NSE7_EFW Practice Test 2 — 25 Questions

Question 1

A network administrator needs to configure a FortiGate to send logs to a FortiAnalyzer. The administrator wants to ensure that logs are sent securely and that the FortiGate can verify the FortiAnalyzer's identity. Which protocol should be used for log transmission?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OFTP over TLS. The FortiGate uses OFTP over TLS to send logs to FortiAnalyzer securely. This protocol encrypts the logs and uses certificates to authenticate the FortiAnalyzer, ensuring that logs are not intercepted or sent to an unauthorized server. Other syslog options lack the necessary security features.

Answer

SNMPv3

Answer

Syslog over UDP

Answer

Syslog over TCP

Question 2

You are configuring BGP and need to advertise a summary route to your ISP. How do you ensure only the summary route is advertised?

Accepted Answer

Use an aggregate-address with summary-only. The BGP aggregate-address command with the summary-only keyword suppresses all more-specific component routes from being advertised, so only the summary route is sent to the ISP. This is the standard way to perform route summarization while hiding the contributing prefixes from external peers.

Answer

Use a distribute-list

Answer

Set the weight to 0

Answer

Configure a route map with a prefix list

Question 3

An administrator has configured a FortiManager to manage a FortiGate. The administrator notices that the FortiGate's configuration is out of sync with FortiManager. After reviewing the revision history, the administrator sees that the FortiGate has a configuration change that was not installed from FortiManager. What is the most likely cause?

Accepted Answer

The FortiGate was configured directly via its CLI or GUI, bypassing FortiManager.. The most likely cause is that the FortiGate was configured directly, bypassing FortiManager. FortiManager tracks configuration changes and compares them with the device. When a direct change occurs, the device's configuration diverges from the FortiManager database, resulting in an out-of-sync status. The administrator can then choose to import the changes or overwrite them by installing the FortiManager configuration.

Answer

The FortiGate's firmware version is incompatible with the FortiManager's firmware.

Answer

The FortiManager's revision history is corrupted and needs to be rebuilt.

Answer

The FortiManager's administrative domain (ADOM) was changed, causing the device to lose synchronization.

Question 4

A company uses a FortiGate as their main firewall. They want to implement a security profile that blocks malicious files downloaded via HTTP. Which FortiGate feature should they use to scan files for viruses and other malware?

Accepted Answer

Antivirus profile with deep inspection enabled in the firewall policy.. The antivirus profile is specifically designed to scan files for viruses and malware. When applied to a firewall policy with deep inspection, it examines files transferred over protocols like HTTP, FTP, and SMTP. Other profiles like IPS, web filter, or application control serve different purposes and do not provide file scanning.

Answer

Intrusion Prevention System (IPS) sensor with signatures for file downloads.

Answer

Web filter profile with category-based blocking.

Answer

Application control profile to block file-sharing applications.

Question 5

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

Accepted Answer

Use a route map in the OSPF redistribute configuration. In FortiOS, when redistributing routes into OSPF, you can attach a route map to the redistribute command to filter which routes are advertised. The route map can match specific criteria such as IP prefix lists, access lists, or interface names. By using a route map that matches only the desired subnet, you ensure that only that connected route is redistributed into OSPF. This is the standard and most flexible method for selective redistribution.

Answer

Configure a distribute-list in the OSPF process

Answer

Use an IP prefix list under the OSPF area command

Answer

Use an access list under the interface configuration

Question 6

A network administrator needs to configure a FortiGate to send logs to a FortiAnalyzer. The administrator wants to ensure that logs are sent securely and that the FortiGate can verify the FortiAnalyzer's identity. Which protocol should be used for log transmission?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OFTP. OFTP is the proprietary protocol used by FortiGate to securely send logs to FortiAnalyzer. It encrypts logs using SSL/TLS, ensuring confidentiality and integrity. The other protocols either lack encryption or are not intended for log forwarding. Therefore, OFTP is the correct choice when encryption is required.

Answer

Syslog over TCP

Answer

SNMPv3

Answer

Syslog over UDP

Question 7

You are troubleshooting high CPU usage on a FortiGate. Which process would you check to see if the IPS engine is the cause?

Accepted Answer

diag sys top. The 'diag sys top' command displays a real-time, sorted list of running processes on the FortiGate along with their CPU and memory utilization. By running it, an administrator can immediately see whether the IPS engine (often shown as 'ipsengine') is consuming an abnormally high percentage of CPU, confirming it as the cause of the high CPU usage. This is the standard FortiOS diagnostic tool for per-process resource monitoring.

Answer

get system status

Answer

diagnose hardware status

Answer

show sys resource

Question 8

An administrator is configuring a new FortiGate cluster in an HA environment. The administrator wants to ensure that if the primary unit fails, the secondary unit takes over with minimal disruption to existing sessions. Which HA setting should be configured to allow the secondary unit to maintain session state?

Accepted Answer

Enable session pickup on both HA nodes.. To maintain session state during an HA failover, session pickup must be enabled. This synchronizes session information between the primary and secondary units, allowing the secondary to take over existing sessions without interruption. Other settings like HA mode, priority, or gratuitous ARP do not provide session synchronization.

Answer

Enable gratuitous ARP on the HA cluster.

Answer

Set the HA priority higher on the secondary unit.

Answer

Configure the HA mode to active-active.

Question 9

A network security engineer is deploying a FortiGate in transparent mode. The engineer needs to ensure that the FortiGate can be managed remotely via HTTPS from the management network, while still passing all other traffic transparently. Which configuration is required?

Accepted Answer

Assign a management IP address to the transparent-mode VDOM and enable HTTPS administrative access on the management interface.. In transparent mode, the FortiGate requires a management IP address to be accessible for administration. This IP is assigned to a VDOM, and administrative access protocols like HTTPS must be enabled on the interface connected to the management network. Firewall policies are not used for management traffic.

Answer

Enable 'set allowaccess https' on all interfaces and assign an IP address to each interface.

Answer

Create a firewall policy allowing HTTPS traffic to the FortiGate's management IP and set the action to 'accept'.

Answer

Configure a static route to the management network and enable HTTPS access on the WAN interface.

Question 10

A FortiGate is configured with two VDOMs: 'root' and 'vdom1'. The administrator wants to allow a server in 'vdom1' to be accessed from the internet via a VIP configured in 'root'. The server's default gateway is the FortiGate's interface in 'vdom1'. What must be configured to ensure return traffic from the server to the internet is handled correctly?

Accepted Answer

Configure a static route in 'vdom1' pointing to the inter-VDOM link, and a static route in 'root' pointing to the internet, plus firewall policies to allow traffic.. The server in 'vdom1' has its default gateway set to the FortiGate's interface in 'vdom1'. When it responds to a request that arrived via a VIP in 'root', the return traffic goes to its default gateway in 'vdom1'. To reach the internet, that traffic must be routed from 'vdom1' to 'root' via an inter-VDOM link. Static routes in both VDOMs and appropriate firewall policies are necessary to allow the traffic to flow correctly. This setup maintains the VIP in 'root' while ensuring symmetric routing.

Answer

Create an inter-VDOM link between 'root' and 'vdom1' and configure routing on both sides.

Answer

Enable 'set allow-routing' on the VIP in 'root' and create a firewall policy in 'vdom1' to allow the return traffic.

Answer

Configure a VIP in 'vdom1' instead of 'root' and apply it to the external interface in 'vdom1'.

Question 11

A FortiGate is deployed as an internal segmentation firewall with VDOMs for each department. The administrator needs to allow a monitoring server in the 'IT' VDOM to reach a syslog server in the 'Mgmt' VDOM over TCP 514. No inter-VDOM links currently exist. What must the administrator configure to permit this traffic while keeping the VDOMs isolated?

Accepted Answer

Create an inter-VDOM link, assign IP addresses from a dedicated transfer subnet to both ends, and add firewall policies in each VDOM.. Inter-VDOM links are the supported method for connecting isolated VDOMs while retaining independent routing tables. The link creates paired interfaces that require IP addressing and firewall policies on both sides. This design lets the administrator permit only TCP 514 from the IT monitoring server to the Mgmt syslog server, maintaining segmentation and explicit control.

Answer

Configure a VDOM exception for the syslog server's IP address in the IT VDOM's firewall policy.

Answer

Assign the monitoring server and syslog server to the same VDOM and use a policy with NAT enabled.

Answer

Enable 'set allow-subnet-overlap enable' on the Mgmt VDOM and add a static route from IT to Mgmt.

Question 12

An administrator is troubleshooting a FortiGate HA cluster in Active-Passive mode. The primary unit unexpectedly failed over to the secondary, and the administrator needs to verify which configuration settings are synchronized between the nodes. Which two configuration elements are synchronized by default in an HA cluster? (Choose two.)

Accepted Answer

Interface IP addresses and static routes. By default, FortiGate HA synchronizes the security and networking configuration, including firewall address objects, policies, interface IP addresses, and static routes. These elements are critical for consistent traffic handling after a failover. Management settings such as hostname, passwords, SNMP, and syslog are not synchronized by default, and HA operational parameters like priority and virtual MAC are handled separately.

Answer

SNMP community strings and syslog server settings

Answer

The FortiGate hostname and administrative passwords

Answer

The cluster's virtual MAC address and HA priority

Question 13

A FortiGate is deployed in transparent mode between an internal network and a router. Users behind the FortiGate cannot reach the internet, but the FortiGate can ping external addresses. The administrator confirms the forwarding domain is enabled on both interfaces. Which action should the administrator take next to allow traffic to pass through the FortiGate?

Accepted Answer

Create a firewall policy from the internal interface to the external interface with NAT disabled and the action set to ACCEPT.. In transparent mode, the FortiGate bridges traffic between interfaces and does not perform NAT or routing. A firewall policy must be created to allow traffic from the internal interface to the external interface, with NAT disabled. Without this policy, traffic is dropped by the implicit deny. The policy action must be ACCEPT to permit the traffic.

Answer

Create a firewall policy from the internal interface to the external interface with NAT enabled.

Answer

Configure a static route on the FortiGate pointing to the external router.

Answer

Enable DHCP on the internal interface to provide IP addresses to users.

Question 14

A network administrator is troubleshooting a FortiGate 300E that is experiencing high CPU usage. The administrator suspects that a large amount of traffic is being processed by the CPU instead of being offloaded to the NP6 processor. Which type of traffic is typically NOT offloaded by the NP6 processor and therefore may contribute to high CPU usage?

Accepted Answer

Traffic requiring deep inspection with SSL/TLS decryption.. The NP6 processor offloads many common traffic types, but it cannot handle SSL/TLS decryption and deep inspection. These tasks require the main CPU because they involve complex cryptographic operations and content inspection. When a FortiGate is configured to decrypt and inspect HTTPS traffic, the CPU load can increase significantly, especially with high throughput. Other listed traffic types are typically offloaded and do not cause high CPU usage.

Answer

Traffic that is subject to simple firewall policies without UTM.

Answer

Traffic that uses NAT with a small number of concurrent sessions.

Answer

Traffic that is routed between VLAN interfaces on the same physical interface.

Question 15

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a new FortiGate is added to an ADOM, it automatically receives a base configuration that includes specific administrative settings, such as DNS servers and NTP servers. Which two FortiManager features can be used to accomplish this? (Choose two.)

Accepted Answer

Provisioning Templates. Provisioning Templates and CLI Templates are both designed to push configuration settings to managed FortiGates. Provisioning Templates are specifically for system-level settings and can be automatically applied when devices are added to an ADOM. CLI Templates offer more flexibility by allowing raw CLI commands to be executed on devices. Together, they can ensure that new FortiGates receive the required base configuration, including DNS and NTP servers.

Answer

Policy Packages

Answer

ADOM Revisions

Answer

Device Groups

Question 16

An administrator is configuring a new FortiManager installation and needs to set up administrative access. The administrator wants to ensure that only authorized personnel can log in and that their actions are logged. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Create administrator accounts with strong passwords and assign appropriate profiles.. To ensure only authorized personnel can log in, administrator accounts with strong passwords and appropriate profiles must be created. To log their actions, administrative logging must be configured. These two configurations directly address the access control and logging requirements. Other options, while beneficial, are not strictly required to meet the stated goals.

Answer

Enable 'Strong Password' policy in the FortiManager global settings.

Answer

Set up a remote syslog server for storing logs.

Answer

Enable two-factor authentication for administrator accounts.

Question 17

An administrator is using FortiManager to manage a FortiGate. The administrator notices that the FortiGate's configuration in FortiManager is different from the actual configuration on the device. To resolve this, the administrator wants to update FortiManager with the current configuration from the FortiGate. Which action should the administrator take?

Accepted Answer

Retrieve the configuration from the FortiGate.. To update FortiManager with the current configuration from a managed FortiGate, the administrator should use the 'Retrieve' function, which pulls the configuration from the device into FortiManager. This ensures FortiManager's database matches the FortiGate. Installing the policy package would push changes to the device, which is not desired. Manual import and ADOM synchronization are not appropriate for this scenario.

Answer

Import the FortiGate's configuration file manually.

Answer

Synchronize the ADOM with the FortiGate.

Answer

Install the policy package to the FortiGate.

Question 18

An administrator needs to back up the FortiGate configuration to a USB drive for disaster recovery. The FortiGate has a USB port and the administrator inserts a USB drive. Which command should the administrator use to perform the backup?

Accepted Answer

execute backup config usb. The correct command to back up the FortiGate configuration to a USB drive is 'execute backup config usb'. This command saves the configuration file to the connected USB storage device. Other backup options like TFTP or flash do not meet the requirement of using a USB drive. Therefore, the administrator should use this command.

Answer

execute backup config tftp

Answer

execute backup full-config usb

Answer

execute backup config flash

Question 19

A network administrator manages two FortiGate HA clusters (cluster A and cluster B) from a single FortiManager. They need to push a new firewall policy to both clusters without affecting the other cluster's configuration. Which FortiManager feature should they use to ensure that the policy is installed only to the intended cluster and that the clusters remain independent?

Accepted Answer

Create a separate ADOM for each cluster and install the policy from each ADOM.. The correct approach is to use separate ADOMs for each HA cluster. ADOMs provide logical separation of devices, policies, and objects, ensuring that policies and objects are contained within their ADOM. When installing from an ADOM, only devices within that ADOM are targeted, so the policy is pushed only to the intended cluster. This also prevents object name conflicts and unintended policy application across clusters.

Answer

Enable 'Workspace Mode' and lock the ADOM to prevent changes to the other cluster.

Answer

Configure a 'Policy Package' that contains the policy and assign it only to the target cluster via 'Assign Package'.

Answer

Use the 'Install Wizard' and select both clusters, then enable 'per-device mapping' for the policy.

Question 20

A network security administrator manages 40 FortiGate appliances from a single FortiManager. The administrator needs to provision a new FortiGate that will be installed at a remote branch office. The branch office uses a private MPLS circuit with no direct internet access for management. The FortiGate must be pre-configured with its management IP, administrative credentials, and initial firewall policy before it is shipped to the site. Which FortiManager feature should the administrator use to accomplish this?

Accepted Answer

Use the FortiManager 'Provisioning Templates' feature to create a model device, assign it to the appropriate ADOM, and pre-configure the required settings.. Provisioning Templates enable administrators to define a model device with pre-set configurations, including management IP, credentials, and policies. This allows the FortiGate to be configured before shipment and automatically receive its settings upon first connection, which is essential for remote sites without direct internet access. Other features like scripts or policy packages require the device to be online first.

Answer

Use the FortiManager 'Device Manager' to add the FortiGate by its serial number, then manually configure all settings via the GUI.

Answer

Use the FortiManager 'Policy Package' to create a policy that references the new FortiGate, then install it to the device.

Answer

Use the FortiManager 'Script' feature to run a CLI script on the FortiGate after it registers with FortiManager.