NSE7_EFW Security And VPN Practice Test 6 — 15 Questions

Question 1

A FortiGate is configured with a site-to-site IPsec VPN to a branch office. The administrator notices that the tunnel is up, but traffic is not passing. After checking, they find that the phase 2 selectors on both peers match, and firewall policies allow the traffic. What is a likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Missing static route for the remote subnet.. For traffic to traverse an IPsec tunnel, the FortiGate must have a route that directs packets for the remote subnet out the tunnel interface. Without this route, the FortiGate will not send traffic into the tunnel, even if the tunnel is up and policies permit it. This is a common oversight in site-to-site VPN configurations.

Answer

Incorrect IPsec phase 2 key lifetime.

Answer

The remote gateway IP address is incorrect.

Answer

The phase 1 proposal mismatch.

Question 2

A network administrator is troubleshooting a FortiGate firewall policy. Traffic that should be allowed is being blocked, and the administrator suspects that the policy is not matching because of the order of policies. Which FortiGate feature can be used to verify which policy a specific traffic flow matches?

Accepted Answer

Policy lookup. Policy lookup is designed specifically to check which policy matches a given set of traffic parameters without generating actual traffic. It is the quickest way to verify policy order and matching criteria, making it ideal for troubleshooting why traffic is blocked due to policy sequencing.

Answer

Session table

Answer

Debug flow

Answer

Packet capture

Question 3

A network administrator wants to allow only specific users to access a web application through the FortiGate. The users are stored in an LDAP directory. Which FortiGate feature should be used to enforce this?

Accepted Answer

LDAP integration with user group and firewall policy. Using LDAP integration, the FortiGate can authenticate users against the existing directory. A firewall policy that includes the LDAP user group restricts access to only those users. This is the most efficient and centralized method, avoiding duplicate user accounts and leveraging existing infrastructure.

Answer

RADIUS authentication with a proxy server

Answer

TACACS+ with a custom user group

Answer

Local user database with two-factor authentication

Question 4

An administrator wants to allow remote users to access the corporate network using SSL VPN. The administrator needs to ensure that users can only access specific internal web servers. Which SSL VPN configuration mode should be used to provide granular access control to specific applications?

Accepted Answer

Web mode. SSL VPN web mode is designed to provide access to specific web applications through a portal. It allows administrators to define bookmarks for internal web servers, giving granular control over which servers users can access. Tunnel mode provides full network access, port forward mode is for specific TCP ports, and IPsec VPN is a different technology.

Answer

Tunnel mode

Answer

Port forward mode

Answer

IPsec VPN

Question 5

An administrator is troubleshooting an IPsec VPN tunnel that is not establishing. The phase 1 configuration uses pre-shared keys, and both peers are FortiGates. Which command would provide the most detailed information about the IKE negotiation?

Accepted Answer

diagnose debug application ike -1. The 'diagnose debug application ike -1' command provides detailed IKE negotiation output, including proposals, authentication, and any errors. This is the most effective way to pinpoint why an IPsec tunnel is failing to establish. Other commands show status or packets but lack the depth of the IKE debug.

Answer

diagnose sniffer packet any 'host <peer-ip> and port 500' 4

Answer

diagnose vpn ike gateway list

Answer

get vpn ipsec tunnel details

Question 6

A FortiGate is configured with a site-to-site IPsec VPN to a branch office. The administrator notices that the tunnel is up, but traffic is not passing. After checking, they find that the phase 2 selectors on both peers match, and firewall policies allow the traffic. What is a likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

get router info routing-table details . To verify that traffic to a specific destination is routed through the IPsec tunnel, you use the command 'get router info routing-table details '. This shows the exact route that will be used, including the outgoing interface. If the route points to the tunnel interface, routing is correct; if not, you must fix the routing configuration. This command is essential for troubleshooting VPN traffic flow.

Answer

diagnose vpn ike gateway list

Answer

diagnose ip route list

Answer

diagnose firewall iprope list

Question 7

A FortiGate is configured with a firewall policy that includes multiple security profiles: antivirus, IPS, and web filter. The administrator notices that some traffic that should be blocked by the IPS is being allowed. The IPS sensor is set to 'Monitor' mode. What is the most likely reason for this behavior?

Accepted Answer

The IPS sensor is in Monitor mode, so it only logs detected attacks and does not block them.. The IPS sensor mode determines whether detected attacks are blocked or only logged. In Monitor mode, the sensor does not block traffic; it only records events. Therefore, traffic that matches an IPS signature will be allowed. To enforce blocking, the sensor must be set to Protect mode. The observed behavior is consistent with Monitor mode being active.

Answer

The antivirus profile is overriding the IPS action and allowing the traffic.

Answer

The IPS sensor is in Protect mode, but the signature is disabled.

Answer

The firewall policy is configured with 'action' set to 'deny', so no traffic is inspected.

Question 8

A network administrator is deploying a dial-up IPsec VPN on a FortiGate to allow remote employees to connect. The administrator wants to ensure that the VPN tunnel can be established even when the client is behind a NAT device. Which configuration setting must be enabled on the FortiGate to achieve this?

Accepted Answer

Enable NAT traversal (NAT-T) on the IPsec phase 1 configuration.. NAT traversal (NAT-T) is the correct setting because it encapsulates IKE and ESP packets in UDP, allowing the VPN to pass through NAT devices. This is essential for dial-up VPNs where remote users may be behind NAT. Without NAT-T, the VPN tunnel may fail to establish due to NAT incompatibilities. Other settings like aggressive mode or IKEv2 do not replace the need for NAT-T.

Answer

Set the phase 2 selector to 0.0.0.0/0 to allow all traffic through the tunnel.

Answer

Set the VPN gateway to use aggressive mode for IKE negotiation.

Answer

Configure the VPN to use IKE version 2 (IKEv2) exclusively.

Question 9

A security administrator is configuring an SSL inspection profile on a FortiGate to inspect HTTPS traffic. The administrator wants to ensure that the FortiGate can decrypt and inspect traffic without causing certificate errors on client browsers. Which certificate must be installed on the client endpoints to prevent certificate warnings?

Accepted Answer

The SSL inspection CA certificate generated by the FortiGate.. The SSL inspection CA certificate generated by the FortiGate must be installed and trusted on client endpoints to prevent certificate warnings. When the FortiGate inspects SSL traffic, it generates certificates signed by this CA. If clients do not trust this CA, they will see warnings. The other certificates are not used for signing the inspected traffic, so they would not prevent warnings.

Answer

The FortiGate's local certificate used for IPsec VPN.

Answer

The FortiGate's default self-signed certificate.

Answer

The web server's public certificate.

Question 10

A network administrator is configuring a new SSL VPN on a FortiGate to allow remote users to access internal resources. The administrator wants to ensure that only authorized users can connect and that they can reach the internal network. Which TWO configurations are required to achieve this? (Choose two.)

Accepted Answer

Create a firewall policy that allows SSL VPN traffic from the SSL VPN interface to the internal network.. To enable SSL VPN access, two essential configurations are required: an SSL VPN portal that defines what users can access and how, and a firewall policy that allows traffic from the SSL VPN interface to the internal network. The portal must be assigned to users or groups, and the policy must permit the traffic. Without either, users cannot connect or reach resources, regardless of authentication method.

Answer

Configure a static route for the SSL VPN subnet to the internal network.

Answer

Set up a RADIUS server for authentication and configure the FortiGate to use it.

Answer

Enable split tunneling to allow users to access the internet directly.

Question 11

An administrator wants to configure a FortiGate to perform deep inspection of SSL traffic for a specific web server. The goal is to detect and block malicious content in HTTPS sessions. What must be installed on the client devices to allow this inspection?

Accepted Answer

A CA certificate that is used by the FortiGate for SSL inspection.. Deep SSL inspection requires the FortiGate to decrypt and re-encrypt traffic, presenting its own certificates to clients. These certificates are signed by a CA certificate on the FortiGate. For clients to accept these certificates without warnings and for inspection to work seamlessly, the FortiGate's CA certificate must be installed and trusted on the client devices. Without it, clients will see certificate errors and may block the connection.

Answer

A client certificate for each user.

Answer

The FortiGate's default self-signed certificate.

Answer

The web server's public certificate.

Question 12

An administrator is deploying a new IPsec VPN between two FortiGates. They want to ensure that the VPN can recover quickly from network disruptions and that only specific subnets are allowed over the tunnel. Which TWO configuration steps are required to meet these requirements? (Choose two.)

Accepted Answer

Enable dead peer detection (DPD) on both ends with a suitable interval and retry count.. To ensure quick recovery, DPD must be enabled to detect peer failures promptly. To restrict traffic to specific subnets, phase2 selectors must be configured with the desired local and remote subnets. These two steps together meet the requirements. The other options do not address the specific needs of recovery and subnet restriction.

Answer

Enable NAT traversal (NAT-T) on the phase1 configuration.

Answer

Configure a firewall policy that allows all traffic between the two sites without any restrictions.

Answer

Set the phase1 proposal to use only AES-256 encryption and SHA-256 hashing.

Question 13

An administrator has configured a FortiGate with two WAN interfaces and wants to ensure that outbound traffic is load-balanced across both links while maintaining session persistence. They have enabled SD-WAN and created two members. Which SD-WAN load-balancing algorithm should they use to distribute traffic based on source IP and ensure that each source IP consistently uses the same link?

Accepted Answer

Source IP. The 'Source IP' algorithm in SD-WAN load balancing uses the source IP address to select a link. All sessions from a given source IP will consistently use the same link, providing session persistence. Round Robin and Weighted Round Robin distribute per session without regard to source, and Session Hash uses the full 5-tuple, which can vary per session. Only Source IP ensures each source IP sticks to one link.

Answer

Round Robin

Answer

Session Hash

Answer

Weighted Round Robin

Question 14

A network administrator is configuring a firewall policy on a FortiGate to allow internal users to access the internet. The administrator wants to log all traffic that matches the policy. Which action should be taken to enable logging for this policy?

Accepted Answer

Enable logging in the firewall policy settings.. To log traffic that matches a firewall policy, you must enable logging in that policy's settings. This is done by enabling 'Log Allowed Traffic' and choosing the log level. Global logging settings only control where logs are stored or sent, and security profile logging is for specific events. There is no monitor mode for firewall policies. Thus, enabling logging in the policy is the correct action.

Answer

Enable logging in the security profile applied to the policy.

Answer

Configure a global logging setting in the FortiGate system settings.

Answer

Set the firewall policy to 'monitor' mode.

Question 15

An administrator is configuring an IPS sensor on a FortiGate to protect an internal web server. The administrator wants to block attacks while minimizing false positives. Which IPS sensor action should be configured for signatures that are known to produce false positives in the internal network?

Accepted Answer

Set the action to 'Monitor' for those signatures.. For signatures that are known to produce false positives, setting the action to 'Monitor' is the best approach. It allows traffic to pass while logging matches, enabling the administrator to review and tune the signature without disrupting legitimate traffic. Blocking could cause false positives to block valid traffic, and passing or disabling removes protection. Monitoring provides visibility and control.

Answer

Disable the signatures entirely.

Answer

Set the action to 'Block' for those signatures.

Answer

Set the action to 'Pass' for those signatures.