NSE7_EFW Central Management Practice Test 7 — 15 Questions

Question 1

A network administrator is using FortiManager to manage a FortiGate. The administrator needs to make a configuration change that requires immediate effect on the FortiGate, but the change is currently in a workspace and not yet committed. What should the administrator do to apply the change?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Commit the workspace changes, then install the policy package.. With workspace mode enabled, changes are isolated until committed. Committing writes the changes to the FortiManager database, making them part of the configuration. To apply them to the managed FortiGate, the administrator must then install the policy package. This sequence ensures that the FortiManager and FortiGate configurations remain consistent and that changes take effect as intended.

Answer

Retrieve the configuration from the FortiGate to overwrite the workspace.

Answer

Install the policy package to the FortiGate.

Answer

Use the 'Save' button in the workspace to apply changes directly to the FortiGate.

Question 2

An administrator manages 25 FortiGates in a single ADOM. A new compliance rule requires that all managed devices use NTP servers 10.1.1.1 and 10.1.1.2. The administrator wants to push this change to all devices with minimal effort and ensure consistency. What is the most efficient way to accomplish this in FortiManager?

Accepted Answer

Use the 'Provisioning Templates' feature to create a system template with the NTP settings and assign it to all devices.. Provisioning Templates in FortiManager are designed to manage system-level settings across multiple devices. By creating a system template with the required NTP servers and assigning it to all devices in the ADOM, the administrator ensures consistent configuration with minimal effort. This approach leverages FortiManager's centralized management and is more efficient than manual configuration or scripts.

Answer

Manually edit the NTP settings on each FortiGate via the CLI.

Answer

Create a new policy package and assign it to all devices.

Answer

Use a script to run CLI commands on each device.

Question 3

You are a FortiManager administrator. You need to configure a new ADOM to manage a set of FortiGates that will be used for a new branch office. The branch office requires a specific set of firewall objects and policies that are different from the headquarters. Which two actions must you perform when creating the new ADOM? (Choose two.)

Accepted Answer

Select the FortiGate firmware version for the ADOM. When creating a new ADOM in FortiManager, you must select the ADOM type (such as 'FortiGate' or 'Enterprise') and the firmware version of the managed devices. These steps ensure that the ADOM supports the correct features and object models for the branch office FortiGates. Assigning administrative users, enabling workspace mode, and configuring a default gateway are not required during ADOM creation.

Answer

Configure a default gateway for the ADOM

Answer

Assign the ADOM to a specific FortiManager administrative user

Answer

Enable workspace mode for the ADOM

Question 4

An administrator uses FortiManager to manage a large number of FortiGates. They need to ensure that when a new firewall address object is created in the global database, it is automatically available in all ADOMs that require it, without manual duplication. Which FortiManager feature should be used?

Accepted Answer

Global Object Database. The Global Object Database in FortiManager is designed for sharing objects across ADOMs. Objects created there can be used in policies within any ADOM that has been enabled to use global objects. This provides centralized management and ensures consistency. Other options do not provide this functionality; global policy packages are for policies, and the other terms are not valid features.

Answer

ADOM Object Sharing

Answer

Policy Package Assignment

Answer

Global Policy Package

Question 5

A company uses FortiManager to manage a large number of FortiGates. They want to enforce a strict change control process where any configuration change must be reviewed and approved before being deployed. Which FortiManager feature should they use?

Accepted Answer

Workspace Mode. Workspace Mode provides a private staging area where administrators can make changes without affecting the live configuration. Changes are saved in the workspace and can be reviewed before being committed and installed. This supports a change control process where changes must be approved before deployment. Other features like Policy Check or Revision History do not provide this pre-deployment review capability.

Answer

Policy Check

Answer

Revision History

Answer

ADOM Revisions

Question 6

A network administrator manages two FortiGate HA clusters (cluster A and cluster B) from a single FortiManager. They need to push a new firewall policy to both clusters without affecting the other cluster's configuration. Which FortiManager feature should they use to ensure that the policy is installed only to the intended cluster and that the clusters remain independent?

Accepted Answer

Create a separate ADOM for each cluster and install the policy from each ADOM.. The correct approach is to use separate ADOMs for each HA cluster. ADOMs provide logical separation of devices, policies, and objects, ensuring that policies and objects are contained within their ADOM. When installing from an ADOM, only devices within that ADOM are targeted, so the policy is pushed only to the intended cluster. This also prevents object name conflicts and unintended policy application across clusters.

Answer

Enable 'Workspace Mode' and lock the ADOM to prevent changes to the other cluster.

Answer

Configure a 'Policy Package' that contains the policy and assign it only to the target cluster via 'Assign Package'.

Answer

Use the 'Install Wizard' and select both clusters, then enable 'per-device mapping' for the policy.

Question 7

A network security administrator manages 40 FortiGate appliances from a single FortiManager. The administrator needs to provision a new FortiGate that will be installed at a remote branch office. The branch office uses a private MPLS circuit with no direct internet access for management. The FortiGate must be pre-configured with its management IP, administrative credentials, and initial firewall policy before it is shipped to the site. Which FortiManager feature should the administrator use to accomplish this?

Accepted Answer

Use the FortiManager 'Provisioning Templates' feature to create a model device, assign it to the appropriate ADOM, and pre-configure the required settings.. Provisioning Templates enable administrators to define a model device with pre-set configurations, including management IP, credentials, and policies. This allows the FortiGate to be configured before shipment and automatically receive its settings upon first connection, which is essential for remote sites without direct internet access. Other features like scripts or policy packages require the device to be online first.

Answer

Use the FortiManager 'Device Manager' to add the FortiGate by its serial number, then manually configure all settings via the GUI.

Answer

Use the FortiManager 'Policy Package' to create a policy that references the new FortiGate, then install it to the device.

Answer

Use the FortiManager 'Script' feature to run a CLI script on the FortiGate after it registers with FortiManager.

Question 8

An administrator is using FortiManager to manage a FortiGate cluster (HA). They need to ensure that when a policy package is installed, both the primary and secondary units receive the configuration. What must be configured in FortiManager to achieve this?

Accepted Answer

Add the HA cluster as a single device using the primary unit's serial number, and FortiManager will synchronize to all cluster members.. FortiManager manages an HA cluster as a single device, added via the primary unit's serial number. When a policy package is installed, FortiManager communicates with the primary, which then synchronizes the configuration to all cluster members. This ensures both units receive the configuration. Other options suggest incorrect or non-existent configurations.

Answer

Configure a 'Cluster' object in FortiManager and assign the policy package to it.

Answer

Enable 'HA Management' in the FortiGate device settings in FortiManager.

Answer

Add both the primary and secondary FortiGate units as separate managed devices in FortiManager.

Question 9

A security administrator is using FortiManager to manage a large number of FortiGates. The administrator needs to ensure that when a new FortiGate is added to FortiManager, it automatically receives a base configuration including system settings and administrative accounts. Which FortiManager feature should be used?

Accepted Answer

Provisioning Templates. Provisioning Templates are designed to automate the configuration of managed devices, including system settings and administrative accounts. They ensure that new devices receive a consistent baseline configuration without manual intervention. This is the appropriate feature for the described scenario.

Answer

Device Groups

Answer

Policy Packages

Answer

ADOM Revisions

Question 10

A security administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a new FortiGate is added to FortiManager, it automatically receives a specific set of global security profiles and firewall objects. Which FortiManager feature should they configure?

Accepted Answer

Provisioning templates. Provisioning templates are designed to automatically apply a predefined set of configurations to managed devices. When a new FortiGate is added to FortiManager, the administrator can assign a provisioning template that includes security profiles and firewall objects, ensuring consistent configuration. Other options do not provide automatic application upon device addition.

Answer

Global object database

Answer

Device blueprints

Answer

ADOM-level policy package

Question 11

A FortiManager administrator is configuring a new ADOM for a region. The administrator wants to restrict the ADOM to only manage FortiGate devices running FortiOS 7.0. Which ADOM version should be selected?

Accepted Answer

7.0. ADOM version must match the FortiOS version of the managed devices to ensure compatibility and access to appropriate features. Selecting 7.0 restricts the ADOM to manage only FortiGates running FortiOS 7.0, which is exactly what the administrator needs.

Answer

7.2

Answer

6.4

Answer

7.4

Question 12

A security administrator needs to ensure that all FortiGate devices in a specific ADOM receive the same set of firewall addresses and services, but these objects should not be available to devices in other ADOMs. What is the most efficient way to achieve this in FortiManager?

Accepted Answer

Create the objects directly in the ADOM's firewall address and service groups.. Creating firewall addresses and services directly within the ADOM ensures they are local to that ADOM and cannot be accessed by other ADOMs. This provides the required isolation and is the most efficient method because it avoids the overhead of global objects and assignment. The objects will be available to all devices within the ADOM, satisfying the need for a common set of objects across those devices.

Answer

Create the objects in the Global Database and assign them to the specific ADOM.

Answer

Use 'Policy Package' assignment to share objects between ADOMs.

Answer

Enable 'Object Sharing' in the ADOM settings to allow cross-ADOM object usage.

Question 13

An administrator wants to delegate management of a specific FortiGate to a regional IT team while retaining overall control in FortiManager. The regional team should only be able to manage firewall policies for that device, not system settings or other devices. What should the administrator configure?

Accepted Answer

Use role-based administration (RBA) to create a restricted administrator account with read-write access to the FortiGate's policy package only.. Role-based administration (RBA) in FortiManager enables the creation of administrator accounts with granular permissions. By assigning a profile that grants read-write access only to the policy package of the specific FortiGate, the regional team can manage firewall policies without accessing system settings or other devices. This provides the necessary delegation while maintaining overall control.

Answer

Enable Workspace Mode for the regional team and lock the ADOM.

Answer

Configure a device group and assign the regional team as group administrators.

Answer

Create a new ADOM for the regional team and move the FortiGate into it.

Question 14

A security engineer is troubleshooting why a policy change made in FortiManager was not applied to a managed FortiGate. The engineer confirms the policy package was installed successfully, but the FortiGate shows no change. Which FortiManager feature should the engineer check first?

Accepted Answer

Workspace mode and approval status. When Workspace mode is enabled, policy changes are not immediately applied; they are stored in a workspace and require approval before installation. If the engineer installed the policy package without approving the workspace changes, the FortiGate would not receive the update. Checking the workspace and approval status reveals whether the change is pending. This is a common pitfall in collaborative environments where multiple administrators manage the same ADOM.

Answer

Policy package installation history

Answer

FortiGate's local configuration backup

Answer

ADOM revision control

Question 15

You are the security administrator for a large enterprise with multiple FortiGate devices managed by FortiManager. You need to create a new firewall policy that references an address object that already exists in the ADOM's global object database. However, you want to ensure that the policy is only installed on a specific subset of FortiGates. Which FortiManager feature should you use to accomplish this?

Accepted Answer

Create a new policy package and assign it to the desired FortiGates.. The requirement is to deploy a policy only to a subset of FortiGates. In FortiManager, policy packages are the primary method for grouping policies and assigning them to specific devices. By creating a new policy package and assigning it only to the desired FortiGates, the administrator ensures that the policy is installed only on those devices. Other mechanisms like dynamic objects or per-device mapping do not control deployment scope, and workspace mode is unrelated to scoping.

Answer

Configure a per-device mapping for the address object.

Answer

Enable workspace mode and lock the ADOM before making changes.

Answer

Use a dynamic object and map it to the desired FortiGates.