NSE7_EFW Security And VPN Practice Test 2 — 15 Questions

Question 1

Which FortiGate feature should be enabled to prevent internal users from accessing malicious websites based on real-time threat intelligence?

Accepted Answer

Web Filter. Web Filtering using categories provides real-time protection by checking URLs against the FortiGuard database.

Answer

Antivirus profile

Answer

Application Control

Answer

DNS Filter

Question 2

When using an IPS sensor, what is the difference between 'Protect' and 'Monitor' mode?

Accepted Answer

Protect drops traffic; Monitor only logs it. 'Protect' drops the traffic if a signature matches, whereas 'Monitor' logs the hit without dropping the traffic.

Answer

Protect applies only to WAN; Monitor applies to LAN

Answer

Protect requires SSL inspection; Monitor does not

Answer

Protect logs traffic; Monitor drops it

Question 3

Which command is used to troubleshoot connectivity by checking the routing table of a specific IP address on the FortiGate?

Accepted Answer

get router info routing-table detail <ip>. The 'get router info route detail' or 'execute router info routing-table' commands are standard for verifying paths.

Answer

diagnose sniffer packet

Answer

get system status

Answer

exec ping-options

Question 4

What is the primary function of the FortiGate Security Fabric?

Accepted Answer

To synchronize security policies and share intelligence across devices. The Security Fabric integrates multiple devices to provide coordinated, end-to-end security visibility and control.

Answer

To configure OSPF automatically

Answer

To increase the throughput of the firewall

Answer

To replace the need for an IPS sensor

Question 5

What does the 'FortiGuard' service provide to the FortiGate?

Accepted Answer

Real-time threat intelligence and database updates. FortiGuard provides real-time updates for security signatures, including IPS, Antivirus, and Web Filtering.

Answer

User management and authentication

Answer

Local firmware storage

Answer

Hardware acceleration support

Question 6

Which method is the most secure for managing FortiGate devices remotely?

Accepted Answer

HTTPS with restricted access via Trusted Hosts. SSH with key-based authentication or HTTPS with restricted access is standard; HTTPS is common for GUI access.

Answer

HTTP with password authentication

Answer

Telnet

Answer

SNMPv1

Question 7

In a site-to-site VPN, you need to allow traffic initiated from the remote site. What configuration is essential on the local FortiGate?

Accepted Answer

A firewall policy allowing traffic from the VPN zone to the Internal zone. A local firewall policy must exist to permit traffic arriving from the VPN interface and destined for the internal network.

Answer

An IPSec phase 3 policy

Answer

A static route to the remote subnet

Answer

A NAT rule for the remote subnet

Question 8

What is the effect of changing the IPS 'buffer' size on a FortiGate device?

Accepted Answer

It determines the maximum size of data packets to hold for inspection. Adjusting the IPS buffer affects how much data is held in memory for inspection, which can prevent packet drops during heavy traffic but increases memory load.

Answer

It disables the hardware acceleration engine

Answer

It changes the signature timeout

Answer

It increases the number of concurrent IPS connections

Question 9

You need to inspect traffic between two internal VLANs. How do you ensure this traffic is processed by the FortiGate?

Accepted Answer

Configure firewall policies between the VLAN interfaces. Since VLANs are logical interfaces, the FortiGate will act as a gateway if the devices are configured to use the FortiGate's IP as their default gateway.

Answer

Enable hardware switching

Answer

Set the firewall mode to Transparent

Answer

Enable inter-VLAN routing on the switches only

Question 10

Which TWO of the following are necessary to successfully deploy an SSL VPN in tunnel mode?

Accepted Answer

A valid SSL certificate for the VPN portal. Tunnel mode requires a configured portal and a policy allowing the VPN tunnel interface to the internal network.

Answer

An IPSec phase 1 configuration

Answer

A BGP session with the client

Answer

A dedicated hardware switch

Question 11

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

Accepted Answer

Encryption algorithm (e.g., AES-256). IKEv2 negotiates encryption, integrity, and Diffie-Hellman groups during the initial exchange.

Answer

TCP port selection

Answer

Firewall policy ID

Question 12

Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?

Accepted Answer

It uses fewer system resources than proxy-based inspection. Flow-based inspection is generally faster and provides better performance than proxy-based inspection.

Answer

It supports deep content inspection for all protocols

Answer

It requires manual buffer allocation

Answer

It offers more granular application control

Question 13

Which THREE of the following are mandatory for a BGP neighbor adjacency to establish?

Accepted Answer

Correct autonomous system numbers. BGP requires the correct AS numbers, reachable IPs, and matching timers or specific parameters to form a connection.

Answer

Identical prefix lists

Answer

Identical router IDs

Question 14

Which THREE types of traffic are typically inspected by an IPS policy?

Accepted Answer

HTTP/HTTPS traffic. IPS is designed to detect and block threats in common protocols like HTTP, FTP, and SMTP.

Answer

SNMP monitoring traffic

Answer

ICMP echo requests

Question 15

In a high availability (HA) cluster, which THREE settings are synchronized between the primary and secondary units?

Accepted Answer

Address objects. HA synchronization ensures that policies, objects, and configurations are mirrored to provide seamless failover.

Answer

Hardware serial numbers

Answer

Management IP address