NSE7_EFW Security And VPN Practice Test 5 — 15 Questions

Question 1

A network administrator is configuring an IPsec VPN between two FortiGates. The administrator wants to ensure that only traffic from the 10.0.0.0/24 subnet is encrypted and sent over the tunnel. Which configuration element must be defined on both FortiGates to match this traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Phase 2 selectors. Phase 2 selectors define the traffic that is encrypted and sent over the IPsec tunnel. They specify the local and remote subnets. Firewall address objects and static routes are used for policy and routing but do not define the encryption domain. Phase 1 proposals are for IKE SA negotiation.

Answer

Phase 1 proposal

Answer

Firewall address objects

Answer

Static route entries

Question 2

A network administrator is configuring an IPsec VPN between two FortiGates. The administrator wants to ensure that only traffic from the 10.0.0.0/24 subnet is encrypted and sent over the tunnel. Which configuration element must be defined on both FortiGates to match this traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IP address of the FortiGate's outgoing interface.. With NAT enabled and configured to use the outgoing interface address, the FortiGate translates the source IP of internal clients to the IP address of the interface that forwards the traffic. This is the typical configuration for allowing internal users to access the internet, and it ensures that return traffic is routed back through the FortiGate.

Answer

The original source IP address of the internal client.

Answer

A randomly selected IP address from the FortiGate's IP pool.

Answer

The IP address of the FortiGate's internal interface.

Question 3

A security administrator is configuring a new SSL inspection profile on a FortiGate. The administrator wants to inspect HTTPS traffic for malware but must ensure that banking websites are not inspected due to privacy concerns. Which feature should be used to exempt specific websites from SSL inspection?

Accepted Answer

Add the banking websites to the SSL exemptions list in the SSL inspection profile.. To exempt specific websites from SSL inspection, the administrator should add them to the SSL exemptions list within the SSL inspection profile. This list allows you to specify FQDNs or IP addresses that should not be decrypted. The FortiGate will then allow traffic to those sites without inspection, maintaining privacy while still inspecting other HTTPS traffic.

Answer

Enable the 'Inspect All Ports' option and exclude port 443.

Answer

Create a static URL filter list and apply it to the SSL inspection profile.

Answer

Configure a firewall policy with a destination address for the banking websites and set the action to DENY.

Question 4

You are configuring a route-based IPsec VPN between two FortiGates. The VPN is up, but traffic from the local subnet is not being encrypted and sent over the tunnel; instead, it is being sent unencrypted out of the WAN interface. You have verified that the phase 1 and phase 2 selectors match on both sides. What is the most likely cause?

Accepted Answer

The IPsec tunnel interface is not included in the outgoing firewall policy that matches the local subnet traffic.. In a route-based IPsec VPN, the tunnel interface must be used in a firewall policy that matches the traffic to be encrypted. Without such a policy, the FortiGate will not encrypt the traffic and will route it according to the routing table, potentially sending it unencrypted out of the WAN interface. Thus, the missing policy is the most likely cause.

Answer

The remote gateway's public IP address is not reachable, so the FortiGate cannot establish the tunnel.

Answer

The dead peer detection (DPD) settings are too aggressive, causing the tunnel to flap.

Answer

The phase 2 selector must be set to 0.0.0.0/0 on both sides to allow any traffic.

Question 5

An administrator is configuring a FortiGate to perform SSL deep inspection for outbound HTTPS traffic. Which TWO actions are required to ensure that users can browse HTTPS sites without certificate errors? (Choose two.)

Accepted Answer

Enable SSL inspection in the firewall policy that allows outbound HTTPS traffic.. SSL deep inspection requires the FortiGate to act as a man-in-the-middle, re-signing server certificates with its own CA. Therefore, clients must trust the FortiGate's CA certificate, and the firewall policy must have SSL inspection enabled with deep inspection mode. Without both, clients will see certificate errors or traffic will not be inspected.

Answer

Configure the FortiGate to use a public CA certificate for re-signing.

Answer

Set the inspection mode to certificate inspection instead of deep inspection.

Answer

Import the server certificates from all HTTPS websites into the FortiGate.

Question 6

A FortiGate is configured with an IPsec VPN to a remote peer. The administrator wants to ensure that only specific subnets are allowed over the tunnel, and that traffic from any other subnet is dropped. Which configuration element on the FortiGate directly enforces this?

Accepted Answer

Phase 2 selectors. Phase 2 selectors specify the exact local and remote subnets that are allowed to use the IPsec tunnel. Traffic not matching these selectors is not encrypted or forwarded through the tunnel, effectively dropping it. This provides a granular control to restrict VPN traffic to specific subnets, which is the requirement in this scenario.

Answer

Static routes with higher priority

Answer

Firewall address objects

Answer

IPsec phase 1 proposals

Question 7

A FortiGate is configured with a route-based IPsec VPN to a remote peer. The tunnel is up, but users report that traffic to the remote subnet intermittently fails. You suspect that the VPN is not being used for all traffic because of a routing issue. Which FortiGate CLI command would you use to verify which route is selected for a specific destination IP address?

Accepted Answer

get router info routing-table details . The command 'get router info routing-table details ' is the correct way to verify which route the FortiGate will use for a specific destination. In a route-based VPN scenario, it shows if the tunnel interface is the outgoing interface. This is essential for diagnosing intermittent failures caused by routing inconsistencies.

Answer

diagnose firewall iprope list <destination_ip>

Answer

show route-map <destination_ip>

Answer

diagnose ip route list <destination_ip>

Question 8

You are deploying a new FortiGate in transparent mode. Users report that they cannot access the internet, but they can access internal servers. You have verified that the FortiGate is in transparent mode and that the management IP is reachable. What is the most likely cause?

Accepted Answer

Firewall policies must be configured to allow traffic from the internal network to the external network, even in transparent mode.. Even in transparent mode, the FortiGate enforces firewall policies. Traffic from internal to external networks must be explicitly allowed by a policy. If such a policy is missing, the implicit deny will block internet access. Internal traffic might be allowed by a different policy, explaining why users can reach internal servers but not the internet.

Answer

The FortiGate's management IP must be in the same subnet as the internal network for traffic to flow.

Answer

The FortiGate requires a default route to the internet, but in transparent mode it does not perform routing.

Answer

Transparent mode does not support NAT, so internet access is impossible without additional configuration.

Question 9

An administrator is troubleshooting an IPsec VPN tunnel that frequently goes down. The logs show 'NO_PROPOSAL_CHOSEN' errors during phase 2 negotiations. Which action should the administrator take to resolve this issue?

Accepted Answer

Verify that the phase 2 proposals on both peers match exactly, including encryption, authentication, and PFS settings.. The 'NO_PROPOSAL_CHOSEN' error during phase 2 indicates a mismatch in the phase 2 proposals between the two VPN peers. The administrator must ensure that the encryption, authentication, and PFS settings match on both sides. This is the definitive fix for this specific error.

Answer

Check that the phase 1 proposal includes a matching pre-shared key.

Answer

Ensure that the local and remote subnets in the phase 2 selectors are identical.

Answer

Restart the IKE daemon on both FortiGates to clear stale security associations.

Question 10

A network administrator needs to allow remote users to access internal resources securely using FortiClient. The administrator wants to use certificate-based authentication for the VPN. Which component must be installed on the FortiClient endpoints to enable certificate authentication?

Accepted Answer

A client certificate issued by a CA trusted by the FortiGate.. Certificate-based authentication requires the client to present a certificate that the FortiGate can validate against its trusted CAs. The client certificate contains the user's identity and is signed by a CA that the FortiGate trusts. The FortiGate then maps the certificate to a user or group. The root CA certificate on the client is only for validating the server, not for client authentication.

Answer

A pre-shared key configured in the FortiClient VPN profile.

Answer

The root CA certificate that signed the FortiGate's server certificate.

Answer

The FortiGate's SSL VPN portal certificate.

Question 11

An administrator is configuring SSL inspection on a FortiGate to inspect traffic to a web server that uses a certificate signed by an internal CA. The FortiGate must decrypt and inspect the traffic without generating certificate errors on client browsers. What must be installed on the client devices?

Accepted Answer

The FortiGate's SSL inspection CA certificate. During SSL inspection, the FortiGate acts as a man-in-the-middle, presenting its own certificate to the client. To avoid certificate warnings, the client must trust the FortiGate's SSL inspection CA. Installing this CA certificate on client devices establishes that trust, allowing seamless inspection without errors.

Answer

A client certificate issued by the internal CA

Answer

The internal CA's root certificate

Answer

The web server's SSL certificate

Question 12

You are configuring a FortiGate to perform deep inspection of HTTPS traffic. After enabling SSL inspection on a firewall policy, users report that some websites show certificate warnings. You have installed the FortiGate's CA certificate on all user workstations. What is the most likely reason for the warnings?

Accepted Answer

The websites use certificate pinning, which prevents the FortiGate from re-signing the certificates.. Certificate pinning causes the client to expect a specific certificate. When deep inspection is enabled, the FortiGate re-signs the server certificate, breaking the pin and triggering a warning. This is a common issue with certain applications and websites that implement pinning.

Answer

The FortiGate's CA certificate has expired.

Answer

The users' browsers are not configured to use the FortiGate as a proxy.

Answer

The SSL inspection profile is set to certificate inspection instead of deep inspection.

Question 13

A network administrator is configuring an IPsec VPN between two FortiGates. The administrator wants to ensure that only traffic from the 10.0.0.0/24 subnet is encrypted and sent over the tunnel. Which configuration element must be defined on both FortiGates to match this traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CA certificate that signed the FortiGate's deep inspection certificate.. To avoid certificate warnings during deep SSL inspection, the CA certificate that signed the FortiGate's inspection certificate must be installed as a trusted root on client devices. This enables clients to trust the certificates generated by the FortiGate for intercepted sessions, ensuring seamless inspection.

Answer

The FortiGate's SSH certificate.

Answer

The FortiGate's default self-signed certificate.

Answer

The web server's original certificate.

Question 14

A company uses a FortiGate as their main firewall. They want to implement a security profile that blocks malicious files downloaded via HTTP. Which FortiGate feature should they use to scan files for viruses and other malware?

Accepted Answer

Antivirus profile with deep inspection enabled in the firewall policy.. The antivirus profile is specifically designed to scan files for viruses and malware. When applied to a firewall policy with deep inspection, it examines files transferred over protocols like HTTP, FTP, and SMTP. Other profiles like IPS, web filter, or application control serve different purposes and do not provide file scanning.

Answer

Intrusion Prevention System (IPS) sensor with signatures for file downloads.

Answer

Web filter profile with category-based blocking.

Answer

Application control profile to block file-sharing applications.

Question 15

A FortiGate is deployed in transparent mode between two routers. The administrator wants to enable IPS inspection on traffic passing through the FortiGate. Which configuration is required to inspect traffic in transparent mode?

Accepted Answer

Create a firewall policy with the incoming and outgoing interfaces set to the transparent bridge pair.. In transparent mode, the FortiGate bridges traffic between interfaces. To inspect traffic, a firewall policy must be created that allows traffic from one bridge interface to the other, with an IPS sensor applied. Interfaces do not have IPs, and IPS is not enabled globally or directly on interfaces. Thus, the policy-based approach is correct.

Answer

Assign IP addresses to the transparent interfaces and enable IPS on those interfaces.

Answer

Configure a VLAN interface for each subnet and apply IPS to the VLAN interfaces.

Answer

Enable IPS globally under System > Config > IPS and select the transparent bridge.