NSE7_EFW Central Management — Timed 50 Questions

Question 1

A FortiManager administrator needs to ensure that logs from all enterprise FortiGates are aggregated and purged based on storage thresholds. Where is this configured?

Accepted Answer

FortiAnalyzer/Log Settings under Device Manager. Log aggregation and purging thresholds for managed FortiGates are configured in the FortiAnalyzer/Log Settings section under Device Manager in FortiManager. This is where you enable logging to FortiAnalyzer, set log storage limits, and define purge policies based on storage thresholds. It centralizes log management for all managed devices in an ADOM.

Answer

System settings under 'Network' tab

Answer

Global Policy settings

Answer

ADOM management settings

Question 2

An enterprise firewall administrator needs to deploy different security profiles to branch offices while sharing the same firewall policy structure. Which feature should be used?

Accepted Answer

Policy Package inheritance and mapping. Policy Package inheritance and mapping allows a central firewall policy structure to be defined once and then mapped to different ADOMs or devices, with per-device security profiles applied. This meets the requirement of sharing the same policy structure while deploying different security profiles to branch offices. It avoids duplicating rules and ensures consistency.

Answer

Creating multiple ADOMs for every branch

Answer

Manual copy-paste of rules

Answer

Using CLI templates exclusively

Question 3

An administrator is configuring the FortiManager to manage multiple FortiGate devices across different regions. Which method ensures that the device configuration remains synchronized with the FortiManager policy database during an automatic configuration update?

Accepted Answer

Enable Auto-update in the Device Manager configuration settings. The 'Auto-update' feature in the FortiManager Device Manager ensures that the configuration on the managed device is automatically synchronized with the policy package defined in the FortiManager database.

Answer

Set the FortiGate to 'Read-Only' mode

Answer

Enable ADOM-level scheduling

Answer

Configure a manual CLI script to push updates

Question 4

Which protocol does FortiManager use to communicate with managed FortiGate devices?

Accepted Answer

FGFM. FortiManager uses the FortiManager-to-FortiGate (FMG-FGT) protocol, which is built on top of SSL/TLS, often referred to as FGFM.

Answer

multiple_choice

Answer

HTTPS

Answer

SSH

Answer

SNMP

Question 5

Which FortiManager feature allows an administrator to test policy changes in a sandbox environment before applying them to production FortiGates?

Accepted Answer

Policy Package Cloning/Revision History. Policy Package Cloning/Revision History allows an administrator to create a copy of a policy package or revert to a previous revision, effectively testing changes in a sandbox before applying to production. Cloning creates an isolated copy that can be modified and installed on test devices, while revision history provides rollback.

Answer

Policy Testing Mode

Answer

Global Policy Lockdown

Answer

Device Manager Simulation

Question 6

When using FortiAnalyzer integration with FortiManager, where do you view the aggregated log reports?

Accepted Answer

Reports & Analytics tab. In FortiManager with FortiAnalyzer integration, aggregated log reports are viewed under the Reports & Analytics tab. This tab surfaces FortiAnalyzer-generated reports and log analytics directly within the FortiManager GUI when the two are integrated, allowing admins to review consolidated log data without switching consoles.

Answer

System Settings

Answer

Device Manager

Answer

Policy & Objects

Question 7

Which type of script in FortiManager is designed to run on the FortiManager itself rather than the managed devices?

Accepted Answer

TCL scripts. TCL scripts in FortiManager are designed to run on the FortiManager itself, allowing administrators to perform local automation tasks such as querying the FortiManager database, generating reports, or manipulating objects before pushing configuration to managed devices. This distinguishes them from CLI and configuration scripts, which are executed on the managed FortiGate devices.

Answer

CLI scripts

Answer

Configuration scripts

Answer

Policy scripts

Question 8

When a policy change is made in FortiManager, it must be 'Installed' to take effect. What is the first stage of the install process?

Accepted Answer

Install Preview. In FortiManager's install workflow, the first stage is Install Preview, which shows the administrator exactly what configuration changes will be pushed to the managed FortiGate devices before committing. This preview step lets the admin validate the diff and catch unintended changes before the actual push. Only after reviewing the preview does FortiManager proceed to the subsequent install stages.

Answer

Database validation

Answer

Config push

Answer

Reboot

Question 9

Which TWO methods can be used to authenticate a FortiGate when it registers to a FortiManager?

Accepted Answer

Password/Pre-shared Key. Option C (Password/Pre-shared Key) is correct because FortiManager supports authenticating a FortiGate during registration by requiring a pre-shared key (PSK) that the FortiGate must supply, configured under the FortiManager's device registration settings. Option D (Serial Number registration) is correct because FortiManager can be configured to accept a FortiGate based on its serial number, either by pre-adding the device or by using the 'Add Device' registration workflow where the serial number identifies and authorizes the unit. Option A (External RADIUS server) is not a FortiGate-to-FortiManager registration authentication method; RADIUS is used for administrative or user authentication, not device registration. Option B (SNMP community string) is only for SNMP monitoring access and plays no role in FortiManager registration. Option E (IP-based automatic discovery) is a discovery mechanism, not an authentication method, and does not by itself authenticate a FortiGate to FortiManager.

Answer

External RADIUS server

Answer

SNMP community string

Answer

IP-based automatic discovery

Question 10

Which TWO actions can be performed on a Revision History item in FortiManager?

Accepted Answer

Compare with current version. Option A is correct because FortiManager's Revision History allows you to select a revision and use the Compare function to diff it against the current version, showing added, removed, or changed configuration lines. Option B is correct because Revision History supports restoring a device's configuration to a previously saved revision, effectively rolling back to that state. Option C is incorrect because deleting an entire ADOM is an administrative action performed from the ADOM management interface, not from a Revision History item. Option D is incorrect because Revision History does not provide a built-in export-to-cloud feature; revisions are stored internally in FortiManager. Option E is incorrect because revisions are immutable snapshots — you cannot permanently modify a stored version, only compare, restore, or delete it.

Answer

Delete the entire ADOM

Answer

Export the revision to an external cloud

Answer

Modify the version permanently

Question 11

Which THREE items can be managed via Device Templates in FortiManager?

Accepted Answer

NTP configuration. Device Templates in FortiManager are used to provision and manage device-level configuration that is not part of the security policy package, including system-level settings. Option B (NTP configuration) is correct because NTP servers and synchronization settings are configured under System settings in a device template. Option D (DNS settings) is correct because DNS servers and related system DNS options are provisioned through device templates. Option E (Local interface IP settings) is correct because interface configuration, including IP addresses and administrative access, is managed via the interface section of a device template. Option A (Firewall policies) is not managed by device templates; firewall policies are handled through policy packages in FortiManager. Option C (Application control databases) is not a device template item; application control signatures are updated via FortiGuard and applied through security profiles/policy packages, not device templates.

Answer

Firewall policies

Answer

Application control databases

Question 12

Which THREE features are specific to the FortiManager 'Enterprise Firewall' management workflow?

Accepted Answer

Object database management. In the FortiManager Enterprise Firewall workflow, object database management (A) is correct because FortiManager maintains a centralized, normalized object database (addresses, services, schedules) that can be shared and referenced across multiple managed FortiGate devices, which is a defining capability of this workflow. Revision control (B) is correct because FortiManager stores policy package and configuration revisions, allowing administrators to view, compare, and revert to previous versions, a core part of the Enterprise Firewall management process. Centralized policy management (E) is correct because the workflow is built around creating policy packages and assigning them to managed devices or ADOMs, enabling consistent firewall policy deployment from a single console. Traffic shaping on routers (C) is incorrect because traffic shaping is a per-device FortiGate feature configured in firewall policies or shapers, not a FortiManager Enterprise Firewall workflow feature, and it applies to FortiGate, not generic routers. Web filter database updates (D) is incorrect because web filtering is a FortiGuard security service handled by the FortiGate (or FortiManager as a FortiGuard proxy), not a defining feature of the Enterprise Firewall management workflow.

Answer

Traffic shaping on routers

Answer

Web filter database updates

Question 13

A FortiManager administrator manages a FortiGate cluster in a single ADOM. During a policy installation, FortiManager reports that the installation failed because the FortiGate configuration was changed directly on the device. The administrator wants FortiManager to automatically retry the installation after resolving the conflict. Which FortiManager setting should the administrator configure?

Accepted Answer

Use the 'Retry' option in the installation wizard after retrieving the latest configuration.. FortiManager detects configuration changes on managed FortiGates and flags them as out-of-sync. The installation wizard offers a 'Retry' option after the administrator retrieves the latest configuration and resolves conflicts. This allows the installation to proceed without starting over. The other options describe settings that either do not exist or do not automatically retry failed installations.

Answer

Enable 'Auto Update' in the ADOM revision settings.

Answer

Configure 'Install Settings' to automatically retrieve the configuration from the FortiGate before installing.

Answer

Enable 'Auto Retry' in the FortiManager system settings.

Question 14

A network administrator manages 20 FortiGate devices from a single FortiManager. The administrator wants to ensure that all devices use the same global firewall address objects, such as a corporate DNS server, without manually creating them on each device. Which FortiManager feature should be used to achieve this?

Accepted Answer

Create the address object in the ADOM's object database and use it in multiple policy packages.. Creating the address object in the ADOM's object database allows it to be referenced by any policy package within that ADOM, ensuring all devices use the same definition. This method is efficient and reduces the risk of inconsistencies. The other options either involve unnecessary complexity or are intended for different use cases, such as dynamic objects or cross-ADOM sharing.

Answer

Use a dynamic object that references an external IP address and assign it to all devices.

Answer

Configure a per-device mapping for the address object and push it to all devices.

Answer

Create the address object in the Global Database and assign it to each device's policy package.

Question 15

A network administrator manages a FortiGate cluster with FortiManager using a single ADOM. The administrator configures a new firewall address object and a policy that references it. After installing the configuration, the administrator notices that the policy is not taking effect on the FortiGate. The FortiGate is in a high-availability (HA) cluster with two members. What is the most likely cause?

Accepted Answer

The policy installation might have failed because the FortiGate's configuration was out of sync, requiring a retrieve before install.. When FortiManager installs configuration to a managed FortiGate, it checks that the device's current configuration matches the last known revision. If the device configuration has been changed locally without being retrieved, the installation can fail or be skipped. The administrator must first retrieve the configuration to synchronize, then install the policy. This ensures consistency and avoids conflicts.

Answer

The FortiGate is in a different ADOM than the policy, so the installation did not apply to it.

Answer

The FortiManager did not synchronize the configuration to the secondary FortiGate in the HA cluster.

Answer

The policy was not installed to the FortiGate because the administrator did not commit the changes in the FortiManager workspace.

Question 16

You are the FortiManager administrator for a large enterprise. You need to create a new firewall policy package that will be assigned to 12 managed FortiGates. The policy package must contain a policy that allows HTTP/HTTPS from the internal subnet to the internet. You want to create this policy once and have it automatically available to all 12 FortiGates without manually copying it. Which FortiManager feature should you use?

Accepted Answer

Policy package assigned to a device group. Assigning a policy package to a device group is the correct approach because FortiManager automatically installs the same policy package to all devices in that group. This eliminates the need to manually copy policies to each FortiGate. The other options either do not provide automatic sharing across multiple devices in the same ADOM or require additional configuration that is not mentioned in the scenario.

Answer

Script executed on each FortiGate via the CLI

Answer

Policy package with a dynamic object for the internal subnet

Answer

Shared policy package in the global ADOM

Question 17

A network security administrator manages 40 FortiGate devices from a single FortiManager. The administrator needs to ensure that when a configuration change is made to a firewall policy in a policy package, the change is automatically pushed to all assigned FortiGates without manual intervention. Which FortiManager feature should be configured to achieve this?

Accepted Answer

Use the 'Install Wizard' to create a recurring schedule for policy installation.. The Install Wizard in FortiManager enables administrators to schedule recurring installations of policy packages to managed FortiGates. By configuring a schedule, any changes made to the policy package will be automatically installed at the next scheduled interval. This meets the requirement for automatic deployment without manual intervention. Other options reference non-existent features or incorrect mechanisms.

Answer

Configure a 'Policy Package' with the 'Install on Policy Change' option enabled.

Answer

Enable 'Automatic Policy Deployment' in the FortiGate device settings.

Answer

Enable 'Auto Install' in the policy package settings.

Question 18

A network administrator manages several FortiGates with FortiManager. The administrator wants to ensure that when a configuration change is made on a managed FortiGate directly (not through FortiManager), FortiManager automatically detects the change and retrieves the updated configuration. Which FortiManager feature should be configured to accomplish this?

Accepted Answer

Enable 'Auto-Retrieve' in the FortiGate's central management settings.. The requirement is for FortiManager to automatically detect and retrieve configuration changes made directly on a managed FortiGate. This is achieved by enabling 'Auto-Retrieve' in the FortiGate's central management settings. When enabled, the FortiGate sends a notification to FortiManager, which then retrieves the updated configuration. Other options either push configuration or do not provide automatic retrieval, so they fail to meet the scenario's needs.

Answer

Enable 'Auto Update' in the FortiGate's central management settings.

Answer

Configure 'Policy & Objects' synchronization with a scheduled install.

Answer

Enable 'Config Revision' and set it to auto-retrieve.

Question 19

An administrator is using FortiManager to manage a FortiGate. The administrator wants to back up the FortiGate configuration to FortiManager on a regular schedule. Which FortiManager feature should be configured?

Accepted Answer

Configuration Backup. FortiManager's Configuration Backup feature allows administrators to schedule regular backups of managed FortiGate configurations. This ensures that a recent copy of the device configuration is stored in FortiManager, which can be used for recovery or auditing. Other features like Revision History or Scripts serve different purposes and do not provide automated scheduled backups of device configurations.

Answer

Scripts

Answer

Revision History

Answer

Provisioning Templates

Question 20

A security administrator is using FortiManager to manage a large number of FortiGates. The administrator needs to ensure that firewall policies are consistently applied across multiple devices. Which two features in FortiManager allow for centralized policy management across multiple FortiGates? (Choose two.)

Accepted Answer

Policy packages. Policy packages and global policy packages are the primary FortiManager features for centralized policy management. Policy packages group policies and objects for assignment to multiple devices within an ADOM, ensuring consistent enforcement. Global policy packages extend this across ADOMs, allowing common rules to be applied enterprise-wide. Together, they enable administrators to manage policies centrally and deploy them efficiently.

Answer

ADOMs (Administrative Domains)

Answer

Device groups

Answer

Revision control