NSE7_EFW Practice Test 14 — 15 Questions

Question 1

An administrator is configuring a FortiGate to use a redundant interface for WAN connectivity. The redundant interface consists of two physical interfaces, port1 and port2. The administrator wants to ensure that if port1 fails, traffic automatically fails over to port2 without manual intervention. Which configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a redundant interface and add port1 and port2 as members, then assign the IP address to the redundant interface.. A redundant interface groups multiple physical interfaces into a single logical interface for redundancy. The IP address is configured on the redundant interface, and the physical members are enslaved. If one member fails, traffic automatically fails over to the remaining member. This provides seamless failover without manual intervention.

Answer

Create a redundant interface and add port1 and port2 as members, then assign the same IP address to both physical interfaces.

Answer

Create a software switch and add port1 and port2 as members, then assign the IP address to the software switch.

Answer

Create an aggregate interface with LACP mode active and add port1 and port2 as members, then assign the IP address to the aggregate interface.

Question 2

You are managing FortiGates across multiple ADOMs. How can you share common firewall objects (e.g., mail servers, common IP ranges) across these ADOMs?

Accepted Answer

Create objects in the Global Database. In FortiManager, the Global Database (Global ADOM) is specifically designed to hold common firewall objects that can be shared across multiple ADOMs. Objects created there are visible and assignable in all ADOMs, eliminating the need to duplicate them. This is the standard method for centralizing object management in multi-ADOM environments.

Answer

Manually copy objects to each ADOM

Answer

Use the API to script the creation in every ADOM

Answer

Enable 'Object Sharing' in system settings

Question 3

You are configuring a FortiGate to perform deep inspection of HTTPS traffic. After enabling SSL inspection on a firewall policy, users report that some websites show certificate warnings. You have installed the FortiGate's CA certificate on all user workstations. What is the most likely reason for the warnings?

Accepted Answer

The websites use certificate pinning, which prevents the FortiGate from re-signing the certificates.. Certificate pinning causes the client to expect a specific certificate. When deep inspection is enabled, the FortiGate re-signs the server certificate, breaking the pin and triggering a warning. This is a common issue with certain applications and websites that implement pinning.

Answer

The FortiGate's CA certificate has expired.

Answer

The users' browsers are not configured to use the FortiGate as a proxy.

Answer

The SSL inspection profile is set to certificate inspection instead of deep inspection.

Question 4

You are a FortiManager administrator. You need to configure a new ADOM to manage a set of FortiGates that will be used for a new branch office. The branch office requires a specific set of firewall objects and policies that are different from the headquarters. Which two actions must you perform when creating the new ADOM? (Choose two.)

Accepted Answer

Select the FortiGate firmware version for the ADOM. When creating a new ADOM in FortiManager, you must select the ADOM type (such as 'FortiGate' or 'Enterprise') and the firmware version of the managed devices. These steps ensure that the ADOM supports the correct features and object models for the branch office FortiGates. Assigning administrative users, enabling workspace mode, and configuring a default gateway are not required during ADOM creation.

Answer

Configure a default gateway for the ADOM

Answer

Assign the ADOM to a specific FortiManager administrative user

Answer

Enable workspace mode for the ADOM

Question 5

An administrator is troubleshooting an IPsec VPN tunnel that is not establishing. The phase 1 configuration uses pre-shared keys, and both peers are FortiGates. Which command would provide the most detailed information about the IKE negotiation?

Accepted Answer

diagnose debug application ike -1. The 'diagnose debug application ike -1' command provides detailed IKE negotiation output, including proposals, authentication, and any errors. This is the most effective way to pinpoint why an IPsec tunnel is failing to establish. Other commands show status or packets but lack the depth of the IKE debug.

Answer

diagnose sniffer packet any 'host <peer-ip> and port 500' 4

Answer

diagnose vpn ike gateway list

Answer

get vpn ipsec tunnel details

Question 6

A FortiGate is configured with an IPsec VPN to a remote peer. The administrator wants to ensure that only specific subnets are allowed over the tunnel, and that traffic from any other subnet is dropped. Which configuration element on the FortiGate directly enforces this?

Accepted Answer

Phase 2 selectors. Phase 2 selectors specify the exact local and remote subnets that are allowed to use the IPsec tunnel. Traffic not matching these selectors is not encrypted or forwarded through the tunnel, effectively dropping it. This provides a granular control to restrict VPN traffic to specific subnets, which is the requirement in this scenario.

Answer

Static routes with higher priority

Answer

Firewall address objects

Answer

IPsec phase 1 proposals

Question 7

A network administrator is troubleshooting a FortiGate HA cluster. The administrator notices that the primary unit's configuration is not synchronizing to the secondary unit. Which CLI command should the administrator use to verify the HA synchronization status and identify any configuration differences?

Accepted Answer

diagnose sys ha checksum show. The command 'diagnose sys ha checksum show' displays the configuration checksums for all HA members. If the checksums differ, the configurations are not synchronized. This allows the administrator to quickly identify and troubleshoot synchronization issues.

Answer

get system ha status

Answer

diagnose debug application hatalk -1

Answer

execute ha synchronize start

Question 8

A security administrator is using FortiManager to manage a large number of FortiGates. The administrator needs to ensure that when a new FortiGate is added to FortiManager, it automatically receives a base configuration including system settings and administrative accounts. Which FortiManager feature should be used?

Accepted Answer

Provisioning Templates. Provisioning Templates are designed to automate the configuration of managed devices, including system settings and administrative accounts. They ensure that new devices receive a consistent baseline configuration without manual intervention. This is the appropriate feature for the described scenario.

Answer

Device Groups

Answer

Policy Packages

Answer

ADOM Revisions

Question 9

An administrator wants to allow remote users to access the corporate network using SSL VPN. The administrator needs to ensure that users can only access specific internal web servers. Which SSL VPN configuration mode should be used to provide granular access control to specific applications?

Accepted Answer

Web mode. SSL VPN web mode is designed to provide access to specific web applications through a portal. It allows administrators to define bookmarks for internal web servers, giving granular control over which servers users can access. Tunnel mode provides full network access, port forward mode is for specific TCP ports, and IPsec VPN is a different technology.

Answer

Tunnel mode

Answer

Port forward mode

Answer

IPsec VPN

Question 10

Which FortiGate feature should be enabled to prevent internal users from accessing malicious websites based on real-time threat intelligence?

Accepted Answer

Web Filter. A Web Filter profile on FortiGate inspects HTTP/HTTPS requests and can block or allow URLs based on FortiGuard category ratings and real-time threat intelligence, including malicious and newly observed domains. It is the feature specifically designed to prevent users from reaching malicious websites. Other profiles address different threat vectors (malware files, applications, DNS queries) and do not provide the same URL-reputation-based blocking.

Answer

Antivirus profile

Answer

Application Control

Answer

DNS Filter

Question 11

A security administrator is configuring an SSL inspection profile on a FortiGate to inspect HTTPS traffic. The administrator wants to ensure that the FortiGate can decrypt and inspect traffic without causing certificate errors on client browsers. Which certificate must be installed on the client endpoints to prevent certificate warnings?

Accepted Answer

The SSL inspection CA certificate generated by the FortiGate.. The SSL inspection CA certificate generated by the FortiGate must be installed and trusted on client endpoints to prevent certificate warnings. When the FortiGate inspects SSL traffic, it generates certificates signed by this CA. If clients do not trust this CA, they will see warnings. The other certificates are not used for signing the inspected traffic, so they would not prevent warnings.

Answer

The FortiGate's local certificate used for IPsec VPN.

Answer

The FortiGate's default self-signed certificate.

Answer

The web server's public certificate.

Question 12

A FortiGate is deployed in a large enterprise network with multiple VDOMs. The administrator needs to configure a firewall policy that allows traffic from any source to any destination while logging all sessions. However, the administrator wants to ensure that the policy does not match traffic that is already being handled by a more specific policy. What is the correct order of policy evaluation in FortiOS?

Accepted Answer

Policies are evaluated from top to bottom, and the first matching policy is applied.. Firewall policies in FortiOS are evaluated in the order they appear, from top to bottom. The first policy that matches all criteria is applied, and subsequent policies are ignored. To avoid a general policy overshadowing specific ones, place specific policies above general ones. This ensures that traffic is handled by the intended policy.

Answer

Policies are evaluated based on the most specific match, regardless of their position in the list.

Answer

Policies are evaluated in random order to ensure load balancing.

Answer

Policies are evaluated from bottom to top, and the last matching policy is applied.

Question 13

A security administrator is preparing to push a configuration change from FortiManager to a managed FortiGate. Before installing, the administrator wants to preview exactly which CLI commands will be sent to the device. Which FortiManager feature should the administrator use?

Accepted Answer

Install Preview. Install Preview in FortiManager renders the exact CLI that will be delivered to the managed FortiGate, letting administrators inspect commands and ordering before committing. This validation step reduces risk of syntax or dependency errors during install. Other features such as revisions or monitors show FortiManager-side history or live device state, but not the projected device-bound script.

Answer

Device Manager Monitor

Answer

Policy Package Revision Diff

Answer

ADOM Revisions

Question 14

A network administrator is configuring an IPsec VPN between two FortiGates. The administrator wants to ensure that only traffic from the 10.0.0.0/24 subnet is encrypted and sent over the tunnel. Which configuration element must be defined on both FortiGates to match this traffic?

Accepted Answer

Phase 2 selectors. Phase 2 selectors define the traffic that is encrypted and sent over the IPsec tunnel. They specify the local and remote subnets. Firewall address objects and static routes are used for policy and routing but do not define the encryption domain. Phase 1 proposals are for IKE SA negotiation.

Answer

Phase 1 proposal

Answer

Firewall address objects

Answer

Static route entries

Question 15

An administrator needs to perform a firmware upgrade on 100 FortiGates. Which feature in FortiManager allows this to be done securely with a rollback option?

Accepted Answer

Firmware Management in Device Manager. FortiManager's Firmware Management feature, accessible via Device Manager, is purpose-built for centralized firmware upgrades across managed FortiGates. It allows an administrator to select multiple devices, schedule or immediately push a firmware image, and critically, it creates a rollback point by backing up the configuration and retaining the previous firmware image before upgrade. This satisfies the secure, scalable, and reversible upgrade requirement for 100 devices without manual intervention.

Answer

Automated patch management

Answer

Manual script pushing

Answer

Global Policy upgrade task