NSE7_EFW Central Management Practice Test 4 — 15 Questions

Question 1

A FortiManager administrator is configuring a new policy package for an ADOM. The administrator wants to use dynamic objects that automatically update based on external sources. Which two object types can be used for this purpose? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Internet Service Database (ISDB) objects. FSSO groups and ISDB objects are both dynamic in nature. FSSO groups update based on user authentication events from external collectors, while ISDB objects are updated by FortiGuard with the latest IP ranges for internet services. Both are supported in FortiManager policy packages and provide automatic updates from external sources.

Answer

Geography-based addresses

Answer

MAC address objects

Answer

FQDN addresses

Question 2

An administrator manages a FortiGate cluster through FortiManager. They need to make a configuration change that will be installed to the cluster. After installing the change, they notice that the secondary unit in the cluster did not receive the updated configuration. What is the most likely cause?

Accepted Answer

The HA cluster is not synchronized because the secondary unit is not in the same HA group.. FortiManager installs configuration to the primary unit of an HA cluster, and the primary synchronizes the configuration to the secondary unit through the HA protocol. If the secondary is not receiving updates, the HA synchronization is likely broken, meaning the secondary is not a functioning member of the cluster.

Answer

The secondary unit is in a different ADOM than the primary unit.

Answer

The FortiManager is not configured to manage the secondary unit.

Answer

The configuration change was not installed to the cluster due to a failed installation.

Question 3

A security administrator is using FortiManager to manage a large number of FortiGates. The administrator needs to ensure that when a policy package is installed, only the changes are pushed to the devices, minimizing disruption. Which installation method should be used?

Accepted Answer

Install Policy Package. The 'Install Policy Package' option is designed to install only the policy package, which contains firewall policies and associated objects. This method minimizes changes by not pushing device-level settings, reducing the risk of unintended disruptions. When only policy changes are required, this is the most efficient and targeted approach. Other options either include unnecessary settings or do not install policies, making them unsuitable for the scenario.

Answer

Install Wizard

Answer

Install Policy Package & Device Settings

Answer

Install Device Settings

Question 4

An administrator is troubleshooting a FortiManager deployment. A FortiGate device is not receiving policy updates from FortiManager. The administrator verifies that the FortiGate is added to FortiManager and that the correct policy package is assigned. What is the most likely cause of the issue?

Accepted Answer

The FortiGate's administrative access is not enabled on the interface used for FortiManager communication.. For FortiManager to install policies, it must communicate with the FortiGate using the FGFM protocol. This requires that the interface used for management has administrative access enabled. If administrative access is disabled on that interface, FortiManager cannot connect, and policy updates will not be delivered. The other options are either optional features or less likely given that the device is already added to FortiManager.

Answer

The FortiGate is in a different time zone than FortiManager.

Answer

The FortiGate's firmware version is not compatible with FortiManager.

Answer

The FortiGate's management VDOM is not enabled.

Question 5

A security administrator is using FortiManager to manage a FortiGate. The administrator wants to ensure that any changes made to the FortiGate's configuration are automatically synchronized back to FortiManager. Which FortiManager feature should be enabled?

Accepted Answer

Auto-Update. The 'Auto-Update' feature in FortiManager enables automatic retrieval of configuration changes from managed FortiGates. When enabled, FortiManager periodically checks for changes and updates its database, ensuring synchronization. Automatic Update and Central Management are not specific to this function, and Configuration Revision is for tracking changes within FortiManager, not for retrieving them from devices.

Answer

Configuration Revision

Answer

Central Management

Answer

Automatic Update

Question 6

A security administrator manages a FortiGate cluster in a single ADOM using FortiManager. During a policy installation, FortiManager reports that the installation failed due to a conflict with a local configuration change on the FortiGate. Which action should the administrator take to resolve the conflict and allow the installation to proceed?

Accepted Answer

Install the configuration using the 'Install Wizard' with the option to overwrite local changes.. Using the Install Wizard with the overwrite option is the correct approach because it resolves configuration conflicts by enforcing FortiManager's configuration on the FortiGate. This maintains centralized control and ensures consistency. Other methods either cede control to the device or involve manual intervention that is not scalable.

Answer

Retrieve the configuration from the FortiGate to FortiManager to overwrite the FortiManager policy package.

Answer

Create a new policy package and assign it to the FortiGate, then install.

Answer

Manually edit the FortiGate's local configuration to match FortiManager, then retry the installation.

Question 7

A security administrator manages 30 FortiGates in a single ADOM on FortiManager. The administrator needs to run a one-time script that retrieves the serial number and current firmware version from every managed device, then outputs the results to a CSV file. Which FortiManager feature should the administrator use to accomplish this?

Accepted Answer

CLI scripts executed via the Scripts menu with the run-on-all-devices option. CLI scripts in FortiManager are designed for executing commands across multiple devices. A script that runs 'get system status' on each FortiGate will return serial number and firmware version. The script results can be exported, providing the needed CSV report. Other options either do not run commands on devices or are not intended for inventory collection.

Answer

Device Manager > Firmware Upgrade wizard

Answer

Revisions diff between the FortiManager database and each FortiGate

Answer

Policy Package installation with the 'retrieve configuration' option

Question 8

A FortiManager administrator manages a large number of FortiGates in a single ADOM. They want to make a configuration change to a policy package and need to ensure that the change is applied to all managed FortiGates without overwriting any local CLI changes made directly on the devices. Which FortiManager workflow should the administrator use?

Accepted Answer

Install the policy package to all devices in the ADOM using the 'Install Wizard', and select the option to 'Preserve device-specific settings'.. The correct approach is to use the Install Wizard with the 'Preserve device-specific settings' option. This allows the administrator to push the centralized policy changes while ensuring that any local CLI modifications on the FortiGates are not overwritten. This is critical in environments where devices have unique local configurations that must be maintained alongside centralized policies.

Answer

Create a new policy package and assign it to the devices, then install it using the 'Install Policy Package' option without any preservation settings.

Answer

Manually log in to each FortiGate and apply the policy changes via CLI, then use FortiManager to synchronize the configuration.

Answer

Use the 'Import Configuration' feature to pull the current device configuration into FortiManager, then modify and push it back.

Question 9

You are setting up an SD-WAN configuration via FortiManager. Which object type is used to group multiple WAN interfaces for SD-WAN member assignment?

Accepted Answer

SD-WAN Zone. In FortiManager SD-WAN configuration, an SD-WAN Zone is the object that groups multiple WAN interfaces so they can be referenced collectively as SD-WAN members in policies and rules.

Answer

IP Pool

Answer

Virtual Wire Pair

Answer

Interface Group

Question 10

What is the primary purpose of an ADOM in FortiManager?

Accepted Answer

To logically group devices for delegated administration and policy management. An ADOM (Administrative Domain) in FortiManager is a logical container that groups managed FortiGate devices, their policies, objects, and configuration. It enables delegated administration, so different administrators can manage separate device groups without seeing each other's data, and it provides a boundary for policy packages and global objects. This makes ADOMs the primary mechanism for multi-tenant or role-based management in FortiManager.

Answer

To provide high availability for the FortiGate

Answer

To allow external API access to the FortiGate

Answer

To increase the storage capacity of the FortiManager

Question 11

You are troubleshooting a policy installation failure where the FortiManager reports a 'Configuration conflict'. Which action should you perform to identify the root cause of the mismatch?

Accepted Answer

Use the 'Diff' feature in the Policy & Objects tab to compare the database and device config. The 'Diff' feature in the Policy & Objects tab allows you to compare the policy package in FortiManager's database against the actual configuration on the managed FortiGate, highlighting exactly where the mismatch exists. This is the correct first step to identify the root cause of a 'Configuration conflict' during policy installation, because it shows line-by-line differences in policy, objects, and settings. Once the diff is reviewed, you can reconcile the differences by importing, reinstalling, or manually adjusting the policy package.

Answer

Force an 'Import Policy' operation

Answer

Reboot the FortiManager

Answer

Disable the policy package entirely

Question 12

When adding a FortiGate to FortiManager, which mode must the FortiGate be in to allow the FortiManager to manage its configuration and policies?

Accepted Answer

Normal mode. A FortiGate must be in Normal mode to be fully managed by FortiManager, allowing FortiManager to push configuration and policies. Normal mode enables central management, whereas other modes restrict what FortiManager can do.

Answer

Registration-only mode

Answer

Backup mode

Answer

Read-only mode

Question 13

An administrator wants to use FortiManager to push a configuration change to 50 FortiGates simultaneously. Which method minimizes downtime and ensures consistency?

Accepted Answer

Assign devices to a Device Group and push a common Policy Package. Assigning the 50 FortiGates to a Device Group and pushing a common Policy Package from FortiManager ensures a single, consistent configuration is deployed to all devices simultaneously, minimizing downtime and configuration drift.

Answer

Create 50 separate ADOMs

Answer

Connect to each FortiGate via SSH and run scripts

Answer

Enable 'Auto-Push' for every change

Question 14

You are managing FortiGates across multiple ADOMs. How can you share common firewall objects (e.g., mail servers, common IP ranges) across these ADOMs?

Accepted Answer

Create objects in the Global Database. In FortiManager, the Global Database (Global ADOM) is specifically designed to hold common firewall objects that can be shared across multiple ADOMs. Objects created there are visible and assignable in all ADOMs, eliminating the need to duplicate them. This is the standard method for centralizing object management in multi-ADOM environments.

Answer

Manually copy objects to each ADOM

Answer

Use the API to script the creation in every ADOM

Answer

Enable 'Object Sharing' in system settings

Question 15

An administrator is migrating a standalone FortiGate into an existing FortiManager. What happens to the existing firewall policies on the FortiGate during the import process?

Accepted Answer

They are imported and converted into a Policy Package. When importing a standalone FortiGate into FortiManager, the existing firewall policies on the device are imported and converted into a Policy Package within FortiManager. This allows the administrator to manage those policies centrally going forward, preserving the existing configuration rather than losing it. The import creates a device entry and an associated policy package reflecting the device's current policy set.

Answer

They are moved to a 'Disabled' state

Answer

They are deleted to ensure a clean slate

Answer

They are merged into the Global Policy