NSE7_EFW Practice Test 4 — 10 Questions

Question 1

A network administrator needs to configure a FortiGate to send logs to a FortiAnalyzer device. The administrator wants to ensure that logs are encrypted during transmission. Which protocol should be used for log forwarding?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OFTP. OFTP is the proprietary protocol used by FortiGate to securely send logs to FortiAnalyzer. It encrypts logs using SSL/TLS, ensuring confidentiality and integrity. The other protocols either lack encryption or are not intended for log forwarding. Therefore, OFTP is the correct choice when encryption is required.

Answer

Syslog over TCP

Answer

SNMPv3

Answer

Syslog over UDP

Question 2

You are troubleshooting high CPU usage on a FortiGate. Which process would you check to see if the IPS engine is the cause?

Accepted Answer

diag sys top. The 'diag sys top' command displays a real-time, sorted list of running processes on the FortiGate along with their CPU and memory utilization. By running it, an administrator can immediately see whether the IPS engine (often shown as 'ipsengine') is consuming an abnormally high percentage of CPU, confirming it as the cause of the high CPU usage. This is the standard FortiOS diagnostic tool for per-process resource monitoring.

Answer

get system status

Answer

diagnose hardware status

Answer

show sys resource

Question 3

An administrator is configuring a new FortiGate cluster in an HA environment. The administrator wants to ensure that if the primary unit fails, the secondary unit takes over with minimal disruption to existing sessions. Which HA setting should be configured to allow the secondary unit to maintain session state?

Accepted Answer

Enable session pickup on both HA nodes.. To maintain session state during an HA failover, session pickup must be enabled. This synchronizes session information between the primary and secondary units, allowing the secondary to take over existing sessions without interruption. Other settings like HA mode, priority, or gratuitous ARP do not provide session synchronization.

Answer

Enable gratuitous ARP on the HA cluster.

Answer

Set the HA priority higher on the secondary unit.

Answer

Configure the HA mode to active-active.

Question 4

A network security engineer is deploying a FortiGate in transparent mode. The engineer needs to ensure that the FortiGate can be managed remotely via HTTPS from the management network, while still passing all other traffic transparently. Which configuration is required?

Accepted Answer

Assign a management IP address to the transparent-mode VDOM and enable HTTPS administrative access on the management interface.. In transparent mode, the FortiGate requires a management IP address to be accessible for administration. This IP is assigned to a VDOM, and administrative access protocols like HTTPS must be enabled on the interface connected to the management network. Firewall policies are not used for management traffic.

Answer

Enable 'set allowaccess https' on all interfaces and assign an IP address to each interface.

Answer

Create a firewall policy allowing HTTPS traffic to the FortiGate's management IP and set the action to 'accept'.

Answer

Configure a static route to the management network and enable HTTPS access on the WAN interface.

Question 5

A FortiGate is configured with two VDOMs: 'root' and 'vdom1'. The administrator wants to allow a server in 'vdom1' to be accessed from the internet via a VIP configured in 'root'. The server's default gateway is the FortiGate's interface in 'vdom1'. What must be configured to ensure return traffic from the server to the internet is handled correctly?

Accepted Answer

Configure a static route in 'vdom1' pointing to the inter-VDOM link, and a static route in 'root' pointing to the internet, plus firewall policies to allow traffic.. The server in 'vdom1' has its default gateway set to the FortiGate's interface in 'vdom1'. When it responds to a request that arrived via a VIP in 'root', the return traffic goes to its default gateway in 'vdom1'. To reach the internet, that traffic must be routed from 'vdom1' to 'root' via an inter-VDOM link. Static routes in both VDOMs and appropriate firewall policies are necessary to allow the traffic to flow correctly. This setup maintains the VIP in 'root' while ensuring symmetric routing.

Answer

Create an inter-VDOM link between 'root' and 'vdom1' and configure routing on both sides.

Answer

Enable 'set allow-routing' on the VIP in 'root' and create a firewall policy in 'vdom1' to allow the return traffic.

Answer

Configure a VIP in 'vdom1' instead of 'root' and apply it to the external interface in 'vdom1'.

Question 6

A FortiGate is deployed as an internal segmentation firewall with VDOMs for each department. The administrator needs to allow a monitoring server in the 'IT' VDOM to reach a syslog server in the 'Mgmt' VDOM over TCP 514. No inter-VDOM links currently exist. What must the administrator configure to permit this traffic while keeping the VDOMs isolated?

Accepted Answer

Create an inter-VDOM link, assign IP addresses from a dedicated transfer subnet to both ends, and add firewall policies in each VDOM.. Inter-VDOM links are the supported method for connecting isolated VDOMs while retaining independent routing tables. The link creates paired interfaces that require IP addressing and firewall policies on both sides. This design lets the administrator permit only TCP 514 from the IT monitoring server to the Mgmt syslog server, maintaining segmentation and explicit control.

Answer

Configure a VDOM exception for the syslog server's IP address in the IT VDOM's firewall policy.

Answer

Assign the monitoring server and syslog server to the same VDOM and use a policy with NAT enabled.

Answer

Enable 'set allow-subnet-overlap enable' on the Mgmt VDOM and add a static route from IT to Mgmt.

Question 7

An administrator is troubleshooting a FortiGate HA cluster in Active-Passive mode. The primary unit unexpectedly failed over to the secondary, and the administrator needs to verify which configuration settings are synchronized between the nodes. Which two configuration elements are synchronized by default in an HA cluster? (Choose two.)

Accepted Answer

Interface IP addresses and static routes. By default, FortiGate HA synchronizes the security and networking configuration, including firewall address objects, policies, interface IP addresses, and static routes. These elements are critical for consistent traffic handling after a failover. Management settings such as hostname, passwords, SNMP, and syslog are not synchronized by default, and HA operational parameters like priority and virtual MAC are handled separately.

Answer

SNMP community strings and syslog server settings

Answer

The FortiGate hostname and administrative passwords

Answer

The cluster's virtual MAC address and HA priority

Question 8

A FortiGate is deployed in transparent mode between an internal network and a router. Users behind the FortiGate cannot reach the internet, but the FortiGate can ping external addresses. The administrator confirms the forwarding domain is enabled on both interfaces. Which action should the administrator take next to allow traffic to pass through the FortiGate?

Accepted Answer

Create a firewall policy from the internal interface to the external interface with NAT disabled and the action set to ACCEPT.. In transparent mode, the FortiGate bridges traffic between interfaces and does not perform NAT or routing. A firewall policy must be created to allow traffic from the internal interface to the external interface, with NAT disabled. Without this policy, traffic is dropped by the implicit deny. The policy action must be ACCEPT to permit the traffic.

Answer

Create a firewall policy from the internal interface to the external interface with NAT enabled.

Answer

Configure a static route on the FortiGate pointing to the external router.

Answer

Enable DHCP on the internal interface to provide IP addresses to users.

Question 9

A network administrator is troubleshooting a FortiGate 300E that is experiencing high CPU usage. The administrator suspects that a large amount of traffic is being processed by the CPU instead of being offloaded to the NP6 processor. Which type of traffic is typically NOT offloaded by the NP6 processor and therefore may contribute to high CPU usage?

Accepted Answer

Traffic requiring deep inspection with SSL/TLS decryption.. The NP6 processor offloads many common traffic types, but it cannot handle SSL/TLS decryption and deep inspection. These tasks require the main CPU because they involve complex cryptographic operations and content inspection. When a FortiGate is configured to decrypt and inspect HTTPS traffic, the CPU load can increase significantly, especially with high throughput. Other listed traffic types are typically offloaded and do not cause high CPU usage.

Answer

Traffic that is subject to simple firewall policies without UTM.

Answer

Traffic that uses NAT with a small number of concurrent sessions.

Answer

Traffic that is routed between VLAN interfaces on the same physical interface.

Question 10

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a new FortiGate is added to an ADOM, it automatically receives a base configuration that includes specific administrative settings, such as DNS servers and NTP servers. Which two FortiManager features can be used to accomplish this? (Choose two.)

Accepted Answer

Provisioning Templates. Provisioning Templates and CLI Templates are both designed to push configuration settings to managed FortiGates. Provisioning Templates are specifically for system-level settings and can be automatically applied when devices are added to an ADOM. CLI Templates offer more flexibility by allowing raw CLI commands to be executed on devices. Together, they can ensure that new FortiGates receive the required base configuration, including DNS and NTP servers.

Answer

Policy Packages

Answer

ADOM Revisions

Answer

Device Groups