NSE7_EFW Central Management Practice Test 5 — 15 Questions

Question 1

What is the result of 'Pushing' a policy package from FortiManager to a FortiGate?

Accepted Answer

The FortiGate policy configuration is overwritten with the FortiManager version. Pushing a policy package from FortiManager to a FortiGate installs the FortiManager-managed policy configuration onto the device, overwriting the FortiGate's existing policy configuration with the FortiManager version. This ensures the device reflects the authoritative configuration defined centrally in FortiManager. The operation is a one-way deployment from manager to managed device.

Answer

The FortiGate policy is sent to the FortiManager

Answer

The policy is saved in a draft state on the FortiGate

Answer

The FortiManager policy is appended to the existing FortiGate policy

Question 2

An administrator needs to perform a firmware upgrade on 100 FortiGates. Which feature in FortiManager allows this to be done securely with a rollback option?

Accepted Answer

Firmware Management in Device Manager. FortiManager's Firmware Management feature, accessible via Device Manager, is purpose-built for centralized firmware upgrades across managed FortiGates. It allows an administrator to select multiple devices, schedule or immediately push a firmware image, and critically, it creates a rollback point by backing up the configuration and retaining the previous firmware image before upgrade. This satisfies the secure, scalable, and reversible upgrade requirement for 100 devices without manual intervention.

Answer

Automated patch management

Answer

Manual script pushing

Answer

Global Policy upgrade task

Question 3

You want to automate the onboarding of new FortiGate units. Which FortiManager feature allows you to pre-configure devices before they connect to the network?

Accepted Answer

Provisioning Templates. Provisioning Templates in FortiManager allow administrators to pre-configure FortiGate devices before they are physically connected to the network. The template defines configuration such as interfaces, routing, and policies, and is applied automatically when the device registers with FortiManager, enabling zero-touch onboarding.

Answer

Scripting

Answer

Device Registration Key

Answer

Policy cloning

Question 4

Where can an administrator check the status of the connection between a FortiGate and FortiManager?

Accepted Answer

Device Manager. In the FortiManager GUI, the Device Manager module provides a centralized view of all managed devices, including their connection status. When a FortiGate is added to FortiManager, its status (e.g., 'Connected', 'Disconnected', 'Unauthorized') is displayed in the Device Manager list. This is the primary location to verify the real-time connectivity between the FortiGate and FortiManager.

Answer

Log View

Answer

Policy & Objects

Answer

System Settings

Question 5

An administrator notices that logs are not appearing in FortiManager for a specific FortiGate. What is the first thing to check to ensure log forwarding is active?

Accepted Answer

Log forwarding configuration on the FortiGate. The first thing to check when logs are not appearing in FortiManager for a specific FortiGate is the log forwarding configuration on the FortiGate itself. This ensures that the device is configured to send logs to FortiManager. Without proper configuration, logs will not be forwarded regardless of other factors.

Answer

The FortiManager license

Answer

The device's physical connection

Answer

The firmware version of the FortiGate

Question 6

An administrator needs to provide access to FortiManager for a junior team member who should only be able to view logs and reports. Which feature is used to define this access?

Accepted Answer

Administrator Profiles. Administrator Profiles in FortiManager define granular read/write permissions across functional areas such as device manager, policy & objects, and log & report. Assigning a profile with read-only access to logs and reports gives the junior team member exactly the view-only scope required.

Answer

Access Control Lists (ACLs)

Answer

ADOM Assignment

Answer

User Groups

Question 7

Which component of FortiManager allows for the centralized management of firmware across multiple devices?

Accepted Answer

Firmware Management. FortiManager's Firmware Management feature provides centralized firmware repository and upgrade orchestration across managed devices. It lets administrators import firmware images, schedule upgrades, and push them to multiple FortiGates from a single console.

Answer

Policy Database

Answer

Device Templates

Answer

Log View

Question 8

What is the benefit of using 'CLI Templates' in FortiManager?

Accepted Answer

They allow applying configuration commands to multiple devices. CLI Templates in FortiManager let administrators define reusable blocks of FortiOS CLI configuration and push them to one or many managed FortiGates in a single operation. This is the core benefit: consistent, repeatable configuration across a device group without manually logging into each unit. They are a provisioning tool layered on top of the FortiManager device database, not a replacement for the GUI or a policy-conversion mechanism.

Answer

They replace the GUI completely

Answer

They convert the policy to a CLI script

Answer

They improve the FortiGate hardware performance

Question 9

Which THREE items are included in a Policy Package when it is pushed from FortiManager?

Accepted Answer

Service Objects. A Policy Package in FortiManager is the container that holds the firewall policy configuration destined for managed FortiGate devices, and it includes Firewall Policies (B), which are the actual allow/deny rules pushed to the device. It also includes the reusable Address Objects (E) and Service Objects (A) that those policies reference, since these named objects must exist on the FortiGate for the policy to function. System interface settings (C) and Routing tables (D) are device-level configuration, not part of the Policy Package; they are handled separately (e.g., via the device's system settings or the "Install Wizard" device-level options), so they are not pushed as part of the policy package.

Answer

System interface settings

Answer

Routing tables

Question 10

Which TWO types of reports can be generated in the FortiAnalyzer module of FortiManager?

Accepted Answer

Custom reports. FortiAnalyzer, whether accessed directly or via the FortiManager module, supports two main report categories: Custom reports (option A), which administrators create from scratch or by modifying templates to select specific datasets, time periods, and layouts, and Pre-defined reports (option B), which are built-in templates provided by Fortinet for common use cases such as traffic, security, and bandwidth analysis. Both are valid report types generated within the FortiAnalyzer module of FortiManager. The other options do not belong: Policy change impact reports (C) are not a FortiAnalyzer report type, Hardware diagnostic reports (D) are not generated by FortiAnalyzer, and Firmware compatibility reports (E) are unrelated to FortiAnalyzer reporting functionality.

Answer

Policy change impact reports

Answer

Hardware diagnostic reports

Answer

Firmware compatibility reports

Question 11

Which THREE factors influence log storage efficiency on a FortiAnalyzer/FortiManager?

Accepted Answer

Log compression settings. Log compression settings (A) directly influence storage efficiency because FortiAnalyzer/FortiManager can compress logs (e.g., using gzip-style compression) before writing them to disk, reducing the bytes consumed per log entry. Log retention days (B) determine how long logs are kept before being purged, so a longer retention period increases the total volume of logs stored and thus affects overall storage efficiency and capacity planning. Disk quota for specific devices (D) limits how much storage each device's logs may consume, directly governing how efficiently the available disk space is allocated and preventing one device from exhausting the shared repository. The firewall firmware version (C) is not a storage-efficiency factor, since it does not change how FortiAnalyzer compresses, retains, or quotas logs. The number of active users (E) is likewise irrelevant to log storage efficiency, as it is not a FortiAnalyzer/FortiManager storage configuration or capacity parameter.

Answer

The firewall firmware version

Answer

The number of active users

Question 12

Which TWO administrative actions require a 'Workspace Mode' enabled in FortiManager?

Accepted Answer

Locking policies for editing. Workspace Mode in FortiManager enables a workflow where administrators lock objects (such as policies) for editing and then review changes before publishing them to managed devices, so options D (locking policies for editing) and E (reviewing changes before publishing) are the two actions that require Workspace Mode to be enabled. In Workspace Mode, an admin must lock a policy package or object before modifying it, and the changes are staged in a workspace until the admin reviews and commits them, which is exactly what D and E describe. The other options do not depend on Workspace Mode: automatic log rotation (A) is a logging/disk-management setting, creating new ADOMs (B) is an administrative function performed from the ADOM management interface regardless of workspace workflow, and forcing a reboot (C) is a device-management action available outside Workspace Mode.

Answer

Automatic log rotation

Answer

Creating new ADOMs

Answer

Forcing a reboot

Question 13

Which THREE steps are involved in the 'Policy Package Installation' workflow?

Accepted Answer

Select the target device. In the Policy Package Installation workflow, you must first select the policy package (option D) that contains the rules you intend to deploy, since the installation operates on a specific package rather than the entire rulebase. Next, you select the target device (option A) — the managed gateway, cluster, or VSX instance — to which that package will be pushed. Before committing, you review the install preview (option C), which shows the changes, warnings, and validation results so you can confirm the impact of the installation. A factory reset (option B) is not part of installation; it is a recovery/redeployment action that erases configuration. Rebooting the target device (option E) is likewise not a required step, as policy installation applies the compiled policy without requiring a reboot.

Answer

Perform a factory reset

Answer

Reboot the target device

Question 14

Which TWO options are available when configuring an SD-WAN rule in FortiManager?

Accepted Answer

Source/Destination criteria. In FortiManager, when you create an SD-WAN rule (SD-WAN Rule / Centralized SD-WAN configuration), the rule must define the traffic it matches and how that traffic is handled. Option B (Source/Destination criteria) is correct because SD-WAN rules match traffic based on source and destination parameters (such as source/destination addresses, users, applications, and services) to identify which flows the rule applies to. Option C (Traffic steering strategy) is correct because each SD-WAN rule requires a steering strategy that determines how matched traffic is distributed or prioritized across SD-WAN members, such as best-quality, lowest-cost, maximize-bandwidth, or manual/SLA-based selection. Option A (Interface physical speed) is not a configurable SD-WAN rule parameter; link speed is a property of the interface/health-check performance, not a rule-matching or steering field. Option D (MAC address spoofing) is unrelated to SD-WAN rule configuration and is not a supported SD-WAN rule setting. Option E (Hardware acceleration toggle) is an interface/system-level setting, not an SD-WAN rule option.

Answer

Interface physical speed

Answer

MAC address spoofing

Answer

Hardware acceleration toggle

Question 15

A security administrator is preparing to push a configuration change from FortiManager to a managed FortiGate. Before installing, the administrator wants to preview exactly which CLI commands will be sent to the device. Which FortiManager feature should the administrator use?

Accepted Answer

Install Preview. Install Preview in FortiManager renders the exact CLI that will be delivered to the managed FortiGate, letting administrators inspect commands and ordering before committing. This validation step reduces risk of syntax or dependency errors during install. Other features such as revisions or monitors show FortiManager-side history or live device state, but not the projected device-bound script.

Answer

Device Manager Monitor

Answer

Policy Package Revision Diff

Answer

ADOM Revisions