NSE7_EFW Practice Test 3 — 10 Questions

Question 1

What is the result of 'Pushing' a policy package from FortiManager to a FortiGate?

Accepted Answer

The FortiGate policy configuration is overwritten with the FortiManager version. Pushing a policy package replaces the current policy configuration on the FortiGate with the version stored in the FortiManager database.

Answer

The FortiGate policy is sent to the FortiManager

Answer

The policy is saved in a draft state on the FortiGate

Answer

The FortiManager policy is appended to the existing FortiGate policy

Question 2

Which method is the most secure for managing FortiGate devices remotely?

Accepted Answer

HTTPS with restricted access via Trusted Hosts. SSH with key-based authentication or HTTPS with restricted access is standard; HTTPS is common for GUI access.

Answer

HTTP with password authentication

Answer

Telnet

Answer

SNMPv1

Question 3

An administrator is migrating a standalone FortiGate into an existing FortiManager. What happens to the existing firewall policies on the FortiGate during the import process?

Accepted Answer

They are imported and converted into a Policy Package. When importing, the FortiManager imports the configuration and creates a Policy Package; the existing policies are added to the 'Policy & Objects' database.

Answer

They are moved to a 'Disabled' state

Answer

They are deleted to ensure a clean slate

Answer

They are merged into the Global Policy

Question 4

Which administrative access type is recommended to be disabled on public-facing interfaces for security best practices?

Accepted Answer

HTTP. HTTP and Telnet are unencrypted protocols and should always be disabled on external interfaces.

Answer

SSH

Answer

HTTPS

Answer

SNMP

Question 5

When a policy change is made in FortiManager, it must be 'Installed' to take effect. What is the first stage of the install process?

Accepted Answer

Install Preview. The install process begins with an 'Install Preview' to verify the configuration changes before they are actually pushed to the device.

Answer

Database validation

Answer

Config push

Answer

Reboot

Question 6

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

Accepted Answer

Encryption algorithm (e.g., AES-256). IKEv2 negotiates encryption, integrity, and Diffie-Hellman groups during the initial exchange.

Answer

TCP port selection

Answer

Firewall policy ID

Question 7

In a VDOM-enabled environment, how are administrative accounts managed?

Accepted Answer

Admins can be scoped to specific VDOMs. Administrative accounts can be restricted to specific VDOMs (Global admin vs. VDOM admin) for granular access control.

Answer

Only the root VDOM admin can change settings

Answer

Admins must be global

Answer

All admins see all VDOMs

Question 8

Which command is used to troubleshoot connectivity by checking the routing table of a specific IP address on the FortiGate?

Accepted Answer

get router info routing-table detail <ip>. The 'get router info route detail' or 'execute router info routing-table' commands are standard for verifying paths.

Answer

diagnose sniffer packet

Answer

get system status

Answer

exec ping-options

Question 9

Which FortiGate feature is used to group multiple physical interfaces for redundancy at Layer 2?

Accepted Answer

802.3ad Aggregate. 802.3ad Link Aggregation (LACP) is the standard for binding physical ports into a single logical interface.

Answer

Loopback interface

Answer

SD-WAN

Answer

VLAN tagging

Question 10

Which TWO of the following are necessary to successfully deploy an SSL VPN in tunnel mode?

Accepted Answer

A valid SSL certificate for the VPN portal. Tunnel mode requires a configured portal and a policy allowing the VPN tunnel interface to the internal network.

Answer

An IPSec phase 1 configuration

Answer

A BGP session with the client

Answer

A dedicated hardware switch