NSE7_EFW Practice Exam 3 — 20 Questions

Question 1

Which THREE aspects of the FortiGate system are affected by changing the global 'set vdom-mode' to 'multi-vdom'?

Accepted Answer

CLI command hierarchy. Changing the VDOM mode affects the CLI hierarchy, the available memory for VDOMs, and how system resources are partitioned.

Answer

The HA cluster size

Answer

The physical port order

Question 2

Which type of script in FortiManager is designed to run on the FortiManager itself rather than the managed devices?

Accepted Answer

TCL scripts. TCL scripts can be used to automate FortiManager functions, whereas CLI scripts typically target the managed devices.

Answer

CLI scripts

Answer

Configuration scripts

Answer

Policy scripts

Question 3

Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?

Accepted Answer

It uses fewer system resources than proxy-based inspection. Flow-based inspection is generally faster and provides better performance than proxy-based inspection.

Answer

It supports deep content inspection for all protocols

Answer

It requires manual buffer allocation

Answer

It offers more granular application control

Question 4

An administrator needs to provide access to FortiManager for a junior team member who should only be able to view logs and reports. Which feature is used to define this access?

Accepted Answer

Administrator Profiles. Administrators create 'Administrator Profiles' to restrict access to specific modules and permissions.

Answer

Access Control Lists (ACLs)

Answer

ADOM Assignment

Answer

User Groups

Question 5

Which TWO actions can be performed on a Revision History item in FortiManager?

Accepted Answer

Compare with current version. Revision history allows you to compare versions (diff) and restore to a previous state.

Answer

Delete the entire ADOM

Answer

Export the revision to an external cloud

Answer

Modify the version permanently

Question 6

Which THREE steps are involved in the 'Policy Package Installation' workflow?

Accepted Answer

Select the target device. The workflow involves selecting the package, choosing the target device, and executing the installation (with a preview).

Answer

Perform a factory reset

Answer

Reboot the target device

Question 7

You are implementing SSL VPN and need to ensure that only compliant corporate laptops can connect. Which feature should you use?

Accepted Answer

Host check. Host check allows the FortiGate to verify the presence of specific software like Antivirus before allowing the VPN connection.

Answer

SSL VPN portal settings

Answer

Two-factor authentication

Answer

PKI user authentication

Question 8

Which component of FortiManager allows for the centralized management of firmware across multiple devices?

Accepted Answer

Firmware Management. The 'Firmware Management' tool is dedicated to tracking, uploading, and deploying firmware to managed FortiGates.

Answer

Policy Database

Answer

Device Templates

Answer

Log View

Question 9

Which THREE items are included in a Policy Package when it is pushed from FortiManager?

Accepted Answer

Service Objects. Policy packages include firewall policies, address objects, and services used within those policies.

Answer

System interface settings

Answer

Routing tables

Question 10

You notice that an IPsec tunnel is up, but no traffic passes. What is the most common reason related to firewall policy configuration?

Accepted Answer

Missing firewall policy. Even if the tunnel is up, a policy must exist to allow traffic to flow between the internal network and the tunnel interface.

Answer

Missing static route

Answer

Incorrect IKE ID

Answer

Phase 1 lifetime expiration

Question 11

A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?

Accepted Answer

HA Group ID. In an HA cluster, devices must share identical HA group IDs, passwords, and heartbeats to form a cluster.

Answer

Device Hostname

Answer

Serial Number

Answer

Priority value

Question 12

An administrator needs to perform a firmware upgrade on 100 FortiGates. Which feature in FortiManager allows this to be done securely with a rollback option?

Accepted Answer

Firmware Management in Device Manager. The 'Firmware Management' feature in Device Manager allows for scheduled upgrades and provides options for managing firmware versions across groups.

Answer

Automated patch management

Answer

Manual script pushing

Answer

Global Policy upgrade task

Question 13

Which THREE items can be managed via Device Templates in FortiManager?

Accepted Answer

NTP configuration. Device templates are used for system-level settings like DNS, NTP, and local interface configurations.

Answer

Firewall policies

Answer

Application control databases

Question 14

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?

Accepted Answer

Mismatched Phase 2 selectors. Phase 2 failure is usually due to mismatched selectors (proxy IDs) or mismatched encryption/authentication algorithms.

Answer

Incorrect IKE version

Answer

Expired certificate

Answer

Mismatched pre-shared key

Question 15

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

Accepted Answer

To encapsulate ESP packets. NAT-T encapsulates ESP packets in UDP 4500 to allow them to pass through NAT devices that would otherwise break ESP integrity.

Answer

To replace the AH protocol

Answer

To manage Phase 1 re-keying

Answer

To verify certificate revocation status

Question 16

What is the primary purpose of an ADOM in FortiManager?

Accepted Answer

To logically group devices for delegated administration and policy management. Administrative Domains (ADOMs) allow the segregation of managed devices based on geography, customer, or business unit for delegated administration.

Answer

To provide high availability for the FortiGate

Answer

To allow external API access to the FortiGate

Answer

To increase the storage capacity of the FortiManager

Question 17

Which TWO types of reports can be generated in the FortiAnalyzer module of FortiManager?

Accepted Answer

Custom reports. FortiAnalyzer provides both pre-defined reports and custom reports for tailored analysis.

Answer

Policy change impact reports

Answer

Hardware diagnostic reports

Answer

Firmware compatibility reports

Question 18

Which FortiGate feature allows you to bypass SSL inspection for specific known-trusted websites to maintain user privacy?

Accepted Answer

URL Filter category exemption. SSL Inspection Exemptions allow bypassing decryption for specific categories or domains.

Answer

Firewall address object

Answer

Application Control override

Answer

IPS signature exclusion

Question 19

You need to inspect traffic between two internal VLANs. How do you ensure this traffic is processed by the FortiGate?

Accepted Answer

Configure firewall policies between the VLAN interfaces. Since VLANs are logical interfaces, the FortiGate will act as a gateway if the devices are configured to use the FortiGate's IP as their default gateway.

Answer

Enable hardware switching

Answer

Set the firewall mode to Transparent

Answer

Enable inter-VLAN routing on the switches only

Question 20

Which TWO options are available when configuring an SD-WAN rule in FortiManager?

Accepted Answer

Source/Destination criteria. SD-WAN rules allow setting traffic steering based on criteria like source/destination and strategy (load balancing/manual).

Answer

Interface physical speed

Answer

MAC address spoofing

Answer

Hardware acceleration toggle