NSE7_EFW Security And VPN — Timed 10 Questions

Question 1

In an OSPF setup, you have a redundant path. You want to ensure traffic prefers one link over another based on cost. Which OSPF command is used?

Accepted Answer

set ospf-cost. The OSPF cost is configured on the interface level to influence link preference.

Answer

set metric-type

Answer

set bandwidth-reference

Answer

set priority

Question 2

In a BGP deployment, your FortiGate is receiving routes from two different ISPs. You want to influence outbound traffic to prefer ISP1 for specific destinations. Which BGP attribute should you modify?

Accepted Answer

Local Preference. Local Preference is a well-known BGP attribute used within an autonomous system to influence outbound path selection. A higher local preference value makes a route preferred, so setting a higher local preference for routes learned from ISP1 causes the FortiGate to prefer ISP1 for those destinations. It is propagated only within the local AS, which is exactly the scope needed here.

Answer

Weight

Answer

AS-Path

Answer

Multi-Exit Discriminator (MED)

Question 3

Which FortiGate feature allows you to bypass SSL inspection for specific known-trusted websites to maintain user privacy?

Accepted Answer

URL Filter category exemption. The URL Filter category exemption allows administrators to bypass SSL inspection for specific URL categories that are considered trusted, such as financial or healthcare sites, to maintain user privacy and comply with regulations. This is configured in the SSL inspection profile by exempting certain categories from deep inspection.

Answer

Firewall address object

Answer

Application Control override

Answer

IPS signature exclusion

Question 4

You are troubleshooting a high CPU issue on a FortiGate. Which utility should you use to identify which process is consuming the most resources?

Accepted Answer

diagnose sys top. The 'get system performance status' command is the primary tool to see process-level CPU usage.

Answer

get system hardware status

Answer

diagnose sniffer packet

Answer

get router info memory

Question 5

In a site-to-site VPN, you need to allow traffic initiated from the remote site. What configuration is essential on the local FortiGate?

Accepted Answer

A firewall policy allowing traffic from the VPN zone to the Internal zone. To allow traffic initiated from the remote site to the local internal network, a firewall policy on the local FortiGate must permit traffic from the VPN zone (where the IPSec tunnel terminates) to the Internal zone. This policy defines the allowed source and destination addresses and services.

Answer

An IPSec phase 3 policy

Answer

A static route to the remote subnet

Answer

A NAT rule for the remote subnet

Question 6

Which THREE of the following are mandatory for a BGP neighbor adjacency to establish?

Accepted Answer

Correct autonomous system numbers. Option B is correct because BGP peers must have compatible autonomous system numbers: an eBGP session requires the remote peer to be in a different AS than the local router, while an iBGP session requires both peers to be in the same AS, and a mismatch prevents the OPEN message from being accepted. Option C is correct because the routers must have IP reachability to each other's neighbor address (typically via a directly connected link for eBGP or via IGP/static routes for iBGP) so the TCP three-way handshake on port 179 can complete before any BGP messages are exchanged. Option E is correct because the BGP version in the OPEN message must match between peers; both sides must agree on the same version (BGP-4 is the current standard), otherwise the session is rejected with a version error. Option A is not required because prefix lists are inbound/outbound route-filtering policies applied after the session is up and do not affect adjacency formation. Option D is not required because router IDs only need to be unique within each AS and do not have to be identical between the two peers for the session to establish.

Answer

Identical prefix lists

Answer

Identical router IDs

Question 7

Which TWO items must be configured to ensure a FortiGate can successfully resolve external hostnames?

Accepted Answer

DNS server IP addresses in system settings. DNS settings are required for the FortiGate itself to resolve external names, and firewall policies must allow DNS traffic if the client uses the FortiGate as a DNS proxy.

Answer

A firewall policy allowing DNS traffic from internal clients to the FortiGate

Answer

An OSPF area configuration

Answer

An IPSec tunnel for DNS traffic

Answer

A static route to the internet

Question 8

Which THREE actions can be performed by the FortiGate when a policy match occurs?

Accepted Answer

Traffic Shaping. When a firewall policy matches traffic, the FortiGate can take one of three fundamental actions: Accept (E), which permits the traffic to pass through the FortiGate; Deny (D), which blocks the traffic and drops it; and Traffic Shaping (C), which applies a shaper or per-IP shaper/policy to control bandwidth for that matched traffic. These three are the standard policy actions configurable in a FortiGate firewall policy (set action accept/deny/ipsec and traffic shaping via set traffic-shaper). Re-routing to a specific switch port (A) is not a FortiGate policy action—it is a Layer 2 switching function performed by switches, not a firewall policy decision. Disabling hardware acceleration (B) is a configuration setting on the policy or global level (e.g., set auto-asic-offload disable) rather than an action the FortiGate performs as the result of a policy match.

Answer

Re-route to a specific switch port

Answer

Disable hardware acceleration

Question 9

A FortiGate is configured with an IPsec VPN to a remote peer using IKEv2. The administrator wants to ensure that only traffic from the 10.0.0.0/24 subnet is encrypted and sent over the tunnel, while all other traffic goes directly to the internet. The VPN is up, but traffic from 10.0.0.0/24 is not being routed through the tunnel. Which configuration step is most likely missing?

Accepted Answer

A firewall policy with source interface as the internal interface, destination interface as the IPsec tunnel, and source address 10.0.0.0/24.. The FortiGate uses firewall policies to determine which traffic is encrypted and sent over an IPsec tunnel. A policy with the internal interface as source, the tunnel interface as destination, and the correct source subnet is required. Without it, traffic from that subnet will not be routed into the tunnel, even if the tunnel is established and routes exist.

Answer

An IKEv2 quick mode selector that includes the 10.0.0.0/24 subnet.

Answer

A static route for 10.0.0.0/24 pointing to the IPsec tunnel interface.

Answer

A phase 2 proposal with matching encryption and authentication algorithms.

Question 10

A FortiGate is configured with two IPsec VPN tunnels to the same remote peer using different WAN links for redundancy. You want the FortiGate to automatically fail over to the secondary tunnel if the primary fails, and to fail back when the primary recovers. Which two configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Enable DPD on both phase-1 configurations and set the primary tunnel's route distance lower than the secondary's.. To achieve automatic failover and failback between two IPsec tunnels, you need both a mechanism to detect tunnel failure and a routing preference. DPD on phase-1 detects dead peers, triggering removal of the primary route. A lower route distance on the primary tunnel ensures it is preferred when active, and the secondary is used only when the primary is down. Together, these provide the desired redundancy.

Answer

Enable 'auto-negotiate' on both phase-1 configurations.

Answer

Enable Dead Peer Detection (DPD) on both phase-2 selectors.

Answer

Configure the primary tunnel with a lower priority value in the phase-1 settings.