NSE7_EFW Central Management Practice Test 8 — 15 Questions

Question 1

An administrator is configuring a new FortiManager and needs to add a FortiGate device for management. They want to ensure that the FortiGate appears in the correct ADOM and that the administrator can immediately manage its policies. Which step must be performed first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the device using the Add Device wizard and specify the ADOM.. Before any management tasks can be performed, the FortiGate must be added to FortiManager. The Add Device wizard is the tool for this, and it includes selecting the ADOM. Once the device is added, the administrator can proceed with policy packages, provisioning templates, or global objects as required.

Answer

Install a provisioning template to the device.

Answer

Configure a global object that the device will use.

Answer

Create a policy package and assign it to the device.

Question 2

A security administrator is responsible for managing a FortiManager appliance that oversees multiple FortiGate devices. The administrator needs to create a new administrative user who should only be able to view firewall policies and device status but not make any changes. Which FortiManager administrative profile should be assigned to this user?

Accepted Answer

Read_Only. The Read_Only administrative profile is designed for users who need to view configurations and status but must not make changes. It provides the necessary visibility without granting modification rights. Other profiles like Super_User or Standard_User grant excessive privileges, while No_Access denies all access.

Answer

No_Access

Answer

Super_User

Answer

Standard_User

Question 3

A network administrator is using FortiManager to manage several FortiGate devices. The administrator needs to ensure that all devices receive the same firewall policy for blocking malicious traffic, but each device has a different WAN IP address. Which FortiManager feature should be used to dynamically assign the correct WAN IP address to each device's policy?

Accepted Answer

Dynamic objects. Dynamic objects are specifically designed to resolve values at install time based on the FortiGate's configuration, such as interface IP addresses. This allows a single policy to be deployed across multiple devices with different WAN IPs, automatically substituting the correct IP for each device. Per-device mapping requires manual overrides, policy packages are for grouping, and ADOMs are for partitioning. Therefore, dynamic objects are the correct feature.

Answer

ADOMs

Answer

Policy packages

Answer

Per-device mapping

Question 4

An administrator is setting up a new FortiManager and needs to add a FortiGate device for management. The FortiGate is behind a NAT device and does not have a public IP address. Which FortiManager feature allows the FortiGate to connect to FortiManager without requiring inbound access?

Accepted Answer

FortiGate initiates connection to FortiManager. The FortiGate always initiates the connection to FortiManager, which means it can be located behind NAT without requiring any inbound firewall rules. The FortiManager listens on TCP port 541 for these connections. This design simplifies deployment in environments where FortiGates are behind NAT or have dynamic IP addresses.

Answer

FortiManager auto-discovery

Answer

FortiManager behind NAT

Answer

Pre-shared key authentication

Question 5

A company uses FortiManager to manage multiple FortiGates. They have a requirement to ensure that all devices in a specific ADOM use the same set of firewall addresses and services. However, they also need to allow some devices to have additional, unique objects. Which FortiManager feature should they use to achieve this?

Accepted Answer

ADOM-level objects. ADOM-level objects are shared across all devices within the ADOM, providing a common set of addresses and services. They allow administrators to maintain consistency while still permitting device-specific objects. Global objects are for cross-ADOM sharing, and device-level or policy package objects are too limited in scope.

Answer

Policy package objects

Answer

Global objects

Answer

Device-level objects

Question 6

A network security administrator is using FortiManager to manage a FortiGate cluster. The administrator needs to ensure that when a policy change is made in FortiManager, it is automatically synchronized to all cluster members. Which FortiManager feature should be configured to achieve this?

Accepted Answer

Add the FortiGate cluster as a single device in FortiManager and install policy packages to it; FortiManager will handle synchronization to all cluster members.. FortiManager manages a FortiGate HA cluster as a single device. When policies are installed to the cluster, FortiManager sends the configuration to the primary unit, which then synchronizes it to all secondary members. This ensures that all cluster members have consistent policies without the need for individual management.

Answer

Use FortiManager's 'HA Management' feature to directly push configurations to each cluster member individually.

Answer

Add each cluster member as a separate device in FortiManager and create a device group for the cluster.

Answer

Configure the FortiGate cluster as a single device in FortiManager and enable 'Auto-Install' for policy changes.

Question 7

An administrator has configured a FortiManager to manage a FortiGate. The administrator notices that the FortiGate's configuration is out of sync with FortiManager. After reviewing the revision history, the administrator sees that the FortiGate has a configuration change that was not installed from FortiManager. What is the most likely cause?

Accepted Answer

The FortiGate was configured directly via its CLI or GUI, bypassing FortiManager.. The most likely cause is that the FortiGate was configured directly, bypassing FortiManager. FortiManager tracks configuration changes and compares them with the device. When a direct change occurs, the device's configuration diverges from the FortiManager database, resulting in an out-of-sync status. The administrator can then choose to import the changes or overwrite them by installing the FortiManager configuration.

Answer

The FortiGate's firmware version is incompatible with the FortiManager's firmware.

Answer

The FortiManager's revision history is corrupted and needs to be rebuilt.

Answer

The FortiManager's administrative domain (ADOM) was changed, causing the device to lose synchronization.

Question 8

A security administrator is setting up a new FortiManager to manage several FortiGate devices. The administrator wants to group devices that share the same security policies and objects. What should the administrator create to achieve this?

Accepted Answer

An administrative domain (ADOM). An ADOM is the correct choice because it provides a separate management space where devices, policies, and objects are contained. Devices within an ADOM can share policy packages and objects, while devices in different ADOMs are isolated. This allows the administrator to group devices with similar security requirements into the same ADOM, simplifying management and ensuring consistency.

Answer

A policy package

Answer

A global object

Answer

A device group

Question 9

A network administrator is new to FortiManager and wants to understand how to organize managed FortiGates for a multi-tenant environment. They need to ensure that each tenant's devices, policies, and objects are completely isolated from one another. What is the primary FortiManager construct that provides this isolation?

Accepted Answer

ADOM. ADOMs (Administrative Domains) are the fundamental unit of isolation in FortiManager. Each ADOM contains its own set of devices, policies, and objects, and there is no cross-ADOM visibility unless global objects are used. For a multi-tenant environment, creating a separate ADOM for each tenant ensures that their configurations are completely isolated, satisfying the requirement for separation.

Answer

Global Database

Answer

Workspace Mode

Answer

Policy Package

Question 10

A company has a FortiManager managing multiple FortiGates. The administrator needs to ensure that when a new FortiGate is added to the FortiManager, it automatically receives a base configuration including interface settings, static routes, and administrative accounts. Which FortiManager feature should be used to accomplish this?

Accepted Answer

Provisioning Templates. Provisioning Templates are specifically designed to apply a set of configuration settings to FortiGates automatically. They can include system settings, interface configurations, static routes, and admin accounts. When a device is added to FortiManager or when a template is assigned, the settings are pushed to the device, ensuring consistent base configurations.

Answer

Scripts

Answer

Policy Packages

Answer

Device Groups

Question 11

An administrator is configuring a new FortiManager and needs to add a FortiGate device for management. They want to ensure that the FortiGate appears in the correct ADOM and that the administrator can immediately manage its policies. Which step must be performed first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configuration revision. Configuration revision automatically creates a snapshot of the device configuration whenever it is modified through FortiManager. This allows administrators to track changes and revert to a previous state if necessary. It is the recommended feature for maintaining configuration backups and ensuring rollback capability.

Answer

Device-level configuration backup via SNMP

Answer

FortiManager backup scheduler

Answer

Policy package installation history

Question 12

An administrator is configuring a FortiManager to manage a FortiGate. The administrator wants to ensure that the FortiGate can be managed and that configuration changes can be installed. Which two settings must be configured on the FortiGate to allow FortiManager management? (Choose two.)

Accepted Answer

Configure the FortiManager IP address in the FortiGate's central management settings.. To allow FortiManager management, the FortiGate must have the FortiManager IP address configured under Central Management and the FortiManager administrative protocol enabled on the interface that connects to FortiManager. These two settings ensure that the FortiGate can initiate communication and accept management commands. Without them, FortiManager cannot manage the device.

Answer

Enable the "fmg" administrative protocol on the FortiGate's WAN interface.

Answer

Register the FortiGate with FortiManager using the FortiGate's serial number.

Answer

Set the FortiGate to operate in "FortiManager" mode under System Settings.

Question 13

A security administrator needs to ensure that all managed FortiGates in a specific ADOM receive a new security profile. They create the profile in the ADOM and want to assign it to all firewall policies in a policy package. However, some policies already use a different profile, and they want to replace it. Which action should they take in FortiManager to efficiently update all relevant policies?

Accepted Answer

Use the 'Replace Object' feature to replace the old profile with the new one across the policy package.. The 'Replace Object' feature is designed to globally replace one object with another within a policy package. It updates all references, such as security profiles in firewall policies, in one operation. This is the most efficient and accurate method to ensure all relevant policies use the new profile without manual editing.

Answer

Create a new policy package with the new profile and assign it to the ADOM.

Answer

Use the 'Policy Check' function to automatically replace the profile.

Answer

Manually edit each policy to change the security profile.

Question 14

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a policy change is made, it is properly validated and installed without causing downtime. Which TWO actions should be taken before installing the policy package? (Choose two.)

Accepted Answer

Review the installation preview to understand the changes. Before installing a policy package, it is essential to run a policy check to catch errors and to review the installation preview to see the exact changes. These steps help ensure that the installation will not cause unintended downtime or security issues. Other actions like workspace mode or scheduling are supplementary but not directly related to validation.

Answer

Schedule the installation during a maintenance window

Answer

Install the policy package to all devices simultaneously

Answer

Enable workspace mode to lock the ADOM

Question 15

An administrator is using FortiManager to manage a FortiGate. The administrator needs to make a configuration change that requires a reboot of the FortiGate. After installing the configuration from FortiManager, the FortiGate reboots. What is the expected behavior of FortiManager during this process?

Accepted Answer

FortiManager will automatically reconnect to the FortiGate after the reboot and verify the configuration.. FortiManager automatically reconnects to the FortiGate after a reboot and verifies the configuration. This is part of its robust management protocol. The FortiGate re-establishes the management tunnel, and FortiManager retrieves the current configuration to confirm the installed changes. No manual intervention is required, and revision history is preserved.

Answer

FortiManager will roll back the configuration because the FortiGate did not acknowledge the install.

Answer

FortiManager will mark the FortiGate as offline and require manual re-registration.

Answer

FortiManager will lose the device's revision history and start a new baseline.