NSE7_EFW Practice Test 3 — 10 Questions

Question 1

When using an IPS sensor, what is the difference between 'Protect' and 'Monitor' mode?

Accepted Answer

Protect drops traffic; Monitor only logs it. In a FortiGate IPS sensor, each signature can be set to 'Monitor' or 'Protect' (or 'Disable'). Monitor mode generates a log/event when the signature matches but does not block the traffic, allowing baselining and false-positive tuning. Protect mode actively drops or resets the offending session in addition to logging, enforcing the signature.

Answer

Protect applies only to WAN; Monitor applies to LAN

Answer

Protect requires SSL inspection; Monitor does not

Answer

Protect logs traffic; Monitor drops it

Question 2

Which THREE items are included in a Policy Package when it is pushed from FortiManager?

Accepted Answer

Service Objects. A Policy Package in FortiManager is the container that holds the firewall policy configuration destined for managed FortiGate devices, and it includes Firewall Policies (B), which are the actual allow/deny rules pushed to the device. It also includes the reusable Address Objects (E) and Service Objects (A) that those policies reference, since these named objects must exist on the FortiGate for the policy to function. System interface settings (C) and Routing tables (D) are device-level configuration, not part of the Policy Package; they are handled separately (e.g., via the device's system settings or the "Install Wizard" device-level options), so they are not pushed as part of the policy package.

Answer

System interface settings

Answer

Routing tables

Question 3

When using SD-WAN, how does the 'member' configuration interact with physical interfaces?

Accepted Answer

Members are logical groups of interfaces. In FortiGate SD-WAN, a member is a logical grouping that references a physical interface (or other interface types) and applies SD-WAN settings such as priority, weight, and health checks. The physical interface retains its IP configuration; the member is an abstraction that allows multiple interfaces to be managed as part of the SD-WAN virtual interface.

Answer

Members replace the IP configuration

Answer

Members require a separate VDOM

Answer

Members must have DHCP enabled

Question 4

A security administrator is using FortiManager to manage a large number of FortiGate devices. The administrator wants to ensure that when a policy change is made in FortiManager, it is automatically validated for compliance with corporate security standards before being installed. Which FortiManager feature should be used to achieve this?

Accepted Answer

Policy Check. Policy Check in FortiManager validates firewall policies against compliance rules and best practices. It can be configured to run automatically before installation, ensuring that only policies meeting corporate standards are deployed. Other features like Installation Wizard, Revision History, and ADOM Revisions do not perform compliance validation.

Answer

Revision History

Answer

Installation Wizard

Answer

ADOM Revisions

Question 5

An administrator manages 25 FortiGates in a single ADOM. A new compliance rule requires that all managed devices use NTP servers 10.1.1.1 and 10.1.1.2. The administrator wants to push this change to all devices with minimal effort and ensure consistency. What is the most efficient way to accomplish this in FortiManager?

Accepted Answer

Use the 'Provisioning Templates' feature to create a system template with the NTP settings and assign it to all devices.. Provisioning Templates in FortiManager are designed to manage system-level settings across multiple devices. By creating a system template with the required NTP servers and assigning it to all devices in the ADOM, the administrator ensures consistent configuration with minimal effort. This approach leverages FortiManager's centralized management and is more efficient than manual configuration or scripts.

Answer

Manually edit the NTP settings on each FortiGate via the CLI.

Answer

Create a new policy package and assign it to all devices.

Answer

Use a script to run CLI commands on each device.

Question 6

A network administrator needs to configure a FortiGate to send logs to a FortiAnalyzer. The administrator wants to ensure that logs are sent securely and that the FortiGate can verify the FortiAnalyzer's identity. Which protocol should be used for log transmission?

Accepted Answer

OFTP over TLS. The FortiGate uses OFTP over TLS to send logs to FortiAnalyzer securely. This protocol encrypts the logs and uses certificates to authenticate the FortiAnalyzer, ensuring that logs are not intercepted or sent to an unauthorized server. Other syslog options lack the necessary security features.

Answer

SNMPv3

Answer

Syslog over UDP

Answer

Syslog over TCP

Question 7

You are configuring BGP and need to advertise a summary route to your ISP. How do you ensure only the summary route is advertised?

Accepted Answer

Use an aggregate-address with summary-only. The BGP aggregate-address command with the summary-only keyword suppresses all more-specific component routes from being advertised, so only the summary route is sent to the ISP. This is the standard way to perform route summarization while hiding the contributing prefixes from external peers.

Answer

Use a distribute-list

Answer

Set the weight to 0

Answer

Configure a route map with a prefix list

Question 8

An administrator has configured a FortiManager to manage a FortiGate. The administrator notices that the FortiGate's configuration is out of sync with FortiManager. After reviewing the revision history, the administrator sees that the FortiGate has a configuration change that was not installed from FortiManager. What is the most likely cause?

Accepted Answer

The FortiGate was configured directly via its CLI or GUI, bypassing FortiManager.. The most likely cause is that the FortiGate was configured directly, bypassing FortiManager. FortiManager tracks configuration changes and compares them with the device. When a direct change occurs, the device's configuration diverges from the FortiManager database, resulting in an out-of-sync status. The administrator can then choose to import the changes or overwrite them by installing the FortiManager configuration.

Answer

The FortiGate's firmware version is incompatible with the FortiManager's firmware.

Answer

The FortiManager's revision history is corrupted and needs to be rebuilt.

Answer

The FortiManager's administrative domain (ADOM) was changed, causing the device to lose synchronization.

Question 9

A company uses a FortiGate as their main firewall. They want to implement a security profile that blocks malicious files downloaded via HTTP. Which FortiGate feature should they use to scan files for viruses and other malware?

Accepted Answer

Antivirus profile with deep inspection enabled in the firewall policy.. The antivirus profile is specifically designed to scan files for viruses and malware. When applied to a firewall policy with deep inspection, it examines files transferred over protocols like HTTP, FTP, and SMTP. Other profiles like IPS, web filter, or application control serve different purposes and do not provide file scanning.

Answer

Intrusion Prevention System (IPS) sensor with signatures for file downloads.

Answer

Web filter profile with category-based blocking.

Answer

Application control profile to block file-sharing applications.

Question 10

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

Accepted Answer

Use a route map in the OSPF redistribute configuration. In FortiOS, when redistributing routes into OSPF, you can attach a route map to the redistribute command to filter which routes are advertised. The route map can match specific criteria such as IP prefix lists, access lists, or interface names. By using a route map that matches only the desired subnet, you ensure that only that connected route is redistributed into OSPF. This is the standard and most flexible method for selective redistribution.

Answer

Configure a distribute-list in the OSPF process

Answer

Use an IP prefix list under the OSPF area command

Answer

Use an access list under the interface configuration