NSE7_EFW Practice Test 4 — 25 Questions

Question 1

A FortiGate is configured with a route-based IPsec VPN to a remote peer. The tunnel is up, but users report that traffic to the remote subnet intermittently fails. You suspect that the VPN is not being used for all traffic because of a routing issue. Which FortiGate CLI command would you use to verify which route is selected for a specific destination IP address?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

get router info routing-table details . The command 'get router info routing-table details ' is the correct way to verify which route the FortiGate will use for a specific destination. In a route-based VPN scenario, it shows if the tunnel interface is the outgoing interface. This is essential for diagnosing intermittent failures caused by routing inconsistencies.

Answer

diagnose firewall iprope list <destination_ip>

Answer

show route-map <destination_ip>

Answer

diagnose ip route list <destination_ip>

Question 2

A security engineer is troubleshooting why a policy change made in FortiManager was not applied to a managed FortiGate. The engineer confirms the policy package was installed successfully, but the FortiGate shows no change. Which FortiManager feature should the engineer check first?

Accepted Answer

Workspace mode and approval status. When Workspace mode is enabled, policy changes are not immediately applied; they are stored in a workspace and require approval before installation. If the engineer installed the policy package without approving the workspace changes, the FortiGate would not receive the update. Checking the workspace and approval status reveals whether the change is pending. This is a common pitfall in collaborative environments where multiple administrators manage the same ADOM.

Answer

Policy package installation history

Answer

FortiGate's local configuration backup

Answer

ADOM revision control

Question 3

You are setting up an SD-WAN configuration via FortiManager. Which object type is used to group multiple WAN interfaces for SD-WAN member assignment?

Accepted Answer

SD-WAN Zone. In FortiManager SD-WAN configuration, an SD-WAN Zone is the object that groups multiple WAN interfaces so they can be referenced collectively as SD-WAN members in policies and rules.

Answer

IP Pool

Answer

Virtual Wire Pair

Answer

Interface Group

Question 4

When adding a FortiGate to FortiManager, which mode must the FortiGate be in to allow the FortiManager to manage its configuration and policies?

Accepted Answer

Normal mode. A FortiGate must be in Normal mode to be fully managed by FortiManager, allowing FortiManager to push configuration and policies. Normal mode enables central management, whereas other modes restrict what FortiManager can do.

Answer

Registration-only mode

Answer

Backup mode

Answer

Read-only mode

Question 5

An administrator wants to use FortiManager to push a configuration change to 50 FortiGates simultaneously. Which method minimizes downtime and ensures consistency?

Accepted Answer

Assign devices to a Device Group and push a common Policy Package. Assigning the 50 FortiGates to a Device Group and pushing a common Policy Package from FortiManager ensures a single, consistent configuration is deployed to all devices simultaneously, minimizing downtime and configuration drift.

Answer

Create 50 separate ADOMs

Answer

Connect to each FortiGate via SSH and run scripts

Answer

Enable 'Auto-Push' for every change

Question 6

An administrator notices that logs are not appearing in FortiManager for a specific FortiGate. What is the first thing to check to ensure log forwarding is active?

Accepted Answer

Log forwarding configuration on the FortiGate. The first thing to check when logs are not appearing in FortiManager for a specific FortiGate is the log forwarding configuration on the FortiGate itself. This ensures that the device is configured to send logs to FortiManager. Without proper configuration, logs will not be forwarded regardless of other factors.

Answer

The FortiManager license

Answer

The device's physical connection

Answer

The firmware version of the FortiGate

Question 7

Which feature allows an administrator to offload SSL inspection to the hardware?

Accepted Answer

CP offloading. CP offloading refers to offloading SSL/TLS inspection to a dedicated Content Processor (CP) chip, which handles the cryptographic operations for SSL inspection so the main CPU is not overwhelmed. FortiGate models with CP9 content processors can accelerate SSL inspection, including full proxy and certificate inspection, by moving the heavy crypto to hardware. This is the feature that allows SSL inspection to be offloaded to hardware.

Answer

Flow-based inspection

Answer

IPS engine offloading

Answer

NP6 offloading

Question 8

What is the benefit of using 'CLI Templates' in FortiManager?

Accepted Answer

They allow applying configuration commands to multiple devices. CLI Templates in FortiManager let administrators define reusable blocks of FortiOS CLI configuration and push them to one or many managed FortiGates in a single operation. This is the core benefit: consistent, repeatable configuration across a device group without manually logging into each unit. They are a provisioning tool layered on top of the FortiManager device database, not a replacement for the GUI or a policy-conversion mechanism.

Answer

They replace the GUI completely

Answer

They convert the policy to a CLI script

Answer

They improve the FortiGate hardware performance

Question 9

What is the purpose of the 'Any' interface in a firewall policy?

Accepted Answer

To match traffic regardless of the ingress or egress interface. In a FortiGate firewall policy, the 'any' interface is a wildcard that matches traffic regardless of which physical or logical interface it arrives on or leaves through. It is typically used for policies that should apply universally, such as a deny-all cleanup rule or a policy that must catch traffic on any interface. It does not bypass routing or force traffic anywhere; it simply removes the interface as a match criterion.

Answer

To force traffic through the hardware switch

Answer

To bypass the routing table

Answer

To match traffic only on the WAN port

Question 10

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

Accepted Answer

Encryption algorithm (e.g., AES-256). During IKEv2 Phase 1 (IKE_SA_INIT and IKE_AUTH), the peers negotiate the encryption algorithm (A), such as AES-256, which protects the IKE SA itself, and the Diffie-Hellman group (E), which determines the key-exchange strength used to derive shared secret keys. They also negotiate the authentication method (B), such as PSK or RSA signatures, to verify each peer's identity during IKE_AUTH. TCP port selection (C) is not negotiated in Phase 1 because IKE uses UDP ports 500 and 4500, and TCP is not used for IKE. A firewall policy ID (D) is a local configuration construct, not an IKEv2 Phase 1 negotiation parameter.

Answer

TCP port selection

Answer

Firewall policy ID

Question 11

In a high availability (HA) cluster, which THREE settings are synchronized between the primary and secondary units?

Accepted Answer

Address objects. In an HA cluster, the configuration that defines security processing is synchronized from the primary to the secondary unit, and address objects (C) are part of that shared configuration so both units resolve the same IPs, ranges, and FQDNs during failover. The user authentication database (D) is also synchronized so locally defined users, groups, and credentials remain valid on the secondary after a failover, avoiding authentication outages. Firewall policies (E) are synchronized as core security configuration, ensuring the secondary enforces identical rules and traffic handling when it takes over. Hardware serial numbers (A) are device-specific identifiers and are never synchronized, and the management IP address (B) is intentionally unique per unit so each node remains individually reachable for administration.

Answer

Hardware serial numbers

Answer

Management IP address

Question 12

Which TWO options are available when configuring an SD-WAN rule in FortiManager?

Accepted Answer

Source/Destination criteria. In FortiManager, when you create an SD-WAN rule (SD-WAN Rule / Centralized SD-WAN configuration), the rule must define the traffic it matches and how that traffic is handled. Option B (Source/Destination criteria) is correct because SD-WAN rules match traffic based on source and destination parameters (such as source/destination addresses, users, applications, and services) to identify which flows the rule applies to. Option C (Traffic steering strategy) is correct because each SD-WAN rule requires a steering strategy that determines how matched traffic is distributed or prioritized across SD-WAN members, such as best-quality, lowest-cost, maximize-bandwidth, or manual/SLA-based selection. Option A (Interface physical speed) is not a configurable SD-WAN rule parameter; link speed is a property of the interface/health-check performance, not a rule-matching or steering field. Option D (MAC address spoofing) is unrelated to SD-WAN rule configuration and is not a supported SD-WAN rule setting. Option E (Hardware acceleration toggle) is an interface/system-level setting, not an SD-WAN rule option.

Answer

Interface physical speed

Answer

MAC address spoofing

Answer

Hardware acceleration toggle

Question 13

A network administrator is using FortiManager to manage a FortiGate. The administrator notices that the FortiGate's configuration has been changed directly via CLI, causing a mismatch with the policy package in FortiManager. What is the recommended first step to resolve this configuration drift?

Accepted Answer

Use the 'Import Configuration' option to pull the FortiGate's current configuration into FortiManager, then review and merge changes.. The recommended first step is to import the FortiGate's configuration into FortiManager. This captures the CLI changes and allows the administrator to review and merge them into the policy package. This approach maintains synchronization while preserving necessary local modifications, avoiding the risks of overwriting or manual reconciliation.

Answer

Re-install the policy package to the FortiGate to overwrite the CLI changes.

Answer

Manually edit the FortiManager policy package to match the FortiGate's CLI changes without importing.

Answer

Delete the FortiGate from FortiManager and re-add it to resynchronize the configuration.

Question 14

An administrator is configuring an HA cluster of two FortiGates in Active-Passive mode. The cluster must maintain session continuity for TCP traffic when a failover occurs, and the administrator wants to minimize unnecessary failovers caused by link flaps on a monitored interface. (Choose two.)

Accepted Answer

Enable session pickup so that TCP session state is synchronized to the backup unit.. Session pickup synchronizes TCP session state so connections survive failover, and interface monitoring hold time and retry settings prevent brief link flaps from triggering unnecessary failovers. Together these address session continuity and failover stability. Priority, heartbeat, and override settings affect election behavior but do not solve the specific requirements.

Answer

Disable heartbeat interfaces and rely only on monitored data interfaces for failure detection.

Answer

Set the HA priority of the backup unit higher than the primary unit to speed up the election.

Answer

Enable override so that the unit with the highest priority always becomes the primary after a failover.

Question 15

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a new firmware version is released, they can test it on a few devices before rolling it out to all. Which two FortiManager features or steps are required to accomplish this? (Choose two.)

Accepted Answer

Use the 'Import Firmware' option to upload the new firmware image to FortiManager.. To test firmware on a subset, you need the firmware image on FortiManager and a way to target only those devices. Importing the firmware ensures availability, and creating a device group allows selective upgrade. Auto-Update and scheduled delays do not provide the needed control, and configuration retrieval is a backup step, not a rollout mechanism.

Answer

Use the 'Retrieve Configuration' option before upgrading to ensure current settings are backed up.

Answer

Enable 'Auto-Update' in the FortiManager system settings to automatically download firmware from FortiGuard.

Answer

Configure a firmware upgrade schedule that applies to all devices but with a delay for non-test devices.

Question 16

A network administrator is configuring an IPsec VPN between two FortiGates. The administrator wants to ensure that only specific subnets are allowed through the tunnel, and that traffic to other subnets is dropped. Which configuration element directly defines the traffic selectors for the VPN?

Accepted Answer

Phase 2 selector. The phase 2 selector defines the source and destination subnets that are allowed through the IPsec tunnel. It acts as a traffic filter, ensuring only matching traffic is encrypted and sent over the VPN. Other elements like phase 1 proposals, firewall address objects, and static routes serve different purposes and do not directly define the selectors. Therefore, the phase 2 selector is the correct answer.

Answer

Phase 1 proposal

Answer

Firewall address objects

Answer

Static route entries

Question 17

A FortiGate is configured with two VDOMs: 'root' and 'internal'. The administrator wants to assign a physical interface to the 'internal' VDOM and then create a VLAN subinterface on that physical interface within the same VDOM. Which VDOM mode must be enabled, and what is the correct sequence of steps?

Accepted Answer

Enable Multi-VDOM mode, assign the physical interface to the 'internal' VDOM, then create the VLAN subinterface on the physical interface from within the 'internal' VDOM.. Multi-VDOM mode is required to assign a physical interface to a VDOM and then create VLAN subinterfaces on that interface within the same VDOM. The correct sequence is to first assign the physical interface to the target VDOM, then create the subinterface while in that VDOM's context. This ensures proper interface hierarchy and isolation.

Answer

Enable Multi-VDOM mode, create the VLAN subinterface on the physical interface in the 'root' VDOM, then reassign both the physical interface and the subinterface to the 'internal' VDOM.

Answer

Enable Split-Task VDOM mode, create the VLAN subinterface on the physical interface in the 'root' VDOM, then move the subinterface to the 'internal' VDOM.

Answer

Enable Split-Task VDOM mode, assign the physical interface to the 'internal' VDOM, then create the VLAN subinterface from the global configuration.

Question 18

A FortiManager administrator is configuring a new ADOM for a multi-tenant environment. The administrator needs to ensure that each tenant's FortiGates are isolated and that tenants cannot view or modify each other's configurations. Which two actions should the administrator take to achieve this? (Choose two.)

Accepted Answer

Configure each tenant's FortiGates in a separate ADOM and assign the tenant's administrative user to only that ADOM.. To achieve multi-tenant isolation, the administrator must create separate ADOMs for each tenant and assign tenant-specific administrative users with custom profiles limited to their respective ADOM. This ensures that tenants cannot access or modify other tenants' configurations. ADOM locking and FortiManager Fabric do not provide isolation, and using a Super_User profile would grant excessive privileges.

Answer

Enable 'ADOM Locking' to prevent concurrent modifications by different tenants.

Answer

Use the 'Super_User' profile for all tenant administrators and rely on ADOM assignments to restrict access.

Answer

Enable 'FortiManager Fabric' to automatically isolate tenant configurations.

Question 19

A FortiManager administrator needs to ensure that when a new firmware version is released, it is automatically downloaded to FortiManager and made available for installation on managed FortiGates. The administrator wants to minimize manual intervention. Which FortiManager feature should be configured?

Accepted Answer

Firmware management with scheduled updates. FortiManager's firmware management feature includes the ability to schedule automatic downloads of firmware images from FortiGuard. This ensures that new firmware versions are available in the FortiManager repository without manual intervention. Administrators can then use the firmware upgrade wizard to install the downloaded firmware on managed devices in a controlled manner.

Answer

Script scheduling for configuration changes

Answer

Centralized licensing for FortiGate devices

Answer

FortiGuard update service for security profiles

Question 20

A FortiManager administrator needs to delegate management of a specific ADOM to a subordinate administrator. The subordinate should only be able to view and modify firewall addresses and policies within that ADOM, and should not have access to other ADOMs or system settings. Which FortiManager feature should the administrator configure?

Accepted Answer

Create a new administrative user with a custom admin profile that includes read-write access to Firewall Objects and Policy & Objects, and assign the user to the specific ADOM.. The correct solution is to create a custom administrative profile with granular permissions limited to Firewall Objects and Policy & Objects, and assign it to the subordinate for the specific ADOM. This ensures the subordinate can perform their duties without gaining excessive privileges. Built-in profiles are too permissive, and other features like ADOM locking or ownership do not provide the required granularity.

Answer

Assign the subordinate the built-in 'Super_User' admin profile and restrict their access by ADOM assignment.

Answer

Configure a new ADOM with restricted visibility and assign the subordinate as the ADOM owner, giving them full control over that ADOM.

Answer

Use the 'ADOM Locking' feature to lock the ADOM to the subordinate administrator, preventing others from accessing it.