NSE7_EFW Practice Exam 2 — 20 Questions

Question 1

When using an IPS sensor, what is the difference between 'Protect' and 'Monitor' mode?

Accepted Answer

Protect drops traffic; Monitor only logs it. In a FortiGate IPS sensor, each signature can be set to 'Monitor' or 'Protect' (or 'Disable'). Monitor mode generates a log/event when the signature matches but does not block the traffic, allowing baselining and false-positive tuning. Protect mode actively drops or resets the offending session in addition to logging, enforcing the signature.

Answer

Protect applies only to WAN; Monitor applies to LAN

Answer

Protect requires SSL inspection; Monitor does not

Answer

Protect logs traffic; Monitor drops it

Question 2

Which THREE items are included in a Policy Package when it is pushed from FortiManager?

Accepted Answer

Service Objects. A Policy Package in FortiManager is the container that holds the firewall policy configuration destined for managed FortiGate devices, and it includes Firewall Policies (B), which are the actual allow/deny rules pushed to the device. It also includes the reusable Address Objects (E) and Service Objects (A) that those policies reference, since these named objects must exist on the FortiGate for the policy to function. System interface settings (C) and Routing tables (D) are device-level configuration, not part of the Policy Package; they are handled separately (e.g., via the device's system settings or the "Install Wizard" device-level options), so they are not pushed as part of the policy package.

Answer

System interface settings

Answer

Routing tables

Question 3

When using SD-WAN, how does the 'member' configuration interact with physical interfaces?

Accepted Answer

Members are logical groups of interfaces. In FortiGate SD-WAN, a member is a logical grouping that references a physical interface (or other interface types) and applies SD-WAN settings such as priority, weight, and health checks. The physical interface retains its IP configuration; the member is an abstraction that allows multiple interfaces to be managed as part of the SD-WAN virtual interface.

Answer

Members replace the IP configuration

Answer

Members require a separate VDOM

Answer

Members must have DHCP enabled

Question 4

A security administrator is using FortiManager to manage a large number of FortiGate devices. The administrator wants to ensure that when a policy change is made in FortiManager, it is automatically validated for compliance with corporate security standards before being installed. Which FortiManager feature should be used to achieve this?

Accepted Answer

Policy Check. Policy Check in FortiManager validates firewall policies against compliance rules and best practices. It can be configured to run automatically before installation, ensuring that only policies meeting corporate standards are deployed. Other features like Installation Wizard, Revision History, and ADOM Revisions do not perform compliance validation.

Answer

Revision History

Answer

Installation Wizard

Answer

ADOM Revisions

Question 5

An administrator manages 25 FortiGates in a single ADOM. A new compliance rule requires that all managed devices use NTP servers 10.1.1.1 and 10.1.1.2. The administrator wants to push this change to all devices with minimal effort and ensure consistency. What is the most efficient way to accomplish this in FortiManager?

Accepted Answer

Use the 'Provisioning Templates' feature to create a system template with the NTP settings and assign it to all devices.. Provisioning Templates in FortiManager are designed to manage system-level settings across multiple devices. By creating a system template with the required NTP servers and assigning it to all devices in the ADOM, the administrator ensures consistent configuration with minimal effort. This approach leverages FortiManager's centralized management and is more efficient than manual configuration or scripts.

Answer

Manually edit the NTP settings on each FortiGate via the CLI.

Answer

Create a new policy package and assign it to all devices.

Answer

Use a script to run CLI commands on each device.

Question 6

A network administrator needs to configure a FortiGate to send logs to a FortiAnalyzer. The administrator wants to ensure that logs are sent securely and that the FortiGate can verify the FortiAnalyzer's identity. Which protocol should be used for log transmission?

Accepted Answer

OFTP over TLS. The FortiGate uses OFTP over TLS to send logs to FortiAnalyzer securely. This protocol encrypts the logs and uses certificates to authenticate the FortiAnalyzer, ensuring that logs are not intercepted or sent to an unauthorized server. Other syslog options lack the necessary security features.

Answer

SNMPv3

Answer

Syslog over UDP

Answer

Syslog over TCP

Question 7

You are configuring BGP and need to advertise a summary route to your ISP. How do you ensure only the summary route is advertised?

Accepted Answer

Use an aggregate-address with summary-only. The BGP aggregate-address command with the summary-only keyword suppresses all more-specific component routes from being advertised, so only the summary route is sent to the ISP. This is the standard way to perform route summarization while hiding the contributing prefixes from external peers.

Answer

Use a distribute-list

Answer

Set the weight to 0

Answer

Configure a route map with a prefix list

Question 8

An administrator has configured a FortiManager to manage a FortiGate. The administrator notices that the FortiGate's configuration is out of sync with FortiManager. After reviewing the revision history, the administrator sees that the FortiGate has a configuration change that was not installed from FortiManager. What is the most likely cause?

Accepted Answer

The FortiGate was configured directly via its CLI or GUI, bypassing FortiManager.. The most likely cause is that the FortiGate was configured directly, bypassing FortiManager. FortiManager tracks configuration changes and compares them with the device. When a direct change occurs, the device's configuration diverges from the FortiManager database, resulting in an out-of-sync status. The administrator can then choose to import the changes or overwrite them by installing the FortiManager configuration.

Answer

The FortiGate's firmware version is incompatible with the FortiManager's firmware.

Answer

The FortiManager's revision history is corrupted and needs to be rebuilt.

Answer

The FortiManager's administrative domain (ADOM) was changed, causing the device to lose synchronization.

Question 9

A company uses a FortiGate as their main firewall. They want to implement a security profile that blocks malicious files downloaded via HTTP. Which FortiGate feature should they use to scan files for viruses and other malware?

Accepted Answer

Antivirus profile with deep inspection enabled in the firewall policy.. The antivirus profile is specifically designed to scan files for viruses and malware. When applied to a firewall policy with deep inspection, it examines files transferred over protocols like HTTP, FTP, and SMTP. Other profiles like IPS, web filter, or application control serve different purposes and do not provide file scanning.

Answer

Intrusion Prevention System (IPS) sensor with signatures for file downloads.

Answer

Web filter profile with category-based blocking.

Answer

Application control profile to block file-sharing applications.

Question 10

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

Accepted Answer

Use a route map in the OSPF redistribute configuration. In FortiOS, when redistributing routes into OSPF, you can attach a route map to the redistribute command to filter which routes are advertised. The route map can match specific criteria such as IP prefix lists, access lists, or interface names. By using a route map that matches only the desired subnet, you ensure that only that connected route is redistributed into OSPF. This is the standard and most flexible method for selective redistribution.

Answer

Configure a distribute-list in the OSPF process

Answer

Use an IP prefix list under the OSPF area command

Answer

Use an access list under the interface configuration

Question 11

A network administrator needs to configure a FortiGate to send logs to a FortiAnalyzer device. The administrator wants to ensure that logs are encrypted during transmission. Which protocol should be used for log forwarding?

Accepted Answer

OFTP. OFTP is the proprietary protocol used by FortiGate to securely send logs to FortiAnalyzer. It encrypts logs using SSL/TLS, ensuring confidentiality and integrity. The other protocols either lack encryption or are not intended for log forwarding. Therefore, OFTP is the correct choice when encryption is required.

Answer

Syslog over TCP

Answer

SNMPv3

Answer

Syslog over UDP

Question 12

You are troubleshooting high CPU usage on a FortiGate. Which process would you check to see if the IPS engine is the cause?

Accepted Answer

diag sys top. The 'diag sys top' command displays a real-time, sorted list of running processes on the FortiGate along with their CPU and memory utilization. By running it, an administrator can immediately see whether the IPS engine (often shown as 'ipsengine') is consuming an abnormally high percentage of CPU, confirming it as the cause of the high CPU usage. This is the standard FortiOS diagnostic tool for per-process resource monitoring.

Answer

get system status

Answer

diagnose hardware status

Answer

show sys resource

Question 13

An administrator is configuring a new FortiGate cluster in an HA environment. The administrator wants to ensure that if the primary unit fails, the secondary unit takes over with minimal disruption to existing sessions. Which HA setting should be configured to allow the secondary unit to maintain session state?

Accepted Answer

Enable session pickup on both HA nodes.. To maintain session state during an HA failover, session pickup must be enabled. This synchronizes session information between the primary and secondary units, allowing the secondary to take over existing sessions without interruption. Other settings like HA mode, priority, or gratuitous ARP do not provide session synchronization.

Answer

Enable gratuitous ARP on the HA cluster.

Answer

Set the HA priority higher on the secondary unit.

Answer

Configure the HA mode to active-active.

Question 14

A network security engineer is deploying a FortiGate in transparent mode. The engineer needs to ensure that the FortiGate can be managed remotely via HTTPS from the management network, while still passing all other traffic transparently. Which configuration is required?

Accepted Answer

Assign a management IP address to the transparent-mode VDOM and enable HTTPS administrative access on the management interface.. In transparent mode, the FortiGate requires a management IP address to be accessible for administration. This IP is assigned to a VDOM, and administrative access protocols like HTTPS must be enabled on the interface connected to the management network. Firewall policies are not used for management traffic.

Answer

Enable 'set allowaccess https' on all interfaces and assign an IP address to each interface.

Answer

Create a firewall policy allowing HTTPS traffic to the FortiGate's management IP and set the action to 'accept'.

Answer

Configure a static route to the management network and enable HTTPS access on the WAN interface.

Question 15

A FortiGate is configured with two VDOMs: 'root' and 'vdom1'. The administrator wants to allow a server in 'vdom1' to be accessed from the internet via a VIP configured in 'root'. The server's default gateway is the FortiGate's interface in 'vdom1'. What must be configured to ensure return traffic from the server to the internet is handled correctly?

Accepted Answer

Configure a static route in 'vdom1' pointing to the inter-VDOM link, and a static route in 'root' pointing to the internet, plus firewall policies to allow traffic.. The server in 'vdom1' has its default gateway set to the FortiGate's interface in 'vdom1'. When it responds to a request that arrived via a VIP in 'root', the return traffic goes to its default gateway in 'vdom1'. To reach the internet, that traffic must be routed from 'vdom1' to 'root' via an inter-VDOM link. Static routes in both VDOMs and appropriate firewall policies are necessary to allow the traffic to flow correctly. This setup maintains the VIP in 'root' while ensuring symmetric routing.

Answer

Create an inter-VDOM link between 'root' and 'vdom1' and configure routing on both sides.

Answer

Enable 'set allow-routing' on the VIP in 'root' and create a firewall policy in 'vdom1' to allow the return traffic.

Answer

Configure a VIP in 'vdom1' instead of 'root' and apply it to the external interface in 'vdom1'.

Question 16

A FortiGate is deployed as an internal segmentation firewall with VDOMs for each department. The administrator needs to allow a monitoring server in the 'IT' VDOM to reach a syslog server in the 'Mgmt' VDOM over TCP 514. No inter-VDOM links currently exist. What must the administrator configure to permit this traffic while keeping the VDOMs isolated?

Accepted Answer

Create an inter-VDOM link, assign IP addresses from a dedicated transfer subnet to both ends, and add firewall policies in each VDOM.. Inter-VDOM links are the supported method for connecting isolated VDOMs while retaining independent routing tables. The link creates paired interfaces that require IP addressing and firewall policies on both sides. This design lets the administrator permit only TCP 514 from the IT monitoring server to the Mgmt syslog server, maintaining segmentation and explicit control.

Answer

Configure a VDOM exception for the syslog server's IP address in the IT VDOM's firewall policy.

Answer

Assign the monitoring server and syslog server to the same VDOM and use a policy with NAT enabled.

Answer

Enable 'set allow-subnet-overlap enable' on the Mgmt VDOM and add a static route from IT to Mgmt.

Question 17

An administrator is troubleshooting a FortiGate HA cluster in Active-Passive mode. The primary unit unexpectedly failed over to the secondary, and the administrator needs to verify which configuration settings are synchronized between the nodes. Which two configuration elements are synchronized by default in an HA cluster? (Choose two.)

Accepted Answer

Interface IP addresses and static routes. By default, FortiGate HA synchronizes the security and networking configuration, including firewall address objects, policies, interface IP addresses, and static routes. These elements are critical for consistent traffic handling after a failover. Management settings such as hostname, passwords, SNMP, and syslog are not synchronized by default, and HA operational parameters like priority and virtual MAC are handled separately.

Answer

SNMP community strings and syslog server settings

Answer

The FortiGate hostname and administrative passwords

Answer

The cluster's virtual MAC address and HA priority

Question 18

A FortiGate is deployed in transparent mode between an internal network and a router. Users behind the FortiGate cannot reach the internet, but the FortiGate can ping external addresses. The administrator confirms the forwarding domain is enabled on both interfaces. Which action should the administrator take next to allow traffic to pass through the FortiGate?

Accepted Answer

Create a firewall policy from the internal interface to the external interface with NAT disabled and the action set to ACCEPT.. In transparent mode, the FortiGate bridges traffic between interfaces and does not perform NAT or routing. A firewall policy must be created to allow traffic from the internal interface to the external interface, with NAT disabled. Without this policy, traffic is dropped by the implicit deny. The policy action must be ACCEPT to permit the traffic.

Answer

Create a firewall policy from the internal interface to the external interface with NAT enabled.

Answer

Configure a static route on the FortiGate pointing to the external router.

Answer

Enable DHCP on the internal interface to provide IP addresses to users.

Question 19

A network administrator is troubleshooting a FortiGate 300E that is experiencing high CPU usage. The administrator suspects that a large amount of traffic is being processed by the CPU instead of being offloaded to the NP6 processor. Which type of traffic is typically NOT offloaded by the NP6 processor and therefore may contribute to high CPU usage?

Accepted Answer

Traffic requiring deep inspection with SSL/TLS decryption.. The NP6 processor offloads many common traffic types, but it cannot handle SSL/TLS decryption and deep inspection. These tasks require the main CPU because they involve complex cryptographic operations and content inspection. When a FortiGate is configured to decrypt and inspect HTTPS traffic, the CPU load can increase significantly, especially with high throughput. Other listed traffic types are typically offloaded and do not cause high CPU usage.

Answer

Traffic that is subject to simple firewall policies without UTM.

Answer

Traffic that uses NAT with a small number of concurrent sessions.

Answer

Traffic that is routed between VLAN interfaces on the same physical interface.

Question 20

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a new FortiGate is added to an ADOM, it automatically receives a base configuration that includes specific administrative settings, such as DNS servers and NTP servers. Which two FortiManager features can be used to accomplish this? (Choose two.)

Accepted Answer

Provisioning Templates. Provisioning Templates and CLI Templates are both designed to push configuration settings to managed FortiGates. Provisioning Templates are specifically for system-level settings and can be automatically applied when devices are added to an ADOM. CLI Templates offer more flexibility by allowing raw CLI commands to be executed on devices. Together, they can ensure that new FortiGates receive the required base configuration, including DNS and NTP servers.

Answer

Policy Packages

Answer

ADOM Revisions

Answer

Device Groups