NSE7_EFW Security And VPN Practice Test 4 — 15 Questions

Question 1

Which command is used to troubleshoot connectivity by checking the routing table of a specific IP address on the FortiGate?

Accepted Answer

get router info routing-table detail . 'get router info routing-table detail ' queries the FortiGate's routing table for the specific destination IP, showing the matched route, next-hop, interface, and metric. This is the standard CLI command for verifying which route a packet to a given IP will take, making it the correct troubleshooting tool for routing lookups.

Answer

diagnose sniffer packet

Answer

get system status

Answer

exec ping-options

Question 2

What is the primary function of the FortiGate Security Fabric?

Accepted Answer

To synchronize security policies and share intelligence across devices. The FortiGate Security Fabric is an integrated architecture that connects FortiGate, FortiAnalyzer, FortiManager, FortiSandbox, FortiClient, and other Fabric-ready products so they can share threat intelligence, synchronize security policies, and coordinate response. Its primary function is that cross-product synchronization and intelligence sharing, not raw throughput or routing. This is what enables automated, end-to-end protection across the network.

Answer

To configure OSPF automatically

Answer

To increase the throughput of the firewall

Answer

To replace the need for an IPS sensor

Question 3

What does the 'FortiGuard' service provide to the FortiGate?

Accepted Answer

Real-time threat intelligence and database updates. FortiGuard is Fortinet's subscription-based security intelligence service that delivers real-time updates to the FortiGate, including antivirus signatures, IPS signatures, web filtering categories, application control signatures, and botnet/IP reputation databases. These updates keep the FortiGate's security profiles current against emerging threats.

Answer

User management and authentication

Answer

Local firmware storage

Answer

Hardware acceleration support

Question 4

Which method is the most secure for managing FortiGate devices remotely?

Accepted Answer

HTTPS with restricted access via Trusted Hosts. HTTPS with restricted access via Trusted Hosts is the most secure option because HTTPS encrypts administrative traffic (protecting credentials and configuration data in transit), and Trusted Hosts limits which source IP addresses or subnets can even attempt to connect to the management interface. This combination provides both confidentiality and access control.

Answer

HTTP with password authentication

Answer

Telnet

Answer

SNMPv1

Question 5

What is the effect of changing the IPS 'buffer' size on a FortiGate device?

Accepted Answer

It determines the maximum size of data packets to hold for inspection. The IPS buffer size on a FortiGate determines the maximum amount of data that can be held for inspection by the IPS engine. Adjusting it affects how much data is buffered before inspection, which can impact detection of threats in large packets or streams.

Answer

It disables the hardware acceleration engine

Answer

It changes the signature timeout

Answer

It increases the number of concurrent IPS connections

Question 6

You need to inspect traffic between two internal VLANs. How do you ensure this traffic is processed by the FortiGate?

Accepted Answer

Configure firewall policies between the VLAN interfaces. To inspect inter-VLAN traffic, the FortiGate must be the gateway for each VLAN, and firewall policies must be configured between the VLAN interfaces. This forces traffic to be routed by the FortiGate, allowing it to apply security profiles and inspection. Without policies, traffic may be dropped or not inspected.

Answer

Enable hardware switching

Answer

Set the firewall mode to Transparent

Answer

Enable inter-VLAN routing on the switches only

Question 7

Which TWO of the following are necessary to successfully deploy an SSL VPN in tunnel mode?

Accepted Answer

A valid SSL certificate for the VPN portal. Option C is correct because tunnel-mode SSL VPN requires the FortiGate (or equivalent SSL VPN gateway) to present a valid server certificate to the client during the TLS handshake; without a trusted certificate, browsers and FortiClient will reject the portal connection. Option D is correct because after the TLS tunnel is established, traffic from the SSL VPN interface (ssl.root / sslvpn) must be permitted by a firewall policy into the Internal zone to reach protected resources; without this policy, the tunnel comes up but no internal traffic flows. Option A is wrong because IPSec phase 1 applies to IPSec VPNs, not SSL/TLS-based VPNs. Option B is wrong because BGP is a dynamic routing protocol and is not required for SSL VPN client connectivity. Option E is wrong because SSL VPN tunnel mode can run on any supported FortiGate model or virtual appliance; dedicated hardware is not a requirement.

Answer

An IPSec phase 1 configuration

Answer

A BGP session with the client

Answer

A dedicated hardware switch

Question 8

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

Accepted Answer

Encryption algorithm (e.g., AES-256). During IKEv2 Phase 1 (IKE_SA_INIT and IKE_AUTH), the peers negotiate the encryption algorithm (A), such as AES-256, which protects the IKE SA itself, and the Diffie-Hellman group (E), which determines the key-exchange strength used to derive shared secret keys. They also negotiate the authentication method (B), such as PSK or RSA signatures, to verify each peer's identity during IKE_AUTH. TCP port selection (C) is not negotiated in Phase 1 because IKE uses UDP ports 500 and 4500, and TCP is not used for IKE. A firewall policy ID (D) is a local configuration construct, not an IKEv2 Phase 1 negotiation parameter.

Answer

TCP port selection

Answer

Firewall policy ID

Question 9

Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?

Accepted Answer

It uses fewer system resources than proxy-based inspection. Flow-based inspection is beneficial because it uses fewer system resources than proxy-based inspection (B): instead of buffering and reassembling full content in a proxy, it inspects packets as they stream through, so it consumes less CPU and memory. It also provides higher throughput performance (C), since the single-pass, stream-oriented engine avoids the store-and-forward overhead and per-protocol proxy processing that slows proxy-based mode. Options A and E are not flow-mode benefits: deep content inspection for all protocols and more granular application control are strengths associated with proxy-based inspection, which can buffer and fully decode traffic. Option D is incorrect because manual buffer allocation is not a requirement or benefit of flow-based inspection; buffering is largely handled automatically and minimized in this mode.

Answer

It supports deep content inspection for all protocols

Answer

It requires manual buffer allocation

Answer

It offers more granular application control

Question 10

Which THREE types of traffic are typically inspected by an IPS policy?

Accepted Answer

HTTP/HTTPS traffic. An IPS policy inspects application-layer protocols where signatures and anomaly rules can detect exploits, so HTTP/HTTPS traffic (A) is correct because web traffic carries the majority of attacks such as SQL injection, XSS, and malicious downloads that IPS engines decode and match. SMTP traffic (B) is correct because email is a primary malware and phishing vector, and IPS inspection of SMTP commands and attachments detects spam, malicious payloads, and mail-based exploits. FTP traffic (D) is correct because FTP transmits credentials and files in cleartext, and IPS rules inspect FTP commands and data channels for brute-force attempts, unauthorized transfers, and known FTP exploits. SNMP monitoring traffic (C) is not typically inspected by an IPS policy because it is management-plane traffic usually handled by access control or monitoring tools rather than deep packet inspection signatures. ICMP echo requests (E) are not typically inspected by an IPS policy because they are simple network-layer diagnostic packets with no application payload for signature-based IPS analysis.

Answer

SNMP monitoring traffic

Answer

ICMP echo requests

Question 11

In a high availability (HA) cluster, which THREE settings are synchronized between the primary and secondary units?

Accepted Answer

Address objects. In an HA cluster, the configuration that defines security processing is synchronized from the primary to the secondary unit, and address objects (C) are part of that shared configuration so both units resolve the same IPs, ranges, and FQDNs during failover. The user authentication database (D) is also synchronized so locally defined users, groups, and credentials remain valid on the secondary after a failover, avoiding authentication outages. Firewall policies (E) are synchronized as core security configuration, ensuring the secondary enforces identical rules and traffic handling when it takes over. Hardware serial numbers (A) are device-specific identifiers and are never synchronized, and the management IP address (B) is intentionally unique per unit so each node remains individually reachable for administration.

Answer

Hardware serial numbers

Answer

Management IP address

Question 12

Which TWO of the following are valid methods for user authentication on a FortiGate?

Accepted Answer

RADIUS. RADIUS (B) is a valid authentication method on a FortiGate: the device can act as a RADIUS client, forwarding user credentials to an external RADIUS server for verification in firewall authentication, SSL VPN, IPsec VPN, and administrative login scenarios. LDAP (C) is likewise valid: FortiGate supports LDAP authentication by binding to directory servers such as Active Directory or OpenLDAP to validate user credentials for the same authentication features. The remaining options are routing or multicast protocols, not authentication mechanisms: BGP (A) and RIP (E) are routing protocols used to exchange route information, and IGMP (D) is a multicast group management protocol, so none of them authenticate users.

Answer

BGP

Answer

IGMP

Answer

RIP

Question 13

Which TWO of the following can be used to optimize IPsec VPN performance?

Accepted Answer

Ensure the configuration uses AES-NI supported ciphers. Option C is correct because selecting AES-NI supported ciphers (such as AES-GCM or AES-CBC) allows the CPU to use dedicated AES-NI instruction sets, dramatically accelerating symmetric encryption and integrity processing for IPsec traffic. Option D is correct because hardware acceleration via ASIC offloading moves IPsec encryption, hashing, and encapsulation from the general-purpose CPU to dedicated crypto hardware, increasing throughput and reducing latency for VPN tunnels. Option A is not appropriate because a 24-hour Phase 1 (IKE SA) lifetime is unusually long and does not optimize performance; it mainly affects rekey frequency and can weaken security without improving throughput. Option B is incorrect because DES is a weak, legacy cipher and is actually slower and less secure than AES on modern hardware. Option E is incorrect because disabling NAT-Traversal does not improve performance and can break IPsec connectivity when NAT devices are present.

Answer

Increase the Phase 1 lifetime to 24 hours

Answer

Use DES encryption for speed

Answer

Disable NAT-Traversal

Question 14

A FortiGate is configured as a dial-up IPsec VPN server. Remote users connect using FortiClient. The administrator wants to ensure that each remote user receives an IP address from a dedicated pool and that only specific internal subnets are accessible. Which TWO actions are required on the FortiGate to meet these requirements? (Choose two.)

Accepted Answer

Configure a mode-config with an IP pool and assign it to the dial-up tunnel.. To assign IP addresses to dial-up VPN users, mode-config with an IP pool is required. Firewall policies then control which internal subnets those users can access. XAuth is for authentication, static routes are unnecessary, and aggregate mode is for combining tunnels, so those do not meet the stated requirements.

Answer

Configure a static route for the remote user subnet pointing to the IPsec tunnel interface.

Answer

Enable XAuth on the dial-up tunnel and configure a user group with local users.

Answer

Set the IPsec tunnel to aggregate mode to combine multiple dial-up connections.

Question 15

A FortiGate is configured with a route-based IPsec VPN to a remote branch. The administrator wants to monitor the VPN tunnel status and bring it up automatically. Which interface must be referenced in the firewall policy to allow traffic through the tunnel?

Accepted Answer

The IPsec tunnel interface (e.g., VPN_Tunnel). For a route-based IPsec VPN, the FortiGate creates a virtual tunnel interface. Firewall policies must reference this tunnel interface to permit traffic into and out of the VPN. This allows the FortiGate to apply security profiles and route traffic based on the tunnel's IP addressing, and it enables tunnel monitoring through DPD.

Answer

The loopback interface

Answer

The WAN interface with the public IP address

Answer

The physical egress interface