NSE7_EFW Practice Exam 4 — 20 Questions

Question 1

A FortiGate is configured with a redundant interface (also known as a link aggregation group) using two physical interfaces. The administrator notices that traffic is not being distributed evenly across the two links; one link is heavily utilized while the other is nearly idle. Which factor is most likely causing this imbalance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The hashing algorithm used for distributing traffic is based on source and destination IP addresses, and the traffic consists of a single large flow.. Link aggregation (redundant interface) on FortiGate uses a hashing algorithm to distribute traffic across member links. The hash typically includes source and destination IP addresses, and possibly Layer 4 ports. If the traffic consists of a single flow, all packets will have the same hash value and will be sent over the same link, causing the imbalance. To achieve even distribution, there must be multiple flows with different source/destination IPs or ports. This is a fundamental characteristic of link aggregation, not a fault.

Answer

One of the physical interfaces is faulty and is dropping packets, causing all traffic to fail over to the other link.

Answer

The FortiGate's redundant interface does not support load balancing; it only provides redundancy.

Answer

The FortiGate's redundant interface is configured in Active-Passive mode, so only one link is used at a time.

Question 2

A FortiGate is deployed in a VDOM-enabled configuration. The administrator needs to allow inter-VDOM routing between the 'LAN' VDOM and the 'DMZ' VDOM without sending traffic to an external device. Which action must be performed?

Accepted Answer

Create a VDOM link (vlink) and assign each end to the respective VDOMs, then configure firewall policies referencing the vlink interfaces.. Inter-VDOM routing requires a VDOM link, which creates a virtual interface pair internal to the FortiGate. Each end is assigned to a VDOM, and firewall policies referencing those interfaces control the traffic. This avoids external cabling and allows full inspection. The other options either reference non-existent features or misunderstand VDOM isolation.

Answer

Enable 'set inter-vdom-routing enable' under the global system settings.

Answer

Create a firewall policy with source and destination interfaces in different VDOMs without any VDOM link.

Answer

Assign the same VLAN ID to interfaces in both VDOMs and rely on Layer 2 switching within the FortiGate.

Question 3

A network administrator is deploying a dial-up IPsec VPN on a FortiGate to allow remote employees to connect. The administrator wants to ensure that the VPN tunnel can be established even when the client is behind a NAT device. Which configuration setting must be enabled on the FortiGate to achieve this?

Accepted Answer

Enable NAT traversal (NAT-T) on the IPsec phase 1 configuration.. NAT traversal (NAT-T) is the correct setting because it encapsulates IKE and ESP packets in UDP, allowing the VPN to pass through NAT devices. This is essential for dial-up VPNs where remote users may be behind NAT. Without NAT-T, the VPN tunnel may fail to establish due to NAT incompatibilities. Other settings like aggressive mode or IKEv2 do not replace the need for NAT-T.

Answer

Set the phase 2 selector to 0.0.0.0/0 to allow all traffic through the tunnel.

Answer

Set the VPN gateway to use aggressive mode for IKE negotiation.

Answer

Configure the VPN to use IKE version 2 (IKEv2) exclusively.

Question 4

An administrator is deploying a new IPsec VPN between two FortiGates. They want to ensure that the VPN can recover quickly from network disruptions and that only specific subnets are allowed over the tunnel. Which TWO configuration steps are required to meet these requirements? (Choose two.)

Accepted Answer

Enable dead peer detection (DPD) on both ends with a suitable interval and retry count.. To ensure quick recovery, DPD must be enabled to detect peer failures promptly. To restrict traffic to specific subnets, phase2 selectors must be configured with the desired local and remote subnets. These two steps together meet the requirements. The other options do not address the specific needs of recovery and subnet restriction.

Answer

Enable NAT traversal (NAT-T) on the phase1 configuration.

Answer

Configure a firewall policy that allows all traffic between the two sites without any restrictions.

Answer

Set the phase1 proposal to use only AES-256 encryption and SHA-256 hashing.

Question 5

An administrator has configured a FortiGate with two WAN interfaces and wants to ensure that outbound traffic is load-balanced across both links while maintaining session persistence. They have enabled SD-WAN and created two members. Which SD-WAN load-balancing algorithm should they use to distribute traffic based on source IP and ensure that each source IP consistently uses the same link?

Accepted Answer

Source IP. The 'Source IP' algorithm in SD-WAN load balancing uses the source IP address to select a link. All sessions from a given source IP will consistently use the same link, providing session persistence. Round Robin and Weighted Round Robin distribute per session without regard to source, and Session Hash uses the full 5-tuple, which can vary per session. Only Source IP ensures each source IP sticks to one link.

Answer

Round Robin

Answer

Session Hash

Answer

Weighted Round Robin

Question 6

An administrator is configuring an IPS sensor on a FortiGate to protect an internal web server. The administrator wants to block attacks while minimizing false positives. Which IPS sensor action should be configured for signatures that are known to produce false positives in the internal network?

Accepted Answer

Set the action to 'Monitor' for those signatures.. For signatures that are known to produce false positives, setting the action to 'Monitor' is the best approach. It allows traffic to pass while logging matches, enabling the administrator to review and tune the signature without disrupting legitimate traffic. Blocking could cause false positives to block valid traffic, and passing or disabling removes protection. Monitoring provides visibility and control.

Answer

Disable the signatures entirely.

Answer

Set the action to 'Block' for those signatures.

Answer

Set the action to 'Pass' for those signatures.

Question 7

An administrator is troubleshooting a FortiGate that is not applying a security profile to traffic. The administrator suspects that the traffic is being offloaded to a network processor (NP6) and bypassing the CPU. Which CLI command can be used to verify whether traffic is being offloaded and which sessions are affected?

Accepted Answer

diagnose npu np6 session list. The command 'diagnose npu np6 session list' specifically lists sessions offloaded to the NP6 processor. This allows the administrator to see which traffic is bypassing the CPU and therefore not subject to security profiles. The other commands either do not focus on offload or do not provide the necessary details.

Answer

diagnose sys session stat

Answer

diagnose debug flow filter

Answer

diagnose sys session list

Question 8

Where can an administrator check the status of the connection between a FortiGate and FortiManager?

Accepted Answer

Device Manager. In the FortiManager GUI, the Device Manager module provides a centralized view of all managed devices, including their connection status. When a FortiGate is added to FortiManager, its status (e.g., 'Connected', 'Disconnected', 'Unauthorized') is displayed in the Device Manager list. This is the primary location to verify the real-time connectivity between the FortiGate and FortiManager.

Answer

Log View

Answer

Policy & Objects

Answer

System Settings

Question 9

A security administrator is configuring a new SSL inspection profile on a FortiGate. The administrator wants to inspect HTTPS traffic for malware but must ensure that banking websites are not inspected due to privacy concerns. Which feature should be used to exempt specific websites from SSL inspection?

Accepted Answer

Add the banking websites to the SSL exemptions list in the SSL inspection profile.. To exempt specific websites from SSL inspection, the administrator should add them to the SSL exemptions list within the SSL inspection profile. This list allows you to specify FQDNs or IP addresses that should not be decrypted. The FortiGate will then allow traffic to those sites without inspection, maintaining privacy while still inspecting other HTTPS traffic.

Answer

Enable the 'Inspect All Ports' option and exclude port 443.

Answer

Create a static URL filter list and apply it to the SSL inspection profile.

Answer

Configure a firewall policy with a destination address for the banking websites and set the action to DENY.

Question 10

An administrator is configuring a FortiGate to use LDAP authentication for SSL VPN users. The LDAP server requires a bind DN and password for queries. Which configuration is required on the FortiGate to successfully authenticate users?

Accepted Answer

Create an LDAP server object with the server IP, port, common name identifier, bind DN, and bind password.. LDAP authentication on FortiGate requires an LDAP server object that includes the server address, port, bind DN, bind password, and common name identifier. This object is then used in a user group, which is referenced in the SSL VPN configuration. Without the proper bind credentials, the FortiGate cannot query the LDAP directory to authenticate users.

Answer

Configure a user group of type 'firewall' and add the LDAP server as a member.

Answer

Configure a RADIUS server object with the LDAP server's IP address and shared secret.

Answer

Enable 'LDAP' as an authentication method in the SSL VPN settings and specify the server's distinguished name.

Question 11

A FortiGate is configured with a static route to 192.168.1.0/24 via 10.0.0.1 on port1. The administrator wants to verify that the FortiGate will use this route for a packet destined to 192.168.1.10. Which command should the administrator use?

Accepted Answer

diagnose ip route get 192.168.1.10. The correct command to check which route the FortiGate will use for a specific destination is 'diagnose ip route get <destination>'. It provides the outgoing interface, gateway, and other details. The other options are invalid commands or incorrect syntax for this purpose.

Answer

get route 192.168.1.10

Answer

diagnose ip route lookup 192.168.1.10

Answer

show route 192.168.1.10

Question 12

A company uses FortiManager to manage multiple FortiGates. They have a requirement to ensure that all devices in a specific ADOM use the same set of firewall addresses and services. However, they also need to allow some devices to have additional, unique objects. Which FortiManager feature should they use to achieve this?

Accepted Answer

ADOM-level objects. ADOM-level objects are shared across all devices within the ADOM, providing a common set of addresses and services. They allow administrators to maintain consistency while still permitting device-specific objects. Global objects are for cross-ADOM sharing, and device-level or policy package objects are too limited in scope.

Answer

Policy package objects

Answer

Global objects

Answer

Device-level objects

Question 13

An administrator is configuring a FortiGate to perform SSL deep inspection for outbound HTTPS traffic. Which TWO actions are required to ensure that users can browse HTTPS sites without certificate errors? (Choose two.)

Accepted Answer

Enable SSL inspection in the firewall policy that allows outbound HTTPS traffic.. SSL deep inspection requires the FortiGate to act as a man-in-the-middle, re-signing server certificates with its own CA. Therefore, clients must trust the FortiGate's CA certificate, and the firewall policy must have SSL inspection enabled with deep inspection mode. Without both, clients will see certificate errors or traffic will not be inspected.

Answer

Configure the FortiGate to use a public CA certificate for re-signing.

Answer

Set the inspection mode to certificate inspection instead of deep inspection.

Answer

Import the server certificates from all HTTPS websites into the FortiGate.

Question 14

What is the effect of changing the IPS 'buffer' size on a FortiGate device?

Accepted Answer

It determines the maximum size of data packets to hold for inspection. The IPS buffer size on a FortiGate determines the maximum amount of data that can be held for inspection by the IPS engine. Adjusting it affects how much data is buffered before inspection, which can impact detection of threats in large packets or streams.

Answer

It disables the hardware acceleration engine

Answer

It changes the signature timeout

Answer

It increases the number of concurrent IPS connections

Question 15

An administrator uses FortiManager to manage a large number of FortiGates. They need to ensure that when a new firewall address object is created in the global database, it is automatically available in all ADOMs that require it, without manual duplication. Which FortiManager feature should be used?

Accepted Answer

Global Object Database. The Global Object Database in FortiManager is designed for sharing objects across ADOMs. Objects created there can be used in policies within any ADOM that has been enabled to use global objects. This provides centralized management and ensures consistency. Other options do not provide this functionality; global policy packages are for policies, and the other terms are not valid features.

Answer

ADOM Object Sharing

Answer

Policy Package Assignment

Answer

Global Policy Package

Question 16

A FortiGate is configured with a route-based IPsec VPN to a remote peer. The tunnel is up, but users report that traffic to the remote subnet intermittently fails. You suspect that the VPN is not being used for all traffic because of a routing issue. Which FortiGate CLI command would you use to verify which route is selected for a specific destination IP address?

Accepted Answer

get router info routing-table details . The command 'get router info routing-table details ' is the correct way to verify which route the FortiGate will use for a specific destination. In a route-based VPN scenario, it shows if the tunnel interface is the outgoing interface. This is essential for diagnosing intermittent failures caused by routing inconsistencies.

Answer

diagnose firewall iprope list <destination_ip>

Answer

show route-map <destination_ip>

Answer

diagnose ip route list <destination_ip>

Question 17

A security engineer is troubleshooting why a policy change made in FortiManager was not applied to a managed FortiGate. The engineer confirms the policy package was installed successfully, but the FortiGate shows no change. Which FortiManager feature should the engineer check first?

Accepted Answer

Workspace mode and approval status. When Workspace mode is enabled, policy changes are not immediately applied; they are stored in a workspace and require approval before installation. If the engineer installed the policy package without approving the workspace changes, the FortiGate would not receive the update. Checking the workspace and approval status reveals whether the change is pending. This is a common pitfall in collaborative environments where multiple administrators manage the same ADOM.

Answer

Policy package installation history

Answer

FortiGate's local configuration backup

Answer

ADOM revision control

Question 18

You are setting up an SD-WAN configuration via FortiManager. Which object type is used to group multiple WAN interfaces for SD-WAN member assignment?

Accepted Answer

SD-WAN Zone. In FortiManager SD-WAN configuration, an SD-WAN Zone is the object that groups multiple WAN interfaces so they can be referenced collectively as SD-WAN members in policies and rules.

Answer

IP Pool

Answer

Virtual Wire Pair

Answer

Interface Group

Question 19

When adding a FortiGate to FortiManager, which mode must the FortiGate be in to allow the FortiManager to manage its configuration and policies?

Accepted Answer

Normal mode. A FortiGate must be in Normal mode to be fully managed by FortiManager, allowing FortiManager to push configuration and policies. Normal mode enables central management, whereas other modes restrict what FortiManager can do.

Answer

Registration-only mode

Answer

Backup mode

Answer

Read-only mode

Question 20

An administrator wants to use FortiManager to push a configuration change to 50 FortiGates simultaneously. Which method minimizes downtime and ensures consistency?

Accepted Answer

Assign devices to a Device Group and push a common Policy Package. Assigning the 50 FortiGates to a Device Group and pushing a common Policy Package from FortiManager ensures a single, consistent configuration is deployed to all devices simultaneously, minimizing downtime and configuration drift.

Answer

Create 50 separate ADOMs

Answer

Connect to each FortiGate via SSH and run scripts

Answer

Enable 'Auto-Push' for every change