NSE7_EFW Central Management Practice Test 2 — 15 Questions

Question 1

You are the FortiManager administrator for a large enterprise. You need to create a new firewall policy package that will be assigned to 12 managed FortiGates. The policy package must contain a policy that allows HTTP/HTTPS from the internal subnet to the internet. You want to create this policy once and have it automatically available to all 12 FortiGates without manually copying it. Which FortiManager feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Policy package assigned to a device group. Assigning a policy package to a device group is the correct approach because FortiManager automatically installs the same policy package to all devices in that group. This eliminates the need to manually copy policies to each FortiGate. The other options either do not provide automatic sharing across multiple devices in the same ADOM or require additional configuration that is not mentioned in the scenario.

Answer

Script executed on each FortiGate via the CLI

Answer

Policy package with a dynamic object for the internal subnet

Answer

Shared policy package in the global ADOM

Question 2

A network security administrator manages 40 FortiGate devices from a single FortiManager. The administrator needs to ensure that when a configuration change is made to a firewall policy in a policy package, the change is automatically pushed to all assigned FortiGates without manual intervention. Which FortiManager feature should be configured to achieve this?

Accepted Answer

Use the 'Install Wizard' to create a recurring schedule for policy installation.. The Install Wizard in FortiManager enables administrators to schedule recurring installations of policy packages to managed FortiGates. By configuring a schedule, any changes made to the policy package will be automatically installed at the next scheduled interval. This meets the requirement for automatic deployment without manual intervention. Other options reference non-existent features or incorrect mechanisms.

Answer

Configure a 'Policy Package' with the 'Install on Policy Change' option enabled.

Answer

Enable 'Automatic Policy Deployment' in the FortiGate device settings.

Answer

Enable 'Auto Install' in the policy package settings.

Question 3

A network administrator manages several FortiGates with FortiManager. The administrator wants to ensure that when a configuration change is made on a managed FortiGate directly (not through FortiManager), FortiManager automatically detects the change and retrieves the updated configuration. Which FortiManager feature should be configured to accomplish this?

Accepted Answer

Enable 'Auto-Retrieve' in the FortiGate's central management settings.. The requirement is for FortiManager to automatically detect and retrieve configuration changes made directly on a managed FortiGate. This is achieved by enabling 'Auto-Retrieve' in the FortiGate's central management settings. When enabled, the FortiGate sends a notification to FortiManager, which then retrieves the updated configuration. Other options either push configuration or do not provide automatic retrieval, so they fail to meet the scenario's needs.

Answer

Enable 'Auto Update' in the FortiGate's central management settings.

Answer

Configure 'Policy & Objects' synchronization with a scheduled install.

Answer

Enable 'Config Revision' and set it to auto-retrieve.

Question 4

An administrator is using FortiManager to manage a FortiGate. The administrator wants to back up the FortiGate configuration to FortiManager on a regular schedule. Which FortiManager feature should be configured?

Accepted Answer

Configuration Backup. FortiManager's Configuration Backup feature allows administrators to schedule regular backups of managed FortiGate configurations. This ensures that a recent copy of the device configuration is stored in FortiManager, which can be used for recovery or auditing. Other features like Revision History or Scripts serve different purposes and do not provide automated scheduled backups of device configurations.

Answer

Scripts

Answer

Revision History

Answer

Provisioning Templates

Question 5

A security administrator is using FortiManager to manage a large number of FortiGates. The administrator needs to ensure that firewall policies are consistently applied across multiple devices. Which two features in FortiManager allow for centralized policy management across multiple FortiGates? (Choose two.)

Accepted Answer

Policy packages. Policy packages and global policy packages are the primary FortiManager features for centralized policy management. Policy packages group policies and objects for assignment to multiple devices within an ADOM, ensuring consistent enforcement. Global policy packages extend this across ADOMs, allowing common rules to be applied enterprise-wide. Together, they enable administrators to manage policies centrally and deploy them efficiently.

Answer

ADOMs (Administrative Domains)

Answer

Device groups

Answer

Revision control

Question 6

A FortiManager administrator must delegate management of a subset of FortiGates to a regional team while retaining central control of global objects and policy packages. The regional team should only see and modify devices assigned to them. Which TWO FortiManager features should the administrator configure to achieve this delegation? (Choose two.)

Accepted Answer

Role-based access control via administrator profiles in FortiManager. Delegation requires two layers: ADOMs to partition devices and objects, and administrator accounts with profiles that restrict each team to its assigned ADOM and permitted modules. The account scoping determines what an admin can see, while the profile determines what actions are allowed. Workspace mode and device-local profiles address workflow and direct logins, not FortiManager-side visibility boundaries.

Answer

Per-device administrative profiles on each FortiGate

Answer

Administrative domains (ADOMs)

Answer

Workspace mode

Question 7

An administrator is using FortiManager to manage a FortiGate. They need to make a configuration change that requires multiple steps and want to ensure that if any step fails, the entire change is rolled back. Which FortiManager feature should be used?

Accepted Answer

Script with 'Transaction' option. The correct feature is a Script with the 'Transaction' option. FortiManager scripts can be executed with transactional behavior, meaning that all commands are applied as a single unit. If any command fails, the entire set of changes is rolled back, leaving the device in its original state. This ensures consistency and prevents partial configurations. Other features like Workspace Mode or Configuration Revisions do not provide automatic transactional rollback.

Answer

Install Wizard with 'Rollback' enabled

Answer

Workspace Mode

Answer

Configuration Revision

Question 8

An administrator needs to ensure that all firewall policies in a policy package are compliant with a corporate security standard. The standard requires that all policies must have logging enabled and must use a specific set of security profiles. Which FortiManager feature can be used to enforce this compliance?

Accepted Answer

Policy compliance. FortiManager's policy compliance feature allows you to define rules that policies must adhere to, such as requiring logging or specific security profiles. You can then run a compliance check on a policy package to identify any violations. This is the correct tool to enforce the corporate security standard. The other options do not provide compliance enforcement.

Answer

Policy check

Answer

Policy package installation

Answer

ADOM revision

Question 9

A network administrator is using FortiManager to manage multiple FortiGates. They want to create a new firewall policy that will be used by all FortiGates in a specific ADOM, but they need to ensure that the policy is only installed on devices that meet certain criteria, such as model or firmware version. Which FortiManager feature allows this?

Accepted Answer

Policy Package with Installation Targets. The correct feature is a Policy Package with Installation Targets. FortiManager allows you to assign a policy package to specific devices or device groups. By using dynamic device groups that filter based on device attributes like model or firmware version, you can ensure that the policy package is only installed on devices that meet the criteria. This provides granular control over policy deployment. Other options either do not control installation or are intended for different purposes.

Answer

Provisioning Template with Device Filter

Answer

ADOM with Device Groups

Answer

Policy Block with Dynamic Objects

Question 10

A company uses FortiManager to manage multiple FortiGates. They want to implement a workflow where changes to firewall policies are reviewed and approved by a senior administrator before being installed on the devices. Which FortiManager feature should be used to accomplish this?

Accepted Answer

Workflow with 'Install' and 'Approve' actions using administrative profiles.. To implement a review and approval workflow for policy changes, the administrator should use administrative profiles to control who can install policies. Junior administrators can be given profiles that allow them to make changes but not install, while senior administrators have install permissions. This creates a workflow where changes must be approved by a senior administrator before installation. Other options do not provide this level of control.

Answer

Policy package with 'Install Wizard' and review step.

Answer

FortiManager's 'Policy Approval' feature.

Answer

Workspace Mode with approval workflow.

Question 11

An administrator is using FortiManager to manage a FortiGate that is behind a NAT device. The FortiManager cannot directly reach the FortiGate's management IP. The administrator wants to enable communication between FortiManager and the FortiGate. Which FortiManager feature should be configured?

Accepted Answer

Use the 'fmg-source-ip' and 'fmg-source-interface' settings on the FortiGate to initiate the connection to FortiManager.. For a FortiGate behind NAT, the recommended approach is to configure the FortiGate to initiate the connection to FortiManager. By specifying the source IP and interface, the FortiGate can use its public IP to reach FortiManager. FortiManager must be configured with the FortiGate's public IP as the management address. This outbound-initiated connection allows FortiManager to manage the device despite NAT.

Answer

Configure the FortiGate as a local device with a private IP.

Answer

Configure the FortiGate to connect to FortiManager using its public IP and enable 'fmg' on the FortiGate's WAN interface.

Answer

Enable 'FortiManager NAT' on the FortiGate.

Question 12

A security administrator is using FortiManager to manage a FortiGate. They want to review the configuration changes made to the FortiGate over the past week and identify who made those changes. Which FortiManager feature should they use?

Accepted Answer

Event Log. The Event Log in FortiManager captures administrative events, including configuration changes, and records the user who initiated them. It provides a detailed audit trail. Configuration Revision History is for version control, Task Monitor is for task status, and Audit Log is not a FortiManager feature. Therefore, the Event Log is the correct choice.

Answer

Task Monitor

Answer

Configuration Revision History

Answer

Audit Log

Question 13

A network engineer is preparing a FortiManager to manage a new FortiGate cluster. The engineer wants to ensure that all configuration changes made to the FortiGate are automatically synchronized back to FortiManager. Which FortiManager feature must be configured to achieve this?

Accepted Answer

Enable 'Retrieve Configuration' on the managed FortiGate. The requirement is to synchronize configuration changes from the FortiGate back to FortiManager. FortiManager's 'Retrieve Configuration' function performs this synchronization by pulling the device's current configuration into the FortiManager database. It is essential when changes are made directly on the FortiGate, ensuring FortiManager's copy is up to date.

Answer

Enable 'FortiGate Revisions' in the ADOM settings

Answer

Enable central management on the FortiManager

Answer

Configure the FortiGate as a managed device with 'Auto Update' enabled in Device Manager

Question 14

An administrator needs to ensure that a specific firewall policy is only installed on FortiGates that are running FortiOS 7.0 or later. How can this be achieved in FortiManager?

Accepted Answer

Use the 'Install On' column with a device group that contains only FortiGates running FortiOS 7.0 or later.. To restrict a firewall policy to FortiGates running FortiOS 7.0 or later, the administrator can create a device group containing only those devices and then set the policy's 'Install On' column to that group. This ensures the policy is only installed on the intended devices. Other options do not provide a mechanism to filter by FortiOS version for policy installation.

Answer

Create a dynamic object that includes only FortiGates with FortiOS 7.0 or later.

Answer

Use the 'Install On' column in the policy to specify FortiOS version.

Answer

Use the 'Policy Package' assignment to only include devices with FortiOS 7.0 or later.

Question 15

An administrator is configuring a FortiManager to manage a large number of FortiGates. They want to ensure that when a policy change is made, it is validated before installation to avoid misconfigurations. Which two actions can be performed in FortiManager to validate policy changes before installation? (Choose two.)

Accepted Answer

Run a 'Policy Check' to verify that the policy does not conflict with existing policies.. Policy Check and Install Preview are both built-in FortiManager features for validating policy changes before installation. Policy Check identifies conflicts, duplicates, and other policy issues, while Install Preview shows the exact CLI commands that will be applied. Together, they provide a comprehensive pre-installation validation, helping administrators avoid misconfigurations and ensuring that the policy will function as intended on the managed FortiGates.

Answer

Configure 'Revision History' to automatically roll back if installation fails.

Answer

Run a 'Policy Consistency Check' to ensure all objects referenced in the policy exist on the FortiGate.

Answer

Enable 'Workspace Mode' to lock the ADOM and prevent other administrators from making changes.