NSE7_EFW Multiple Select — 30 Questions

Question 1

Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?

Accepted Answer

It uses fewer system resources than proxy-based inspection. Flow-based inspection is beneficial because it uses fewer system resources than proxy-based inspection (B): instead of buffering and reassembling full content in a proxy, it inspects packets as they stream through, so it consumes less CPU and memory. It also provides higher throughput performance (C), since the single-pass, stream-oriented engine avoids the store-and-forward overhead and per-protocol proxy processing that slows proxy-based mode. Options A and E are not flow-mode benefits: deep content inspection for all protocols and more granular application control are strengths associated with proxy-based inspection, which can buffer and fully decode traffic. Option D is incorrect because manual buffer allocation is not a requirement or benefit of flow-based inspection; buffering is largely handled automatically and minimized in this mode.

Answer

It supports deep content inspection for all protocols

Answer

It requires manual buffer allocation

Answer

It offers more granular application control

Question 2

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a policy change is made, it is properly validated and installed without causing downtime. Which TWO actions should be taken before installing the policy package? (Choose two.)

Accepted Answer

Review the installation preview to understand the changes. Before installing a policy package, it is essential to run a policy check to catch errors and to review the installation preview to see the exact changes. These steps help ensure that the installation will not cause unintended downtime or security issues. Other actions like workspace mode or scheduling are supplementary but not directly related to validation.

Answer

Schedule the installation during a maintenance window

Answer

Install the policy package to all devices simultaneously

Answer

Enable workspace mode to lock the ADOM

Question 3

Which TWO methods are used to achieve traffic separation in a multi-VDOM environment?

Accepted Answer

Using VLAN sub-interfaces. In a multi-VDOM FortiGate environment, traffic separation is achieved by assigning physical ports to VDOMs (option C), since each VDOM maintains its own independent routing table, firewall policies, and interfaces, so binding distinct physical interfaces to different VDOMs isolates their traffic at Layer 1/2. VLAN sub-interfaces (option A) also achieve traffic separation because a single physical interface can be partitioned into multiple VLAN-tagged sub-interfaces, each of which can be placed in a different VDOM, keeping the VLANs logically isolated even when they share the same physical link. Options B, D, and E do not provide traffic separation: SSL inspection is a security inspection feature, different HA clusters relate to redundancy/device grouping rather than intra-device VDOM traffic isolation, and differing firmware versions are irrelevant (and unsupported) for separating traffic within a multi-VDOM deployment.

Answer

Enabling SSL inspection globally

Answer

Using different HA clusters

Answer

Using different firmware versions

Question 4

Which TWO of the following are valid methods for user authentication on a FortiGate?

Accepted Answer

RADIUS. RADIUS (B) is a valid authentication method on a FortiGate: the device can act as a RADIUS client, forwarding user credentials to an external RADIUS server for verification in firewall authentication, SSL VPN, IPsec VPN, and administrative login scenarios. LDAP (C) is likewise valid: FortiGate supports LDAP authentication by binding to directory servers such as Active Directory or OpenLDAP to validate user credentials for the same authentication features. The remaining options are routing or multicast protocols, not authentication mechanisms: BGP (A) and RIP (E) are routing protocols used to exchange route information, and IGMP (D) is a multicast group management protocol, so none of them authenticate users.

Answer

BGP

Answer

IGMP

Answer

RIP

Question 5

Which THREE items are included in a Policy Package when it is pushed from FortiManager?

Accepted Answer

Service Objects. A Policy Package in FortiManager is the container that holds the firewall policy configuration destined for managed FortiGate devices, and it includes Firewall Policies (B), which are the actual allow/deny rules pushed to the device. It also includes the reusable Address Objects (E) and Service Objects (A) that those policies reference, since these named objects must exist on the FortiGate for the policy to function. System interface settings (C) and Routing tables (D) are device-level configuration, not part of the Policy Package; they are handled separately (e.g., via the device's system settings or the "Install Wizard" device-level options), so they are not pushed as part of the policy package.

Answer

System interface settings

Answer

Routing tables

Question 6

An administrator is troubleshooting a FortiGate HA cluster in Active-Passive mode. The primary unit unexpectedly failed over to the secondary, and the administrator needs to verify which configuration settings are synchronized between the nodes. Which two configuration elements are synchronized by default in an HA cluster? (Choose two.)

Accepted Answer

Interface IP addresses and static routes. By default, FortiGate HA synchronizes the security and networking configuration, including firewall address objects, policies, interface IP addresses, and static routes. These elements are critical for consistent traffic handling after a failover. Management settings such as hostname, passwords, SNMP, and syslog are not synchronized by default, and HA operational parameters like priority and virtual MAC are handled separately.

Answer

SNMP community strings and syslog server settings

Answer

The FortiGate hostname and administrative passwords

Answer

The cluster's virtual MAC address and HA priority

Question 7

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a new FortiGate is added to an ADOM, it automatically receives a base configuration that includes specific administrative settings, such as DNS servers and NTP servers. Which two FortiManager features can be used to accomplish this? (Choose two.)

Accepted Answer

Provisioning Templates. Provisioning Templates and CLI Templates are both designed to push configuration settings to managed FortiGates. Provisioning Templates are specifically for system-level settings and can be automatically applied when devices are added to an ADOM. CLI Templates offer more flexibility by allowing raw CLI commands to be executed on devices. Together, they can ensure that new FortiGates receive the required base configuration, including DNS and NTP servers.

Answer

Policy Packages

Answer

ADOM Revisions

Answer

Device Groups

Question 8

An administrator is configuring a new FortiManager installation and needs to set up administrative access. The administrator wants to ensure that only authorized personnel can log in and that their actions are logged. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Create administrator accounts with strong passwords and assign appropriate profiles.. To ensure only authorized personnel can log in, administrator accounts with strong passwords and appropriate profiles must be created. To log their actions, administrative logging must be configured. These two configurations directly address the access control and logging requirements. Other options, while beneficial, are not strictly required to meet the stated goals.

Answer

Enable 'Strong Password' policy in the FortiManager global settings.

Answer

Set up a remote syslog server for storing logs.

Answer

Enable two-factor authentication for administrator accounts.

Question 9

An administrator is configuring a FortiGate in transparent mode. The FortiGate will be placed between an internal network and a router. The administrator wants to ensure that the FortiGate can be managed remotely and that it can still perform security inspections. Which two configurations are required? (Choose two.)

Accepted Answer

Configure firewall policies to allow traffic between the internal network and the router.. In transparent mode, the FortiGate forwards traffic at Layer 2, so data interfaces do not have IP addresses. To manage the device remotely, an IP address must be assigned to a management interface or a VLAN interface. Additionally, firewall policies are required to allow traffic between the internal and external interfaces; these policies also enable security inspections. Without these, traffic would be blocked, and the FortiGate would not be manageable remotely.

Answer

Enable NAT on the external interface to allow internal hosts to access the internet.

Answer

Configure a default gateway on the FortiGate to route management traffic.

Answer

Set the FortiGate to NAT mode instead of transparent mode to enable security inspections.

Question 10

An administrator is deploying a new IPsec VPN between two FortiGates. They want to ensure that the VPN can recover quickly from network disruptions and that only specific subnets are allowed over the tunnel. Which TWO configuration steps are required to meet these requirements? (Choose two.)

Accepted Answer

Enable dead peer detection (DPD) on both ends with a suitable interval and retry count.. To ensure quick recovery, DPD must be enabled to detect peer failures promptly. To restrict traffic to specific subnets, phase2 selectors must be configured with the desired local and remote subnets. These two steps together meet the requirements. The other options do not address the specific needs of recovery and subnet restriction.

Answer

Enable NAT traversal (NAT-T) on the phase1 configuration.

Answer

Configure a firewall policy that allows all traffic between the two sites without any restrictions.

Answer

Set the phase1 proposal to use only AES-256 encryption and SHA-256 hashing.

Question 11

An administrator is configuring a FortiGate to perform SSL deep inspection for outbound HTTPS traffic. Which TWO actions are required to ensure that users can browse HTTPS sites without certificate errors? (Choose two.)

Accepted Answer

Enable SSL inspection in the firewall policy that allows outbound HTTPS traffic.. SSL deep inspection requires the FortiGate to act as a man-in-the-middle, re-signing server certificates with its own CA. Therefore, clients must trust the FortiGate's CA certificate, and the firewall policy must have SSL inspection enabled with deep inspection mode. Without both, clients will see certificate errors or traffic will not be inspected.

Answer

Configure the FortiGate to use a public CA certificate for re-signing.

Answer

Set the inspection mode to certificate inspection instead of deep inspection.

Answer

Import the server certificates from all HTTPS websites into the FortiGate.

Question 12

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

Accepted Answer

Encryption algorithm (e.g., AES-256). During IKEv2 Phase 1 (IKE_SA_INIT and IKE_AUTH), the peers negotiate the encryption algorithm (A), such as AES-256, which protects the IKE SA itself, and the Diffie-Hellman group (E), which determines the key-exchange strength used to derive shared secret keys. They also negotiate the authentication method (B), such as PSK or RSA signatures, to verify each peer's identity during IKE_AUTH. TCP port selection (C) is not negotiated in Phase 1 because IKE uses UDP ports 500 and 4500, and TCP is not used for IKE. A firewall policy ID (D) is a local configuration construct, not an IKEv2 Phase 1 negotiation parameter.

Answer

TCP port selection

Answer

Firewall policy ID

Question 13

In a high availability (HA) cluster, which THREE settings are synchronized between the primary and secondary units?

Accepted Answer

Address objects. In an HA cluster, the configuration that defines security processing is synchronized from the primary to the secondary unit, and address objects (C) are part of that shared configuration so both units resolve the same IPs, ranges, and FQDNs during failover. The user authentication database (D) is also synchronized so locally defined users, groups, and credentials remain valid on the secondary after a failover, avoiding authentication outages. Firewall policies (E) are synchronized as core security configuration, ensuring the secondary enforces identical rules and traffic handling when it takes over. Hardware serial numbers (A) are device-specific identifiers and are never synchronized, and the management IP address (B) is intentionally unique per unit so each node remains individually reachable for administration.

Answer

Hardware serial numbers

Answer

Management IP address

Question 14

Which TWO options are available when configuring an SD-WAN rule in FortiManager?

Accepted Answer

Source/Destination criteria. In FortiManager, when you create an SD-WAN rule (SD-WAN Rule / Centralized SD-WAN configuration), the rule must define the traffic it matches and how that traffic is handled. Option B (Source/Destination criteria) is correct because SD-WAN rules match traffic based on source and destination parameters (such as source/destination addresses, users, applications, and services) to identify which flows the rule applies to. Option C (Traffic steering strategy) is correct because each SD-WAN rule requires a steering strategy that determines how matched traffic is distributed or prioritized across SD-WAN members, such as best-quality, lowest-cost, maximize-bandwidth, or manual/SLA-based selection. Option A (Interface physical speed) is not a configurable SD-WAN rule parameter; link speed is a property of the interface/health-check performance, not a rule-matching or steering field. Option D (MAC address spoofing) is unrelated to SD-WAN rule configuration and is not a supported SD-WAN rule setting. Option E (Hardware acceleration toggle) is an interface/system-level setting, not an SD-WAN rule option.

Answer

Interface physical speed

Answer

MAC address spoofing

Answer

Hardware acceleration toggle

Question 15

An administrator is configuring an HA cluster of two FortiGates in Active-Passive mode. The cluster must maintain session continuity for TCP traffic when a failover occurs, and the administrator wants to minimize unnecessary failovers caused by link flaps on a monitored interface. (Choose two.)

Accepted Answer

Enable session pickup so that TCP session state is synchronized to the backup unit.. Session pickup synchronizes TCP session state so connections survive failover, and interface monitoring hold time and retry settings prevent brief link flaps from triggering unnecessary failovers. Together these address session continuity and failover stability. Priority, heartbeat, and override settings affect election behavior but do not solve the specific requirements.

Answer

Disable heartbeat interfaces and rely only on monitored data interfaces for failure detection.

Answer

Set the HA priority of the backup unit higher than the primary unit to speed up the election.

Answer

Enable override so that the unit with the highest priority always becomes the primary after a failover.

Question 16

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a new firmware version is released, they can test it on a few devices before rolling it out to all. Which two FortiManager features or steps are required to accomplish this? (Choose two.)

Accepted Answer

Use the 'Import Firmware' option to upload the new firmware image to FortiManager.. To test firmware on a subset, you need the firmware image on FortiManager and a way to target only those devices. Importing the firmware ensures availability, and creating a device group allows selective upgrade. Auto-Update and scheduled delays do not provide the needed control, and configuration retrieval is a backup step, not a rollout mechanism.

Answer

Use the 'Retrieve Configuration' option before upgrading to ensure current settings are backed up.

Answer

Enable 'Auto-Update' in the FortiManager system settings to automatically download firmware from FortiGuard.

Answer

Configure a firmware upgrade schedule that applies to all devices but with a delay for non-test devices.

Question 17

A FortiManager administrator is configuring a new ADOM for a multi-tenant environment. The administrator needs to ensure that each tenant's FortiGates are isolated and that tenants cannot view or modify each other's configurations. Which two actions should the administrator take to achieve this? (Choose two.)

Accepted Answer

Configure each tenant's FortiGates in a separate ADOM and assign the tenant's administrative user to only that ADOM.. To achieve multi-tenant isolation, the administrator must create separate ADOMs for each tenant and assign tenant-specific administrative users with custom profiles limited to their respective ADOM. This ensures that tenants cannot access or modify other tenants' configurations. ADOM locking and FortiManager Fabric do not provide isolation, and using a Super_User profile would grant excessive privileges.

Answer

Enable 'ADOM Locking' to prevent concurrent modifications by different tenants.

Answer

Use the 'Super_User' profile for all tenant administrators and rely on ADOM assignments to restrict access.

Answer

Enable 'FortiManager Fabric' to automatically isolate tenant configurations.

Question 18

A FortiManager administrator is configuring a new policy package for a managed FortiGate. The administrator wants to ensure that the policy package can be installed successfully and that the FortiGate will enforce the policies as intended. Which two actions must be performed before installing the policy package? (Choose two.)

Accepted Answer

Ensure the FortiGate device is in the same ADOM as the policy package.. To install a policy package to a FortiGate, the package must be assigned to the device in Device Manager, and the device must be in the same ADOM as the package. These two conditions ensure that the package is applicable to the device and that the installation can proceed. Other steps like consistency checks or workspace mode are optional or unrelated.

Answer

Run a policy consistency check to validate the package.

Answer

Configure a firewall address object for all external interfaces.

Answer

Enable workspace mode for the ADOM to allow policy editing.

Question 19

Which TWO types of reports can be generated in the FortiAnalyzer module of FortiManager?

Accepted Answer

Custom reports. FortiAnalyzer, whether accessed directly or via the FortiManager module, supports two main report categories: Custom reports (option A), which administrators create from scratch or by modifying templates to select specific datasets, time periods, and layouts, and Pre-defined reports (option B), which are built-in templates provided by Fortinet for common use cases such as traffic, security, and bandwidth analysis. Both are valid report types generated within the FortiAnalyzer module of FortiManager. The other options do not belong: Policy change impact reports (C) are not a FortiAnalyzer report type, Hardware diagnostic reports (D) are not generated by FortiAnalyzer, and Firmware compatibility reports (E) are unrelated to FortiAnalyzer reporting functionality.

Answer

Policy change impact reports

Answer

Hardware diagnostic reports

Answer

Firmware compatibility reports

Question 20

A security administrator is using FortiManager to manage a large number of FortiGates. The administrator needs to ensure that when a policy package is installed, the installation is performed efficiently and only to devices that require the changes. Which two actions should the administrator take to optimize the installation process? (Choose two.)

Accepted Answer

Use 'Install Wizard' and select only the devices that need the policy changes.. To optimize policy installation in FortiManager, administrators should target only the devices that require the changes. This can be achieved by selecting specific devices in the Install Wizard and by ensuring the policy package is assigned only to those devices. These actions reduce unnecessary installations, minimize network load, and improve overall efficiency. Other options like Auto Install or Install All do not provide targeted deployment and can lead to inefficiencies.

Answer

Use 'Install All' to ensure all devices are up to date.

Answer

Schedule installations during off-peak hours to reduce impact.

Answer

Enable 'Auto Install' on the policy package to push changes automatically to all devices.