NSE7_EFW Security And VPN Practice Test 2 — 15 Questions

Question 1

An administrator wants to configure a FortiGate to perform deep SSL inspection for traffic to a specific category of websites, while excluding financial websites from inspection to comply with privacy policies. Which FortiGate feature allows this granular control?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSL inspection exemptions. SSL inspection exemptions are designed to bypass deep inspection for specific destinations or categories. By exempting financial categories, the FortiGate will not decrypt that traffic, respecting privacy policies. Other features like web filtering or application control do not directly control the inspection exemption list.

Answer

FortiGuard category-based SD-WAN rules

Answer

Application control sensor

Answer

Web filter profile with category-based actions

Question 2

A FortiGate is configured with an IPS sensor in monitor mode. The administrator notices that the sensor is detecting attacks but not blocking them. The administrator wants to change the sensor to block attacks while still logging them. Which action should the administrator take?

Accepted Answer

Change the IPS sensor action from Monitor to Block for the relevant signatures.. To block attacks, the IPS sensor's signature actions must be set to Block. Monitor mode only logs, so changing to Block ensures the FortiGate drops malicious packets. This action also logs the event by default, meeting the requirement to both block and log.

Answer

Set the action to 'Reset' for the signatures.

Answer

Change the IPS sensor mode from Monitor to Protect in the global settings.

Answer

Enable 'Block Malicious Traffic' in the firewall policy.

Question 3

A FortiGate is configured with a static route to 10.0.0.0/8 via 192.168.1.1. The administrator wants to ensure that if the primary next-hop becomes unreachable, the FortiGate automatically removes the route from the routing table. Which feature should be configured?

Accepted Answer

Enable 'link-health' on the static route and configure a health check.. Link-health monitoring on a static route enables the FortiGate to track the next-hop's reachability. If the health check fails, the route is withdrawn, allowing a backup route to be used. This is the correct way to achieve automatic failover for static routes without relying on dynamic routing protocols.

Answer

Enable 'blackhole' on the static route.

Answer

Set the route's administrative distance to a lower value.

Answer

Configure a dynamic routing protocol to redistribute the static route.

Question 4

A FortiGate is deployed as the hub in a hub-and-spoke IPsec VPN topology. A spoke's dynamic IP address changes, and the hub must re-establish the tunnel without administrator intervention. The spoke is configured with a pre-shared key and a dynamic DNS hostname. Which configuration on the hub allows the tunnel to recover automatically when the spoke's IP changes?

Accepted Answer

Configure the spoke's remote gateway as a fully qualified domain name (FQDN) on the hub and set the phase 1 interface to the public-facing interface.. Configuring the hub to use the spoke's FQDN as the remote gateway allows the hub to resolve the hostname and update the tunnel endpoint when the spoke's IP changes. This enables automatic recovery without manual intervention. DPD only detects failures, and using 0.0.0.0 is for dial-up scenarios where the hub does not initiate. Aggressive mode is not required for FQDN-based dynamic gateways.

Answer

Set the spoke's remote gateway to 0.0.0.0 and enable the 'dynamic' keyword in the phase 2 selector.

Answer

Set the spoke's remote gateway to the DDNS hostname and configure the hub to use IKEv2 with aggressive mode.

Answer

Enable dead peer detection (DPD) on the hub and set the retry count to 3 with a 10-second interval.

Question 5

You manage a FortiGate 600E cluster running FortiOS 7.2. A new IPsec VPN tunnel to a remote office is configured with IKEv2 and a pre-shared key. The remote office uses a FortiGate 60F behind a NAT device that performs port address translation. The tunnel fails to establish, and debug output shows that the remote gateway is not responding to the initial IKE packets. You verify that the pre-shared keys match and that UDP 500 and 4500 are allowed on both sides. Which configuration change on your local FortiGate is most likely to resolve the issue?

Accepted Answer

Enable NAT traversal (NAT-T) on the IPsec phase-1 configuration.. When a FortiGate is behind a NAT device, IPsec traffic may be dropped because the NAT device modifies the source port or IP address. Enabling NAT traversal on the phase-1 configuration allows the FortiGate to encapsulate IKE and ESP packets in UDP port 4500, which the NAT device can forward. This is the standard solution for IPsec behind NAT.

Answer

Change the IKE version to IKEv1.

Answer

Set the local gateway to use a dynamic IP address.

Answer

Configure a static route to the remote public IP address.

Question 6

A security administrator wants to inspect SSL-encrypted traffic for malware without breaking legitimate banking applications that use certificate pinning. The FortiGate is running FortiOS 7.0 and is configured for deep inspection. Which action should the administrator take to exclude the banking applications from SSL inspection while still inspecting all other HTTPS traffic?

Accepted Answer

Configure an application control profile that identifies the banking applications and set the action to 'Allow' with 'Exempt from SSL Inspection' enabled.. Using application control to identify the banking applications and marking them as exempt from SSL inspection allows the FortiGate to skip deep inspection for those apps while still inspecting other HTTPS traffic. This method is dynamic and does not rely on static IPs or certificate names. The other options are either impractical, misconfigured, or do not leverage application control for exemption.

Answer

In the SSL inspection profile, add the banking applications' certificate common names to the 'Exempt from SSL Inspection' list.

Answer

Enable 'Inspect All Ports' in the SSL inspection profile and set the action to 'Bypass' for the banking applications' server certificates.

Answer

Create a separate firewall policy that matches the banking applications' destination IP addresses and set the SSL inspection profile to 'no-inspection'.

Question 7

You are deploying a new FortiGate 200F in a small office. The office has a single internet connection and a web server that must be accessible from the internet on TCP port 443. You configure a virtual IP (VIP) to map the public IP to the internal web server's private IP. However, external users cannot reach the web server. You verify that the firewall policy allowing traffic from the WAN to the VIP is correct and that the web server is running. Which additional configuration is required on the FortiGate to make the web server accessible?

Accepted Answer

Ensure that the VIP is configured with the correct external IP and mapped to the internal IP, and that the firewall policy uses the VIP as the destination address.. A virtual IP (VIP) on a FortiGate performs destination NAT, mapping a public IP to a private IP. For external access to work, the VIP must be correctly configured, and the firewall policy must use the VIP as the destination address. The policy then allows the translated traffic to reach the internal server.

Answer

Create a firewall policy that allows traffic from the internal network to the web server.

Answer

Configure a firewall policy that allows traffic from the WAN to the internal web server's private IP address.

Answer

Enable NAT on the firewall policy that allows traffic from the WAN to the VIP.

Question 8

A FortiGate is configured as a dial-up IPsec VPN server for remote users. The administrator wants to ensure that a specific remote user, when connecting, is assigned the IP address 10.10.10.50 from a dedicated pool, and that this user's traffic is inspected by a specific firewall policy. Which configuration step is required to achieve this?

Accepted Answer

Create a dial-up IPsec VPN with mode-config, and in the user group configuration, set the 'set ip-address' to the desired IP for that user.. For dial-up IPsec VPNs, FortiGate supports mode-config to assign IP addresses to clients. To assign a specific IP to a particular user, you configure the user group with the 'set ip-address' option, which overrides the pool assignment. This allows the creation of policies that match that specific IP for granular control. The other options do not provide a mechanism for per-user static IP assignment.

Answer

Create a dial-up IPsec tunnel with a unique pre-shared key for that user and assign the IP address in the phase1 configuration.

Answer

Configure a user group with a firewall address object for the user's IP and apply it in the phase2 selector.

Answer

In the dial-up IPsec phase1, enable mode-config and assign an IP address from an IP pool using the 'set mode-cfg' and 'set assign-ip-from' commands with a specific user group.

Question 9

A network administrator is configuring an IPsec VPN on a FortiGate to connect to a third-party vendor's Cisco ASA. The tunnel fails to establish, and the administrator suspects a phase 1 parameter mismatch. Which two parameters must match exactly on both peers for phase 1 to succeed? (Choose two.)

Accepted Answer

Pre-shared key. For IPsec phase 1 to succeed, the encryption algorithm and pre-shared key (when using PSK authentication) must match exactly on both peers. The encryption algorithm ensures both sides can encrypt/decrypt IKE messages, and the PSK authenticates the peers. PFS is a phase 2 parameter, DH group can sometimes be negotiated if multiple groups are offered, and authentication method must be compatible but not identical.

Answer

Authentication method

Answer

Diffie-Hellman group

Answer

Perfect Forward Secrecy (PFS)

Question 10

A network administrator is configuring an IPsec VPN between two FortiGates. The administrator wants to ensure that the VPN tunnel is highly available and can fail over to a secondary interface if the primary interface goes down. Which TWO of the following configurations are required to achieve this? (Choose two.)

Accepted Answer

Enable dead peer detection (DPD) on the phase 1 configuration.. To achieve IPsec VPN high availability, the FortiGate must be able to detect a failed tunnel and fail over to an alternate remote gateway. Configuring multiple phase 1 gateways with different remote gateways provides the redundancy, and enabling dead peer detection (DPD) allows the FortiGate to detect failures and trigger failover. Other options like phase 2 selector or IKEv2 do not directly enable failover.

Answer

Enable IKEv2 for faster reconnection.

Answer

Configure a separate IPsec tunnel for each interface.

Answer

Set the phase 2 selector to 0.0.0.0/0 to allow all traffic.

Question 11

A FortiGate is configured with a dial-up IPsec VPN for remote users. The administrator wants to ensure that remote users can access internal resources but are not allowed to communicate with each other over the VPN. Which feature should be enabled on the FortiGate?

Accepted Answer

Client-to-client traffic blocking in the IPsec VPN settings.. To prevent remote VPN users from communicating with each other, the FortiGate must be configured to block client-to-client traffic. This setting is available in the IPsec VPN configuration and ensures that packets destined from one VPN client to another are dropped, thus isolating users while still allowing them to reach internal resources.

Answer

Split tunneling on the FortiClient.

Answer

Enabling XAuth for user authentication.

Answer

IPsec phase 2 selectors with 0.0.0.0/0 on the client side.

Question 12

A company is using FortiGate SSL VPN with web mode for remote users. The administrator wants to ensure that users can access internal web applications but cannot download files from those applications. Which SSL VPN portal configuration should be used?

Accepted Answer

Enable 'web mode' and in the portal settings, disable the 'file transfer' option.. In SSL VPN web mode, the portal settings include a 'file transfer' option. When disabled, users cannot download or upload files through the web portal, but they can still access web applications. This is the simplest and most direct way to meet the requirement. The other options either use the wrong mode or incorrect configuration methods.

Answer

Enable 'web mode' and configure a bookmark for each web application with the 'file transfer' option disabled.

Answer

Enable 'tunnel mode' and create a firewall policy that blocks file downloads.

Answer

Enable 'web mode' and configure a firewall policy to block HTTP file extensions.

Question 13

A network administrator is configuring an IPsec VPN between two FortiGates. The administrator enables 'auto-negotiate' on the phase-1 interface and sets the 'net-device' option to disable. The VPN tunnel comes up, but traffic from the local subnet is not being encrypted and sent through the tunnel. What is the most likely cause?

Accepted Answer

The phase-2 selectors do not match the local and remote subnets, so traffic is not matched by the VPN policy.. In an IPsec VPN, the phase-2 selectors must match the traffic that needs to be encrypted. If the local and remote subnets defined in phase-2 do not correspond to the actual source and destination of the traffic, the FortiGate will not match the traffic to the VPN policy, and it will not be encrypted or sent through the tunnel. Ensuring the selectors are correct resolves the issue.

Answer

The 'net-device' option must be enabled for the tunnel to be used as a route-based interface.

Answer

The 'auto-negotiate' option must be disabled to allow traffic to trigger the tunnel.

Answer

The FortiGate is missing a static route to the remote subnet pointing to the VPN interface.

Question 14

An administrator is configuring a FortiGate to perform SSL deep inspection. The administrator wants to ensure that the FortiGate can inspect traffic to a web server that uses a certificate signed by an internal CA. The internal CA certificate is installed on the FortiGate. Which two actions must the administrator take to allow SSL deep inspection to work without certificate errors? (Choose two.)

Accepted Answer

Add the internal CA certificate to the SSL inspection profile's trusted CA list.. To perform SSL deep inspection on traffic to a server with a certificate signed by an internal CA, the FortiGate must trust that internal CA. This requires importing the internal CA certificate into the FortiGate's local certificate store and adding it to the SSL inspection profile's trusted CA list. These two actions enable the FortiGate to validate the server's certificate and proceed with deep inspection without certificate errors.

Answer

Configure the SSL inspection profile to use the internal CA certificate for re-signing.

Answer

Ensure the FortiGate can reach the internal CA's CRL or OCSP server for revocation checks.

Answer

Install the internal CA certificate as a trusted CA on the client devices.

Question 15

An administrator is configuring a new SSL inspection profile on a FortiGate. The administrator wants to inspect HTTPS traffic for malware but must avoid decrypting traffic to financial websites due to privacy concerns. What should the administrator do?

Accepted Answer

Create a separate firewall policy for financial websites with SSL inspection set to no-inspection.. The recommended approach is to create a firewall policy that matches financial website categories and set SSL inspection to no-inspection. This policy should be placed above the general inspection policy. This way, traffic to financial sites is not decrypted, while other HTTPS traffic is inspected.

Answer

Disable SSL inspection globally and enable it only for specific policies.

Answer

Add the financial websites to the SSL inspection profile's exempt list.

Answer

Use a custom signature in the IPS sensor to bypass decryption for financial sites.