NSE7_EFW Central Management — 10 Questions

Question 1

Which protocol does FortiManager use to communicate with managed FortiGate devices?

Accepted Answer

FGFM. FortiManager uses the FortiManager-to-FortiGate (FMG-FGT) protocol, which is built on top of SSL/TLS, often referred to as FGFM.

Answer

multiple_choice

Answer

HTTPS

Answer

SSH

Answer

SNMP

Question 2

A FortiManager administrator needs to ensure that logs from all enterprise FortiGates are aggregated and purged based on storage thresholds. Where is this configured?

Accepted Answer

FortiAnalyzer/Log Settings under Device Manager. The log retention and storage settings are managed in the FortiManager's 'FortiView' or 'Device Settings' regarding log management, specifically under 'Log Settings' where disk quota and retention policies are defined.

Answer

System settings under 'Network' tab

Answer

Global Policy settings

Answer

ADOM management settings

Question 3

An enterprise firewall administrator needs to deploy different security profiles to branch offices while sharing the same firewall policy structure. Which feature should be used?

Accepted Answer

Policy Package inheritance and mapping. Policy Packages allow for the grouping of policies, while the use of 'Global Policy' or 'Package Inheritance' allows for common policies to be shared across various ADOMs or device groups.

Answer

Creating multiple ADOMs for every branch

Answer

Manual copy-paste of rules

Answer

Using CLI templates exclusively

Question 4

You are setting up an SD-WAN configuration via FortiManager. Which object type is used to group multiple WAN interfaces for SD-WAN member assignment?

Accepted Answer

SD-WAN Zone. The 'SD-WAN Zone' object is used in FortiManager to group multiple interfaces together for use in SD-WAN policies.

Answer

IP Pool

Answer

Virtual Wire Pair

Answer

Interface Group

Question 5

What is the primary purpose of an ADOM in FortiManager?

Accepted Answer

To logically group devices for delegated administration and policy management. Administrative Domains (ADOMs) allow the segregation of managed devices based on geography, customer, or business unit for delegated administration.

Answer

To provide high availability for the FortiGate

Answer

To allow external API access to the FortiGate

Answer

To increase the storage capacity of the FortiManager

Question 6

You are troubleshooting a policy installation failure where the FortiManager reports a 'Configuration conflict'. Which action should you perform to identify the root cause of the mismatch?

Accepted Answer

Use the 'Diff' feature in the Policy & Objects tab to compare the database and device config. The 'Check Configuration' or 'Diff' tool in the Policy & Objects tab allows administrators to compare the database version against the running device configuration to pinpoint the exact setting causing the conflict.

Answer

Force an 'Import Policy' operation

Answer

Reboot the FortiManager

Answer

Disable the policy package entirely

Question 7

When adding a FortiGate to FortiManager, which mode must the FortiGate be in to allow the FortiManager to manage its configuration and policies?

Accepted Answer

Normal mode. The FortiGate must be in 'Normal' mode; if it is in 'Backup' or 'Read-only' mode, full management is not possible.

Answer

Registration-only mode

Answer

Backup mode

Answer

Read-only mode

Question 8

An administrator wants to use FortiManager to push a configuration change to 50 FortiGates simultaneously. Which method minimizes downtime and ensures consistency?

Accepted Answer

Assign devices to a Device Group and push a common Policy Package. Using 'Provisioning Templates' or 'Device Groups' allows the administrator to push changes to multiple devices in a controlled, unified manner.

Answer

Create 50 separate ADOMs

Answer

Connect to each FortiGate via SSH and run scripts

Answer

Enable 'Auto-Push' for every change

Question 9

An administrator is configuring the FortiManager to manage multiple FortiGate devices across different regions. Which method ensures that the device configuration remains synchronized with the FortiManager policy database during an automatic configuration update?

Accepted Answer

Enable Auto-update in the Device Manager configuration settings. The 'Auto-update' feature in the FortiManager Device Manager ensures that the configuration on the managed device is automatically synchronized with the policy package defined in the FortiManager database.

Answer

Set the FortiGate to 'Read-Only' mode

Answer

Enable ADOM-level scheduling

Answer

Configure a manual CLI script to push updates

Question 10

Which FortiManager feature allows an administrator to test policy changes in a sandbox environment before applying them to production FortiGates?

Accepted Answer

Policy Package Cloning/Revision History. The 'Revision History' or 'Policy Package cloning' allows admins to modify and verify changes before pushing them to the production devices.

Answer

Policy Testing Mode

Answer

Global Policy Lockdown

Answer

Device Manager Simulation