NSE7_EFW Security And VPN — 15 Questions

Question 1

In an OSPF setup, you have a redundant path. You want to ensure traffic prefers one link over another based on cost. Which OSPF command is used?

Accepted Answer

set ospf-cost. The OSPF cost is configured on the interface level to influence link preference.

Answer

set metric-type

Answer

set bandwidth-reference

Answer

set priority

Question 2

You are troubleshooting a high CPU issue on a FortiGate. Which utility should you use to identify which process is consuming the most resources?

Accepted Answer

diagnose sys top. The 'get system performance status' command is the primary tool to see process-level CPU usage.

Answer

get system hardware status

Answer

diagnose sniffer packet

Answer

get router info memory

Question 3

Which TWO items must be configured to ensure a FortiGate can successfully resolve external hostnames?

Accepted Answer

DNS server IP addresses in system settings. DNS settings are required for the FortiGate itself to resolve external names, and firewall policies must allow DNS traffic if the client uses the FortiGate as a DNS proxy.

Answer

A firewall policy allowing DNS traffic from internal clients to the FortiGate

Answer

An OSPF area configuration

Answer

An IPSec tunnel for DNS traffic

Answer

A static route to the internet

Question 4

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?

Accepted Answer

Mismatched Phase 2 selectors. Phase 2 failure is usually due to mismatched selectors (proxy IDs) or mismatched encryption/authentication algorithms.

Answer

Incorrect IKE version

Answer

Expired certificate

Answer

Mismatched pre-shared key

Question 5

You are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?

Accepted Answer

Create an IPS sensor override for the specific signature ID. Using an IPS sensor override or a specific signature exemption allows you to modify the behavior for a single signature without disabling it globally.

Answer

Change the IPS mode from blocking to monitoring

Answer

Disable the entire IPS sensor profile

Answer

Increase the IPS packet buffer size

Question 6

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

Accepted Answer

Use a route map in the OSPF redistribute configuration. A route map must be applied during redistribution to filter the prefixes being injected.

Answer

Configure a distribute-list in the OSPF process

Answer

Use an IP prefix list under the OSPF area command

Answer

Use an access list under the interface configuration

Question 7

What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?

Accepted Answer

Implicit Deny. The implicit deny policy is the last rule in the firewall policy list and drops all non-matching traffic.

Answer

Send to local DNS

Answer

Route to DMZ

Answer

Allow

Question 8

In a BGP deployment, your FortiGate is receiving routes from two different ISPs. You want to influence outbound traffic to prefer ISP1 for specific destinations. Which BGP attribute should you modify?

Accepted Answer

Local Preference. Local Preference is used to influence outbound traffic selection within an AS.

Answer

Weight

Answer

AS-Path

Answer

Multi-Exit Discriminator (MED)

Question 9

A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?

Accepted Answer

The FortiGate CA certificate used for SSL inspection. The FortiGate acts as a man-in-the-middle, so the client must trust the CA certificate generated by the FortiGate.

Answer

The FortiGate's local device certificate

Answer

The Fortinet_Factory CA certificate

Answer

A third-party public CA certificate

Question 10

You are implementing SSL VPN and need to ensure that only compliant corporate laptops can connect. Which feature should you use?

Accepted Answer

Host check. Host check allows the FortiGate to verify the presence of specific software like Antivirus before allowing the VPN connection.

Answer

SSL VPN portal settings

Answer

Two-factor authentication

Answer

PKI user authentication

Question 11

You notice that an IPsec tunnel is up, but no traffic passes. What is the most common reason related to firewall policy configuration?

Accepted Answer

Missing firewall policy. Even if the tunnel is up, a policy must exist to allow traffic to flow between the internal network and the tunnel interface.

Answer

Missing static route

Answer

Incorrect IKE ID

Answer

Phase 1 lifetime expiration

Question 12

You are configuring BGP and need to advertise a summary route to your ISP. How do you ensure only the summary route is advertised?

Accepted Answer

Use an aggregate-address with summary-only. The 'aggregate-address' command with the 'summary-only' option is the correct way to advertise only the summary and suppress specific component routes.

Answer

Use a distribute-list

Answer

Set the weight to 0

Answer

Configure a route map with a prefix list

Question 13

Which FortiGate feature allows you to bypass SSL inspection for specific known-trusted websites to maintain user privacy?

Accepted Answer

URL Filter category exemption. SSL Inspection Exemptions allow bypassing decryption for specific categories or domains.

Answer

Firewall address object

Answer

Application Control override

Answer

IPS signature exclusion

Question 14

What is the purpose of the 'Any' interface in a firewall policy?

Accepted Answer

To match traffic regardless of the ingress or egress interface. The 'Any' interface enables the policy to match traffic originating from or destined to any physical or logical interface on the FortiGate.

Answer

To force traffic through the hardware switch

Answer

To bypass the routing table

Answer

To match traffic only on the WAN port

Question 15

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

Accepted Answer

To encapsulate ESP packets. NAT-T encapsulates ESP packets in UDP 4500 to allow them to pass through NAT devices that would otherwise break ESP integrity.

Answer

To replace the AH protocol

Answer

To manage Phase 1 re-keying

Answer

To verify certificate revocation status