NSE7_EFW Practice Test 2 — 30 Questions

Question 1

A network administrator needs to configure a FortiGate to send logs to a FortiAnalyzer device. The administrator wants to ensure that logs are encrypted during transmission. Which protocol should be used for log forwarding?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OFTP. OFTP is the proprietary protocol used by FortiGate to securely send logs to FortiAnalyzer. It encrypts logs using SSL/TLS, ensuring confidentiality and integrity. The other protocols either lack encryption or are not intended for log forwarding. Therefore, OFTP is the correct choice when encryption is required.

Answer

Syslog over TCP

Answer

SNMPv3

Answer

Syslog over UDP

Question 2

You are troubleshooting high CPU usage on a FortiGate. Which process would you check to see if the IPS engine is the cause?

Accepted Answer

diag sys top. The 'diag sys top' command displays a real-time, sorted list of running processes on the FortiGate along with their CPU and memory utilization. By running it, an administrator can immediately see whether the IPS engine (often shown as 'ipsengine') is consuming an abnormally high percentage of CPU, confirming it as the cause of the high CPU usage. This is the standard FortiOS diagnostic tool for per-process resource monitoring.

Answer

get system status

Answer

diagnose hardware status

Answer

show sys resource

Question 3

An administrator is configuring a new FortiGate cluster in an HA environment. The administrator wants to ensure that if the primary unit fails, the secondary unit takes over with minimal disruption to existing sessions. Which HA setting should be configured to allow the secondary unit to maintain session state?

Accepted Answer

Enable session pickup on both HA nodes.. To maintain session state during an HA failover, session pickup must be enabled. This synchronizes session information between the primary and secondary units, allowing the secondary to take over existing sessions without interruption. Other settings like HA mode, priority, or gratuitous ARP do not provide session synchronization.

Answer

Enable gratuitous ARP on the HA cluster.

Answer

Set the HA priority higher on the secondary unit.

Answer

Configure the HA mode to active-active.

Question 4

A network security engineer is deploying a FortiGate in transparent mode. The engineer needs to ensure that the FortiGate can be managed remotely via HTTPS from the management network, while still passing all other traffic transparently. Which configuration is required?

Accepted Answer

Assign a management IP address to the transparent-mode VDOM and enable HTTPS administrative access on the management interface.. In transparent mode, the FortiGate requires a management IP address to be accessible for administration. This IP is assigned to a VDOM, and administrative access protocols like HTTPS must be enabled on the interface connected to the management network. Firewall policies are not used for management traffic.

Answer

Enable 'set allowaccess https' on all interfaces and assign an IP address to each interface.

Answer

Create a firewall policy allowing HTTPS traffic to the FortiGate's management IP and set the action to 'accept'.

Answer

Configure a static route to the management network and enable HTTPS access on the WAN interface.

Question 5

A FortiGate is configured with two VDOMs: 'root' and 'vdom1'. The administrator wants to allow a server in 'vdom1' to be accessed from the internet via a VIP configured in 'root'. The server's default gateway is the FortiGate's interface in 'vdom1'. What must be configured to ensure return traffic from the server to the internet is handled correctly?

Accepted Answer

Configure a static route in 'vdom1' pointing to the inter-VDOM link, and a static route in 'root' pointing to the internet, plus firewall policies to allow traffic.. The server in 'vdom1' has its default gateway set to the FortiGate's interface in 'vdom1'. When it responds to a request that arrived via a VIP in 'root', the return traffic goes to its default gateway in 'vdom1'. To reach the internet, that traffic must be routed from 'vdom1' to 'root' via an inter-VDOM link. Static routes in both VDOMs and appropriate firewall policies are necessary to allow the traffic to flow correctly. This setup maintains the VIP in 'root' while ensuring symmetric routing.

Answer

Create an inter-VDOM link between 'root' and 'vdom1' and configure routing on both sides.

Answer

Enable 'set allow-routing' on the VIP in 'root' and create a firewall policy in 'vdom1' to allow the return traffic.

Answer

Configure a VIP in 'vdom1' instead of 'root' and apply it to the external interface in 'vdom1'.

Question 6

A FortiGate is deployed as an internal segmentation firewall with VDOMs for each department. The administrator needs to allow a monitoring server in the 'IT' VDOM to reach a syslog server in the 'Mgmt' VDOM over TCP 514. No inter-VDOM links currently exist. What must the administrator configure to permit this traffic while keeping the VDOMs isolated?

Accepted Answer

Create an inter-VDOM link, assign IP addresses from a dedicated transfer subnet to both ends, and add firewall policies in each VDOM.. Inter-VDOM links are the supported method for connecting isolated VDOMs while retaining independent routing tables. The link creates paired interfaces that require IP addressing and firewall policies on both sides. This design lets the administrator permit only TCP 514 from the IT monitoring server to the Mgmt syslog server, maintaining segmentation and explicit control.

Answer

Configure a VDOM exception for the syslog server's IP address in the IT VDOM's firewall policy.

Answer

Assign the monitoring server and syslog server to the same VDOM and use a policy with NAT enabled.

Answer

Enable 'set allow-subnet-overlap enable' on the Mgmt VDOM and add a static route from IT to Mgmt.

Question 7

An administrator is troubleshooting a FortiGate HA cluster in Active-Passive mode. The primary unit unexpectedly failed over to the secondary, and the administrator needs to verify which configuration settings are synchronized between the nodes. Which two configuration elements are synchronized by default in an HA cluster? (Choose two.)

Accepted Answer

Interface IP addresses and static routes. By default, FortiGate HA synchronizes the security and networking configuration, including firewall address objects, policies, interface IP addresses, and static routes. These elements are critical for consistent traffic handling after a failover. Management settings such as hostname, passwords, SNMP, and syslog are not synchronized by default, and HA operational parameters like priority and virtual MAC are handled separately.

Answer

SNMP community strings and syslog server settings

Answer

The FortiGate hostname and administrative passwords

Answer

The cluster's virtual MAC address and HA priority

Question 8

A FortiGate is deployed in transparent mode between an internal network and a router. Users behind the FortiGate cannot reach the internet, but the FortiGate can ping external addresses. The administrator confirms the forwarding domain is enabled on both interfaces. Which action should the administrator take next to allow traffic to pass through the FortiGate?

Accepted Answer

Create a firewall policy from the internal interface to the external interface with NAT disabled and the action set to ACCEPT.. In transparent mode, the FortiGate bridges traffic between interfaces and does not perform NAT or routing. A firewall policy must be created to allow traffic from the internal interface to the external interface, with NAT disabled. Without this policy, traffic is dropped by the implicit deny. The policy action must be ACCEPT to permit the traffic.

Answer

Create a firewall policy from the internal interface to the external interface with NAT enabled.

Answer

Configure a static route on the FortiGate pointing to the external router.

Answer

Enable DHCP on the internal interface to provide IP addresses to users.

Question 9

A network administrator is troubleshooting a FortiGate 300E that is experiencing high CPU usage. The administrator suspects that a large amount of traffic is being processed by the CPU instead of being offloaded to the NP6 processor. Which type of traffic is typically NOT offloaded by the NP6 processor and therefore may contribute to high CPU usage?

Accepted Answer

Traffic requiring deep inspection with SSL/TLS decryption.. The NP6 processor offloads many common traffic types, but it cannot handle SSL/TLS decryption and deep inspection. These tasks require the main CPU because they involve complex cryptographic operations and content inspection. When a FortiGate is configured to decrypt and inspect HTTPS traffic, the CPU load can increase significantly, especially with high throughput. Other listed traffic types are typically offloaded and do not cause high CPU usage.

Answer

Traffic that is subject to simple firewall policies without UTM.

Answer

Traffic that uses NAT with a small number of concurrent sessions.

Answer

Traffic that is routed between VLAN interfaces on the same physical interface.

Question 10

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a new FortiGate is added to an ADOM, it automatically receives a base configuration that includes specific administrative settings, such as DNS servers and NTP servers. Which two FortiManager features can be used to accomplish this? (Choose two.)

Accepted Answer

Provisioning Templates. Provisioning Templates and CLI Templates are both designed to push configuration settings to managed FortiGates. Provisioning Templates are specifically for system-level settings and can be automatically applied when devices are added to an ADOM. CLI Templates offer more flexibility by allowing raw CLI commands to be executed on devices. Together, they can ensure that new FortiGates receive the required base configuration, including DNS and NTP servers.

Answer

Policy Packages

Answer

ADOM Revisions

Answer

Device Groups

Question 11

An administrator is configuring a new FortiManager installation and needs to set up administrative access. The administrator wants to ensure that only authorized personnel can log in and that their actions are logged. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Create administrator accounts with strong passwords and assign appropriate profiles.. To ensure only authorized personnel can log in, administrator accounts with strong passwords and appropriate profiles must be created. To log their actions, administrative logging must be configured. These two configurations directly address the access control and logging requirements. Other options, while beneficial, are not strictly required to meet the stated goals.

Answer

Enable 'Strong Password' policy in the FortiManager global settings.

Answer

Set up a remote syslog server for storing logs.

Answer

Enable two-factor authentication for administrator accounts.

Question 12

An administrator is using FortiManager to manage a FortiGate. The administrator notices that the FortiGate's configuration in FortiManager is different from the actual configuration on the device. To resolve this, the administrator wants to update FortiManager with the current configuration from the FortiGate. Which action should the administrator take?

Accepted Answer

Retrieve the configuration from the FortiGate.. To update FortiManager with the current configuration from a managed FortiGate, the administrator should use the 'Retrieve' function, which pulls the configuration from the device into FortiManager. This ensures FortiManager's database matches the FortiGate. Installing the policy package would push changes to the device, which is not desired. Manual import and ADOM synchronization are not appropriate for this scenario.

Answer

Import the FortiGate's configuration file manually.

Answer

Synchronize the ADOM with the FortiGate.

Answer

Install the policy package to the FortiGate.

Question 13

An administrator needs to back up the FortiGate configuration to a USB drive for disaster recovery. The FortiGate has a USB port and the administrator inserts a USB drive. Which command should the administrator use to perform the backup?

Accepted Answer

execute backup config usb. The correct command to back up the FortiGate configuration to a USB drive is 'execute backup config usb'. This command saves the configuration file to the connected USB storage device. Other backup options like TFTP or flash do not meet the requirement of using a USB drive. Therefore, the administrator should use this command.

Answer

execute backup config tftp

Answer

execute backup full-config usb

Answer

execute backup config flash

Question 14

A network administrator manages two FortiGate HA clusters (cluster A and cluster B) from a single FortiManager. They need to push a new firewall policy to both clusters without affecting the other cluster's configuration. Which FortiManager feature should they use to ensure that the policy is installed only to the intended cluster and that the clusters remain independent?

Accepted Answer

Create a separate ADOM for each cluster and install the policy from each ADOM.. The correct approach is to use separate ADOMs for each HA cluster. ADOMs provide logical separation of devices, policies, and objects, ensuring that policies and objects are contained within their ADOM. When installing from an ADOM, only devices within that ADOM are targeted, so the policy is pushed only to the intended cluster. This also prevents object name conflicts and unintended policy application across clusters.

Answer

Enable 'Workspace Mode' and lock the ADOM to prevent changes to the other cluster.

Answer

Configure a 'Policy Package' that contains the policy and assign it only to the target cluster via 'Assign Package'.

Answer

Use the 'Install Wizard' and select both clusters, then enable 'per-device mapping' for the policy.

Question 15

A network security administrator manages 40 FortiGate appliances from a single FortiManager. The administrator needs to provision a new FortiGate that will be installed at a remote branch office. The branch office uses a private MPLS circuit with no direct internet access for management. The FortiGate must be pre-configured with its management IP, administrative credentials, and initial firewall policy before it is shipped to the site. Which FortiManager feature should the administrator use to accomplish this?

Accepted Answer

Use the FortiManager 'Provisioning Templates' feature to create a model device, assign it to the appropriate ADOM, and pre-configure the required settings.. Provisioning Templates enable administrators to define a model device with pre-set configurations, including management IP, credentials, and policies. This allows the FortiGate to be configured before shipment and automatically receive its settings upon first connection, which is essential for remote sites without direct internet access. Other features like scripts or policy packages require the device to be online first.

Answer

Use the FortiManager 'Device Manager' to add the FortiGate by its serial number, then manually configure all settings via the GUI.

Answer

Use the FortiManager 'Policy Package' to create a policy that references the new FortiGate, then install it to the device.

Answer

Use the FortiManager 'Script' feature to run a CLI script on the FortiGate after it registers with FortiManager.

Question 16

An administrator is using FortiManager to manage a FortiGate cluster (HA). They need to ensure that when a policy package is installed, both the primary and secondary units receive the configuration. What must be configured in FortiManager to achieve this?

Accepted Answer

Add the HA cluster as a single device using the primary unit's serial number, and FortiManager will synchronize to all cluster members.. FortiManager manages an HA cluster as a single device, added via the primary unit's serial number. When a policy package is installed, FortiManager communicates with the primary, which then synchronizes the configuration to all cluster members. This ensures both units receive the configuration. Other options suggest incorrect or non-existent configurations.

Answer

Configure a 'Cluster' object in FortiManager and assign the policy package to it.

Answer

Enable 'HA Management' in the FortiGate device settings in FortiManager.

Answer

Add both the primary and secondary FortiGate units as separate managed devices in FortiManager.

Question 17

You are the security administrator for a large enterprise with multiple FortiGate devices managed by FortiManager. You need to create a new firewall policy that references an address object that already exists in the ADOM's global object database. However, you want to ensure that the policy is only installed on a specific subset of FortiGates. Which FortiManager feature should you use to accomplish this?

Accepted Answer

Create a new policy package and assign it to the desired FortiGates.. The requirement is to deploy a policy only to a subset of FortiGates. In FortiManager, policy packages are the primary method for grouping policies and assigning them to specific devices. By creating a new policy package and assigning it only to the desired FortiGates, the administrator ensures that the policy is installed only on those devices. Other mechanisms like dynamic objects or per-device mapping do not control deployment scope, and workspace mode is unrelated to scoping.

Answer

Configure a per-device mapping for the address object.

Answer

Enable workspace mode and lock the ADOM before making changes.

Answer

Use a dynamic object and map it to the desired FortiGates.

Question 18

A security administrator is responsible for managing a FortiManager appliance that oversees multiple FortiGate devices. The administrator needs to create a new administrative user who should only be able to view firewall policies and device status but not make any changes. Which FortiManager administrative profile should be assigned to this user?

Accepted Answer

Read_Only. The Read_Only administrative profile is designed for users who need to view configurations and status but must not make changes. It provides the necessary visibility without granting modification rights. Other profiles like Super_User or Standard_User grant excessive privileges, while No_Access denies all access.

Answer

No_Access

Answer

Super_User

Answer

Standard_User

Question 19

You are deploying a new FortiGate in transparent mode. Users report that they cannot access the internet, but they can access internal servers. You have verified that the FortiGate is in transparent mode and that the management IP is reachable. What is the most likely cause?

Accepted Answer

Firewall policies must be configured to allow traffic from the internal network to the external network, even in transparent mode.. Even in transparent mode, the FortiGate enforces firewall policies. Traffic from internal to external networks must be explicitly allowed by a policy. If such a policy is missing, the implicit deny will block internet access. Internal traffic might be allowed by a different policy, explaining why users can reach internal servers but not the internet.

Answer

The FortiGate's management IP must be in the same subnet as the internal network for traffic to flow.

Answer

The FortiGate requires a default route to the internet, but in transparent mode it does not perform routing.

Answer

Transparent mode does not support NAT, so internet access is impossible without additional configuration.

Question 20

An administrator is setting up a new FortiManager and needs to add a FortiGate device for management. The FortiGate is behind a NAT device and does not have a public IP address. Which FortiManager feature allows the FortiGate to connect to FortiManager without requiring inbound access?

Accepted Answer

FortiGate initiates connection to FortiManager. The FortiGate always initiates the connection to FortiManager, which means it can be located behind NAT without requiring any inbound firewall rules. The FortiManager listens on TCP port 541 for these connections. This design simplifies deployment in environments where FortiGates are behind NAT or have dynamic IP addresses.

Answer

FortiManager auto-discovery

Answer

FortiManager behind NAT

Answer

Pre-shared key authentication