Answer

Use the 'Save' button in the workspace to apply changes directly to the FortiGate.

Question 5

A FortiGate is configured with a static route to a destination network via a next-hop IP. The administrator wants to ensure that if the next-hop becomes unreachable, the route is removed from the routing table. Which feature should be configured?

Accepted Answer

Configure a link monitor on the interface associated with the next-hop and enable 'update-static-route'.. Link monitors actively probe a target IP (often the next-hop) and can trigger actions such as removing static routes when the probe fails. Enabling 'update-static-route' ensures that static routes associated with the monitored interface or next-hop are removed from the routing table if the link monitor detects a failure. This provides automatic failover or route withdrawal.

Answer

Enable 'set link-down-failover' on the static route.

Answer

Set the route's distance to a higher value than other routes to the same destination.

Answer

Enable 'set blackhole enable' on the static route.

Question 6

A security administrator needs to ensure that all FortiGate devices in a specific ADOM receive the same set of firewall addresses and services, but these objects should not be available to devices in other ADOMs. What is the most efficient way to achieve this in FortiManager?

Accepted Answer

Create the objects directly in the ADOM's firewall address and service groups.. Creating firewall addresses and services directly within the ADOM ensures they are local to that ADOM and cannot be accessed by other ADOMs. This provides the required isolation and is the most efficient method because it avoids the overhead of global objects and assignment. The objects will be available to all devices within the ADOM, satisfying the need for a common set of objects across those devices.

Answer

Create the objects in the Global Database and assign them to the specific ADOM.

Answer

Use 'Policy Package' assignment to share objects between ADOMs.

Answer

Enable 'Object Sharing' in the ADOM settings to allow cross-ADOM object usage.

Question 7

What is the result of 'Pushing' a policy package from FortiManager to a FortiGate?

Accepted Answer

The FortiGate policy configuration is overwritten with the FortiManager version. Pushing a policy package from FortiManager to a FortiGate installs the FortiManager-managed policy configuration onto the device, overwriting the FortiGate's existing policy configuration with the FortiManager version. This ensures the device reflects the authoritative configuration defined centrally in FortiManager. The operation is a one-way deployment from manager to managed device.

Answer

The FortiGate policy is sent to the FortiManager

Answer

The policy is saved in a draft state on the FortiGate

Answer

The FortiManager policy is appended to the existing FortiGate policy

Question 8

Which component of FortiManager allows for the centralized management of firmware across multiple devices?

Accepted Answer

Firmware Management. FortiManager's Firmware Management feature provides centralized firmware repository and upgrade orchestration across managed devices. It lets administrators import firmware images, schedule upgrades, and push them to multiple FortiGates from a single console.

Answer

Policy Database

Answer

Device Templates

Answer

Log View

Question 9

A FortiGate is configured with a route-based IPsec VPN to a remote branch. The administrator wants to monitor the VPN tunnel status and bring it up automatically. Which interface must be referenced in the firewall policy to allow traffic through the tunnel?

Accepted Answer

The IPsec tunnel interface (e.g., VPN_Tunnel). For a route-based IPsec VPN, the FortiGate creates a virtual tunnel interface. Firewall policies must reference this tunnel interface to permit traffic into and out of the VPN. This allows the FortiGate to apply security profiles and route traffic based on the tunnel's IP addressing, and it enables tunnel monitoring through DPD.

Answer

The loopback interface

Answer

The WAN interface with the public IP address

Answer

The physical egress interface

Question 10

You are configuring a site-to-site IPsec VPN between two FortiGates. The VPN must be highly available, and you want to use two ISP links on each side. You configure two phase 1 interfaces on each FortiGate, each bound to a different WAN interface. You want the VPN to fail over automatically if one ISP link goes down. Which configuration is required to achieve this?

Accepted Answer

Configure the two phase 1 interfaces with different names, and use route-based VPN with two tunnel interfaces and configure FortiGate to monitor the tunnels and adjust routing accordingly.. For automatic failover with two ISP links, a route-based VPN with two tunnel interfaces is required. Each tunnel interface is associated with a phase 1 bound to a different WAN interface. By monitoring the tunnel interfaces (e.g., using link health monitoring or a routing protocol like BGP), the FortiGate can detect when a tunnel goes down and remove its route, causing traffic to fail over to the other tunnel.

Answer

Configure the two phase 1 interfaces with different names and enable dead peer detection (DPD) on both.

Answer

Configure the two phase 1 interfaces with the same name and enable IPsec aggregate.

Answer

Configure the two phase 1 interfaces with the same remote gateway and enable IPsec replay protection.

Question 11

An administrator is configuring a new FortiManager installation and needs to add a FortiGate device for centralized management. Which protocol does FortiManager use to communicate with the FortiGate for management and configuration tasks?

Accepted Answer

FGFM. FGFM is the dedicated protocol for FortiManager to manage FortiGates. It runs over TCP port 541 and enables secure configuration, monitoring, and management. Other protocols like SNMP, CAPWAP, and SSH serve different purposes and are not used for full management functionality.

Answer

CAPWAP

Answer

SSH

Answer

SNMP

Question 12

A network administrator is configuring a new SSL VPN on a FortiGate to allow remote users to access internal resources. The administrator wants to ensure that only authorized users can connect and that they can reach the internal network. Which TWO configurations are required to achieve this? (Choose two.)

Accepted Answer

Create a firewall policy that allows SSL VPN traffic from the SSL VPN interface to the internal network.. To enable SSL VPN access, two essential configurations are required: an SSL VPN portal that defines what users can access and how, and a firewall policy that allows traffic from the SSL VPN interface to the internal network. The portal must be assigned to users or groups, and the policy must permit the traffic. Without either, users cannot connect or reach resources, regardless of authentication method.

Answer

Configure a static route for the SSL VPN subnet to the internal network.

Answer

Set up a RADIUS server for authentication and configure the FortiGate to use it.

Answer

Enable split tunneling to allow users to access the internet directly.

Question 13

A network security administrator is using FortiManager to manage a FortiGate cluster. The administrator needs to ensure that when a policy change is made in FortiManager, it is automatically synchronized to all cluster members. Which FortiManager feature should be configured to achieve this?

Accepted Answer

Add the FortiGate cluster as a single device in FortiManager and install policy packages to it; FortiManager will handle synchronization to all cluster members.. FortiManager manages a FortiGate HA cluster as a single device. When policies are installed to the cluster, FortiManager sends the configuration to the primary unit, which then synchronizes it to all secondary members. This ensures that all cluster members have consistent policies without the need for individual management.

Answer

Use FortiManager's 'HA Management' feature to directly push configurations to each cluster member individually.

Answer

Add each cluster member as a separate device in FortiManager and create a device group for the cluster.

Answer

Configure the FortiGate cluster as a single device in FortiManager and enable 'Auto-Install' for policy changes.

Question 14

An administrator wants to configure a FortiGate to perform deep inspection of SSL traffic for a specific web server. The goal is to detect and block malicious content in HTTPS sessions. What must be installed on the client devices to allow this inspection?

Accepted Answer

A CA certificate that is used by the FortiGate for SSL inspection.. Deep SSL inspection requires the FortiGate to decrypt and re-encrypt traffic, presenting its own certificates to clients. These certificates are signed by a CA certificate on the FortiGate. For clients to accept these certificates without warnings and for inspection to work seamlessly, the FortiGate's CA certificate must be installed and trusted on the client devices. Without it, clients will see certificate errors and may block the connection.

Answer

A client certificate for each user.

Answer

The FortiGate's default self-signed certificate.

Answer

The web server's public certificate.

Question 15

A network administrator is configuring a new FortiGate firewall policy to allow HTTP traffic from the internal network to the internet. The policy is configured with NAT enabled and uses the outgoing interface's IP address. Which statement describes the source IP address seen by the external web server?

Accepted Answer

The IP address of the FortiGate's outgoing interface.. With NAT enabled and configured to use the outgoing interface address, the FortiGate translates the source IP of internal clients to the IP address of the interface that forwards the traffic. This is the typical configuration for allowing internal users to access the internet, and it ensures that return traffic is routed back through the FortiGate.

Answer

The original source IP address of the internal client.

Answer

A randomly selected IP address from the FortiGate's IP pool.

Answer

The IP address of the FortiGate's internal interface.