NSE7_EFW Security And VPN Practice Test 3 — 15 Questions

Question 1

A FortiGate is configured with an IPsec VPN tunnel using IKEv2. The administrator wants to ensure that the tunnel uses perfect forward secrecy (PFS) and that the DH group is 14. Which configuration change is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the Phase 2 proposal's DH group to 14 and enable PFS.. Perfect forward secrecy in IPsec is achieved by specifying a DH group in the Phase 2 proposal. This ensures that each new IPsec SA uses a unique key derived from a fresh DH exchange. Setting the Phase 2 DH group to 14 meets the requirement.

Answer

Set the Phase 1 proposal's DH group to 14 and enable PFS.

Answer

Enable PFS in the Phase 1 settings and set the DH group to 14 in Phase 2.

Answer

Set the DH group to 14 in both Phase 1 and Phase 2 and enable PFS in Phase 1.

Question 2

A network administrator is configuring a FortiGate to perform deep inspection of SSL traffic for a specific web server. The server uses a certificate signed by an internal certificate authority (CA). The administrator wants to ensure that the FortiGate can inspect the traffic without generating certificate errors for users. What must the administrator do?

Accepted Answer

Configure the SSL inspection profile to use the internal CA certificate as the signing certificate, and ensure that users' browsers trust that CA.. Deep inspection requires the FortiGate to act as a man-in-the-middle, decrypting and re-encrypting traffic. To do this without errors, the FortiGate must use a CA certificate to re-sign the server's certificate, and clients must trust that CA. Using the internal CA as the signing certificate and distributing it to clients ensures seamless inspection.

Answer

Import the internal CA certificate into the FortiGate's local certificate store and enable deep inspection in the SSL inspection profile.

Answer

Enable 'untrusted SSL' inspection in the SSL inspection profile and set the action to 'allow' so that the FortiGate can inspect traffic without decrypting.

Answer

Install the web server's certificate on the FortiGate and enable 'ssl-exempt' for that server to avoid inspection issues.

Question 3

An administrator is configuring an SSL VPN on a FortiGate to allow remote users to access internal web applications. The administrator wants to ensure that users can access multiple internal web servers using their IP addresses, but the servers use different ports. Which two configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Create a firewall policy that allows traffic from the SSL VPN interface to the internal servers' subnets, specifying the appropriate services and ports.. To allow SSL VPN users to access multiple internal web servers on different ports, two key steps are required: a firewall policy that permits traffic from the SSL VPN interface to the internal servers, including the necessary ports, and bookmarks in the SSL VPN portal to provide easy access to each server. The firewall policy is essential for security and traffic flow, while bookmarks enhance usability. Other options like separate portals or web mode are not mandatory for this scenario.

Answer

Enable 'web mode' in the SSL VPN settings to allow access to web applications through the browser.

Answer

Configure the SSL VPN portal to use 'tunnel mode' and define the internal subnets as split tunnel routes.

Answer

Configure a separate SSL VPN portal for each web server, specifying the server's IP and port in the portal settings.

Question 4

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?

Accepted Answer

Mismatched Phase 2 selectors. Phase 2 failures in IPsec VPN are commonly caused by mismatched Phase 2 selectors (also known as proxy IDs or encryption domains). If the local and remote subnets or selectors do not match exactly, the tunnel will fail to establish.

Answer

Incorrect IKE version

Answer

Expired certificate

Answer

Mismatched pre-shared key

Question 5

You are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?

Accepted Answer

Create an IPS sensor override for the specific signature ID. An IPS sensor override lets you change the action for a single signature ID (or a signature and its parameters) without disabling the whole sensor or the entire IPS profile. Setting the offending signature to 'Monitor' or 'Pass' while leaving all other signatures in blocking mode resolves the false positive while preserving protection against every other threat. This is the surgical, least-disruptive fix.

Answer

Change the IPS mode from blocking to monitoring

Answer

Disable the entire IPS sensor profile

Answer

Increase the IPS packet buffer size

Question 6

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

Accepted Answer

Use a route map in the OSPF redistribute configuration. In FortiOS, when redistributing routes into OSPF, you can attach a route map to the redistribute command to filter which routes are advertised. The route map can match specific criteria such as IP prefix lists, access lists, or interface names. By using a route map that matches only the desired subnet, you ensure that only that connected route is redistributed into OSPF. This is the standard and most flexible method for selective redistribution.

Answer

Configure a distribute-list in the OSPF process

Answer

Use an IP prefix list under the OSPF area command

Answer

Use an access list under the interface configuration

Question 7

What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?

Accepted Answer

Implicit Deny. FortiGate firewall policies are evaluated top-down, and if no explicit policy matches the traffic, the implicit deny rule at the bottom of the policy table drops the packet. This default-deny posture is a core security principle and is not configurable to 'allow' by default. The implicit deny also logs denied traffic if logging is enabled on the implicit rule.

Answer

Send to local DNS

Answer

Route to DMZ

Answer

Allow

Question 8

A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?

Accepted Answer

The FortiGate CA certificate used for SSL inspection. When configuring SSL inspection, the FortiGate acts as a man-in-the-middle, presenting its own certificate to clients. To prevent browser warnings, the FortiGate CA certificate used for SSL inspection must be installed as a trusted root CA on client endpoints. This allows clients to trust the certificates generated by the FortiGate.

Answer

The FortiGate's local device certificate

Answer

The Fortinet_Factory CA certificate

Answer

A third-party public CA certificate

Question 9

You are implementing SSL VPN and need to ensure that only compliant corporate laptops can connect. Which feature should you use?

Accepted Answer

Host check. Host check (also called host checking or endpoint compliance) in FortiOS SSL VPN evaluates the connecting endpoint against configured compliance rules — such as OS version, antivirus presence, or registry keys — before granting access. This ensures only compliant corporate laptops can establish the tunnel.

Answer

SSL VPN portal settings

Answer

Two-factor authentication

Answer

PKI user authentication

Question 10

You notice that an IPsec tunnel is up, but no traffic passes. What is the most common reason related to firewall policy configuration?

Accepted Answer

Missing firewall policy. An IPsec tunnel can be fully up (Phase 1 and Phase 2 SAs established) yet pass no traffic if there is no firewall policy that permits the interesting traffic between the two protected subnets. FortiGate requires an explicit firewall policy matching source, destination, and service to allow traffic through the tunnel; without it, the implicit deny drops the packets even though the tunnel itself is healthy.

Answer

Missing static route

Answer

Incorrect IKE ID

Answer

Phase 1 lifetime expiration

Question 11

You are configuring BGP and need to advertise a summary route to your ISP. How do you ensure only the summary route is advertised?

Accepted Answer

Use an aggregate-address with summary-only. The BGP aggregate-address command with the summary-only keyword suppresses all more-specific component routes from being advertised, so only the summary route is sent to the ISP. This is the standard way to perform route summarization while hiding the contributing prefixes from external peers.

Answer

Use a distribute-list

Answer

Set the weight to 0

Answer

Configure a route map with a prefix list

Question 12

What is the purpose of the 'Any' interface in a firewall policy?

Accepted Answer

To match traffic regardless of the ingress or egress interface. In a FortiGate firewall policy, the 'any' interface is a wildcard that matches traffic regardless of which physical or logical interface it arrives on or leaves through. It is typically used for policies that should apply universally, such as a deny-all cleanup rule or a policy that must catch traffic on any interface. It does not bypass routing or force traffic anywhere; it simply removes the interface as a match criterion.

Answer

To force traffic through the hardware switch

Answer

To bypass the routing table

Answer

To match traffic only on the WAN port

Question 13

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

Accepted Answer

To encapsulate ESP packets. UDP port 4500 is used for NAT-Traversal (NAT-T) to encapsulate ESP packets within UDP. This allows IPsec traffic to pass through NAT devices that would otherwise drop ESP packets.

Answer

To replace the AH protocol

Answer

To manage Phase 1 re-keying

Answer

To verify certificate revocation status

Question 14

Which FortiGate feature should be enabled to prevent internal users from accessing malicious websites based on real-time threat intelligence?

Accepted Answer

Web Filter. A Web Filter profile on FortiGate inspects HTTP/HTTPS requests and can block or allow URLs based on FortiGuard category ratings and real-time threat intelligence, including malicious and newly observed domains. It is the feature specifically designed to prevent users from reaching malicious websites. Other profiles address different threat vectors (malware files, applications, DNS queries) and do not provide the same URL-reputation-based blocking.

Answer

Antivirus profile

Answer

Application Control

Answer

DNS Filter

Question 15

When using an IPS sensor, what is the difference between 'Protect' and 'Monitor' mode?

Accepted Answer

Protect drops traffic; Monitor only logs it. In a FortiGate IPS sensor, each signature can be set to 'Monitor' or 'Protect' (or 'Disable'). Monitor mode generates a log/event when the signature matches but does not block the traffic, allowing baselining and false-positive tuning. Protect mode actively drops or resets the offending session in addition to logging, enforcing the signature.

Answer

Protect applies only to WAN; Monitor applies to LAN

Answer

Protect requires SSL inspection; Monitor does not

Answer

Protect logs traffic; Monitor drops it