NSE7_EFW Practice Test 15 — 15 Questions

Question 1

An administrator is using FortiManager to manage a FortiGate. The administrator needs to make a configuration change that requires a reboot of the FortiGate. After installing the configuration from FortiManager, the FortiGate reboots. What is the expected behavior of FortiManager during this process?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FortiManager will automatically reconnect to the FortiGate after the reboot and verify the configuration.. FortiManager automatically reconnects to the FortiGate after a reboot and verifies the configuration. This is part of its robust management protocol. The FortiGate re-establishes the management tunnel, and FortiManager retrieves the current configuration to confirm the installed changes. No manual intervention is required, and revision history is preserved.

Answer

FortiManager will roll back the configuration because the FortiGate did not acknowledge the install.

Answer

FortiManager will mark the FortiGate as offline and require manual re-registration.

Answer

FortiManager will lose the device's revision history and start a new baseline.

Question 2

A security administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a new FortiGate is added to FortiManager, it automatically receives a specific set of global security profiles and firewall objects. Which FortiManager feature should they configure?

Accepted Answer

Provisioning templates. Provisioning templates are designed to automatically apply a predefined set of configurations to managed devices. When a new FortiGate is added to FortiManager, the administrator can assign a provisioning template that includes security profiles and firewall objects, ensuring consistent configuration. Other options do not provide automatic application upon device addition.

Answer

Global object database

Answer

Device blueprints

Answer

ADOM-level policy package

Question 3

You are configuring a route-based IPsec VPN between two FortiGates. The VPN is up, but traffic from the local subnet is not being encrypted and sent over the tunnel; instead, it is being sent unencrypted out of the WAN interface. You have verified that the phase 1 and phase 2 selectors match on both sides. What is the most likely cause?

Accepted Answer

The IPsec tunnel interface is not included in the outgoing firewall policy that matches the local subnet traffic.. In a route-based IPsec VPN, the tunnel interface must be used in a firewall policy that matches the traffic to be encrypted. Without such a policy, the FortiGate will not encrypt the traffic and will route it according to the routing table, potentially sending it unencrypted out of the WAN interface. Thus, the missing policy is the most likely cause.

Answer

The remote gateway's public IP address is not reachable, so the FortiGate cannot establish the tunnel.

Answer

The dead peer detection (DPD) settings are too aggressive, causing the tunnel to flap.

Answer

The phase 2 selector must be set to 0.0.0.0/0 on both sides to allow any traffic.

Question 4

An administrator wants to delegate management of a specific FortiGate to a regional IT team while retaining overall control in FortiManager. The regional team should only be able to manage firewall policies for that device, not system settings or other devices. What should the administrator configure?

Accepted Answer

Use role-based administration (RBA) to create a restricted administrator account with read-write access to the FortiGate's policy package only.. Role-based administration (RBA) in FortiManager enables the creation of administrator accounts with granular permissions. By assigning a profile that grants read-write access only to the policy package of the specific FortiGate, the regional team can manage firewall policies without accessing system settings or other devices. This provides the necessary delegation while maintaining overall control.

Answer

Enable Workspace Mode for the regional team and lock the ADOM.

Answer

Configure a device group and assign the regional team as group administrators.

Answer

Create a new ADOM for the regional team and move the FortiGate into it.

Question 5

A company has a FortiManager managing multiple FortiGates. The administrator needs to ensure that when a new FortiGate is added to the FortiManager, it automatically receives a base configuration including interface settings, static routes, and administrative accounts. Which FortiManager feature should be used to accomplish this?

Accepted Answer

Provisioning Templates. Provisioning Templates are specifically designed to apply a set of configuration settings to FortiGates automatically. They can include system settings, interface configurations, static routes, and admin accounts. When a device is added to FortiManager or when a template is assigned, the settings are pushed to the device, ensuring consistent base configurations.

Answer

Scripts

Answer

Policy Packages

Answer

Device Groups

Question 6

An administrator is configuring a new FortiManager and needs to add a FortiGate device for management. They want to ensure that the FortiGate appears in the correct ADOM and that the administrator can immediately manage its policies. Which step must be performed first?

Accepted Answer

Add the device using the Add Device wizard and specify the ADOM.. Before any management tasks can be performed, the FortiGate must be added to FortiManager. The Add Device wizard is the tool for this, and it includes selecting the ADOM. Once the device is added, the administrator can proceed with policy packages, provisioning templates, or global objects as required.

Answer

Install a provisioning template to the device.

Answer

Configure a global object that the device will use.

Answer

Create a policy package and assign it to the device.

Question 7

A network administrator is configuring a FortiGate to perform deep inspection of SSL traffic for a group of users. The administrator wants to ensure that the FortiGate can decrypt and inspect the traffic without generating certificate warnings for the users. Which certificate must be installed on the client endpoints to prevent certificate warnings?

Accepted Answer

The CA certificate that signed the FortiGate's deep inspection certificate.. To avoid certificate warnings during deep SSL inspection, the CA certificate that signed the FortiGate's inspection certificate must be installed as a trusted root on client devices. This enables clients to trust the certificates generated by the FortiGate for intercepted sessions, ensuring seamless inspection.

Answer

The FortiGate's SSH certificate.

Answer

The FortiGate's default self-signed certificate.

Answer

The web server's original certificate.

Question 8

A network administrator is configuring a new FortiGate to replace an existing firewall at the network edge. The administrator wants to ensure that the FortiGate can be managed remotely via HTTPS on its WAN interface. Which configuration step is required to allow this access?

Accepted Answer

Enable HTTPS administrative access on the WAN interface.. Administrative access protocols on interfaces are disabled by default, especially on WAN-facing interfaces. To enable remote HTTPS management, the administrator must explicitly enable HTTPS administrative access on the WAN interface, typically using the command 'set allowaccess https'. This allows the FortiGate to respond to HTTPS management requests on that interface, and best practice is to also configure trusted hosts to restrict access.

Answer

Set the WAN interface to DHCP client mode and enable 'set allowaccess ping'.

Answer

Configure a virtual IP (VIP) mapping the WAN IP to the internal management IP.

Answer

Create a firewall policy from WAN to LAN that allows HTTPS traffic.

Question 9

A network engineer has just added a new FortiGate to FortiManager and wants FortiManager to automatically retrieve the device's current configuration so it can be managed centrally. Which action accomplishes this?

Accepted Answer

Import the device configuration. Importing the configuration transfers the FortiGate's running settings into FortiManager, establishing the device database and policy baseline for centralized management. Installation pushes changes the other direction, discovery merely finds devices, and time synchronization is unrelated to configuration capture. Import is the correct first step after adding a device.

Answer

Synchronize the device clock

Answer

Run a device discovery scan

Answer

Install a default policy package

Question 10

A FortiGate is configured as a dial-up IPsec VPN server. Remote users connect using FortiClient. The administrator wants to ensure that each remote user receives an IP address from a dedicated pool and that only specific internal subnets are accessible. Which TWO actions are required on the FortiGate to meet these requirements? (Choose two.)

Accepted Answer

Configure a mode-config with an IP pool and assign it to the dial-up tunnel.. To assign IP addresses to dial-up VPN users, mode-config with an IP pool is required. Firewall policies then control which internal subnets those users can access. XAuth is for authentication, static routes are unnecessary, and aggregate mode is for combining tunnels, so those do not meet the stated requirements.

Answer

Configure a static route for the remote user subnet pointing to the IPsec tunnel interface.

Answer

Enable XAuth on the dial-up tunnel and configure a user group with local users.

Answer

Set the IPsec tunnel to aggregate mode to combine multiple dial-up connections.

Question 11

A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?

Accepted Answer

The FortiGate CA certificate used for SSL inspection. When configuring SSL inspection, the FortiGate acts as a man-in-the-middle, presenting its own certificate to clients. To prevent browser warnings, the FortiGate CA certificate used for SSL inspection must be installed as a trusted root CA on client endpoints. This allows clients to trust the certificates generated by the FortiGate.

Answer

The FortiGate's local device certificate

Answer

The Fortinet_Factory CA certificate

Answer

A third-party public CA certificate

Question 12

An administrator edits a shared firewall policy in FortiManager that is assigned to multiple FortiGates, but one FortiGate is currently offline. What happens when the administrator attempts to install the policy package to all assigned devices?

Accepted Answer

FortiManager installs to the online devices and marks the offline device as out of sync.. Installation in FortiManager is performed per assigned device. Reachable FortiGates receive the compiled configuration and become synchronized, while an offline device cannot accept the update and remains out of sync until it reconnects and a subsequent install is performed. The package and other devices are unaffected by the single unreachable member.

Answer

The install proceeds only if the offline device is removed from the policy package first.

Answer

The policy package is automatically rolled back on all devices.

Answer

Installation is blocked for all devices until the offline device reconnects.

Question 13

You are using FortiManager to manage a FortiGate cluster. You need to create a firewall policy that allows traffic from the internal network to the internet, but you want to ensure that the policy is only installed on the primary unit of the cluster. How can you achieve this in FortiManager?

Accepted Answer

This is not possible; policies are installed on the entire cluster. FortiManager manages a FortiGate cluster as a single logical device. When you install a policy package, it is applied to the entire cluster, and the cluster's primary unit synchronizes the configuration to all secondary units. There is no option to install a policy to only the primary unit. Any attempt to do so would be outside the supported functionality of FortiManager.

Answer

Configure the policy with the 'Primary' role in the install target settings

Answer

Use a dynamic object with a metadata variable that resolves to the primary unit's IP

Answer

Install the policy package only to the primary unit using the 'Install Wizard' with the 'Primary' option

Question 14

What is the primary purpose of an ADOM in FortiManager?

Accepted Answer

To logically group devices for delegated administration and policy management. An ADOM (Administrative Domain) in FortiManager is a logical container that groups managed FortiGate devices, their policies, objects, and configuration. It enables delegated administration, so different administrators can manage separate device groups without seeing each other's data, and it provides a boundary for policy packages and global objects. This makes ADOMs the primary mechanism for multi-tenant or role-based management in FortiManager.

Answer

To provide high availability for the FortiGate

Answer

To allow external API access to the FortiGate

Answer

To increase the storage capacity of the FortiManager

Question 15

An administrator needs to provide access to FortiManager for a junior team member who should only be able to view logs and reports. Which feature is used to define this access?

Accepted Answer

Administrator Profiles. Administrator Profiles in FortiManager define granular read/write permissions across functional areas such as device manager, policy & objects, and log & report. Assigning a profile with read-only access to logs and reports gives the junior team member exactly the view-only scope required.

Answer

Access Control Lists (ACLs)

Answer

ADOM Assignment

Answer

User Groups