NSE7_EFW Practice Test 7 — 10 Questions

Question 1

You are configuring BGP and need to advertise a summary route to your ISP. How do you ensure only the summary route is advertised?

Accepted Answer

Use an aggregate-address with summary-only. The 'aggregate-address' command with the 'summary-only' option is the correct way to advertise only the summary and suppress specific component routes.

Answer

Use a distribute-list

Answer

Set the weight to 0

Answer

Configure a route map with a prefix list

Question 2

Which TWO of the following can be used to optimize IPsec VPN performance?

Accepted Answer

Ensure the configuration uses AES-NI supported ciphers. Hardware acceleration (ASIC) and selecting efficient encryption algorithms like AES-NI (hardware-accelerated AES) improve VPN throughput.

Answer

Increase the Phase 1 lifetime to 24 hours

Answer

Use DES encryption for speed

Answer

Disable NAT-Traversal

Question 3

What is the benefit of using 'CLI Templates' in FortiManager?

Accepted Answer

They allow applying configuration commands to multiple devices. CLI templates allow you to push specific configuration lines to multiple devices, which is useful for settings not covered by the GUI policy editor.

Answer

They replace the GUI completely

Answer

They convert the policy to a CLI script

Answer

They improve the FortiGate hardware performance

Question 4

Which THREE factors influence log storage efficiency on a FortiAnalyzer/FortiManager?

Accepted Answer

Log compression settings. Log compression, log retention settings, and disk quota management determine how long logs persist and how much space they consume.

Answer

The firewall firmware version

Answer

The number of active users

Question 5

You are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?

Accepted Answer

Create an IPS sensor override for the specific signature ID. Using an IPS sensor override or a specific signature exemption allows you to modify the behavior for a single signature without disabling it globally.

Answer

Change the IPS mode from blocking to monitoring

Answer

Disable the entire IPS sensor profile

Answer

Increase the IPS packet buffer size

Question 6

What is the purpose of the 'Any' interface in a firewall policy?

Accepted Answer

To match traffic regardless of the ingress or egress interface. The 'Any' interface enables the policy to match traffic originating from or destined to any physical or logical interface on the FortiGate.

Answer

To force traffic through the hardware switch

Answer

To bypass the routing table

Answer

To match traffic only on the WAN port

Question 7

Which THREE features are specific to the FortiManager 'Enterprise Firewall' management workflow?

Accepted Answer

Object database management. Centralized policy management, object database management, and revision control are key parts of the enterprise workflow.

Answer

Traffic shaping on routers

Answer

Web filter database updates

Question 8

Which FortiGate feature should be enabled to prevent internal users from accessing malicious websites based on real-time threat intelligence?

Accepted Answer

Web Filter. Web Filtering using categories provides real-time protection by checking URLs against the FortiGuard database.

Answer

Antivirus profile

Answer

Application Control

Answer

DNS Filter

Question 9

What is the primary function of the FortiGate Security Fabric?

Accepted Answer

To synchronize security policies and share intelligence across devices. The Security Fabric integrates multiple devices to provide coordinated, end-to-end security visibility and control.

Answer

To configure OSPF automatically

Answer

To increase the throughput of the firewall

Answer

To replace the need for an IPS sensor

Question 10

Which THREE of the following are mandatory for a BGP neighbor adjacency to establish?

Accepted Answer

Correct autonomous system numbers. BGP requires the correct AS numbers, reachable IPs, and matching timers or specific parameters to form a connection.

Answer

Identical prefix lists

Answer

Identical router IDs