NSE7_EFW Hard Questions — 25 Difficult Questions

Question 1

A FortiGate is configured with a site-to-site IPsec VPN to a remote peer. The VPN is up, but traffic is not passing. You run 'diagnose vpn tunnel list' and see that the tunnel is up, but the phase-2 selectors show no traffic. You suspect a routing issue. Which command would you use to verify that traffic is being routed correctly through the tunnel?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

get router info routing-table details . To verify that traffic to a specific destination is routed through the IPsec tunnel, you use the command 'get router info routing-table details '. This shows the exact route that will be used, including the outgoing interface. If the route points to the tunnel interface, routing is correct; if not, you must fix the routing configuration. This command is essential for troubleshooting VPN traffic flow.

Answer

diagnose vpn ike gateway list

Answer

diagnose ip route list

Answer

diagnose firewall iprope list

Question 2

An administrator manages multiple FortiGates in a single ADOM using normalized interfaces. A new policy must reference an interface that has different names on each device (port1 on one, wan1 on another). Which FortiManager object should the administrator use in the policy to ensure correct per-device mapping?

Accepted Answer

Normalized interface. Normalized interfaces provide a logical abstraction that FortiManager resolves to the correct physical interface per device using per-device mappings. This allows one shared policy to reference a stable name while each FortiGate receives the appropriate local interface, such as port1 or wan1, during installation. Zones, dynamic interfaces, and virtual wire pairs operate per device and do not deliver this cross-device mapping.

Answer

Zone

Answer

Virtual wire pair

Answer

Dynamic interface

Question 3

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a policy change is made, it is properly validated and installed without causing downtime. Which TWO actions should be taken before installing the policy package? (Choose two.)

Accepted Answer

Review the installation preview to understand the changes. Before installing a policy package, it is essential to run a policy check to catch errors and to review the installation preview to see the exact changes. These steps help ensure that the installation will not cause unintended downtime or security issues. Other actions like workspace mode or scheduling are supplementary but not directly related to validation.

Answer

Schedule the installation during a maintenance window

Answer

Install the policy package to all devices simultaneously

Answer

Enable workspace mode to lock the ADOM

Question 4

A FortiGate has two WAN interfaces, wan1 and wan2, managed by SD-WAN. The administrator wants traffic for the SaaS application Microsoft 365 to prefer wan1, while all other internet traffic should use wan2 unless wan2 fails. Which SD-WAN configuration element is required to meet this requirement?

Accepted Answer

Create an SD-WAN rule with the Internet Service 'Microsoft 365' selected, set wan1 as the preferred member, and configure wan2 as a standby member.. SD-WAN rules can match Internet Service entries such as Microsoft 365, allowing the administrator to prefer wan1 for that application while other traffic uses wan2. Configuring wan2 as standby provides failover. This satisfies both the application-specific preference and the fallback requirement without relying on static routes or policy routes, which lack SD-WAN health checking.

Answer

Create an SD-WAN rule with a destination of all, set wan2 as the preferred member, and enable the 'implicit' SLA target.

Answer

Configure a policy route that matches Microsoft 365 IP addresses and directs them to wan1, and rely on the default static route for all other traffic.

Answer

Set wan1 as the primary default route and wan2 as a lower-distance default route, and use a firewall policy to match Microsoft 365.

Question 5

A FortiGate is configured with an IPsec VPN tunnel using IKEv2. The administrator wants to ensure that the tunnel uses perfect forward secrecy (PFS) and that the DH group is 14. Which configuration change is required?

Accepted Answer

Set the Phase 2 proposal's DH group to 14 and enable PFS.. Perfect forward secrecy in IPsec is achieved by specifying a DH group in the Phase 2 proposal. This ensures that each new IPsec SA uses a unique key derived from a fresh DH exchange. Setting the Phase 2 DH group to 14 meets the requirement.

Answer

Set the Phase 1 proposal's DH group to 14 and enable PFS.

Answer

Enable PFS in the Phase 1 settings and set the DH group to 14 in Phase 2.

Answer

Set the DH group to 14 in both Phase 1 and Phase 2 and enable PFS in Phase 1.

Question 6

A network administrator is configuring a FortiGate to perform deep inspection of SSL traffic for a specific web server. The server uses a certificate signed by an internal certificate authority (CA). The administrator wants to ensure that the FortiGate can inspect the traffic without generating certificate errors for users. What must the administrator do?

Accepted Answer

Configure the SSL inspection profile to use the internal CA certificate as the signing certificate, and ensure that users' browsers trust that CA.. Deep inspection requires the FortiGate to act as a man-in-the-middle, decrypting and re-encrypting traffic. To do this without errors, the FortiGate must use a CA certificate to re-sign the server's certificate, and clients must trust that CA. Using the internal CA as the signing certificate and distributing it to clients ensures seamless inspection.

Answer

Import the internal CA certificate into the FortiGate's local certificate store and enable deep inspection in the SSL inspection profile.

Answer

Enable 'untrusted SSL' inspection in the SSL inspection profile and set the action to 'allow' so that the FortiGate can inspect traffic without decrypting.

Answer

Install the web server's certificate on the FortiGate and enable 'ssl-exempt' for that server to avoid inspection issues.

Question 7

An administrator is configuring a FortiGate in HA Active-Passive mode. The cluster has two members: FortiGate-1 and FortiGate-2. The administrator wants to ensure that if the primary unit fails, the secondary unit takes over with minimal disruption. The administrator has configured the HA heartbeat interfaces and set the priority of FortiGate-1 to 200 and FortiGate-2 to 100. However, after a power failure on FortiGate-1, FortiGate-2 does not become the primary. What is the most likely cause?

Accepted Answer

The HA override setting is disabled on both units.. The most likely cause is that HA override is disabled. Without override, the primary unit is elected based on uptime, and if the primary fails, the secondary may not take over if it is waiting for the primary to return. In some firmware versions, if override is disabled, the secondary will not preempt the primary even after a failure, leading to a situation where neither unit is primary until the original primary returns. Enabling override on the desired primary unit ensures it takes over when it comes back online.

Answer

The HA group ID is different on the two units.

Answer

The heartbeat interfaces are not connected to a switch and are directly connected.

Answer

The HA priority values are not identical on both units.

Question 8

An administrator is configuring an SSL VPN on a FortiGate to allow remote users to access internal web applications. The administrator wants to ensure that users can access multiple internal web servers using their IP addresses, but the servers use different ports. Which two configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Create a firewall policy that allows traffic from the SSL VPN interface to the internal servers' subnets, specifying the appropriate services and ports.. To allow SSL VPN users to access multiple internal web servers on different ports, two key steps are required: a firewall policy that permits traffic from the SSL VPN interface to the internal servers, including the necessary ports, and bookmarks in the SSL VPN portal to provide easy access to each server. The firewall policy is essential for security and traffic flow, while bookmarks enhance usability. Other options like separate portals or web mode are not mandatory for this scenario.

Answer

Enable 'web mode' in the SSL VPN settings to allow access to web applications through the browser.

Answer

Configure the SSL VPN portal to use 'tunnel mode' and define the internal subnets as split tunnel routes.

Answer

Configure a separate SSL VPN portal for each web server, specifying the server's IP and port in the portal settings.

Question 9

A FortiManager administrator is troubleshooting why a configuration change made directly on a managed FortiGate is not appearing in the FortiManager policy package. The administrator wants to retrieve the FortiGate's current configuration and compare it with the FortiManager database to identify the differences. Which action should the administrator take in FortiManager?

Accepted Answer

Run 'Retrieve Config' from the Device Manager. To identify configuration drift, the administrator must first retrieve the current configuration from the FortiGate into FortiManager. The 'Retrieve Config' action in Device Manager performs this synchronization, updating the FortiManager database with the device's actual settings. Once retrieved, the administrator can compare the device-level configuration with the policy package to see differences and decide on remediation.

Answer

Enable 'Auto-Update' on the device in FortiManager

Answer

Run 'Import Configuration' from the Policy & Objects

Answer

Use the 'Install Wizard' to push the FortiManager configuration to the device

Question 10

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

Accepted Answer

To encapsulate ESP packets. UDP port 4500 is used for NAT-Traversal (NAT-T) to encapsulate ESP packets within UDP. This allows IPsec traffic to pass through NAT devices that would otherwise drop ESP packets.

Answer

To replace the AH protocol

Answer

To manage Phase 1 re-keying

Answer

To verify certificate revocation status

Question 11

An administrator is deploying a new FortiGate in a high-availability (HA) cluster using FGCP. The administrator must ensure that the cluster can synchronize sessions and maintain uptime during a failover. Which two configuration settings must be identical on both FortiGate devices for the HA cluster to form and function correctly? (Choose two.)

Accepted Answer

The heartbeat interface configuration.. For an FGCP HA cluster to form, the HA group name and password must match to authenticate members, and the heartbeat interface configuration must be identical to allow heartbeat communication. Device priority can differ and is used for master election; hostnames can be unique; firmware should match but is not a configuration setting that must be identical for the cluster to form.

Answer

The device priority (priority setting).

Answer

The firmware version.

Answer

The hostname of each FortiGate.

Question 12

A FortiManager administrator needs to ensure that logs from all enterprise FortiGates are aggregated and purged based on storage thresholds. Where is this configured?

Accepted Answer

FortiAnalyzer/Log Settings under Device Manager. Log aggregation and purging thresholds for managed FortiGates are configured in the FortiAnalyzer/Log Settings section under Device Manager in FortiManager. This is where you enable logging to FortiAnalyzer, set log storage limits, and define purge policies based on storage thresholds. It centralizes log management for all managed devices in an ADOM.

Answer

System settings under 'Network' tab

Answer

Global Policy settings

Answer

ADOM management settings

Question 13

An administrator is troubleshooting an issue where hardware acceleration is not working after upgrading firmware. Which command identifies if the NP configuration has changed?

Accepted Answer

diag hardware npu np6 port-list. The command 'diag hardware npu np6 port-list' displays the current NP6 port configuration and status, allowing the administrator to compare it with the expected configuration after a firmware upgrade. If hardware acceleration is not working, this command can reveal whether the NP6 ports are properly mapped or if the configuration has changed.

Answer

config system npu

Answer

diagnose firewall npu

Answer

get hardware status

Question 14

When using 'set session-ttl' globally, which sessions are affected?

Accepted Answer

Only new sessions. Global session TTL settings apply to all sessions that do not have a specific override or a policy-based setting.

Answer

All sessions

Answer

Only TCP sessions

Answer

Only existing sessions

Question 15

A security administrator manages a FortiGate cluster in a single ADOM using FortiManager. During a policy installation, FortiManager reports that the installation failed due to a conflict with a local configuration change on the FortiGate. Which action should the administrator take to resolve the conflict and allow the installation to proceed?

Accepted Answer

Install the configuration using the 'Install Wizard' with the option to overwrite local changes.. Using the Install Wizard with the overwrite option is the correct approach because it resolves configuration conflicts by enforcing FortiManager's configuration on the FortiGate. This maintains centralized control and ensures consistency. Other methods either cede control to the device or involve manual intervention that is not scalable.

Answer

Retrieve the configuration from the FortiGate to FortiManager to overwrite the FortiManager policy package.

Answer

Create a new policy package and assign it to the FortiGate, then install.

Answer

Manually edit the FortiGate's local configuration to match FortiManager, then retry the installation.

Question 16

Which THREE types of traffic are typically NOT offloaded by the NP6 processor?

Accepted Answer

Traffic requiring proxy-based inspection. Option B is correct because the NP6 processor cannot perform proxy-based inspection, which requires the full TCP or UDP payload to be reassembled and examined by a higher-layer proxy (e.g., FortiGate's proxy inspection mode); such traffic must be handled by the CPU. Option C is correct because encrypted traffic (e.g., TLS/HTTPS) cannot be inspected or offloaded until it is decrypted, and decryption itself is performed by the CPU before any accelerated processing can occur. Option D is correct because the NP6 only offloads traffic for protocols it explicitly supports in its fast-path; traffic using unsupported protocols is punted to the CPU for processing. Option A is not correct because simple ICMP packets are commonly offloaded by the NP6 fast path. Option E is not correct because standard UDP traffic is typically offloaded by the NP6 when it matches supported session types.

Answer

Simple ICMP packets

Answer

Standard UDP traffic

Question 17

You need to ensure that session synchronization between HA nodes is as efficient as possible. Which parameter should be tuned in the HA configuration?

Accepted Answer

session-pickup-delay. The session-pickup-delay parameter controls how long a secondary HA node waits before picking up sessions after a failover. Tuning this delay ensures that session synchronization is efficient by preventing the secondary node from prematurely taking over sessions that may still be active on the primary, thus avoiding unnecessary session re-establishment and reducing synchronization overhead. A shorter delay can speed up failover but may cause session flapping, while a longer delay can reduce synchronization traffic but increase failover time. Therefore, adjusting session-pickup-delay directly impacts the efficiency of session synchronization between HA nodes.

Answer

monitor-interface

Answer

override

Answer

heartbeat-interval

Question 18

Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?

Accepted Answer

Action (Accept to Deny). Changing critical security profile settings or specific policy parameters that affect the session tuple typically triggers a session flush to ensure consistent security enforcement.

Answer

Schedule

Answer

Comments field

Answer

Policy Name

Question 19

In an OSPF setup, you have a redundant path. You want to ensure traffic prefers one link over another based on cost. Which OSPF command is used?

Accepted Answer

set ospf-cost. The OSPF cost is configured on the interface level to influence link preference.

Answer

set metric-type

Answer

set bandwidth-reference

Answer

set priority

Question 20

You are troubleshooting a high CPU issue on a FortiGate. Which utility should you use to identify which process is consuming the most resources?

Accepted Answer

diagnose sys top. The 'get system performance status' command is the primary tool to see process-level CPU usage.

Answer

get system hardware status

Answer

diagnose sniffer packet

Answer

get router info memory