NSE7_EFW Practice Test 6 — 10 Questions

Question 1

A network administrator is using FortiManager to manage several FortiGate devices. The administrator needs to ensure that all devices receive the same firewall policy for blocking malicious traffic, but each device has a different WAN IP address. Which FortiManager feature should be used to dynamically assign the correct WAN IP address to each device's policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dynamic objects. Dynamic objects are specifically designed to resolve values at install time based on the FortiGate's configuration, such as interface IP addresses. This allows a single policy to be deployed across multiple devices with different WAN IPs, automatically substituting the correct IP for each device. Per-device mapping requires manual overrides, policy packages are for grouping, and ADOMs are for partitioning. Therefore, dynamic objects are the correct feature.

Answer

ADOMs

Answer

Policy packages

Answer

Per-device mapping

Question 2

A FortiGate is configured with two VDOMs: 'root' and 'dmz'. The administrator wants to use a single physical interface to carry traffic for both VDOMs, keeping the traffic logically separated. Which interface type must be configured to achieve this?

Accepted Answer

Multi-VDOM interface. A multi-VDOM interface allows a single physical interface to be used by more than one VDOM, each with its own IP address and routing table. This satisfies the requirement of using one port for both VDOMs while maintaining logical separation. Other interface types are either single-VDOM or serve different purposes such as inter-VDOM links or L2 retransmission.

Answer

NPU VDOM link

Answer

VLAN subinterface

Answer

EMAC-VLAN

Question 3

A network administrator needs to allow remote users to access internal resources securely using FortiClient. The administrator wants to use certificate-based authentication for the VPN. Which component must be installed on the FortiClient endpoints to enable certificate authentication?

Accepted Answer

A client certificate issued by a CA trusted by the FortiGate.. Certificate-based authentication requires the client to present a certificate that the FortiGate can validate against its trusted CAs. The client certificate contains the user's identity and is signed by a CA that the FortiGate trusts. The FortiGate then maps the certificate to a user or group. The root CA certificate on the client is only for validating the server, not for client authentication.

Answer

A pre-shared key configured in the FortiClient VPN profile.

Answer

The root CA certificate that signed the FortiGate's server certificate.

Answer

The FortiGate's SSL VPN portal certificate.

Question 4

A security administrator is setting up a new FortiManager to manage several FortiGate devices. The administrator wants to group devices that share the same security policies and objects. What should the administrator create to achieve this?

Accepted Answer

An administrative domain (ADOM). An ADOM is the correct choice because it provides a separate management space where devices, policies, and objects are contained. Devices within an ADOM can share policy packages and objects, while devices in different ADOMs are isolated. This allows the administrator to group devices with similar security requirements into the same ADOM, simplifying management and ensuring consistency.

Answer

A policy package

Answer

A global object

Answer

A device group

Question 5

An administrator is configuring a new FortiGate device in FortiManager. They need to ensure that the device's configuration is automatically backed up daily and that they can revert to a previous configuration if needed. Which FortiManager feature should be enabled?

Accepted Answer

Configuration revision. Configuration revision automatically creates a snapshot of the device configuration whenever it is modified through FortiManager. This allows administrators to track changes and revert to a previous state if necessary. It is the recommended feature for maintaining configuration backups and ensuring rollback capability.

Answer

Device-level configuration backup via SNMP

Answer

FortiManager backup scheduler

Answer

Policy package installation history

Question 6

A network administrator wants to allow only specific users to access a web application through the FortiGate. The users are stored in an LDAP directory. Which FortiGate feature should be used to enforce this?

Accepted Answer

LDAP integration with user group and firewall policy. Using LDAP integration, the FortiGate can authenticate users against the existing directory. A firewall policy that includes the LDAP user group restricts access to only those users. This is the most efficient and centralized method, avoiding duplicate user accounts and leveraging existing infrastructure.

Answer

RADIUS authentication with a proxy server

Answer

TACACS+ with a custom user group

Answer

Local user database with two-factor authentication

Question 7

A security administrator needs to ensure that all managed FortiGates in a specific ADOM receive a new security profile. They create the profile in the ADOM and want to assign it to all firewall policies in a policy package. However, some policies already use a different profile, and they want to replace it. Which action should they take in FortiManager to efficiently update all relevant policies?

Accepted Answer

Use the 'Replace Object' feature to replace the old profile with the new one across the policy package.. The 'Replace Object' feature is designed to globally replace one object with another within a policy package. It updates all references, such as security profiles in firewall policies, in one operation. This is the most efficient and accurate method to ensure all relevant policies use the new profile without manual editing.

Answer

Create a new policy package with the new profile and assign it to the ADOM.

Answer

Use the 'Policy Check' function to automatically replace the profile.

Answer

Manually edit each policy to change the security profile.

Question 8

A FortiGate is configured with a site-to-site IPsec VPN to a branch office. The administrator notices that the tunnel is up, but traffic is not passing. After checking, they find that the phase 2 selectors on both peers match, and firewall policies allow the traffic. What is a likely cause?

Accepted Answer

Missing static route for the remote subnet.. For traffic to traverse an IPsec tunnel, the FortiGate must have a route that directs packets for the remote subnet out the tunnel interface. Without this route, the FortiGate will not send traffic into the tunnel, even if the tunnel is up and policies permit it. This is a common oversight in site-to-site VPN configurations.

Answer

Incorrect IPsec phase 2 key lifetime.

Answer

The remote gateway IP address is incorrect.

Answer

The phase 1 proposal mismatch.

Question 9

A network administrator is troubleshooting a FortiGate firewall policy. Traffic that should be allowed is being blocked, and the administrator suspects that the policy is not matching because of the order of policies. Which FortiGate feature can be used to verify which policy a specific traffic flow matches?

Accepted Answer

Policy lookup. Policy lookup is designed specifically to check which policy matches a given set of traffic parameters without generating actual traffic. It is the quickest way to verify policy order and matching criteria, making it ideal for troubleshooting why traffic is blocked due to policy sequencing.

Answer

Session table

Answer

Debug flow

Answer

Packet capture

Question 10

An administrator is configuring a FortiGate in transparent mode. The FortiGate will be placed between an internal network and a router. The administrator wants to ensure that the FortiGate can be managed remotely and that it can still perform security inspections. Which two configurations are required? (Choose two.)

Accepted Answer

Configure firewall policies to allow traffic between the internal network and the router.. In transparent mode, the FortiGate forwards traffic at Layer 2, so data interfaces do not have IP addresses. To manage the device remotely, an IP address must be assigned to a management interface or a VLAN interface. Additionally, firewall policies are required to allow traffic between the internal and external interfaces; these policies also enable security inspections. Without these, traffic would be blocked, and the FortiGate would not be manageable remotely.

Answer

Enable NAT on the external interface to allow internal hosts to access the internet.

Answer

Configure a default gateway on the FortiGate to route management traffic.

Answer

Set the FortiGate to NAT mode instead of transparent mode to enable security inspections.