NSE7_EFW Practice Questions 1 — 50 Questions

Question 1

An administrator wants to back up the configuration of a FortiGate to a USB drive connected to the device. Which CLI command should the administrator use to perform this backup?

Accepted Answer

execute backup config usb . The correct CLI command to back up the FortiGate configuration to a USB drive is 'execute backup config usb '. This command saves the configuration to the USB device with the specified filename. Other backup options include TFTP, FTP, and SCP, but USB is specifically for local USB drives.

Answer

execute backup config flash <filename>

Answer

execute backup config usb

Answer

execute backup config tftp

Question 2

A network administrator is configuring a new FortiGate and needs to set up an administrator account that can only view logs and monitor system status, without making any configuration changes. Which administrator profile should be assigned to this account?

Accepted Answer

read_only. The read_only administrator profile is specifically designed for users who need to monitor the FortiGate without making changes. It grants access to view system status, logs, and configuration but denies any modification privileges. This aligns with the requirement for an account that can only view logs and monitor status. The other profiles either grant too much access or none at all.

Answer

no_access

Answer

prof_admin

Answer

super_admin

Question 3

A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?

Accepted Answer

Flood to all ports. In transparent mode, a FortiGate acts as a Layer 2 bridge and does not participate in routing. When it receives a frame destined for a MAC address not present in its forwarding table, it behaves like a standard Layer 2 switch and floods the frame out all ports in the same broadcast domain (except the ingress port). This ensures the frame can reach its intended destination if the MAC is simply unknown to the FortiGate.

Answer

Drop the packet

Answer

Forward to the management interface

Answer

Send an ICMP unreachable message

Question 4

A FortiGate is deployed in transparent mode between two routers. The administrator wants to enable IPS inspection on traffic passing through the FortiGate. Which configuration is required to inspect traffic in transparent mode?

Accepted Answer

Create a firewall policy with the incoming and outgoing interfaces set to the transparent bridge pair.. In transparent mode, the FortiGate bridges traffic between interfaces. To inspect traffic, a firewall policy must be created that allows traffic from one bridge interface to the other, with an IPS sensor applied. Interfaces do not have IPs, and IPS is not enabled globally or directly on interfaces. Thus, the policy-based approach is correct.

Answer

Assign IP addresses to the transparent interfaces and enable IPS on those interfaces.

Answer

Configure a VLAN interface for each subnet and apply IPS to the VLAN interfaces.

Answer

Enable IPS globally under System > Config > IPS and select the transparent bridge.

Question 5

A FortiGate is configured with a site-to-site IPsec VPN to a remote peer. The VPN is up, but traffic is not passing. You run 'diagnose vpn tunnel list' and see that the tunnel is up, but the phase-2 selectors show no traffic. You suspect a routing issue. Which command would you use to verify that traffic is being routed correctly through the tunnel?

Accepted Answer

get router info routing-table details . To verify that traffic to a specific destination is routed through the IPsec tunnel, you use the command 'get router info routing-table details '. This shows the exact route that will be used, including the outgoing interface. If the route points to the tunnel interface, routing is correct; if not, you must fix the routing configuration. This command is essential for troubleshooting VPN traffic flow.

Answer

diagnose vpn ike gateway list

Answer

diagnose ip route list

Answer

diagnose firewall iprope list

Question 6

An administrator manages multiple FortiGates in a single ADOM using normalized interfaces. A new policy must reference an interface that has different names on each device (port1 on one, wan1 on another). Which FortiManager object should the administrator use in the policy to ensure correct per-device mapping?

Accepted Answer

Normalized interface. Normalized interfaces provide a logical abstraction that FortiManager resolves to the correct physical interface per device using per-device mappings. This allows one shared policy to reference a stable name while each FortiGate receives the appropriate local interface, such as port1 or wan1, during installation. Zones, dynamic interfaces, and virtual wire pairs operate per device and do not deliver this cross-device mapping.

Answer

Zone

Answer

Virtual wire pair

Answer

Dynamic interface

Question 7

Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?

Accepted Answer

It uses fewer system resources than proxy-based inspection. Flow-based inspection is beneficial because it uses fewer system resources than proxy-based inspection (B): instead of buffering and reassembling full content in a proxy, it inspects packets as they stream through, so it consumes less CPU and memory. It also provides higher throughput performance (C), since the single-pass, stream-oriented engine avoids the store-and-forward overhead and per-protocol proxy processing that slows proxy-based mode. Options A and E are not flow-mode benefits: deep content inspection for all protocols and more granular application control are strengths associated with proxy-based inspection, which can buffer and fully decode traffic. Option D is incorrect because manual buffer allocation is not a requirement or benefit of flow-based inspection; buffering is largely handled automatically and minimized in this mode.

Answer

It supports deep content inspection for all protocols

Answer

It requires manual buffer allocation

Answer

It offers more granular application control

Question 8

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a policy change is made, it is properly validated and installed without causing downtime. Which TWO actions should be taken before installing the policy package? (Choose two.)

Accepted Answer

Review the installation preview to understand the changes. Before installing a policy package, it is essential to run a policy check to catch errors and to review the installation preview to see the exact changes. These steps help ensure that the installation will not cause unintended downtime or security issues. Other actions like workspace mode or scheduling are supplementary but not directly related to validation.

Answer

Schedule the installation during a maintenance window

Answer

Install the policy package to all devices simultaneously

Answer

Enable workspace mode to lock the ADOM

Question 9

Which TWO methods are used to achieve traffic separation in a multi-VDOM environment?

Accepted Answer

Using VLAN sub-interfaces. In a multi-VDOM FortiGate environment, traffic separation is achieved by assigning physical ports to VDOMs (option C), since each VDOM maintains its own independent routing table, firewall policies, and interfaces, so binding distinct physical interfaces to different VDOMs isolates their traffic at Layer 1/2. VLAN sub-interfaces (option A) also achieve traffic separation because a single physical interface can be partitioned into multiple VLAN-tagged sub-interfaces, each of which can be placed in a different VDOM, keeping the VLANs logically isolated even when they share the same physical link. Options B, D, and E do not provide traffic separation: SSL inspection is a security inspection feature, different HA clusters relate to redundancy/device grouping rather than intra-device VDOM traffic isolation, and differing firmware versions are irrelevant (and unsupported) for separating traffic within a multi-VDOM deployment.

Answer

Enabling SSL inspection globally

Answer

Using different HA clusters

Answer

Using different firmware versions

Question 10

Which method is the most secure for managing FortiGate devices remotely?

Accepted Answer

HTTPS with restricted access via Trusted Hosts. HTTPS with restricted access via Trusted Hosts is the most secure option because HTTPS encrypts administrative traffic (protecting credentials and configuration data in transit), and Trusted Hosts limits which source IP addresses or subnets can even attempt to connect to the management interface. This combination provides both confidentiality and access control.

Answer

HTTP with password authentication

Answer

Telnet

Answer

SNMPv1

Question 11

A FortiManager administrator is troubleshooting why a configuration change made directly on a managed FortiGate is not appearing in the FortiManager policy package. The administrator wants to retrieve the FortiGate's current configuration and compare it with the FortiManager database to identify the differences. Which action should the administrator take in FortiManager?

Accepted Answer

Run 'Retrieve Config' from the Device Manager. To identify configuration drift, the administrator must first retrieve the current configuration from the FortiGate into FortiManager. The 'Retrieve Config' action in Device Manager performs this synchronization, updating the FortiManager database with the device's actual settings. Once retrieved, the administrator can compare the device-level configuration with the policy package to see differences and decide on remediation.

Answer

Enable 'Auto-Update' on the device in FortiManager

Answer

Run 'Import Configuration' from the Policy & Objects

Answer

Use the 'Install Wizard' to push the FortiManager configuration to the device

Question 12

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

Accepted Answer

To encapsulate ESP packets. UDP port 4500 is used for NAT-Traversal (NAT-T) to encapsulate ESP packets within UDP. This allows IPsec traffic to pass through NAT devices that would otherwise drop ESP packets.

Answer

To replace the AH protocol

Answer

To manage Phase 1 re-keying

Answer

To verify certificate revocation status

Question 13

An administrator needs to configure a FortiGate to send logs to a FortiAnalyzer device. The FortiAnalyzer is reachable via the management interface. Which CLI command sequence correctly configures the FortiGate to send logs to the FortiAnalyzer?

Accepted Answer

config log fortianalyzer setting; set status enable; set server 10.1.1.100; end. The correct CLI sequence is under 'config log fortianalyzer setting', where you enable the status and specify the server IP. Other options configure different logging destinations or disable the feature. This ensures logs are sent to the FortiAnalyzer for analysis and archiving.

Answer

config log syslogd setting; set status enable; set server 10.1.1.100; end

Answer

config log fortianalyzer setting; set status disable; set server 10.1.1.100; end

Answer

config log memory setting; set status enable; set server 10.1.1.100; end

Question 14

An administrator is using FortiManager to manage a FortiGate device. The administrator notices that the FortiGate's configuration has drifted from the FortiManager policy package. What is the most likely cause of this configuration drift?

Accepted Answer

The FortiGate was configured directly via its CLI or GUI, bypassing FortiManager.. Configuration drift happens when the FortiGate's running configuration differs from the FortiManager policy package. The most common cause is direct configuration changes on the FortiGate, bypassing FortiManager. To maintain consistency, all changes should be made through FortiManager. Other scenarios like pending installations or reboots do not typically cause drift.

Answer

FortiManager automatically updated the policy package without installing it.

Answer

The FortiManager administrator modified the policy package but did not install it.

Answer

The FortiGate device was rebooted without saving its configuration.

Question 15

An administrator is configuring SSL inspection on a FortiGate to inspect traffic to a web server that uses a certificate signed by an internal CA. The FortiGate must decrypt and inspect the traffic without generating certificate errors on client browsers. What must be installed on the client devices?

Accepted Answer

The FortiGate's SSL inspection CA certificate. During SSL inspection, the FortiGate acts as a man-in-the-middle, presenting its own certificate to the client. To avoid certificate warnings, the client must trust the FortiGate's SSL inspection CA. Installing this CA certificate on client devices establishes that trust, allowing seamless inspection without errors.

Answer

A client certificate issued by the internal CA

Answer

The internal CA's root certificate

Answer

The web server's SSL certificate

Question 16

A network administrator is configuring a FortiGate HA cluster and wants to prevent ARP cache issues on connected switches by using a virtual MAC address. Which configuration mode should be used?

Accepted Answer

Enable virtual MAC address in HA settings.. The virtual MAC address feature in HA settings ensures that the cluster interfaces use a consistent MAC address, avoiding ARP cache problems on switches. Other options do not provide a stable MAC address across failover events.

Answer

Configure a virtual IP (VIP) for each interface.

Answer

Set the HA mode to Active-Active.

Answer

Enable gratuitous ARP on the HA interfaces.

Question 17

You notice that an IPsec tunnel is up, but no traffic passes. What is the most common reason related to firewall policy configuration?

Accepted Answer

Missing firewall policy. An IPsec tunnel can be fully up (Phase 1 and Phase 2 SAs established) yet pass no traffic if there is no firewall policy that permits the interesting traffic between the two protected subnets. FortiGate requires an explicit firewall policy matching source, destination, and service to allow traffic through the tunnel; without it, the implicit deny drops the packets even though the tunnel itself is healthy.

Answer

Missing static route

Answer

Incorrect IKE ID

Answer

Phase 1 lifetime expiration

Question 18

What is the purpose of 'dedicated HA' interfaces?

Accepted Answer

To isolate heartbeat traffic. Dedicated HA interfaces in FortiGate HA (High Availability) are used exclusively for heartbeat and synchronization traffic between cluster members. By isolating this traffic on its own physical interface, you prevent it from competing with user data and ensure reliable, low-latency communication for HA state updates and failover detection. This separation is critical because HA heartbeat packets are small but time-sensitive; any delay or loss can cause split-brain or unnecessary failovers.

Answer

To provide extra management access

Answer

To increase throughput

Answer

To act as a backup WAN port

Question 19

What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?

Accepted Answer

Implicit Deny. FortiGate firewall policies are evaluated top-down, and if no explicit policy matches the traffic, the implicit deny rule at the bottom of the policy table drops the packet. This default-deny posture is a core security principle and is not configurable to 'allow' by default. The implicit deny also logs denied traffic if logging is enabled on the implicit rule.

Answer

Send to local DNS

Answer

Route to DMZ

Answer

Allow

Question 20

Which TWO of the following are valid methods for user authentication on a FortiGate?

Accepted Answer

RADIUS. RADIUS (B) is a valid authentication method on a FortiGate: the device can act as a RADIUS client, forwarding user credentials to an external RADIUS server for verification in firewall authentication, SSL VPN, IPsec VPN, and administrative login scenarios. LDAP (C) is likewise valid: FortiGate supports LDAP authentication by binding to directory servers such as Active Directory or OpenLDAP to validate user credentials for the same authentication features. The remaining options are routing or multicast protocols, not authentication mechanisms: BGP (A) and RIP (E) are routing protocols used to exchange route information, and IGMP (D) is a multicast group management protocol, so none of them authenticate users.

Answer

BGP

Answer

IGMP

Answer

RIP