NSE7_EFW Practice Test 2 — 25 Questions

Question 1

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

Accepted Answer

Encryption algorithm (e.g., AES-256). IKEv2 negotiates encryption, integrity, and Diffie-Hellman groups during the initial exchange.

Answer

TCP port selection

Answer

Firewall policy ID

Question 2

In a VDOM-enabled environment, how are administrative accounts managed?

Accepted Answer

Admins can be scoped to specific VDOMs. Administrative accounts can be restricted to specific VDOMs (Global admin vs. VDOM admin) for granular access control.

Answer

Only the root VDOM admin can change settings

Answer

Admins must be global

Answer

All admins see all VDOMs

Question 3

Which command is used to troubleshoot connectivity by checking the routing table of a specific IP address on the FortiGate?

Accepted Answer

get router info routing-table detail <ip>. The 'get router info route detail' or 'execute router info routing-table' commands are standard for verifying paths.

Answer

diagnose sniffer packet

Answer

get system status

Answer

exec ping-options

Question 4

Which FortiGate feature is used to group multiple physical interfaces for redundancy at Layer 2?

Accepted Answer

802.3ad Aggregate. 802.3ad Link Aggregation (LACP) is the standard for binding physical ports into a single logical interface.

Answer

Loopback interface

Answer

SD-WAN

Answer

VLAN tagging

Question 5

Which TWO of the following are necessary to successfully deploy an SSL VPN in tunnel mode?

Accepted Answer

A valid SSL certificate for the VPN portal. Tunnel mode requires a configured portal and a policy allowing the VPN tunnel interface to the internal network.

Answer

An IPSec phase 1 configuration

Answer

A BGP session with the client

Answer

A dedicated hardware switch

Question 6

When configuring an aggregate interface (LACP) on a FortiGate, which mode must be set to ensure traffic is distributed across links based on source and destination IP?

Accepted Answer

Hash algorithm L4. The 'LACP-mode' set to 'active' or 'passive' relates to negotiation, but the distribution algorithm is governed by the 'dst-mac' or 'ip' hash settings in the interface configuration.

Answer

VLAN tagging

Answer

Interface mirroring

Answer

LACP mode active

Question 7

Which CLI command shows the current HA synchronization status and the checksums of the configurations?

Accepted Answer

get system ha status. 'get system ha status' provides the overall cluster health, including checksum comparison between nodes.

Answer

diag hardware ha

Answer

show system ha

Answer

diagnose sys ha sync

Question 8

Which THREE items are included in the configuration file of a FortiGate?

Accepted Answer

User certificates. The configuration file contains system settings, policy rules, and interface definitions.

Answer

FortiGuard cached updates

Answer

Real-time session tables

Question 9

Which THREE types of traffic are typically NOT offloaded by the NP6 processor?

Accepted Answer

Traffic requiring proxy-based inspection. Traffic that requires complex inspection, such as encrypted traffic that hasn't been decrypted or specific types of tunnels without hardware support, is handled by the CPU.

Answer

Simple ICMP packets

Answer

Standard UDP traffic

Question 10

You are troubleshooting high CPU usage on a FortiGate. Which process would you check to see if the IPS engine is the cause?

Accepted Answer

diag sys top. The 'diag sys top' command displays real-time resource utilization, allowing the admin to identify specific processes like 'ipsengine' consuming CPU.

Answer

get system status

Answer

diagnose hardware status

Answer

show sys resource

Question 11

An administrator is troubleshooting an issue where hardware acceleration is not working after upgrading firmware. Which command identifies if the NP configuration has changed?

Accepted Answer

diag hardware npu np6 port-list. 'diag hardware npu np6 port-list' or similar status commands help verify the current operational state and mapping of physical ports to NPU cores.

Answer

config system npu

Answer

diagnose firewall npu

Answer

get hardware status

Question 12

When using SD-WAN, how does the 'member' configuration interact with physical interfaces?

Accepted Answer

Members are logical groups of interfaces. SD-WAN members are physical interfaces (or tunnels) added to the SD-WAN zone, allowing the FortiGate to manage them as a single logical pool.

Answer

Members replace the IP configuration

Answer

Members require a separate VDOM

Answer

Members must have DHCP enabled

Question 13

Which feature allows an administrator to offload SSL inspection to the hardware?

Accepted Answer

CP offloading. The FortiASIC CP (Content Processor) hardware chips are specifically designed to offload CPU-intensive tasks like SSL/TLS decryption.

Answer

Flow-based inspection

Answer

IPS engine offloading

Answer

NP6 offloading

Question 14

Which TWO methods are used to achieve traffic separation in a multi-VDOM environment?

Accepted Answer

Using VLAN sub-interfaces. Physical port assignment and VLAN tagging are the standard methods for segmenting traffic at the network edge in VDOMs.

Answer

Enabling SSL inspection globally

Answer

Using different HA clusters

Answer

Using different firmware versions

Question 15

Which TWO settings are modified to reduce the impact of a failover event in an HA cluster?

Accepted Answer

hb-interval. 'hb-interval' and 'hb-lost-threshold' determine how quickly the cluster reacts to heartbeat loss.

Answer

group-password

Answer

priority

Answer

monitored-interfaces

Question 16

Which THREE aspects of the FortiGate system are affected by changing the global 'set vdom-mode' to 'multi-vdom'?

Accepted Answer

CLI command hierarchy. Changing the VDOM mode affects the CLI hierarchy, the available memory for VDOMs, and how system resources are partitioned.

Answer

The HA cluster size

Answer

The physical port order

Question 17

Which type of script in FortiManager is designed to run on the FortiManager itself rather than the managed devices?

Accepted Answer

TCL scripts. TCL scripts can be used to automate FortiManager functions, whereas CLI scripts typically target the managed devices.

Answer

CLI scripts

Answer

Configuration scripts

Answer

Policy scripts

Question 18

Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?

Accepted Answer

It uses fewer system resources than proxy-based inspection. Flow-based inspection is generally faster and provides better performance than proxy-based inspection.

Answer

It supports deep content inspection for all protocols

Answer

It requires manual buffer allocation

Answer

It offers more granular application control

Question 19

An administrator needs to provide access to FortiManager for a junior team member who should only be able to view logs and reports. Which feature is used to define this access?

Accepted Answer

Administrator Profiles. Administrators create 'Administrator Profiles' to restrict access to specific modules and permissions.

Answer

Access Control Lists (ACLs)

Answer

ADOM Assignment

Answer

User Groups

Question 20

Which TWO actions can be performed on a Revision History item in FortiManager?

Accepted Answer

Compare with current version. Revision history allows you to compare versions (diff) and restore to a previous state.

Answer

Delete the entire ADOM

Answer

Export the revision to an external cloud

Answer

Modify the version permanently