NSE7_EFW Practice Exam 1 — 20 Questions

Question 1

You are managing FortiGates across multiple ADOMs. How can you share common firewall objects (e.g., mail servers, common IP ranges) across these ADOMs?

Accepted Answer

Create objects in the Global Database. Using the 'Global Database' or 'Global Policy' objects allows administrators to define objects once and share them across multiple ADOMs.

Answer

Manually copy objects to each ADOM

Answer

Use the API to script the creation in every ADOM

Answer

Enable 'Object Sharing' in system settings

Question 2

An administrator wants to use FortiManager to push a configuration change to 50 FortiGates simultaneously. Which method minimizes downtime and ensures consistency?

Accepted Answer

Assign devices to a Device Group and push a common Policy Package. Using 'Provisioning Templates' or 'Device Groups' allows the administrator to push changes to multiple devices in a controlled, unified manner.

Answer

Create 50 separate ADOMs

Answer

Connect to each FortiGate via SSH and run scripts

Answer

Enable 'Auto-Push' for every change

Question 3

You are setting up an SD-WAN configuration via FortiManager. Which object type is used to group multiple WAN interfaces for SD-WAN member assignment?

Accepted Answer

SD-WAN Zone. The 'SD-WAN Zone' object is used in FortiManager to group multiple interfaces together for use in SD-WAN policies.

Answer

IP Pool

Answer

Virtual Wire Pair

Answer

Interface Group

Question 4

An enterprise firewall administrator needs to deploy different security profiles to branch offices while sharing the same firewall policy structure. Which feature should be used?

Accepted Answer

Policy Package inheritance and mapping. Policy Packages allow for the grouping of policies, while the use of 'Global Policy' or 'Package Inheritance' allows for common policies to be shared across various ADOMs or device groups.

Answer

Creating multiple ADOMs for every branch

Answer

Manual copy-paste of rules

Answer

Using CLI templates exclusively

Question 5

Which TWO administrative actions require a 'Workspace Mode' enabled in FortiManager?

Accepted Answer

Locking policies for editing. Workspace mode is required for concurrent editing and locking of policies by multiple administrators.

Answer

Automatic log rotation

Answer

Creating new ADOMs

Answer

Forcing a reboot

Question 6

Which TWO actions should be taken when preparing to upgrade a FortiGate HA cluster?

Accepted Answer

Review release notes. A configuration backup is mandatory, and checking the release notes for firmware-specific HA behavior is critical for a smooth upgrade.

Answer

Clear all sessions

Answer

Disable heartbeat interfaces

Answer

Change HA mode to Standalone

Question 7

An administrator notices that logs are not appearing in FortiManager for a specific FortiGate. What is the first thing to check to ensure log forwarding is active?

Accepted Answer

Log forwarding configuration on the FortiGate. Checking the 'Log Settings' on the FortiGate to ensure the 'Remote Logging' feature is enabled and pointing to the correct FortiManager/FortiAnalyzer IP.

Answer

The FortiManager license

Answer

The device's physical connection

Answer

The firmware version of the FortiGate

Question 8

Which FortiManager feature allows an administrator to test policy changes in a sandbox environment before applying them to production FortiGates?

Accepted Answer

Policy Package Cloning/Revision History. The 'Revision History' or 'Policy Package cloning' allows admins to modify and verify changes before pushing them to the production devices.

Answer

Policy Testing Mode

Answer

Global Policy Lockdown

Answer

Device Manager Simulation

Question 9

A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?

Accepted Answer

The FortiGate CA certificate used for SSL inspection. The FortiGate acts as a man-in-the-middle, so the client must trust the CA certificate generated by the FortiGate.

Answer

The FortiGate's local device certificate

Answer

The Fortinet_Factory CA certificate

Answer

A third-party public CA certificate

Question 10

You need to ensure that session synchronization between HA nodes is as efficient as possible. Which parameter should be tuned in the HA configuration?

Accepted Answer

session-pickup-delay. The 'session-pickup' setting, specifically 'session-pickup-delay', helps manage the timing and load of session synchronization to prevent CPU spikes.

Answer

monitor-interface

Answer

override

Answer

heartbeat-interval

Question 11

You are troubleshooting a policy installation failure where the FortiManager reports a 'Configuration conflict'. Which action should you perform to identify the root cause of the mismatch?

Accepted Answer

Use the 'Diff' feature in the Policy & Objects tab to compare the database and device config. The 'Check Configuration' or 'Diff' tool in the Policy & Objects tab allows administrators to compare the database version against the running device configuration to pinpoint the exact setting causing the conflict.

Answer

Force an 'Import Policy' operation

Answer

Reboot the FortiManager

Answer

Disable the policy package entirely

Question 12

Which configuration mode allows you to define a virtual MAC address for an HA cluster to prevent ARP cache issues on switches?

Accepted Answer

Virtual MAC. The 'ha-mgmt-status' and virtual MAC features ensure that the cluster presents a consistent MAC regardless of which node is master.

Answer

DHCP relay

Answer

Static ARP

Answer

Physical MAC

Question 13

A FortiManager administrator needs to ensure that logs from all enterprise FortiGates are aggregated and purged based on storage thresholds. Where is this configured?

Accepted Answer

FortiAnalyzer/Log Settings under Device Manager. The log retention and storage settings are managed in the FortiManager's 'FortiView' or 'Device Settings' regarding log management, specifically under 'Log Settings' where disk quota and retention policies are defined.

Answer

System settings under 'Network' tab

Answer

Global Policy settings

Answer

ADOM management settings

Question 14

An administrator is configuring the FortiManager to manage multiple FortiGate devices across different regions. Which method ensures that the device configuration remains synchronized with the FortiManager policy database during an automatic configuration update?

Accepted Answer

Enable Auto-update in the Device Manager configuration settings. The 'Auto-update' feature in the FortiManager Device Manager ensures that the configuration on the managed device is automatically synchronized with the policy package defined in the FortiManager database.

Answer

Set the FortiGate to 'Read-Only' mode

Answer

Enable ADOM-level scheduling

Answer

Configure a manual CLI script to push updates

Question 15

When using FortiAnalyzer integration with FortiManager, where do you view the aggregated log reports?

Accepted Answer

Reports & Analytics tab. Reports are generated and viewed within the FortiAnalyzer module, which is embedded in the FortiManager.

Answer

System Settings

Answer

Device Manager

Answer

Policy & Objects

Question 16

You want to automate the onboarding of new FortiGate units. Which FortiManager feature allows you to pre-configure devices before they connect to the network?

Accepted Answer

Provisioning Templates. Provisioning Templates allow you to define configuration settings that are applied automatically when the device registers with the FortiManager.

Answer

Scripting

Answer

Device Registration Key

Answer

Policy cloning

Question 17

When adding a FortiGate to FortiManager, which mode must the FortiGate be in to allow the FortiManager to manage its configuration and policies?

Accepted Answer

Normal mode. The FortiGate must be in 'Normal' mode; if it is in 'Backup' or 'Read-only' mode, full management is not possible.

Answer

Registration-only mode

Answer

Backup mode

Answer

Read-only mode

Question 18

Which TWO methods can be used to authenticate a FortiGate when it registers to a FortiManager?

Accepted Answer

Password/Pre-shared Key. Registration can be secured using a serial number/password combination or by adding the device's IP and certificate/serial in the FMG.

Answer

External RADIUS server

Answer

SNMP community string

Answer

IP-based automatic discovery

Question 19

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

Accepted Answer

Use a route map in the OSPF redistribute configuration. A route map must be applied during redistribution to filter the prefixes being injected.

Answer

Configure a distribute-list in the OSPF process

Answer

Use an IP prefix list under the OSPF area command

Answer

Use an access list under the interface configuration

Question 20

What is the effect of changing the IPS 'buffer' size on a FortiGate device?

Accepted Answer

It determines the maximum size of data packets to hold for inspection. Adjusting the IPS buffer affects how much data is held in memory for inspection, which can prevent packet drops during heavy traffic but increases memory load.

Answer

It disables the hardware acceleration engine

Answer

It changes the signature timeout

Answer

It increases the number of concurrent IPS connections