NSE7_EFW Central Management Practice Test 6 — 15 Questions

Question 1

An administrator manages multiple FortiGates in a single ADOM using normalized interfaces. A new policy must reference an interface that has different names on each device (port1 on one, wan1 on another). Which FortiManager object should the administrator use in the policy to ensure correct per-device mapping?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Normalized interface. Normalized interfaces provide a logical abstraction that FortiManager resolves to the correct physical interface per device using per-device mappings. This allows one shared policy to reference a stable name while each FortiGate receives the appropriate local interface, such as port1 or wan1, during installation. Zones, dynamic interfaces, and virtual wire pairs operate per device and do not deliver this cross-device mapping.

Answer

Zone

Answer

Virtual wire pair

Answer

Dynamic interface

Question 2

An administrator is configuring a new FortiManager installation and needs to add a FortiGate device for centralized management. Which protocol does FortiManager use to communicate with the FortiGate for management and configuration tasks?

Accepted Answer

FGFM. FGFM is the dedicated protocol for FortiManager to manage FortiGates. It runs over TCP port 541 and enables secure configuration, monitoring, and management. Other protocols like SNMP, CAPWAP, and SSH serve different purposes and are not used for full management functionality.

Answer

CAPWAP

Answer

SSH

Answer

SNMP

Question 3

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a new FortiGate is added to an ADOM, it automatically receives a base configuration that includes specific administrative settings, such as DNS servers and NTP servers. Which two FortiManager features can be used to accomplish this? (Choose two.)

Accepted Answer

Provisioning Templates. Provisioning Templates and CLI Templates are both designed to push configuration settings to managed FortiGates. Provisioning Templates are specifically for system-level settings and can be automatically applied when devices are added to an ADOM. CLI Templates offer more flexibility by allowing raw CLI commands to be executed on devices. Together, they can ensure that new FortiGates receive the required base configuration, including DNS and NTP servers.

Answer

Policy Packages

Answer

ADOM Revisions

Answer

Device Groups

Question 4

A network administrator is using FortiManager to manage a FortiGate. The administrator wants to make a change to a firewall policy that is currently installed on the FortiGate. After editing the policy in FortiManager, what must the administrator do to make the change take effect on the FortiGate?

Accepted Answer

Install the policy package to the FortiGate. After editing a policy in FortiManager, the administrator must install the policy package to the FortiGate. This operation transfers the updated configuration to the device, making the new policy active. Saving only commits changes to the FortiManager database, while refreshing retrieves device status. Rebooting does not apply configuration changes. Installation is the definitive step to enforce policy updates on managed devices.

Answer

Save the policy package

Answer

Reboot the FortiGate

Answer

Refresh the FortiGate status

Question 5

A security administrator is using FortiManager to manage a large number of FortiGate devices. The administrator wants to ensure that when a policy change is made in FortiManager, it is automatically validated for compliance with corporate security standards before being installed. Which FortiManager feature should be used to achieve this?

Accepted Answer

Policy Check. Policy Check in FortiManager validates firewall policies against compliance rules and best practices. It can be configured to run automatically before installation, ensuring that only policies meeting corporate standards are deployed. Other features like Installation Wizard, Revision History, and ADOM Revisions do not perform compliance validation.

Answer

Revision History

Answer

Installation Wizard

Answer

ADOM Revisions

Question 6

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a new FortiGate is added to FortiManager, it is automatically placed into the correct ADOM based on its model and firmware version. Which FortiManager feature should be configured to achieve this?

Accepted Answer

ADOM mode set to 'Advanced' and use of ADOM assignment rules.. To automatically place new FortiGates into the correct ADOM based on model and firmware, the administrator must use Advanced ADOM mode and configure ADOM assignment rules. These rules evaluate device attributes and assign the device to the appropriate ADOM. Other options either require manual assignment or do not consider model and firmware, so they are incorrect.

Answer

Device Manager with 'Auto-Provisioning' enabled.

Answer

ADOM mode set to 'Advanced' and manual assignment of devices.

Answer

ADOM mode set to 'Normal' and use of device groups.

Question 7

A security administrator is using FortiManager to manage a large number of FortiGates. The administrator needs to ensure that when a policy package is installed, the installation is performed efficiently and only to devices that require the changes. Which two actions should the administrator take to optimize the installation process? (Choose two.)

Accepted Answer

Use 'Install Wizard' and select only the devices that need the policy changes.. To optimize policy installation in FortiManager, administrators should target only the devices that require the changes. This can be achieved by selecting specific devices in the Install Wizard and by ensuring the policy package is assigned only to those devices. These actions reduce unnecessary installations, minimize network load, and improve overall efficiency. Other options like Auto Install or Install All do not provide targeted deployment and can lead to inefficiencies.

Answer

Use 'Install All' to ensure all devices are up to date.

Answer

Schedule installations during off-peak hours to reduce impact.

Answer

Enable 'Auto Install' on the policy package to push changes automatically to all devices.

Question 8

You are using FortiManager to manage a FortiGate cluster. You need to create a firewall policy that allows traffic from the internal network to the internet, but you want to ensure that the policy is only installed on the primary unit of the cluster. How can you achieve this in FortiManager?

Accepted Answer

This is not possible; policies are installed on the entire cluster. FortiManager manages a FortiGate cluster as a single logical device. When you install a policy package, it is applied to the entire cluster, and the cluster's primary unit synchronizes the configuration to all secondary units. There is no option to install a policy to only the primary unit. Any attempt to do so would be outside the supported functionality of FortiManager.

Answer

Configure the policy with the 'Primary' role in the install target settings

Answer

Use a dynamic object with a metadata variable that resolves to the primary unit's IP

Answer

Install the policy package only to the primary unit using the 'Install Wizard' with the 'Primary' option

Question 9

An administrator is using FortiManager to manage a FortiGate device. The administrator notices that the FortiGate's configuration has drifted from the FortiManager policy package. What is the most likely cause of this configuration drift?

Accepted Answer

The FortiGate was configured directly via its CLI or GUI, bypassing FortiManager.. Configuration drift happens when the FortiGate's running configuration differs from the FortiManager policy package. The most common cause is direct configuration changes on the FortiGate, bypassing FortiManager. To maintain consistency, all changes should be made through FortiManager. Other scenarios like pending installations or reboots do not typically cause drift.

Answer

FortiManager automatically updated the policy package without installing it.

Answer

The FortiManager administrator modified the policy package but did not install it.

Answer

The FortiGate device was rebooted without saving its configuration.

Question 10

An administrator is configuring a new FortiManager installation and needs to set up administrative access. The administrator wants to ensure that only authorized personnel can log in and that their actions are logged. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Create administrator accounts with strong passwords and assign appropriate profiles.. To ensure only authorized personnel can log in, administrator accounts with strong passwords and appropriate profiles must be created. To log their actions, administrative logging must be configured. These two configurations directly address the access control and logging requirements. Other options, while beneficial, are not strictly required to meet the stated goals.

Answer

Enable 'Strong Password' policy in the FortiManager global settings.

Answer

Set up a remote syslog server for storing logs.

Answer

Enable two-factor authentication for administrator accounts.

Question 11

An administrator is setting up a new FortiManager to manage several FortiGates. The administrator wants to ensure that only authorized personnel can make changes to firewall policies. Which FortiManager feature should be used to control administrative access and permissions?

Accepted Answer

Administrator profiles. Administrator profiles are the correct feature to control administrative access and permissions in FortiManager. They allow you to define granular permissions, such as read-only or full access, and can be scoped to specific ADOMs. By assigning appropriate profiles to users, you ensure that only authorized personnel can make changes to firewall policies, meeting the security requirement.

Answer

ADOMs

Answer

FortiManager HA

Answer

Workspace mode

Question 12

A network engineer has just added a new FortiGate to FortiManager and wants FortiManager to automatically retrieve the device's current configuration so it can be managed centrally. Which action accomplishes this?

Accepted Answer

Import the device configuration. Importing the configuration transfers the FortiGate's running settings into FortiManager, establishing the device database and policy baseline for centralized management. Installation pushes changes the other direction, discovery merely finds devices, and time synchronization is unrelated to configuration capture. Import is the correct first step after adding a device.

Answer

Synchronize the device clock

Answer

Run a device discovery scan

Answer

Install a default policy package

Question 13

An administrator is using FortiManager to manage a FortiGate. The administrator notices that the FortiGate's configuration in FortiManager is different from the actual configuration on the device. To resolve this, the administrator wants to update FortiManager with the current configuration from the FortiGate. Which action should the administrator take?

Accepted Answer

Retrieve the configuration from the FortiGate.. To update FortiManager with the current configuration from a managed FortiGate, the administrator should use the 'Retrieve' function, which pulls the configuration from the device into FortiManager. This ensures FortiManager's database matches the FortiGate. Installing the policy package would push changes to the device, which is not desired. Manual import and ADOM synchronization are not appropriate for this scenario.

Answer

Import the FortiGate's configuration file manually.

Answer

Synchronize the ADOM with the FortiGate.

Answer

Install the policy package to the FortiGate.

Question 14

An administrator is using FortiManager to manage a large enterprise network with multiple ADOMs. The administrator needs to ensure that certain firewall objects are available across all ADOMs. Which two steps must be performed to share objects across ADOMs? (Choose two.)

Accepted Answer

Create the objects in the Global Database.. To share objects across ADOMs in FortiManager, the objects must first be created in the Global Database, and then assigned to each ADOM where they are needed. This two-step process ensures that the objects are available for use in policy packages within those ADOMs. Other options like Workspace Mode, policy packages, or Import Configuration do not provide cross-ADOM object sharing.

Answer

Enable Workspace Mode in each ADOM.

Answer

Use the 'Import Configuration' feature to copy objects from one ADOM to another.

Answer

Create a policy package that includes the objects and install it to all devices.

Question 15

An administrator edits a shared firewall policy in FortiManager that is assigned to multiple FortiGates, but one FortiGate is currently offline. What happens when the administrator attempts to install the policy package to all assigned devices?

Accepted Answer

FortiManager installs to the online devices and marks the offline device as out of sync.. Installation in FortiManager is performed per assigned device. Reachable FortiGates receive the compiled configuration and become synchronized, while an offline device cannot accept the update and remains out of sync until it reconnects and a subsequent install is performed. The package and other devices are unaffected by the single unreachable member.

Answer

The install proceeds only if the offline device is removed from the policy package first.

Answer

The policy package is automatically rolled back on all devices.

Answer

Installation is blocked for all devices until the offline device reconnects.