NSE7_EFW Practice Test 16 — 15 Questions

Question 1

An administrator is using FortiManager to manage a large enterprise network with multiple ADOMs. The administrator needs to ensure that certain firewall objects are available across all ADOMs. Which two steps must be performed to share objects across ADOMs? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create the objects in the Global Database.. To share objects across ADOMs in FortiManager, the objects must first be created in the Global Database, and then assigned to each ADOM where they are needed. This two-step process ensures that the objects are available for use in policy packages within those ADOMs. Other options like Workspace Mode, policy packages, or Import Configuration do not provide cross-ADOM object sharing.

Answer

Enable Workspace Mode in each ADOM.

Answer

Use the 'Import Configuration' feature to copy objects from one ADOM to another.

Answer

Create a policy package that includes the objects and install it to all devices.

Question 2

What is the impact of changing the 'set vdom-mode' from 'no-vdom' to 'multi-vdom'?

Accepted Answer

System reboot required. Changing the VDOM mode from 'no-vdom' to 'multi-vdom' requires a system reboot because it fundamentally restructures the FortiGate's configuration and operational mode. The device must reinitialize its internal segmentation and management processes, so a reboot is mandatory.

Answer

Automatic disablement of HA

Answer

Loss of all firewall policies

Answer

No impact, immediate change

Question 3

What is the primary function of the FortiGate Security Fabric?

Accepted Answer

To synchronize security policies and share intelligence across devices. The FortiGate Security Fabric is an integrated architecture that connects FortiGate, FortiAnalyzer, FortiManager, FortiSandbox, FortiClient, and other Fabric-ready products so they can share threat intelligence, synchronize security policies, and coordinate response. Its primary function is that cross-product synchronization and intelligence sharing, not raw throughput or routing. This is what enables automated, end-to-end protection across the network.

Answer

To configure OSPF automatically

Answer

To increase the throughput of the firewall

Answer

To replace the need for an IPS sensor

Question 4

A network administrator is deploying a new FortiGate in a Security Fabric with multiple FortiGates and FortiSwitches. The administrator wants to ensure that the Security Fabric can automatically discover and authorize new devices. Which two configuration steps are required on the root FortiGate? (Choose two.)

Accepted Answer

Enable device detection on the interfaces connected to the fabric devices.. To enable automatic discovery and authorization in Security Fabric, the root FortiGate must have Security Fabric enabled with a group name and password, and device detection must be enabled on the interfaces connected to fabric devices. These steps allow the root to discover and authenticate new FortiGates and FortiSwitches.

Answer

Configure a dedicated management VDOM for the Security Fabric.

Answer

Set the root FortiGate's role to 'root' in the Security Fabric settings.

Answer

Configure a static route to each fabric device's management IP address.

Question 5

An administrator is using FortiManager to manage a large enterprise network with multiple ADOMs. The administrator needs to ensure that certain firewall objects are available across all ADOMs. Which two steps must be performed to share objects across ADOMs? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ADOM mode set to 'Advanced' and use of ADOM assignment rules.. To automatically place new FortiGates into the correct ADOM based on model and firmware, the administrator must use Advanced ADOM mode and configure ADOM assignment rules. These rules evaluate device attributes and assign the device to the appropriate ADOM. Other options either require manual assignment or do not consider model and firmware, so they are incorrect.

Answer

Device Manager with 'Auto-Provisioning' enabled.

Answer

ADOM mode set to 'Advanced' and manual assignment of devices.

Answer

ADOM mode set to 'Normal' and use of device groups.

Question 6

You want to automate the onboarding of new FortiGate units. Which FortiManager feature allows you to pre-configure devices before they connect to the network?

Accepted Answer

Provisioning Templates. Provisioning Templates in FortiManager allow administrators to pre-configure FortiGate devices before they are physically connected to the network. The template defines configuration such as interfaces, routing, and policies, and is applied automatically when the device registers with FortiManager, enabling zero-touch onboarding.

Answer

Scripting

Answer

Device Registration Key

Answer

Policy cloning

Question 7

Which command is used to troubleshoot connectivity by checking the routing table of a specific IP address on the FortiGate?

Accepted Answer

get router info routing-table detail . 'get router info routing-table detail ' queries the FortiGate's routing table for the specific destination IP, showing the matched route, next-hop, interface, and metric. This is the standard CLI command for verifying which route a packet to a given IP will take, making it the correct troubleshooting tool for routing lookups.

Answer

diagnose sniffer packet

Answer

get system status

Answer

exec ping-options

Question 8

Which command allows you to view the current routing table for a specific VDOM?

Accepted Answer

get router info routing-table all. The command 'get router info routing-table all' displays the complete routing table for the current VDOM. When executed within a specific VDOM context, it shows that VDOM's routes. This is the standard FortiOS command to view routing information, and 'all' includes all routes regardless of protocol.

Answer

get system routing

Answer

diag ip route

Answer

show router table

Question 9

Which TWO actions should be taken when preparing to upgrade a FortiGate HA cluster?

Accepted Answer

Review release notes. Option A (Review release notes) is correct because Fortinet release notes document the supported upgrade path, firmware version compatibility, and known issues that must be checked before upgrading an HA cluster to avoid breaking the cluster or losing configuration. Option C (Backup the configuration) is correct because taking a full configuration backup before the upgrade provides a rollback point in case the firmware upgrade fails or the cluster does not re-form properly. Options B, D, and E are not appropriate: clearing all sessions is unnecessary and disruptive, disabling heartbeat interfaces would break HA communication and cause a split-brain, and changing the HA mode to Standalone is not part of a standard HA upgrade procedure since the cluster should remain in HA mode during the upgrade.

Answer

Clear all sessions

Answer

Disable heartbeat interfaces

Answer

Change HA mode to Standalone

Question 10

An administrator has a FortiGate 600E running FortiOS 7.4 with NP6 processors. They enable hardware acceleration on a firewall policy that matches TCP port 445 traffic between two internal subnets. After enabling it, they notice that session setup is offloaded but the first few packets are still processed by the CPU. Which setting should they verify to ensure that the NP6 can accelerate the entire session from the first packet?

Accepted Answer

Verify that the session is established by the CPU and then offloaded to the NP6; this is normal behavior.. The CPU handles the first packet of a session to perform essential tasks such as route lookup, policy enforcement, and session creation. Once the session is established, it is offloaded to the NP6 for subsequent packets. This behavior is by design and cannot be changed with a configuration setting. Therefore, the administrator should recognize that the observed behavior is normal and requires no action.

Answer

Enable 'set auto-asic-offload enable' under the firewall policy.

Answer

Set 'set offload-deep-inspection enable' on the firewall policy to allow the NP6 to handle the first packets.

Answer

Configure 'set np-acceleration enable' in the global system settings.

Question 11

An administrator has a FortiGate 600E running FortiOS 7.2 with VDOMs enabled. The 'root' VDOM is in NAT mode and a 'dmz' VDOM is also in NAT mode. The administrator needs to allow HTTP traffic from the 'dmz' VDOM to a web server in the 'root' VDOM, and wants the traffic to be inspected by the firewall policy in the 'root' VDOM. Which configuration is required to accomplish this?

Accepted Answer

Create a VDOM link between the 'dmz' and 'root' VDOMs, assign IP addresses to both ends, and add firewall policies in both VDOMs to permit the traffic.. To allow traffic between two VDOMs, you must create a VDOM link, which acts as a virtual cable connecting them. Each end of the link needs an IP address, and firewall policies in each VDOM must permit the traffic. This ensures that the 'root' VDOM can apply its security policies to the traffic from the 'dmz' VDOM, meeting the requirement for inspection.

Answer

Configure a firewall policy in the 'dmz' VDOM with the destination interface as the 'root' VDOM's interface, and enable NAT.

Answer

Enable inter-VDOM routing globally with the command 'config system settings' and 'set inter-vdom-routing enable', then create a single policy in the 'root' VDOM.

Answer

Assign the same VDOM ID to both VDOMs and configure a firewall policy with the source interface in 'dmz' and destination interface in 'root'.

Question 12

A network administrator is new to FortiManager and wants to understand how to organize managed FortiGates for a multi-tenant environment. They need to ensure that each tenant's devices, policies, and objects are completely isolated from one another. What is the primary FortiManager construct that provides this isolation?

Accepted Answer

ADOM. ADOMs (Administrative Domains) are the fundamental unit of isolation in FortiManager. Each ADOM contains its own set of devices, policies, and objects, and there is no cross-ADOM visibility unless global objects are used. For a multi-tenant environment, creating a separate ADOM for each tenant ensures that their configurations are completely isolated, satisfying the requirement for separation.

Answer

Global Database

Answer

Workspace Mode

Answer

Policy Package

Question 13

Which configuration mode allows you to define a virtual MAC address for an HA cluster to prevent ARP cache issues on switches?

Accepted Answer

Virtual MAC. The Virtual MAC configuration mode in FortiGate HA allows you to define a virtual MAC address for the cluster's interfaces, which prevents ARP cache issues on upstream switches during failover. When a failover occurs, the new primary uses the same virtual MAC, so switches do not need to relearn the MAC address, avoiding traffic blackholes. This is configured under config system ha with the virtual-mac setting.

Answer

DHCP relay

Answer

Static ARP

Answer

Physical MAC

Question 14

You are troubleshooting a policy installation failure where the FortiManager reports a 'Configuration conflict'. Which action should you perform to identify the root cause of the mismatch?

Accepted Answer

Use the 'Diff' feature in the Policy & Objects tab to compare the database and device config. The 'Diff' feature in the Policy & Objects tab allows you to compare the policy package in FortiManager's database against the actual configuration on the managed FortiGate, highlighting exactly where the mismatch exists. This is the correct first step to identify the root cause of a 'Configuration conflict' during policy installation, because it shows line-by-line differences in policy, objects, and settings. Once the diff is reviewed, you can reconcile the differences by importing, reinstalling, or manually adjusting the policy package.

Answer

Force an 'Import Policy' operation

Answer

Reboot the FortiManager

Answer

Disable the policy package entirely

Question 15

A FortiGate is deployed in a VDOM-enabled configuration with three VDOMs: root, finance, and engineering. The administrator needs to inspect traffic flowing between the finance and engineering VDOMs using a security profile. Which action must be taken to allow inter-VDOM traffic to be inspected?

Accepted Answer

Enable inter-VDOM routing by creating a VDOM link between finance and engineering, then apply firewall policies on the VDOM link interfaces.. Inter-VDOM traffic must traverse a VDOM link to be inspected by firewall policies. Without a VDOM link, traffic between VDOMs is not inspected because it does not pass through a policy. The correct approach is to create a VDOM link and apply policies on its interfaces, enabling security profiles to inspect the traffic.

Answer

Configure a static route in the root VDOM that points to both finance and engineering subnets, then enable 'inspection-mode' on the root VDOM.

Answer

Assign all interfaces to the root VDOM and use VLANs to separate traffic, then apply security profiles on the root VDOM's interfaces.

Answer

Enable 'set allow-subnet-overlap enable' on the finance and engineering VDOMs, then create a firewall policy with 'inspection' action.