NSE7_EFW Central Management — 10 Questions

Question 1

A FortiManager administrator needs to ensure that logs from all enterprise FortiGates are aggregated and purged based on storage thresholds. Where is this configured?

Accepted Answer

FortiAnalyzer/Log Settings under Device Manager. Log aggregation and purging thresholds for managed FortiGates are configured in the FortiAnalyzer/Log Settings section under Device Manager in FortiManager. This is where you enable logging to FortiAnalyzer, set log storage limits, and define purge policies based on storage thresholds. It centralizes log management for all managed devices in an ADOM.

Answer

System settings under 'Network' tab

Answer

Global Policy settings

Answer

ADOM management settings

Question 2

An enterprise firewall administrator needs to deploy different security profiles to branch offices while sharing the same firewall policy structure. Which feature should be used?

Accepted Answer

Policy Package inheritance and mapping. Policy Package inheritance and mapping allows a central firewall policy structure to be defined once and then mapped to different ADOMs or devices, with per-device security profiles applied. This meets the requirement of sharing the same policy structure while deploying different security profiles to branch offices. It avoids duplicating rules and ensures consistency.

Answer

Creating multiple ADOMs for every branch

Answer

Manual copy-paste of rules

Answer

Using CLI templates exclusively

Question 3

An administrator is configuring the FortiManager to manage multiple FortiGate devices across different regions. Which method ensures that the device configuration remains synchronized with the FortiManager policy database during an automatic configuration update?

Accepted Answer

Enable Auto-update in the Device Manager configuration settings. The 'Auto-update' feature in the FortiManager Device Manager ensures that the configuration on the managed device is automatically synchronized with the policy package defined in the FortiManager database.

Answer

Set the FortiGate to 'Read-Only' mode

Answer

Enable ADOM-level scheduling

Answer

Configure a manual CLI script to push updates

Question 4

Which protocol does FortiManager use to communicate with managed FortiGate devices?

Accepted Answer

FGFM. FortiManager uses the FortiManager-to-FortiGate (FMG-FGT) protocol, which is built on top of SSL/TLS, often referred to as FGFM.

Answer

multiple_choice

Answer

HTTPS

Answer

SSH

Answer

SNMP

Question 5

Which FortiManager feature allows an administrator to test policy changes in a sandbox environment before applying them to production FortiGates?

Accepted Answer

Policy Package Cloning/Revision History. Policy Package Cloning/Revision History allows an administrator to create a copy of a policy package or revert to a previous revision, effectively testing changes in a sandbox before applying to production. Cloning creates an isolated copy that can be modified and installed on test devices, while revision history provides rollback.

Answer

Policy Testing Mode

Answer

Global Policy Lockdown

Answer

Device Manager Simulation

Question 6

When using FortiAnalyzer integration with FortiManager, where do you view the aggregated log reports?

Accepted Answer

Reports & Analytics tab. In FortiManager with FortiAnalyzer integration, aggregated log reports are viewed under the Reports & Analytics tab. This tab surfaces FortiAnalyzer-generated reports and log analytics directly within the FortiManager GUI when the two are integrated, allowing admins to review consolidated log data without switching consoles.

Answer

System Settings

Answer

Device Manager

Answer

Policy & Objects

Question 7

Which type of script in FortiManager is designed to run on the FortiManager itself rather than the managed devices?

Accepted Answer

TCL scripts. TCL scripts in FortiManager are designed to run on the FortiManager itself, allowing administrators to perform local automation tasks such as querying the FortiManager database, generating reports, or manipulating objects before pushing configuration to managed devices. This distinguishes them from CLI and configuration scripts, which are executed on the managed FortiGate devices.

Answer

CLI scripts

Answer

Configuration scripts

Answer

Policy scripts

Question 8

When a policy change is made in FortiManager, it must be 'Installed' to take effect. What is the first stage of the install process?

Accepted Answer

Install Preview. In FortiManager's install workflow, the first stage is Install Preview, which shows the administrator exactly what configuration changes will be pushed to the managed FortiGate devices before committing. This preview step lets the admin validate the diff and catch unintended changes before the actual push. Only after reviewing the preview does FortiManager proceed to the subsequent install stages.

Answer

Database validation

Answer

Config push

Answer

Reboot

Question 9

Which TWO methods can be used to authenticate a FortiGate when it registers to a FortiManager?

Accepted Answer

Password/Pre-shared Key. Option C (Password/Pre-shared Key) is correct because FortiManager supports authenticating a FortiGate during registration by requiring a pre-shared key (PSK) that the FortiGate must supply, configured under the FortiManager's device registration settings. Option D (Serial Number registration) is correct because FortiManager can be configured to accept a FortiGate based on its serial number, either by pre-adding the device or by using the 'Add Device' registration workflow where the serial number identifies and authorizes the unit. Option A (External RADIUS server) is not a FortiGate-to-FortiManager registration authentication method; RADIUS is used for administrative or user authentication, not device registration. Option B (SNMP community string) is only for SNMP monitoring access and plays no role in FortiManager registration. Option E (IP-based automatic discovery) is a discovery mechanism, not an authentication method, and does not by itself authenticate a FortiGate to FortiManager.

Answer

External RADIUS server

Answer

SNMP community string

Answer

IP-based automatic discovery

Question 10

Which TWO actions can be performed on a Revision History item in FortiManager?

Accepted Answer

Compare with current version. Option A is correct because FortiManager's Revision History allows you to select a revision and use the Compare function to diff it against the current version, showing added, removed, or changed configuration lines. Option B is correct because Revision History supports restoring a device's configuration to a previously saved revision, effectively rolling back to that state. Option C is incorrect because deleting an entire ADOM is an administrative action performed from the ADOM management interface, not from a Revision History item. Option D is incorrect because Revision History does not provide a built-in export-to-cloud feature; revisions are stored internally in FortiManager. Option E is incorrect because revisions are immutable snapshots — you cannot permanently modify a stored version, only compare, restore, or delete it.

Answer

Delete the entire ADOM

Answer

Export the revision to an external cloud

Answer

Modify the version permanently