NSE7_EFW Practice Test 5 — 25 Questions

Question 1

An administrator wants to allow remote users to access the corporate network using FortiClient VPN. The administrator has configured an IPsec VPN with mode-cfg to assign IP addresses to clients. Which additional configuration is required to allow the clients to access internal resources?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a firewall policy from the VPN interface to the internal interface, allowing the assigned IP range.. For VPN clients to access internal resources, a firewall policy must be in place to allow traffic from the VPN interface to the internal network. The policy should match the source IP range assigned to clients and the destination internal subnets. Without this policy, traffic is dropped by the implicit deny rule. Other options like split tunneling, static routes, or selector changes do not provide the necessary permission and may not be required.

Answer

Configure a static route on the FortiGate for the VPN clients' assigned subnet.

Answer

Enable split tunneling in the FortiClient configuration.

Answer

Set the phase 2 selector to include the internal subnet as the remote subnet.

Question 2

A FortiManager administrator is configuring a new policy package for a managed FortiGate. The administrator wants to ensure that the policy package can be installed successfully and that the FortiGate will enforce the policies as intended. Which two actions must be performed before installing the policy package? (Choose two.)

Accepted Answer

Ensure the FortiGate device is in the same ADOM as the policy package.. To install a policy package to a FortiGate, the package must be assigned to the device in Device Manager, and the device must be in the same ADOM as the package. These two conditions ensure that the package is applicable to the device and that the installation can proceed. Other steps like consistency checks or workspace mode are optional or unrelated.

Answer

Run a policy consistency check to validate the package.

Answer

Configure a firewall address object for all external interfaces.

Answer

Enable workspace mode for the ADOM to allow policy editing.

Question 3

A FortiManager administrator is troubleshooting a policy installation failure on a managed FortiGate. The installation fails with an error indicating a duplicate object name. Which FortiManager feature can the administrator use to identify and resolve the conflict?

Accepted Answer

Use the 'Installation Preview' to see the exact configuration changes and identify the duplicate object.. The Installation Preview is the most effective tool for diagnosing installation failures. It shows the exact CLI commands that FortiManager will send to the FortiGate, including object definitions. By reviewing the preview, the administrator can see which object is duplicated and take corrective action, such as renaming the object in FortiManager or removing the conflict on the device.

Answer

Use the 'Revision History' to revert to a previous policy package version that did not have the duplicate object.

Answer

Use the 'Device Manager' to compare the FortiGate's configuration with the policy package and find duplicate objects.

Answer

Use the 'Policy Check' feature to validate the policy package for conflicts before installation.

Question 4

A network administrator has two FortiManager appliances in HA mode. The primary FortiManager fails over to the secondary. After failover, the administrator notices that some managed FortiGates show as 'Unreachable' in the secondary FortiManager. What is the most likely cause?

Accepted Answer

The FortiGates are configured with the primary FortiManager's IP address as the only management server.. In FortiManager HA, the secondary assumes the primary's virtual IP if configured. If FortiGates are pointed to a specific physical IP that does not move, they lose connectivity. Ensuring FortiGates use the HA virtual IP or FQDN that resolves to the active node prevents this. Other options are not typical causes of selective unreachability.

Answer

The secondary FortiManager does not have the same licenses installed as the primary.

Answer

The secondary FortiManager requires a reboot to synchronize device status.

Answer

The FortiGates are not configured to allow management from the secondary FortiManager's serial number.

Question 5

A network administrator is configuring a FortiGate 600E to manage bandwidth for a critical VoIP VLAN. The administrator needs to guarantee 2 Mbps for SIP signaling and allow burst up to 4 Mbps, while ensuring that unused bandwidth can be shared with other traffic when not needed. Which QoS method should the administrator use to meet these requirements?

Accepted Answer

Traffic shaping with a guaranteed bandwidth of 2 Mbps and a maximum bandwidth of 4 Mbps.. Traffic shaping is designed to guarantee a minimum bandwidth while allowing bursts up to a maximum when extra capacity exists. By setting a guaranteed bandwidth of 2 Mbps and a maximum of 4 Mbps, the FortiGate ensures SIP signaling always has at least 2 Mbps and can use up to 4 Mbps if available, sharing unused bandwidth with other traffic. Policing would drop excess packets, and prioritization alone does not guarantee bandwidth.

Answer

Traffic prioritization using a high-priority queue for SIP traffic.

Answer

Traffic policing with a guaranteed bandwidth of 2 Mbps and a maximum bandwidth of 4 Mbps.

Answer

Traffic shaping with a maximum bandwidth of 2 Mbps and a guaranteed bandwidth of 4 Mbps.

Question 6

An administrator has configured a FortiGate to perform deep inspection of SSL traffic. Users report that when they access a banking website, the browser shows a certificate warning and the connection is blocked. The administrator has imported the FortiGate's CA certificate into the browsers' trusted root store. Which action should the administrator take to allow access to the banking site while maintaining SSL inspection for other sites?

Accepted Answer

Create a firewall policy that exempts the banking site from SSL inspection by using a destination address and setting the SSL inspection profile to 'no-inspection'.. When deep inspection causes certificate warnings for certain sites, the best approach is to exempt those sites from inspection. This is done by creating a firewall policy that matches the destination and sets SSL inspection to 'no-inspection'. This allows the original certificate to pass through, avoiding the warning, while other traffic continues to be inspected. Global disabling or altering trusted certificates does not achieve the selective exemption.

Answer

Import the banking site's certificate into the FortiGate's CA store as a trusted root.

Answer

Disable deep inspection globally on the FortiGate to resolve the certificate warning.

Answer

Add the banking site's certificate to the FortiGate's untrusted certificate list.

Question 7

A network administrator is setting up a new FortiGate and wants to back up the configuration to a TFTP server at 192.168.1.50 before making changes. The administrator is logged into the CLI as the admin user. Which command correctly performs the backup?

Accepted Answer

execute backup config tftp backup.conf 192.168.1.50. The CLI command 'execute backup config tftp' followed by the filename and TFTP server IP address creates a configuration backup. The other options either use the wrong protocol, omit required credentials, or reverse the operation with 'restore'. The correct command is the standard FortiGate method for backing up the configuration to a TFTP server.

Answer

execute restore config tftp backup.conf 192.168.1.50

Answer

execute backup config sftp backup.conf 192.168.1.50

Answer

execute backup full-config ftp backup.conf 192.168.1.50

Question 8

You are implementing SSL VPN and need to ensure that only compliant corporate laptops can connect. Which feature should you use?

Accepted Answer

Host check. Host check (also called host checking or endpoint compliance) in FortiOS SSL VPN evaluates the connecting endpoint against configured compliance rules — such as OS version, antivirus presence, or registry keys — before granting access. This ensures only compliant corporate laptops can establish the tunnel.

Answer

SSL VPN portal settings

Answer

Two-factor authentication

Answer

PKI user authentication

Question 9

You are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?

Accepted Answer

Create an IPS sensor override for the specific signature ID. An IPS sensor override lets you change the action for a single signature ID (or a signature and its parameters) without disabling the whole sensor or the entire IPS profile. Setting the offending signature to 'Monitor' or 'Pass' while leaving all other signatures in blocking mode resolves the false positive while preserving protection against every other threat. This is the surgical, least-disruptive fix.

Answer

Change the IPS mode from blocking to monitoring

Answer

Disable the entire IPS sensor profile

Answer

Increase the IPS packet buffer size

Question 10

You need to inspect traffic between two internal VLANs. How do you ensure this traffic is processed by the FortiGate?

Accepted Answer

Configure firewall policies between the VLAN interfaces. To inspect inter-VLAN traffic, the FortiGate must be the gateway for each VLAN, and firewall policies must be configured between the VLAN interfaces. This forces traffic to be routed by the FortiGate, allowing it to apply security profiles and inspection. Without policies, traffic may be dropped or not inspected.

Answer

Enable hardware switching

Answer

Set the firewall mode to Transparent

Answer

Enable inter-VLAN routing on the switches only

Question 11

Which FortiGate feature is used to group multiple physical interfaces for redundancy at Layer 2?

Accepted Answer

802.3ad Aggregate. An 802.3ad Aggregate (LACP) groups multiple physical interfaces into a single logical link, providing link redundancy and increased bandwidth at Layer 2. If one member link fails, traffic continues over the remaining links, which is exactly the Layer 2 redundancy use case described.

Answer

Loopback interface

Answer

SD-WAN

Answer

VLAN tagging

Question 12

Which TWO types of reports can be generated in the FortiAnalyzer module of FortiManager?

Accepted Answer

Custom reports. FortiAnalyzer, whether accessed directly or via the FortiManager module, supports two main report categories: Custom reports (option A), which administrators create from scratch or by modifying templates to select specific datasets, time periods, and layouts, and Pre-defined reports (option B), which are built-in templates provided by Fortinet for common use cases such as traffic, security, and bandwidth analysis. Both are valid report types generated within the FortiAnalyzer module of FortiManager. The other options do not belong: Policy change impact reports (C) are not a FortiAnalyzer report type, Hardware diagnostic reports (D) are not generated by FortiAnalyzer, and Firmware compatibility reports (E) are unrelated to FortiAnalyzer reporting functionality.

Answer

Policy change impact reports

Answer

Hardware diagnostic reports

Answer

Firmware compatibility reports

Question 13

A security administrator is using FortiManager to manage a large number of FortiGates. The administrator needs to ensure that when a policy package is installed, the installation is performed efficiently and only to devices that require the changes. Which two actions should the administrator take to optimize the installation process? (Choose two.)

Accepted Answer

Use 'Install Wizard' and select only the devices that need the policy changes.. To optimize policy installation in FortiManager, administrators should target only the devices that require the changes. This can be achieved by selecting specific devices in the Install Wizard and by ensuring the policy package is assigned only to those devices. These actions reduce unnecessary installations, minimize network load, and improve overall efficiency. Other options like Auto Install or Install All do not provide targeted deployment and can lead to inefficiencies.

Answer

Use 'Install All' to ensure all devices are up to date.

Answer

Schedule installations during off-peak hours to reduce impact.

Answer

Enable 'Auto Install' on the policy package to push changes automatically to all devices.

Question 14

What does the 'FortiGuard' service provide to the FortiGate?

Accepted Answer

Real-time threat intelligence and database updates. FortiGuard is Fortinet's subscription-based security intelligence service that delivers real-time updates to the FortiGate, including antivirus signatures, IPS signatures, web filtering categories, application control signatures, and botnet/IP reputation databases. These updates keep the FortiGate's security profiles current against emerging threats.

Answer

User management and authentication

Answer

Local firmware storage

Answer

Hardware acceleration support

Question 15

Which THREE steps are involved in the 'Policy Package Installation' workflow?

Accepted Answer

Select the target device. In the Policy Package Installation workflow, you must first select the policy package (option D) that contains the rules you intend to deploy, since the installation operates on a specific package rather than the entire rulebase. Next, you select the target device (option A) — the managed gateway, cluster, or VSX instance — to which that package will be pushed. Before committing, you review the install preview (option C), which shows the changes, warnings, and validation results so you can confirm the impact of the installation. A factory reset (option B) is not part of installation; it is a recovery/redeployment action that erases configuration. Rebooting the target device (option E) is likewise not a required step, as policy installation applies the compiled policy without requiring a reboot.

Answer

Perform a factory reset

Answer

Reboot the target device

Question 16

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?

Accepted Answer

Mismatched Phase 2 selectors. Phase 2 failures in IPsec VPN are commonly caused by mismatched Phase 2 selectors (also known as proxy IDs or encryption domains). If the local and remote subnets or selectors do not match exactly, the tunnel will fail to establish.

Answer

Incorrect IKE version

Answer

Expired certificate

Answer

Mismatched pre-shared key

Question 17

In a VDOM-enabled environment, how are administrative accounts managed?

Accepted Answer

Admins can be scoped to specific VDOMs. In a VDOM-enabled FortiGate, administrative accounts can be scoped to specific VDOMs, restricting each admin's visibility and management scope to only the VDOMs assigned to them. This is a core benefit of VDOMs for multi-tenant or departmental management separation. The root admin retains global scope, but other admins can be limited.

Answer

Only the root VDOM admin can change settings

Answer

Admins must be global

Answer

All admins see all VDOMs

Question 18

A FortiManager administrator is configuring a new ADOM for a region. The administrator wants to restrict the ADOM to only manage FortiGate devices running FortiOS 7.0. Which ADOM version should be selected?

Accepted Answer

7.0. ADOM version must match the FortiOS version of the managed devices to ensure compatibility and access to appropriate features. Selecting 7.0 restricts the ADOM to manage only FortiGates running FortiOS 7.0, which is exactly what the administrator needs.

Answer

7.2

Answer

6.4

Answer

7.4

Question 19

Which THREE aspects of the FortiGate system are affected by changing the global 'set vdom-mode' to 'multi-vdom'?

Accepted Answer

CLI command hierarchy. Changing the global 'set vdom-mode' to 'multi-vdom' restructures the CLI command hierarchy (A), because commands become nested under 'config vdom' and you must enter a VDOM context to configure most objects, so option A is correct. It also changes the management of system resources (C), since each VDOM maintains its own separate routing table, firewall objects, administrators, and resource limits, allowing per-VDOM management and isolation, making option C correct. It additionally changes how firewall policies are applied (E), because policies are created and evaluated within each VDOM rather than globally, so inter-VDOM traffic requires explicit VDOM links and policies, confirming option E. The HA cluster size (B) is not affected by VDOM mode, as HA operates at the device level regardless of VDOM configuration. The physical port order (D) is also unaffected, since port numbering and interface naming remain the same whether in NAT/global or multi-VDOM mode.

Answer

The HA cluster size

Answer

The physical port order

Question 20

You need to inspect traffic between two VDOMs. Which mechanism is required?

Accepted Answer

Inter-VDOM Link. An Inter-VDOM Link is a virtual point-to-point interface pair that connects two VDOMs inside the same FortiGate, allowing traffic to be inspected by firewall policies as it passes between them. It is the only supported mechanism for routing and inspecting traffic between VDOMs on a single device. Without it, VDOMs are isolated routing domains and traffic cannot flow between them.

Answer

Policy-based routing

Answer

Physical loopback cable

Answer

Static NAT