NSE7_EFW Practice Test 2 — 10 Questions

Question 1

A FortiManager administrator is troubleshooting why a configuration change made directly on a managed FortiGate is not appearing in the FortiManager policy package. The administrator wants to retrieve the FortiGate's current configuration and compare it with the FortiManager database to identify the differences. Which action should the administrator take in FortiManager?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run 'Retrieve Config' from the Device Manager. To identify configuration drift, the administrator must first retrieve the current configuration from the FortiGate into FortiManager. The 'Retrieve Config' action in Device Manager performs this synchronization, updating the FortiManager database with the device's actual settings. Once retrieved, the administrator can compare the device-level configuration with the policy package to see differences and decide on remediation.

Answer

Enable 'Auto-Update' on the device in FortiManager

Answer

Run 'Import Configuration' from the Policy & Objects

Answer

Use the 'Install Wizard' to push the FortiManager configuration to the device

Question 2

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

Accepted Answer

To encapsulate ESP packets. UDP port 4500 is used for NAT-Traversal (NAT-T) to encapsulate ESP packets within UDP. This allows IPsec traffic to pass through NAT devices that would otherwise drop ESP packets.

Answer

To replace the AH protocol

Answer

To manage Phase 1 re-keying

Answer

To verify certificate revocation status

Question 3

An administrator needs to configure a FortiGate to send logs to a FortiAnalyzer device. The FortiAnalyzer is reachable via the management interface. Which CLI command sequence correctly configures the FortiGate to send logs to the FortiAnalyzer?

Accepted Answer

config log fortianalyzer setting; set status enable; set server 10.1.1.100; end. The correct CLI sequence is under 'config log fortianalyzer setting', where you enable the status and specify the server IP. Other options configure different logging destinations or disable the feature. This ensures logs are sent to the FortiAnalyzer for analysis and archiving.

Answer

config log syslogd setting; set status enable; set server 10.1.1.100; end

Answer

config log fortianalyzer setting; set status disable; set server 10.1.1.100; end

Answer

config log memory setting; set status enable; set server 10.1.1.100; end

Question 4

An administrator is using FortiManager to manage a FortiGate device. The administrator notices that the FortiGate's configuration has drifted from the FortiManager policy package. What is the most likely cause of this configuration drift?

Accepted Answer

The FortiGate was configured directly via its CLI or GUI, bypassing FortiManager.. Configuration drift happens when the FortiGate's running configuration differs from the FortiManager policy package. The most common cause is direct configuration changes on the FortiGate, bypassing FortiManager. To maintain consistency, all changes should be made through FortiManager. Other scenarios like pending installations or reboots do not typically cause drift.

Answer

FortiManager automatically updated the policy package without installing it.

Answer

The FortiManager administrator modified the policy package but did not install it.

Answer

The FortiGate device was rebooted without saving its configuration.

Question 5

An administrator is configuring SSL inspection on a FortiGate to inspect traffic to a web server that uses a certificate signed by an internal CA. The FortiGate must decrypt and inspect the traffic without generating certificate errors on client browsers. What must be installed on the client devices?

Accepted Answer

The FortiGate's SSL inspection CA certificate. During SSL inspection, the FortiGate acts as a man-in-the-middle, presenting its own certificate to the client. To avoid certificate warnings, the client must trust the FortiGate's SSL inspection CA. Installing this CA certificate on client devices establishes that trust, allowing seamless inspection without errors.

Answer

A client certificate issued by the internal CA

Answer

The internal CA's root certificate

Answer

The web server's SSL certificate

Question 6

A network administrator is configuring a FortiGate HA cluster and wants to prevent ARP cache issues on connected switches by using a virtual MAC address. Which configuration mode should be used?

Accepted Answer

Enable virtual MAC address in HA settings.. The virtual MAC address feature in HA settings ensures that the cluster interfaces use a consistent MAC address, avoiding ARP cache problems on switches. Other options do not provide a stable MAC address across failover events.

Answer

Configure a virtual IP (VIP) for each interface.

Answer

Set the HA mode to Active-Active.

Answer

Enable gratuitous ARP on the HA interfaces.

Question 7

You notice that an IPsec tunnel is up, but no traffic passes. What is the most common reason related to firewall policy configuration?

Accepted Answer

Missing firewall policy. An IPsec tunnel can be fully up (Phase 1 and Phase 2 SAs established) yet pass no traffic if there is no firewall policy that permits the interesting traffic between the two protected subnets. FortiGate requires an explicit firewall policy matching source, destination, and service to allow traffic through the tunnel; without it, the implicit deny drops the packets even though the tunnel itself is healthy.

Answer

Missing static route

Answer

Incorrect IKE ID

Answer

Phase 1 lifetime expiration

Question 8

What is the purpose of 'dedicated HA' interfaces?

Accepted Answer

To isolate heartbeat traffic. Dedicated HA interfaces in FortiGate HA (High Availability) are used exclusively for heartbeat and synchronization traffic between cluster members. By isolating this traffic on its own physical interface, you prevent it from competing with user data and ensure reliable, low-latency communication for HA state updates and failover detection. This separation is critical because HA heartbeat packets are small but time-sensitive; any delay or loss can cause split-brain or unnecessary failovers.

Answer

To provide extra management access

Answer

To increase throughput

Answer

To act as a backup WAN port

Question 9

What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?

Accepted Answer

Implicit Deny. FortiGate firewall policies are evaluated top-down, and if no explicit policy matches the traffic, the implicit deny rule at the bottom of the policy table drops the packet. This default-deny posture is a core security principle and is not configurable to 'allow' by default. The implicit deny also logs denied traffic if logging is enabled on the implicit rule.

Answer

Send to local DNS

Answer

Route to DMZ

Answer

Allow

Question 10

Which TWO of the following are valid methods for user authentication on a FortiGate?

Accepted Answer

RADIUS. RADIUS (B) is a valid authentication method on a FortiGate: the device can act as a RADIUS client, forwarding user credentials to an external RADIUS server for verification in firewall authentication, SSL VPN, IPsec VPN, and administrative login scenarios. LDAP (C) is likewise valid: FortiGate supports LDAP authentication by binding to directory servers such as Active Directory or OpenLDAP to validate user credentials for the same authentication features. The remaining options are routing or multicast protocols, not authentication mechanisms: BGP (A) and RIP (E) are routing protocols used to exchange route information, and IGMP (D) is a multicast group management protocol, so none of them authenticate users.

Answer

BGP

Answer

IGMP

Answer

RIP