NSE7_EFW Practice Test 9 — 10 Questions

Question 1

An administrator notices that logs are not appearing in FortiManager for a specific FortiGate. What is the first thing to check to ensure log forwarding is active?

Accepted Answer

Log forwarding configuration on the FortiGate. The first thing to check when logs are not appearing in FortiManager for a specific FortiGate is the log forwarding configuration on the FortiGate itself. This ensures that the device is configured to send logs to FortiManager. Without proper configuration, logs will not be forwarded regardless of other factors.

Answer

The FortiManager license

Answer

The device's physical connection

Answer

The firmware version of the FortiGate

Question 2

Which feature allows an administrator to offload SSL inspection to the hardware?

Accepted Answer

CP offloading. CP offloading refers to offloading SSL/TLS inspection to a dedicated Content Processor (CP) chip, which handles the cryptographic operations for SSL inspection so the main CPU is not overwhelmed. FortiGate models with CP9 content processors can accelerate SSL inspection, including full proxy and certificate inspection, by moving the heavy crypto to hardware. This is the feature that allows SSL inspection to be offloaded to hardware.

Answer

Flow-based inspection

Answer

IPS engine offloading

Answer

NP6 offloading

Question 3

What is the benefit of using 'CLI Templates' in FortiManager?

Accepted Answer

They allow applying configuration commands to multiple devices. CLI Templates in FortiManager let administrators define reusable blocks of FortiOS CLI configuration and push them to one or many managed FortiGates in a single operation. This is the core benefit: consistent, repeatable configuration across a device group without manually logging into each unit. They are a provisioning tool layered on top of the FortiManager device database, not a replacement for the GUI or a policy-conversion mechanism.

Answer

They replace the GUI completely

Answer

They convert the policy to a CLI script

Answer

They improve the FortiGate hardware performance

Question 4

What is the purpose of the 'Any' interface in a firewall policy?

Accepted Answer

To match traffic regardless of the ingress or egress interface. In a FortiGate firewall policy, the 'any' interface is a wildcard that matches traffic regardless of which physical or logical interface it arrives on or leaves through. It is typically used for policies that should apply universally, such as a deny-all cleanup rule or a policy that must catch traffic on any interface. It does not bypass routing or force traffic anywhere; it simply removes the interface as a match criterion.

Answer

To force traffic through the hardware switch

Answer

To bypass the routing table

Answer

To match traffic only on the WAN port

Question 5

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

Accepted Answer

Encryption algorithm (e.g., AES-256). During IKEv2 Phase 1 (IKE_SA_INIT and IKE_AUTH), the peers negotiate the encryption algorithm (A), such as AES-256, which protects the IKE SA itself, and the Diffie-Hellman group (E), which determines the key-exchange strength used to derive shared secret keys. They also negotiate the authentication method (B), such as PSK or RSA signatures, to verify each peer's identity during IKE_AUTH. TCP port selection (C) is not negotiated in Phase 1 because IKE uses UDP ports 500 and 4500, and TCP is not used for IKE. A firewall policy ID (D) is a local configuration construct, not an IKEv2 Phase 1 negotiation parameter.

Answer

TCP port selection

Answer

Firewall policy ID

Question 6

In a high availability (HA) cluster, which THREE settings are synchronized between the primary and secondary units?

Accepted Answer

Address objects. In an HA cluster, the configuration that defines security processing is synchronized from the primary to the secondary unit, and address objects (C) are part of that shared configuration so both units resolve the same IPs, ranges, and FQDNs during failover. The user authentication database (D) is also synchronized so locally defined users, groups, and credentials remain valid on the secondary after a failover, avoiding authentication outages. Firewall policies (E) are synchronized as core security configuration, ensuring the secondary enforces identical rules and traffic handling when it takes over. Hardware serial numbers (A) are device-specific identifiers and are never synchronized, and the management IP address (B) is intentionally unique per unit so each node remains individually reachable for administration.

Answer

Hardware serial numbers

Answer

Management IP address

Question 7

Which TWO options are available when configuring an SD-WAN rule in FortiManager?

Accepted Answer

Source/Destination criteria. In FortiManager, when you create an SD-WAN rule (SD-WAN Rule / Centralized SD-WAN configuration), the rule must define the traffic it matches and how that traffic is handled. Option B (Source/Destination criteria) is correct because SD-WAN rules match traffic based on source and destination parameters (such as source/destination addresses, users, applications, and services) to identify which flows the rule applies to. Option C (Traffic steering strategy) is correct because each SD-WAN rule requires a steering strategy that determines how matched traffic is distributed or prioritized across SD-WAN members, such as best-quality, lowest-cost, maximize-bandwidth, or manual/SLA-based selection. Option A (Interface physical speed) is not a configurable SD-WAN rule parameter; link speed is a property of the interface/health-check performance, not a rule-matching or steering field. Option D (MAC address spoofing) is unrelated to SD-WAN rule configuration and is not a supported SD-WAN rule setting. Option E (Hardware acceleration toggle) is an interface/system-level setting, not an SD-WAN rule option.

Answer

Interface physical speed

Answer

MAC address spoofing

Answer

Hardware acceleration toggle

Question 8

A network administrator is using FortiManager to manage a FortiGate. The administrator notices that the FortiGate's configuration has been changed directly via CLI, causing a mismatch with the policy package in FortiManager. What is the recommended first step to resolve this configuration drift?

Accepted Answer

Use the 'Import Configuration' option to pull the FortiGate's current configuration into FortiManager, then review and merge changes.. The recommended first step is to import the FortiGate's configuration into FortiManager. This captures the CLI changes and allows the administrator to review and merge them into the policy package. This approach maintains synchronization while preserving necessary local modifications, avoiding the risks of overwriting or manual reconciliation.

Answer

Re-install the policy package to the FortiGate to overwrite the CLI changes.

Answer

Manually edit the FortiManager policy package to match the FortiGate's CLI changes without importing.

Answer

Delete the FortiGate from FortiManager and re-add it to resynchronize the configuration.

Question 9

An administrator is configuring an HA cluster of two FortiGates in Active-Passive mode. The cluster must maintain session continuity for TCP traffic when a failover occurs, and the administrator wants to minimize unnecessary failovers caused by link flaps on a monitored interface. (Choose two.)

Accepted Answer

Enable session pickup so that TCP session state is synchronized to the backup unit.. Session pickup synchronizes TCP session state so connections survive failover, and interface monitoring hold time and retry settings prevent brief link flaps from triggering unnecessary failovers. Together these address session continuity and failover stability. Priority, heartbeat, and override settings affect election behavior but do not solve the specific requirements.

Answer

Disable heartbeat interfaces and rely only on monitored data interfaces for failure detection.

Answer

Set the HA priority of the backup unit higher than the primary unit to speed up the election.

Answer

Enable override so that the unit with the highest priority always becomes the primary after a failover.

Question 10

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a new firmware version is released, they can test it on a few devices before rolling it out to all. Which two FortiManager features or steps are required to accomplish this? (Choose two.)

Accepted Answer

Use the 'Import Firmware' option to upload the new firmware image to FortiManager.. To test firmware on a subset, you need the firmware image on FortiManager and a way to target only those devices. Importing the firmware ensures availability, and creating a device group allows selective upgrade. Auto-Update and scheduled delays do not provide the needed control, and configuration retrieval is a backup step, not a rollout mechanism.

Answer

Use the 'Retrieve Configuration' option before upgrading to ensure current settings are backed up.

Answer

Enable 'Auto-Update' in the FortiManager system settings to automatically download firmware from FortiGuard.

Answer

Configure a firmware upgrade schedule that applies to all devices but with a delay for non-test devices.