NSE7_EFW Central Management Practice Test 1 — 15 Questions

Question 1

A FortiManager administrator needs to ensure that logs from all enterprise FortiGates are aggregated and purged based on storage thresholds. Where is this configured?

Accepted Answer

FortiAnalyzer/Log Settings under Device Manager. Log aggregation and purging thresholds for managed FortiGates are configured in the FortiAnalyzer/Log Settings section under Device Manager in FortiManager. This is where you enable logging to FortiAnalyzer, set log storage limits, and define purge policies based on storage thresholds. It centralizes log management for all managed devices in an ADOM.

Answer

System settings under 'Network' tab

Answer

Global Policy settings

Answer

ADOM management settings

Question 2

An enterprise firewall administrator needs to deploy different security profiles to branch offices while sharing the same firewall policy structure. Which feature should be used?

Accepted Answer

Policy Package inheritance and mapping. Policy Package inheritance and mapping allows a central firewall policy structure to be defined once and then mapped to different ADOMs or devices, with per-device security profiles applied. This meets the requirement of sharing the same policy structure while deploying different security profiles to branch offices. It avoids duplicating rules and ensures consistency.

Answer

Creating multiple ADOMs for every branch

Answer

Manual copy-paste of rules

Answer

Using CLI templates exclusively

Question 3

An administrator is configuring the FortiManager to manage multiple FortiGate devices across different regions. Which method ensures that the device configuration remains synchronized with the FortiManager policy database during an automatic configuration update?

Accepted Answer

Enable Auto-update in the Device Manager configuration settings. The 'Auto-update' feature in the FortiManager Device Manager ensures that the configuration on the managed device is automatically synchronized with the policy package defined in the FortiManager database.

Answer

Set the FortiGate to 'Read-Only' mode

Answer

Enable ADOM-level scheduling

Answer

Configure a manual CLI script to push updates

Question 4

Which protocol does FortiManager use to communicate with managed FortiGate devices?

Accepted Answer

FGFM. FortiManager uses the FortiManager-to-FortiGate (FMG-FGT) protocol, which is built on top of SSL/TLS, often referred to as FGFM.

Answer

multiple_choice

Answer

HTTPS

Answer

SSH

Answer

SNMP

Question 5

Which FortiManager feature allows an administrator to test policy changes in a sandbox environment before applying them to production FortiGates?

Accepted Answer

Policy Package Cloning/Revision History. Policy Package Cloning/Revision History allows an administrator to create a copy of a policy package or revert to a previous revision, effectively testing changes in a sandbox before applying to production. Cloning creates an isolated copy that can be modified and installed on test devices, while revision history provides rollback.

Answer

Policy Testing Mode

Answer

Global Policy Lockdown

Answer

Device Manager Simulation

Question 6

When using FortiAnalyzer integration with FortiManager, where do you view the aggregated log reports?

Accepted Answer

Reports & Analytics tab. In FortiManager with FortiAnalyzer integration, aggregated log reports are viewed under the Reports & Analytics tab. This tab surfaces FortiAnalyzer-generated reports and log analytics directly within the FortiManager GUI when the two are integrated, allowing admins to review consolidated log data without switching consoles.

Answer

System Settings

Answer

Device Manager

Answer

Policy & Objects

Question 7

Which type of script in FortiManager is designed to run on the FortiManager itself rather than the managed devices?

Accepted Answer

TCL scripts. TCL scripts in FortiManager are designed to run on the FortiManager itself, allowing administrators to perform local automation tasks such as querying the FortiManager database, generating reports, or manipulating objects before pushing configuration to managed devices. This distinguishes them from CLI and configuration scripts, which are executed on the managed FortiGate devices.

Answer

CLI scripts

Answer

Configuration scripts

Answer

Policy scripts

Question 8

When a policy change is made in FortiManager, it must be 'Installed' to take effect. What is the first stage of the install process?

Accepted Answer

Install Preview. In FortiManager's install workflow, the first stage is Install Preview, which shows the administrator exactly what configuration changes will be pushed to the managed FortiGate devices before committing. This preview step lets the admin validate the diff and catch unintended changes before the actual push. Only after reviewing the preview does FortiManager proceed to the subsequent install stages.

Answer

Database validation

Answer

Config push

Answer

Reboot

Question 9

Which TWO methods can be used to authenticate a FortiGate when it registers to a FortiManager?

Accepted Answer

Password/Pre-shared Key. Option C (Password/Pre-shared Key) is correct because FortiManager supports authenticating a FortiGate during registration by requiring a pre-shared key (PSK) that the FortiGate must supply, configured under the FortiManager's device registration settings. Option D (Serial Number registration) is correct because FortiManager can be configured to accept a FortiGate based on its serial number, either by pre-adding the device or by using the 'Add Device' registration workflow where the serial number identifies and authorizes the unit. Option A (External RADIUS server) is not a FortiGate-to-FortiManager registration authentication method; RADIUS is used for administrative or user authentication, not device registration. Option B (SNMP community string) is only for SNMP monitoring access and plays no role in FortiManager registration. Option E (IP-based automatic discovery) is a discovery mechanism, not an authentication method, and does not by itself authenticate a FortiGate to FortiManager.

Answer

External RADIUS server

Answer

SNMP community string

Answer

IP-based automatic discovery

Question 10

Which TWO actions can be performed on a Revision History item in FortiManager?

Accepted Answer

Compare with current version. Option A is correct because FortiManager's Revision History allows you to select a revision and use the Compare function to diff it against the current version, showing added, removed, or changed configuration lines. Option B is correct because Revision History supports restoring a device's configuration to a previously saved revision, effectively rolling back to that state. Option C is incorrect because deleting an entire ADOM is an administrative action performed from the ADOM management interface, not from a Revision History item. Option D is incorrect because Revision History does not provide a built-in export-to-cloud feature; revisions are stored internally in FortiManager. Option E is incorrect because revisions are immutable snapshots — you cannot permanently modify a stored version, only compare, restore, or delete it.

Answer

Delete the entire ADOM

Answer

Export the revision to an external cloud

Answer

Modify the version permanently

Question 11

Which THREE items can be managed via Device Templates in FortiManager?

Accepted Answer

NTP configuration. Device Templates in FortiManager are used to provision and manage device-level configuration that is not part of the security policy package, including system-level settings. Option B (NTP configuration) is correct because NTP servers and synchronization settings are configured under System settings in a device template. Option D (DNS settings) is correct because DNS servers and related system DNS options are provisioned through device templates. Option E (Local interface IP settings) is correct because interface configuration, including IP addresses and administrative access, is managed via the interface section of a device template. Option A (Firewall policies) is not managed by device templates; firewall policies are handled through policy packages in FortiManager. Option C (Application control databases) is not a device template item; application control signatures are updated via FortiGuard and applied through security profiles/policy packages, not device templates.

Answer

Firewall policies

Answer

Application control databases

Question 12

Which THREE features are specific to the FortiManager 'Enterprise Firewall' management workflow?

Accepted Answer

Object database management. In the FortiManager Enterprise Firewall workflow, object database management (A) is correct because FortiManager maintains a centralized, normalized object database (addresses, services, schedules) that can be shared and referenced across multiple managed FortiGate devices, which is a defining capability of this workflow. Revision control (B) is correct because FortiManager stores policy package and configuration revisions, allowing administrators to view, compare, and revert to previous versions, a core part of the Enterprise Firewall management process. Centralized policy management (E) is correct because the workflow is built around creating policy packages and assigning them to managed devices or ADOMs, enabling consistent firewall policy deployment from a single console. Traffic shaping on routers (C) is incorrect because traffic shaping is a per-device FortiGate feature configured in firewall policies or shapers, not a FortiManager Enterprise Firewall workflow feature, and it applies to FortiGate, not generic routers. Web filter database updates (D) is incorrect because web filtering is a FortiGuard security service handled by the FortiGate (or FortiManager as a FortiGuard proxy), not a defining feature of the Enterprise Firewall management workflow.

Answer

Traffic shaping on routers

Answer

Web filter database updates

Question 13

A FortiManager administrator manages a FortiGate cluster in a single ADOM. During a policy installation, FortiManager reports that the installation failed because the FortiGate configuration was changed directly on the device. The administrator wants FortiManager to automatically retry the installation after resolving the conflict. Which FortiManager setting should the administrator configure?

Accepted Answer

Use the 'Retry' option in the installation wizard after retrieving the latest configuration.. FortiManager detects configuration changes on managed FortiGates and flags them as out-of-sync. The installation wizard offers a 'Retry' option after the administrator retrieves the latest configuration and resolves conflicts. This allows the installation to proceed without starting over. The other options describe settings that either do not exist or do not automatically retry failed installations.

Answer

Enable 'Auto Update' in the ADOM revision settings.

Answer

Configure 'Install Settings' to automatically retrieve the configuration from the FortiGate before installing.

Answer

Enable 'Auto Retry' in the FortiManager system settings.

Question 14

A network administrator manages 20 FortiGate devices from a single FortiManager. The administrator wants to ensure that all devices use the same global firewall address objects, such as a corporate DNS server, without manually creating them on each device. Which FortiManager feature should be used to achieve this?

Accepted Answer

Create the address object in the ADOM's object database and use it in multiple policy packages.. Creating the address object in the ADOM's object database allows it to be referenced by any policy package within that ADOM, ensuring all devices use the same definition. This method is efficient and reduces the risk of inconsistencies. The other options either involve unnecessary complexity or are intended for different use cases, such as dynamic objects or cross-ADOM sharing.

Answer

Use a dynamic object that references an external IP address and assign it to all devices.

Answer

Configure a per-device mapping for the address object and push it to all devices.

Answer

Create the address object in the Global Database and assign it to each device's policy package.

Question 15

A network administrator manages a FortiGate cluster with FortiManager using a single ADOM. The administrator configures a new firewall address object and a policy that references it. After installing the configuration, the administrator notices that the policy is not taking effect on the FortiGate. The FortiGate is in a high-availability (HA) cluster with two members. What is the most likely cause?

Accepted Answer

The policy installation might have failed because the FortiGate's configuration was out of sync, requiring a retrieve before install.. When FortiManager installs configuration to a managed FortiGate, it checks that the device's current configuration matches the last known revision. If the device configuration has been changed locally without being retrieved, the installation can fail or be skipped. The administrator must first retrieve the configuration to synchronize, then install the policy. This ensures consistency and avoids conflicts.

Answer

The FortiGate is in a different ADOM than the policy, so the installation did not apply to it.

Answer

The FortiManager did not synchronize the configuration to the secondary FortiGate in the HA cluster.

Answer

The policy was not installed to the FortiGate because the administrator did not commit the changes in the FortiManager workspace.