NSE7_EFW Practice Exam 4 — 20 Questions

Question 1

You are configuring BGP and need to advertise a summary route to your ISP. How do you ensure only the summary route is advertised?

Accepted Answer

Use an aggregate-address with summary-only. The 'aggregate-address' command with the 'summary-only' option is the correct way to advertise only the summary and suppress specific component routes.

Answer

Use a distribute-list

Answer

Set the weight to 0

Answer

Configure a route map with a prefix list

Question 2

Which TWO of the following can be used to optimize IPsec VPN performance?

Accepted Answer

Ensure the configuration uses AES-NI supported ciphers. Hardware acceleration (ASIC) and selecting efficient encryption algorithms like AES-NI (hardware-accelerated AES) improve VPN throughput.

Answer

Increase the Phase 1 lifetime to 24 hours

Answer

Use DES encryption for speed

Answer

Disable NAT-Traversal

Question 3

What is the benefit of using 'CLI Templates' in FortiManager?

Accepted Answer

They allow applying configuration commands to multiple devices. CLI templates allow you to push specific configuration lines to multiple devices, which is useful for settings not covered by the GUI policy editor.

Answer

They replace the GUI completely

Answer

They convert the policy to a CLI script

Answer

They improve the FortiGate hardware performance

Question 4

Which THREE factors influence log storage efficiency on a FortiAnalyzer/FortiManager?

Accepted Answer

Log compression settings. Log compression, log retention settings, and disk quota management determine how long logs persist and how much space they consume.

Answer

The firewall firmware version

Answer

The number of active users

Question 5

You are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?

Accepted Answer

Create an IPS sensor override for the specific signature ID. Using an IPS sensor override or a specific signature exemption allows you to modify the behavior for a single signature without disabling it globally.

Answer

Change the IPS mode from blocking to monitoring

Answer

Disable the entire IPS sensor profile

Answer

Increase the IPS packet buffer size

Question 6

What is the purpose of the 'Any' interface in a firewall policy?

Accepted Answer

To match traffic regardless of the ingress or egress interface. The 'Any' interface enables the policy to match traffic originating from or destined to any physical or logical interface on the FortiGate.

Answer

To force traffic through the hardware switch

Answer

To bypass the routing table

Answer

To match traffic only on the WAN port

Question 7

Which THREE features are specific to the FortiManager 'Enterprise Firewall' management workflow?

Accepted Answer

Object database management. Centralized policy management, object database management, and revision control are key parts of the enterprise workflow.

Answer

Traffic shaping on routers

Answer

Web filter database updates

Question 8

Which FortiGate feature should be enabled to prevent internal users from accessing malicious websites based on real-time threat intelligence?

Accepted Answer

Web Filter. Web Filtering using categories provides real-time protection by checking URLs against the FortiGuard database.

Answer

Antivirus profile

Answer

Application Control

Answer

DNS Filter

Question 9

What is the primary function of the FortiGate Security Fabric?

Accepted Answer

To synchronize security policies and share intelligence across devices. The Security Fabric integrates multiple devices to provide coordinated, end-to-end security visibility and control.

Answer

To configure OSPF automatically

Answer

To increase the throughput of the firewall

Answer

To replace the need for an IPS sensor

Question 10

Which THREE of the following are mandatory for a BGP neighbor adjacency to establish?

Accepted Answer

Correct autonomous system numbers. BGP requires the correct AS numbers, reachable IPs, and matching timers or specific parameters to form a connection.

Answer

Identical prefix lists

Answer

Identical router IDs

Question 11

Where can an administrator check the status of the connection between a FortiGate and FortiManager?

Accepted Answer

Device Manager. The 'Device Manager' page lists all managed devices and displays their status (e.g., 'Up', 'Down', 'Synchronized').

Answer

Log View

Answer

Policy & Objects

Answer

System Settings

Question 12

What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?

Accepted Answer

Implicit Deny. The implicit deny policy is the last rule in the firewall policy list and drops all non-matching traffic.

Answer

Send to local DNS

Answer

Route to DMZ

Answer

Allow

Question 13

When using an IPS sensor, what is the difference between 'Protect' and 'Monitor' mode?

Accepted Answer

Protect drops traffic; Monitor only logs it. 'Protect' drops the traffic if a signature matches, whereas 'Monitor' logs the hit without dropping the traffic.

Answer

Protect applies only to WAN; Monitor applies to LAN

Answer

Protect requires SSL inspection; Monitor does not

Answer

Protect logs traffic; Monitor drops it

Question 14

What does the 'FortiGuard' service provide to the FortiGate?

Accepted Answer

Real-time threat intelligence and database updates. FortiGuard provides real-time updates for security signatures, including IPS, Antivirus, and Web Filtering.

Answer

User management and authentication

Answer

Local firmware storage

Answer

Hardware acceleration support

Question 15

You need to inspect traffic between two VDOMs. Which mechanism is required?

Accepted Answer

Inter-VDOM Link. Inter-VDOM links are virtual interfaces used to route traffic between distinct VDOMs, essentially creating a 'cable' between them.

Answer

Policy-based routing

Answer

Physical loopback cable

Answer

Static NAT

Question 16

In a BGP deployment, your FortiGate is receiving routes from two different ISPs. You want to influence outbound traffic to prefer ISP1 for specific destinations. Which BGP attribute should you modify?

Accepted Answer

Local Preference. Local Preference is used to influence outbound traffic selection within an AS.

Answer

Weight

Answer

AS-Path

Answer

Multi-Exit Discriminator (MED)

Question 17

Which TWO of the following are valid methods for user authentication on a FortiGate?

Accepted Answer

RADIUS. FortiGate supports both local user databases and integration with external enterprise servers like RADIUS and LDAP.

Answer

BGP

Answer

IGMP

Answer

RIP

Question 18

What is the impact of changing the 'set vdom-mode' from 'no-vdom' to 'multi-vdom'?

Accepted Answer

System reboot required. Changing the VDOM mode triggers a system reboot because it fundamentally changes how the kernel handles memory allocation and resource segmentation.

Answer

Automatic disablement of HA

Answer

Loss of all firewall policies

Answer

No impact, immediate change

Question 19

In a site-to-site VPN, you need to allow traffic initiated from the remote site. What configuration is essential on the local FortiGate?

Accepted Answer

A firewall policy allowing traffic from the VPN zone to the Internal zone. A local firewall policy must exist to permit traffic arriving from the VPN interface and destined for the internal network.

Answer

An IPSec phase 3 policy

Answer

A static route to the remote subnet

Answer

A NAT rule for the remote subnet

Question 20

Which THREE types of traffic are typically inspected by an IPS policy?

Accepted Answer

HTTP/HTTPS traffic. IPS is designed to detect and block threats in common protocols like HTTP, FTP, and SMTP.

Answer

SNMP monitoring traffic

Answer

ICMP echo requests