NSE7_EFW Multiple Select — 10 Questions

Question 1

Which TWO administrative actions require a 'Workspace Mode' enabled in FortiManager?

Accepted Answer

Locking policies for editing. Workspace mode is required for concurrent editing and locking of policies by multiple administrators.

Answer

Automatic log rotation

Answer

Creating new ADOMs

Answer

Forcing a reboot

Question 2

Which TWO actions should be taken when preparing to upgrade a FortiGate HA cluster?

Accepted Answer

Review release notes. A configuration backup is mandatory, and checking the release notes for firmware-specific HA behavior is critical for a smooth upgrade.

Answer

Clear all sessions

Answer

Disable heartbeat interfaces

Answer

Change HA mode to Standalone

Question 3

Which TWO methods can be used to authenticate a FortiGate when it registers to a FortiManager?

Accepted Answer

Password/Pre-shared Key. Registration can be secured using a serial number/password combination or by adding the device's IP and certificate/serial in the FMG.

Answer

External RADIUS server

Answer

SNMP community string

Answer

IP-based automatic discovery

Question 4

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

Accepted Answer

Encryption algorithm (e.g., AES-256). IKEv2 negotiates encryption, integrity, and Diffie-Hellman groups during the initial exchange.

Answer

TCP port selection

Answer

Firewall policy ID

Question 5

Which TWO of the following are necessary to successfully deploy an SSL VPN in tunnel mode?

Accepted Answer

A valid SSL certificate for the VPN portal. Tunnel mode requires a configured portal and a policy allowing the VPN tunnel interface to the internal network.

Answer

An IPSec phase 1 configuration

Answer

A BGP session with the client

Answer

A dedicated hardware switch

Question 6

Which THREE items are included in the configuration file of a FortiGate?

Accepted Answer

User certificates. The configuration file contains system settings, policy rules, and interface definitions.

Answer

FortiGuard cached updates

Answer

Real-time session tables

Question 7

Which THREE types of traffic are typically NOT offloaded by the NP6 processor?

Accepted Answer

Traffic requiring proxy-based inspection. Traffic that requires complex inspection, such as encrypted traffic that hasn't been decrypted or specific types of tunnels without hardware support, is handled by the CPU.

Answer

Simple ICMP packets

Answer

Standard UDP traffic

Question 8

Which TWO methods are used to achieve traffic separation in a multi-VDOM environment?

Accepted Answer

Using VLAN sub-interfaces. Physical port assignment and VLAN tagging are the standard methods for segmenting traffic at the network edge in VDOMs.

Answer

Enabling SSL inspection globally

Answer

Using different HA clusters

Answer

Using different firmware versions

Question 9

Which TWO settings are modified to reduce the impact of a failover event in an HA cluster?

Accepted Answer

hb-interval. 'hb-interval' and 'hb-lost-threshold' determine how quickly the cluster reacts to heartbeat loss.

Answer

group-password

Answer

priority

Answer

monitored-interfaces

Question 10

Which THREE aspects of the FortiGate system are affected by changing the global 'set vdom-mode' to 'multi-vdom'?

Accepted Answer

CLI command hierarchy. Changing the VDOM mode affects the CLI hierarchy, the available memory for VDOMs, and how system resources are partitioned.

Answer

The HA cluster size

Answer

The physical port order