NSE7_EFW Practice Test 8 — 10 Questions

Question 1

A FortiGate is configured with a static route to 192.168.1.0/24 via 10.0.0.1 on port1. The administrator wants to verify that the FortiGate will use this route for a packet destined to 192.168.1.10. Which command should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

diagnose ip route get 192.168.1.10. The correct command to check which route the FortiGate will use for a specific destination is 'diagnose ip route get <destination>'. It provides the outgoing interface, gateway, and other details. The other options are invalid commands or incorrect syntax for this purpose.

Answer

get route 192.168.1.10

Answer

diagnose ip route lookup 192.168.1.10

Answer

show route 192.168.1.10

Question 2

A company uses FortiManager to manage multiple FortiGates. They have a requirement to ensure that all devices in a specific ADOM use the same set of firewall addresses and services. However, they also need to allow some devices to have additional, unique objects. Which FortiManager feature should they use to achieve this?

Accepted Answer

ADOM-level objects. ADOM-level objects are shared across all devices within the ADOM, providing a common set of addresses and services. They allow administrators to maintain consistency while still permitting device-specific objects. Global objects are for cross-ADOM sharing, and device-level or policy package objects are too limited in scope.

Answer

Policy package objects

Answer

Global objects

Answer

Device-level objects

Question 3

An administrator is configuring a FortiGate to perform SSL deep inspection for outbound HTTPS traffic. Which TWO actions are required to ensure that users can browse HTTPS sites without certificate errors? (Choose two.)

Accepted Answer

Enable SSL inspection in the firewall policy that allows outbound HTTPS traffic.. SSL deep inspection requires the FortiGate to act as a man-in-the-middle, re-signing server certificates with its own CA. Therefore, clients must trust the FortiGate's CA certificate, and the firewall policy must have SSL inspection enabled with deep inspection mode. Without both, clients will see certificate errors or traffic will not be inspected.

Answer

Configure the FortiGate to use a public CA certificate for re-signing.

Answer

Set the inspection mode to certificate inspection instead of deep inspection.

Answer

Import the server certificates from all HTTPS websites into the FortiGate.

Question 4

What is the effect of changing the IPS 'buffer' size on a FortiGate device?

Accepted Answer

It determines the maximum size of data packets to hold for inspection. The IPS buffer size on a FortiGate determines the maximum amount of data that can be held for inspection by the IPS engine. Adjusting it affects how much data is buffered before inspection, which can impact detection of threats in large packets or streams.

Answer

It disables the hardware acceleration engine

Answer

It changes the signature timeout

Answer

It increases the number of concurrent IPS connections

Question 5

An administrator uses FortiManager to manage a large number of FortiGates. They need to ensure that when a new firewall address object is created in the global database, it is automatically available in all ADOMs that require it, without manual duplication. Which FortiManager feature should be used?

Accepted Answer

Global Object Database. The Global Object Database in FortiManager is designed for sharing objects across ADOMs. Objects created there can be used in policies within any ADOM that has been enabled to use global objects. This provides centralized management and ensures consistency. Other options do not provide this functionality; global policy packages are for policies, and the other terms are not valid features.

Answer

ADOM Object Sharing

Answer

Policy Package Assignment

Answer

Global Policy Package

Question 6

A FortiGate is configured with a route-based IPsec VPN to a remote peer. The tunnel is up, but users report that traffic to the remote subnet intermittently fails. You suspect that the VPN is not being used for all traffic because of a routing issue. Which FortiGate CLI command would you use to verify which route is selected for a specific destination IP address?

Accepted Answer

get router info routing-table details . The command 'get router info routing-table details ' is the correct way to verify which route the FortiGate will use for a specific destination. In a route-based VPN scenario, it shows if the tunnel interface is the outgoing interface. This is essential for diagnosing intermittent failures caused by routing inconsistencies.

Answer

diagnose firewall iprope list <destination_ip>

Answer

show route-map <destination_ip>

Answer

diagnose ip route list <destination_ip>

Question 7

A security engineer is troubleshooting why a policy change made in FortiManager was not applied to a managed FortiGate. The engineer confirms the policy package was installed successfully, but the FortiGate shows no change. Which FortiManager feature should the engineer check first?

Accepted Answer

Workspace mode and approval status. When Workspace mode is enabled, policy changes are not immediately applied; they are stored in a workspace and require approval before installation. If the engineer installed the policy package without approving the workspace changes, the FortiGate would not receive the update. Checking the workspace and approval status reveals whether the change is pending. This is a common pitfall in collaborative environments where multiple administrators manage the same ADOM.

Answer

Policy package installation history

Answer

FortiGate's local configuration backup

Answer

ADOM revision control

Question 8

You are setting up an SD-WAN configuration via FortiManager. Which object type is used to group multiple WAN interfaces for SD-WAN member assignment?

Accepted Answer

SD-WAN Zone. In FortiManager SD-WAN configuration, an SD-WAN Zone is the object that groups multiple WAN interfaces so they can be referenced collectively as SD-WAN members in policies and rules.

Answer

IP Pool

Answer

Virtual Wire Pair

Answer

Interface Group

Question 9

When adding a FortiGate to FortiManager, which mode must the FortiGate be in to allow the FortiManager to manage its configuration and policies?

Accepted Answer

Normal mode. A FortiGate must be in Normal mode to be fully managed by FortiManager, allowing FortiManager to push configuration and policies. Normal mode enables central management, whereas other modes restrict what FortiManager can do.

Answer

Registration-only mode

Answer

Backup mode

Answer

Read-only mode

Question 10

An administrator wants to use FortiManager to push a configuration change to 50 FortiGates simultaneously. Which method minimizes downtime and ensures consistency?

Accepted Answer

Assign devices to a Device Group and push a common Policy Package. Assigning the 50 FortiGates to a Device Group and pushing a common Policy Package from FortiManager ensures a single, consistent configuration is deployed to all devices simultaneously, minimizing downtime and configuration drift.

Answer

Create 50 separate ADOMs

Answer

Connect to each FortiGate via SSH and run scripts

Answer

Enable 'Auto-Push' for every change