NSE7_EFW Central Management Practice Test 3 — 15 Questions

Question 1

A network administrator has configured a FortiManager to manage several FortiGates. They want to ensure that when they install a policy package to a device, the FortiManager automatically retrieves the current configuration from the FortiGate before installing, to avoid conflicts. Which FortiManager feature should they enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Auto-Update Device Configuration. Auto-Update Device Configuration ensures that FortiManager retrieves the latest configuration from the managed FortiGate before installing a policy package. This prevents conflicts and ensures that the install process is based on the current state of the device. The other options do not provide this automatic pre-install synchronization.

Answer

Install Wizard with Preview

Answer

Automatic Retrieval of Device Configuration

Answer

Policy Package Revision Control

Question 2

A network administrator manages several FortiGate devices from a single FortiManager. The administrator needs to push a common set of firewall address objects to all devices in an ADOM without affecting device-specific policies or objects. Which FortiManager feature should be used?

Accepted Answer

Policy package with shared objects. Shared objects within a policy package allow an administrator to define an object once and reference it in multiple policies and devices within an ADOM. This ensures consistency and reduces administrative overhead. When the policy package is installed, the objects are pushed to the managed devices as needed, without affecting device-specific objects or policies.

Answer

ADOM-level object database with global objects

Answer

Per-device mapping in the installation wizard

Answer

FortiManager script to create objects on each device

Question 3

A network administrator manages 40 FortiGates from a single FortiManager. The administrator needs to apply a new web filtering profile to all branch offices at once, but each branch must retain its unique firewall address objects. Which FortiManager feature should the administrator use?

Accepted Answer

Shared object in the ADOM's object database. The correct approach is to create the web filtering profile as a shared object within the ADOM's object database. Shared objects can be referenced by multiple policy packages, enabling the administrator to apply the profile to all branch offices simultaneously. Each branch's unique address objects remain unchanged, as they are separate objects. This method avoids duplication and ensures consistent security enforcement across all managed FortiGates.

Answer

Policy package with per-device mapping

Answer

Global policy package assigned to all ADOMs

Answer

Dynamic object with device group filter

Question 4

A security administrator manages 40 FortiGate devices through a single FortiManager. To ensure configuration consistency, they decide to enforce a standard set of firewall policies across all devices using a policy package. After assigning the policy package to a device group, they discover that some devices have unique local policies that must be preserved. What is the recommended approach to maintain both the global policy package and the device-specific policies?

Accepted Answer

Assign the policy package to the device group and use 'Policy Block' to append device-specific policies.. The correct approach is to use policy blocks to append device-specific policies after the global policy package. Policy blocks are reusable policy sets that can be inserted into any policy package, enabling administrators to maintain a standardized baseline while allowing exceptions for certain devices. This avoids duplication and keeps the management centralized.

Answer

Use the 'Per-Device Mapping' feature in the policy package to assign different objects to different devices.

Answer

Create a separate policy package for each device that includes both global and local policies.

Answer

Enable 'Workspace Mode' on FortiManager and manually merge local policies into the global package.

Question 5

A network administrator is configuring a new FortiManager to manage several FortiGate devices. The administrator wants to ensure that the FortiManager can communicate with the FortiGates and that the FortiGates can receive policy updates. Which two protocols must be allowed on the network to enable this communication? (Choose two.)

Accepted Answer

TCP port 443 for HTTPS management access.. FortiManager communicates with FortiGates using the FGFM protocol over TCP port 541. Additionally, TCP port 443 is used for HTTPS management access and secure communication. Both ports must be allowed for full management functionality. Other ports like UDP 541, SSH, or syslog are not required for this purpose.

Answer

UDP port 541 for FortiManager-FortiGate communication.

Answer

TCP port 22 for SSH access.

Answer

UDP port 514 for syslog.

Question 6

An administrator has a FortiManager managing 50 FortiGates in a single ADOM. They need to ensure that configuration changes made on FortiGate devices are automatically synchronized back to FortiManager without manual intervention. Which FortiManager feature should be configured to achieve this?

Accepted Answer

Configure 'Auto Update' in the FortiManager device settings to retrieve configuration from the FortiGate.. The correct feature is 'Auto Update' in the FortiManager device settings. When enabled, FortiManager periodically retrieves the configuration from the managed FortiGate, capturing any changes made locally. This maintains consistency between the device and the manager's database, which is essential for accurate policy management and auditing.

Answer

Enable 'Auto Retrieve' in the FortiManager device settings.

Answer

Enable 'Auto Update' in the ADOM settings.

Answer

Configure 'Central Management' in the FortiGate to allow FortiManager to retrieve configuration.

Question 7

A network administrator manages a FortiManager with two ADOMs: one for the headquarters (root ADOM) and one for a branch office (ADOM "Branch"). The administrator wants to use a firewall address object named "Web_Server" that already exists in the root ADOM within a policy package in the Branch ADOM. What is the most efficient way to make this object available in the Branch ADOM?

Accepted Answer

In the root ADOM, edit the "Web_Server" object and assign it to the Branch ADOM using the "Per-ADOM" option.. The correct approach is to assign the existing firewall address object to the Branch ADOM using the per-ADOM assignment feature. This allows the object to be used in both ADOMs without duplication. It maintains a single source of truth and simplifies management. Other methods like CSV import or manual duplication are inefficient and can cause inconsistencies.

Answer

Create a new object with the same name in the Branch ADOM and manually synchronize it with the root ADOM's object.

Answer

Enable the "Object Sharing" option in the root ADOM and select the Branch ADOM as a target.

Answer

Export the object from the root ADOM as a CSV file and import it into the Branch ADOM.

Question 8

An administrator is using FortiManager to manage a large number of FortiGate devices. They need to ensure that when a new firmware version is available, it can be deployed to all devices in a specific ADOM with minimal manual effort. Which FortiManager feature should be used?

Accepted Answer

Firmware upgrade scheduling via the FortiManager GUI. FortiManager's firmware upgrade scheduling feature enables administrators to automate firmware deployment to multiple devices. By selecting the desired firmware and scheduling the upgrade, the administrator can ensure devices are updated with minimal intervention. This feature also supports upgrade groups and can handle dependencies, making it suitable for large-scale deployments.

Answer

FortiManager scripts with firmware upgrade commands

Answer

Firmware templates

Answer

Upgrade groups

Question 9

A network security team uses FortiManager to manage a large number of FortiGate devices. They need to ensure that configuration changes are applied consistently and that they can quickly roll back if an issue occurs. Which two features in FortiManager support these requirements? (Choose two.)

Accepted Answer

Revision History. Revision History and Configuration Revisions both provide a historical record of changes and the ability to revert to previous states. Revision History tracks changes made within FortiManager, while Configuration Revisions store full device configuration snapshots. Together, they ensure consistent change management and rapid rollback, which are critical in large-scale deployments.

Answer

Policy Check

Answer

Workspace Mode

Answer

Installation Preview

Question 10

An administrator is using FortiManager to manage a FortiGate. The administrator wants to install a policy package to the FortiGate but needs to ensure that the installation does not overwrite any local changes made directly on the FortiGate. Which installation option should be used?

Accepted Answer

Install Wizard with 'Check for Conflicts' option. The 'Check for Conflicts' option in the Install Wizard is specifically designed to detect differences between FortiManager and the managed FortiGate before installation. It allows the administrator to review and resolve conflicts, preventing accidental overwrites of local changes. This is the correct approach to safeguard local modifications.

Answer

Install Wizard with 'Preview' option

Answer

Install Wizard with 'Auto Retrieve' enabled

Answer

Install Wizard with 'Install and Reload' option

Question 11

An administrator is configuring a new ADOM in FortiManager to manage a set of FortiGates. The administrator wants to ensure that the ADOM is properly set up for centralized management. Which two actions are required when creating an ADOM? (Choose two.)

Accepted Answer

Assign a firmware version for the ADOM. When creating an ADOM in FortiManager, the administrator must specify the ADOM mode (Normal or Backup) and assign a firmware version. These two settings are fundamental to the ADOM's operation: the mode determines whether the ADOM is used for policy management or backup, and the firmware version ensures compatibility with managed devices. Other settings, such as workspace mode or central management, are configured after creation and are not required during the initial setup.

Answer

Enable workspace mode

Answer

Define a unique ADOM name

Answer

Configure central management settings

Question 12

An administrator is troubleshooting a FortiManager installation failure. The installation log shows that the FortiGate rejected the configuration due to a conflict with an existing object. The administrator wants to avoid this in the future by ensuring that FortiManager checks for object conflicts before installation. Which FortiManager feature should they use?

Accepted Answer

Run 'Policy Check' to validate the policy package for object conflicts.. Policy Check is designed to validate the policy package and detect various issues, including object conflicts with the managed FortiGate. It compares the objects in FortiManager with those on the FortiGate and reports discrepancies. By running Policy Check before installation, the administrator can identify and resolve conflicts, ensuring a smooth installation. This proactive approach is more efficient than troubleshooting after a failure.

Answer

Configure 'ADOM Revision' to automatically revert if a conflict occurs.

Answer

Use 'Install Preview' to see the CLI commands and manually check for conflicts.

Answer

Enable 'Auto Update' to synchronize objects from the FortiGate before installation.

Question 13

An administrator is using FortiManager to manage a large number of FortiGates and needs to ensure that configuration changes are properly tracked and can be rolled back if necessary. Which two FortiManager features support revision control and rollback of configuration changes? (Choose two.)

Accepted Answer

Workspace Mode. Revision History and Workspace Mode both provide mechanisms for tracking changes and rolling back configurations. Revision History automatically saves snapshots, while Workspace Mode allows controlled editing with commit and rollback. Together, they enable administrators to manage changes safely.

Answer

Configuration Archive

Answer

ADOM Revision

Answer

Policy Package Locking

Question 14

A security administrator needs to delegate management of a specific FortiGate device to a regional team while keeping other devices under central IT control. The regional team should only have access to that device and its policies. Which FortiManager feature should be configured?

Accepted Answer

Per-device administrative access using device-level administrator accounts. FortiManager supports granular administrative access by allowing administrators to be assigned to specific devices. This is done by creating an administrator account with a custom profile that includes only the desired device. The regional team can then manage that device's policies and objects without affecting other devices, achieving the required delegation.

Answer

ADOMs

Answer

Workspace mode with locked objects

Answer

Administrative domains (ADOMs) with restricted administrator accounts

Question 15

You are a security administrator using FortiManager to manage a large number of FortiGates. You need to make configuration changes that must be reviewed and approved by a senior administrator before being installed. Which two FortiManager features are required to implement this workflow? (Choose two.)

Accepted Answer

Workspace mode. To implement a review-and-approval workflow for configuration changes, you need a way to stage changes without immediately applying them, and a way to control who can make and approve changes. Workspace mode provides the staging area by locking the ADOM and allowing changes to be made in a separate workspace. Administrative profiles with appropriate permissions ensure that only authorized administrators can approve and commit changes. Together, they enable the required workflow. Policy packages, revision history, and FortiAnalyzer integration do not provide these capabilities.

Answer

FortiAnalyzer integration

Answer

Revision history

Answer

Policy packages