NSE7_EFW Practice Exam 3 — 20 Questions

Question 1

An administrator is configuring a new FortiManager installation and needs to set up administrative access. The administrator wants to ensure that only authorized personnel can log in and that their actions are logged. Which two configurations are required to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create administrator accounts with strong passwords and assign appropriate profiles.. To ensure only authorized personnel can log in, administrator accounts with strong passwords and appropriate profiles must be created. To log their actions, administrative logging must be configured. These two configurations directly address the access control and logging requirements. Other options, while beneficial, are not strictly required to meet the stated goals.

Answer

Enable 'Strong Password' policy in the FortiManager global settings.

Answer

Set up a remote syslog server for storing logs.

Answer

Enable two-factor authentication for administrator accounts.

Question 2

An administrator is using FortiManager to manage a FortiGate. The administrator notices that the FortiGate's configuration in FortiManager is different from the actual configuration on the device. To resolve this, the administrator wants to update FortiManager with the current configuration from the FortiGate. Which action should the administrator take?

Accepted Answer

Retrieve the configuration from the FortiGate.. To update FortiManager with the current configuration from a managed FortiGate, the administrator should use the 'Retrieve' function, which pulls the configuration from the device into FortiManager. This ensures FortiManager's database matches the FortiGate. Installing the policy package would push changes to the device, which is not desired. Manual import and ADOM synchronization are not appropriate for this scenario.

Answer

Import the FortiGate's configuration file manually.

Answer

Synchronize the ADOM with the FortiGate.

Answer

Install the policy package to the FortiGate.

Question 3

An administrator needs to back up the FortiGate configuration to a USB drive for disaster recovery. The FortiGate has a USB port and the administrator inserts a USB drive. Which command should the administrator use to perform the backup?

Accepted Answer

execute backup config usb. The correct command to back up the FortiGate configuration to a USB drive is 'execute backup config usb'. This command saves the configuration file to the connected USB storage device. Other backup options like TFTP or flash do not meet the requirement of using a USB drive. Therefore, the administrator should use this command.

Answer

execute backup config tftp

Answer

execute backup full-config usb

Answer

execute backup config flash

Question 4

A network administrator manages two FortiGate HA clusters (cluster A and cluster B) from a single FortiManager. They need to push a new firewall policy to both clusters without affecting the other cluster's configuration. Which FortiManager feature should they use to ensure that the policy is installed only to the intended cluster and that the clusters remain independent?

Accepted Answer

Create a separate ADOM for each cluster and install the policy from each ADOM.. The correct approach is to use separate ADOMs for each HA cluster. ADOMs provide logical separation of devices, policies, and objects, ensuring that policies and objects are contained within their ADOM. When installing from an ADOM, only devices within that ADOM are targeted, so the policy is pushed only to the intended cluster. This also prevents object name conflicts and unintended policy application across clusters.

Answer

Enable 'Workspace Mode' and lock the ADOM to prevent changes to the other cluster.

Answer

Configure a 'Policy Package' that contains the policy and assign it only to the target cluster via 'Assign Package'.

Answer

Use the 'Install Wizard' and select both clusters, then enable 'per-device mapping' for the policy.

Question 5

A network security administrator manages 40 FortiGate appliances from a single FortiManager. The administrator needs to provision a new FortiGate that will be installed at a remote branch office. The branch office uses a private MPLS circuit with no direct internet access for management. The FortiGate must be pre-configured with its management IP, administrative credentials, and initial firewall policy before it is shipped to the site. Which FortiManager feature should the administrator use to accomplish this?

Accepted Answer

Use the FortiManager 'Provisioning Templates' feature to create a model device, assign it to the appropriate ADOM, and pre-configure the required settings.. Provisioning Templates enable administrators to define a model device with pre-set configurations, including management IP, credentials, and policies. This allows the FortiGate to be configured before shipment and automatically receive its settings upon first connection, which is essential for remote sites without direct internet access. Other features like scripts or policy packages require the device to be online first.

Answer

Use the FortiManager 'Device Manager' to add the FortiGate by its serial number, then manually configure all settings via the GUI.

Answer

Use the FortiManager 'Policy Package' to create a policy that references the new FortiGate, then install it to the device.

Answer

Use the FortiManager 'Script' feature to run a CLI script on the FortiGate after it registers with FortiManager.

Question 6

An administrator is using FortiManager to manage a FortiGate cluster (HA). They need to ensure that when a policy package is installed, both the primary and secondary units receive the configuration. What must be configured in FortiManager to achieve this?

Accepted Answer

Add the HA cluster as a single device using the primary unit's serial number, and FortiManager will synchronize to all cluster members.. FortiManager manages an HA cluster as a single device, added via the primary unit's serial number. When a policy package is installed, FortiManager communicates with the primary, which then synchronizes the configuration to all cluster members. This ensures both units receive the configuration. Other options suggest incorrect or non-existent configurations.

Answer

Configure a 'Cluster' object in FortiManager and assign the policy package to it.

Answer

Enable 'HA Management' in the FortiGate device settings in FortiManager.

Answer

Add both the primary and secondary FortiGate units as separate managed devices in FortiManager.

Question 7

You are the security administrator for a large enterprise with multiple FortiGate devices managed by FortiManager. You need to create a new firewall policy that references an address object that already exists in the ADOM's global object database. However, you want to ensure that the policy is only installed on a specific subset of FortiGates. Which FortiManager feature should you use to accomplish this?

Accepted Answer

Create a new policy package and assign it to the desired FortiGates.. The requirement is to deploy a policy only to a subset of FortiGates. In FortiManager, policy packages are the primary method for grouping policies and assigning them to specific devices. By creating a new policy package and assigning it only to the desired FortiGates, the administrator ensures that the policy is installed only on those devices. Other mechanisms like dynamic objects or per-device mapping do not control deployment scope, and workspace mode is unrelated to scoping.

Answer

Configure a per-device mapping for the address object.

Answer

Enable workspace mode and lock the ADOM before making changes.

Answer

Use a dynamic object and map it to the desired FortiGates.

Question 8

A security administrator is responsible for managing a FortiManager appliance that oversees multiple FortiGate devices. The administrator needs to create a new administrative user who should only be able to view firewall policies and device status but not make any changes. Which FortiManager administrative profile should be assigned to this user?

Accepted Answer

Read_Only. The Read_Only administrative profile is designed for users who need to view configurations and status but must not make changes. It provides the necessary visibility without granting modification rights. Other profiles like Super_User or Standard_User grant excessive privileges, while No_Access denies all access.

Answer

No_Access

Answer

Super_User

Answer

Standard_User

Question 9

You are deploying a new FortiGate in transparent mode. Users report that they cannot access the internet, but they can access internal servers. You have verified that the FortiGate is in transparent mode and that the management IP is reachable. What is the most likely cause?

Accepted Answer

Firewall policies must be configured to allow traffic from the internal network to the external network, even in transparent mode.. Even in transparent mode, the FortiGate enforces firewall policies. Traffic from internal to external networks must be explicitly allowed by a policy. If such a policy is missing, the implicit deny will block internet access. Internal traffic might be allowed by a different policy, explaining why users can reach internal servers but not the internet.

Answer

The FortiGate's management IP must be in the same subnet as the internal network for traffic to flow.

Answer

The FortiGate requires a default route to the internet, but in transparent mode it does not perform routing.

Answer

Transparent mode does not support NAT, so internet access is impossible without additional configuration.

Question 10

An administrator is setting up a new FortiManager and needs to add a FortiGate device for management. The FortiGate is behind a NAT device and does not have a public IP address. Which FortiManager feature allows the FortiGate to connect to FortiManager without requiring inbound access?

Accepted Answer

FortiGate initiates connection to FortiManager. The FortiGate always initiates the connection to FortiManager, which means it can be located behind NAT without requiring any inbound firewall rules. The FortiManager listens on TCP port 541 for these connections. This design simplifies deployment in environments where FortiGates are behind NAT or have dynamic IP addresses.

Answer

FortiManager auto-discovery

Answer

FortiManager behind NAT

Answer

Pre-shared key authentication

Question 11

A network administrator is using FortiManager to manage several FortiGate devices. The administrator needs to ensure that all devices receive the same firewall policy for blocking malicious traffic, but each device has a different WAN IP address. Which FortiManager feature should be used to dynamically assign the correct WAN IP address to each device's policy?

Accepted Answer

Dynamic objects. Dynamic objects are specifically designed to resolve values at install time based on the FortiGate's configuration, such as interface IP addresses. This allows a single policy to be deployed across multiple devices with different WAN IPs, automatically substituting the correct IP for each device. Per-device mapping requires manual overrides, policy packages are for grouping, and ADOMs are for partitioning. Therefore, dynamic objects are the correct feature.

Answer

ADOMs

Answer

Policy packages

Answer

Per-device mapping

Question 12

A FortiGate is configured with two VDOMs: 'root' and 'dmz'. The administrator wants to use a single physical interface to carry traffic for both VDOMs, keeping the traffic logically separated. Which interface type must be configured to achieve this?

Accepted Answer

Multi-VDOM interface. A multi-VDOM interface allows a single physical interface to be used by more than one VDOM, each with its own IP address and routing table. This satisfies the requirement of using one port for both VDOMs while maintaining logical separation. Other interface types are either single-VDOM or serve different purposes such as inter-VDOM links or L2 retransmission.

Answer

NPU VDOM link

Answer

VLAN subinterface

Answer

EMAC-VLAN

Question 13

A network administrator needs to allow remote users to access internal resources securely using FortiClient. The administrator wants to use certificate-based authentication for the VPN. Which component must be installed on the FortiClient endpoints to enable certificate authentication?

Accepted Answer

A client certificate issued by a CA trusted by the FortiGate.. Certificate-based authentication requires the client to present a certificate that the FortiGate can validate against its trusted CAs. The client certificate contains the user's identity and is signed by a CA that the FortiGate trusts. The FortiGate then maps the certificate to a user or group. The root CA certificate on the client is only for validating the server, not for client authentication.

Answer

A pre-shared key configured in the FortiClient VPN profile.

Answer

The root CA certificate that signed the FortiGate's server certificate.

Answer

The FortiGate's SSL VPN portal certificate.

Question 14

A security administrator is setting up a new FortiManager to manage several FortiGate devices. The administrator wants to group devices that share the same security policies and objects. What should the administrator create to achieve this?

Accepted Answer

An administrative domain (ADOM). An ADOM is the correct choice because it provides a separate management space where devices, policies, and objects are contained. Devices within an ADOM can share policy packages and objects, while devices in different ADOMs are isolated. This allows the administrator to group devices with similar security requirements into the same ADOM, simplifying management and ensuring consistency.

Answer

A policy package

Answer

A global object

Answer

A device group

Question 15

An administrator is configuring a new FortiManager installation and needs to set up administrative access. The administrator wants to ensure that only authorized personnel can log in and that their actions are logged. Which two configurations are required to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configuration revision. Configuration revision automatically creates a snapshot of the device configuration whenever it is modified through FortiManager. This allows administrators to track changes and revert to a previous state if necessary. It is the recommended feature for maintaining configuration backups and ensuring rollback capability.

Answer

Device-level configuration backup via SNMP

Answer

FortiManager backup scheduler

Answer

Policy package installation history

Question 16

A network administrator wants to allow only specific users to access a web application through the FortiGate. The users are stored in an LDAP directory. Which FortiGate feature should be used to enforce this?

Accepted Answer

LDAP integration with user group and firewall policy. Using LDAP integration, the FortiGate can authenticate users against the existing directory. A firewall policy that includes the LDAP user group restricts access to only those users. This is the most efficient and centralized method, avoiding duplicate user accounts and leveraging existing infrastructure.

Answer

RADIUS authentication with a proxy server

Answer

TACACS+ with a custom user group

Answer

Local user database with two-factor authentication

Question 17

A security administrator needs to ensure that all managed FortiGates in a specific ADOM receive a new security profile. They create the profile in the ADOM and want to assign it to all firewall policies in a policy package. However, some policies already use a different profile, and they want to replace it. Which action should they take in FortiManager to efficiently update all relevant policies?

Accepted Answer

Use the 'Replace Object' feature to replace the old profile with the new one across the policy package.. The 'Replace Object' feature is designed to globally replace one object with another within a policy package. It updates all references, such as security profiles in firewall policies, in one operation. This is the most efficient and accurate method to ensure all relevant policies use the new profile without manual editing.

Answer

Create a new policy package with the new profile and assign it to the ADOM.

Answer

Use the 'Policy Check' function to automatically replace the profile.

Answer

Manually edit each policy to change the security profile.

Question 18

A FortiGate is configured with a site-to-site IPsec VPN to a branch office. The administrator notices that the tunnel is up, but traffic is not passing. After checking, they find that the phase 2 selectors on both peers match, and firewall policies allow the traffic. What is a likely cause?

Accepted Answer

Missing static route for the remote subnet.. For traffic to traverse an IPsec tunnel, the FortiGate must have a route that directs packets for the remote subnet out the tunnel interface. Without this route, the FortiGate will not send traffic into the tunnel, even if the tunnel is up and policies permit it. This is a common oversight in site-to-site VPN configurations.

Answer

Incorrect IPsec phase 2 key lifetime.

Answer

The remote gateway IP address is incorrect.

Answer

The phase 1 proposal mismatch.

Question 19

A network administrator is troubleshooting a FortiGate firewall policy. Traffic that should be allowed is being blocked, and the administrator suspects that the policy is not matching because of the order of policies. Which FortiGate feature can be used to verify which policy a specific traffic flow matches?

Accepted Answer

Policy lookup. Policy lookup is designed specifically to check which policy matches a given set of traffic parameters without generating actual traffic. It is the quickest way to verify policy order and matching criteria, making it ideal for troubleshooting why traffic is blocked due to policy sequencing.

Answer

Session table

Answer

Debug flow

Answer

Packet capture

Question 20

An administrator is configuring a FortiGate in transparent mode. The FortiGate will be placed between an internal network and a router. The administrator wants to ensure that the FortiGate can be managed remotely and that it can still perform security inspections. Which two configurations are required? (Choose two.)

Accepted Answer

Configure firewall policies to allow traffic between the internal network and the router.. In transparent mode, the FortiGate forwards traffic at Layer 2, so data interfaces do not have IP addresses. To manage the device remotely, an IP address must be assigned to a management interface or a VLAN interface. Additionally, firewall policies are required to allow traffic between the internal and external interfaces; these policies also enable security inspections. Without these, traffic would be blocked, and the FortiGate would not be manageable remotely.

Answer

Enable NAT on the external interface to allow internal hosts to access the internet.

Answer

Configure a default gateway on the FortiGate to route management traffic.

Answer

Set the FortiGate to NAT mode instead of transparent mode to enable security inspections.