NSE7_EFW System Configuration Practice Test 4 — 15 Questions

Question 1

An administrator is configuring a new FortiGate and needs to set the device to automatically synchronize its clock with an external NTP server. Which CLI command is used to enable NTP synchronization?

Accepted Answer

config system ntp; set ntpsync enable; config ntpserver; edit 1; set server <ip>; end; end. To enable NTP synchronization with an external server, you must enable NTP sync and define at least one NTP server under 'config system ntp'. The correct command includes the 'config ntpserver' section. The other options are either incomplete or use incorrect syntax.

Answer

config system ntp; set ntpsync enable; end

Answer

config system global; set ntp-server <ip>; end

Answer

config system ntp; set ntpsync enable; set server <ip>; end

Question 2

An administrator is configuring a FortiGate to act as a DNS server for internal clients. The administrator wants to enable DNS forwarding to external servers and also allow the FortiGate to resolve queries for internal domains using its local DNS database. Which TWO configurations are required to achieve this? (Choose two.)

Accepted Answer

Configure the FortiGate to use external DNS servers.. To have the FortiGate act as a DNS server with forwarding and local database resolution, you must enable DNS forwarding on the interface to accept queries, and configure external DNS servers for forwarding. The local DNS database is configured separately but is not part of the required two settings for this scenario; the question asks for the two configurations to achieve forwarding and local resolution, which are the interface setting and external DNS servers.

Answer

Create a DNS zone for the internal domain.

Answer

Configure a DNS filter profile.

Answer

Enable DNS proxy on the FortiGate.

Question 3

A network administrator is deploying a FortiGate 100F in a branch office. The device will use two WAN links: port1 (primary) and port2 (backup). The administrator wants the FortiGate to automatically use port2 when port1 fails, without manual intervention. Which configuration should be applied?

Accepted Answer

Configure a link health monitor on port1 and port2, then create an SD-WAN zone containing both interfaces and set the load-balance algorithm to redundant.. SD-WAN with redundant load balancing is designed for active-standby failover. Health monitors detect link failures, and the FortiGate automatically switches to the backup interface. This meets the requirement for automatic failover without manual intervention, unlike static routes with distances or other methods that lack health checking or automatic switching.

Answer

Configure a link health monitor on port1 and port2, then create an SD-WAN zone containing both interfaces and set the load-balance algorithm to source-ip.

Answer

Configure a link health monitor on port1 and port2, then create a static route for the default gateway using port1 and enable 'set link-health' on that route.

Answer

Configure a link health monitor on port1 and port2, then create a static route for the default gateway with port1 as the preferred interface and port2 with a higher distance.

Question 4

An administrator is configuring a FortiGate in NAT/route mode. The FortiGate has two VDOMs: 'root' and 'vdom1'. The administrator wants to allow a server in 'vdom1' (IP 10.1.1.10) to be accessed from the internet via a VIP configured on the 'root' VDOM's WAN interface (port1, IP 203.0.113.5). The VIP should translate the public IP to the server's private IP. Which configuration is required to achieve this inter-VDOM routing?

Accepted Answer

Create a VIP in 'root' with the external IP 203.0.113.5 and mapped IP 10.1.1.10, then create an inter-VDOM link between 'root' and 'vdom1', and add firewall policies in both VDOMs to allow the traffic.. Inter-VDOM routing requires an inter-VDOM link to connect the VDOMs. The VIP must be created in the VDOM where the external interface resides, which is 'root'. Firewall policies in both VDOMs are necessary to permit traffic from the WAN to the inter-VDOM link and then to the server in 'vdom1'. This ensures proper address translation and routing between VDOMs.

Answer

Create a VIP in 'root' with the external IP 203.0.113.5 and mapped IP 10.1.1.10, then create a firewall policy in 'root' that allows traffic from port1 to the internal interface, and enable 'set inter-vdom enable' on the policy.

Answer

Create a VIP in 'vdom1' with the external IP 203.0.113.5 and mapped IP 10.1.1.10, then create a firewall policy in 'root' that allows traffic from port1 to 'vdom1', and enable 'set inter-vdom enable' on the policy.

Answer

Create a VIP in 'vdom1' with the external IP 203.0.113.5 and mapped IP 10.1.1.10, then create a firewall policy in 'vdom1' allowing traffic from port1 to the internal interface.

Question 5

An administrator is configuring a FortiGate to send logs to a FortiAnalyzer device. The FortiAnalyzer is reachable via the management interface. The administrator wants to ensure that logs are sent reliably and that the FortiGate can buffer logs if the FortiAnalyzer is temporarily unreachable. Which two configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Enable 'set reliable enable' under the FortiAnalyzer configuration to use TCP for log transmission and ensure logs are buffered during outages.. Enabling reliable logging via 'set reliable enable' under the FortiAnalyzer settings is essential for reliable log delivery and buffering. Additionally, configuring the FortiAnalyzer settings with the correct IP address is necessary. The other options either refer to non-existent commands or are not required in this scenario because the management interface is used.

Answer

Configure a firewall policy to allow the FortiGate to initiate connections to the FortiAnalyzer on TCP port 514.

Answer

Enable 'set buffer-logs enable' under the FortiAnalyzer configuration to allow local buffering of logs when the FortiAnalyzer is unreachable.

Answer

Configure the FortiGate to use the management VDOM for logging and ensure that the management interface has a route to the FortiAnalyzer.

Question 6

A FortiGate has two WAN interfaces, wan1 and wan2, managed by SD-WAN. The administrator wants traffic for the SaaS application Microsoft 365 to prefer wan1, while all other internet traffic should use wan2 unless wan2 fails. Which SD-WAN configuration element is required to meet this requirement?

Accepted Answer

Create an SD-WAN rule with the Internet Service 'Microsoft 365' selected, set wan1 as the preferred member, and configure wan2 as a standby member.. SD-WAN rules can match Internet Service entries such as Microsoft 365, allowing the administrator to prefer wan1 for that application while other traffic uses wan2. Configuring wan2 as standby provides failover. This satisfies both the application-specific preference and the fallback requirement without relying on static routes or policy routes, which lack SD-WAN health checking.

Answer

Create an SD-WAN rule with a destination of all, set wan2 as the preferred member, and enable the 'implicit' SLA target.

Answer

Configure a policy route that matches Microsoft 365 IP addresses and directs them to wan1, and rely on the default static route for all other traffic.

Answer

Set wan1 as the primary default route and wan2 as a lower-distance default route, and use a firewall policy to match Microsoft 365.

Question 7

A network administrator is deploying a new FortiGate 200F at a branch office. The ISP requires the WAN interface to use a /30 subnet with the address 203.0.113.2/30 and gateway 203.0.113.1. The administrator wants to minimize the number of static routes and ensure the default route automatically follows the WAN link status. Which configuration should the administrator use?

Accepted Answer

Configure the WAN interface with the address and gateway, then create a static default route using the interface as the outgoing interface.. A static route that references only the outgoing interface is tied to the interface state, so it is withdrawn from the routing table when the link goes down. This avoids black-holing traffic and eliminates the need for separate link-monitor objects. The gateway address on the interface is used for next-hop resolution, but the route's presence depends on the interface being up.

Answer

Configure a static default route with the gateway 203.0.113.1 and enable the 'Gateway' link health check.

Answer

Configure a static default route with the gateway 203.0.113.1 and set the distance to 5.

Answer

Configure the WAN interface with the address and enable the 'Retrieve default gateway from server' option.

Question 8

A security administrator needs to allow outbound HTTP and HTTPS traffic from a guest VLAN to the internet. The guest VLAN is on interface VLAN 100, and the internet-facing interface is wan1. The administrator wants to log all allowed sessions and apply a web filter profile to block malicious sites. Which firewall policy configuration is required?

Accepted Answer

Create a policy with incoming interface VLAN 100, outgoing interface wan1, source all, destination all, service HTTP HTTPS, action accept, enable NAT, and apply the web filter profile.. The correct policy must match traffic from the guest VLAN to the internet, allow HTTP and HTTPS, enable NAT for outbound connections, and apply the web filter profile for content inspection. The direction of the policy is critical: incoming interface must be the source VLAN and outgoing interface must be the WAN. Logging should be enabled to capture allowed sessions.

Answer

Create a policy with incoming interface VLAN 100, outgoing interface wan1, source all, destination all, service HTTP HTTPS, action deny, and apply the web filter profile.

Answer

Create a policy with incoming interface wan1, outgoing interface VLAN 100, source all, destination all, service HTTP HTTPS, action accept, and apply the web filter profile.

Answer

Create a policy with incoming interface VLAN 100, outgoing interface wan1, source all, destination all, service ALL, action accept, enable NAT, and apply the web filter profile.

Question 9

A network administrator is configuring a FortiGate to send logs to a FortiAnalyzer device. The FortiAnalyzer is reachable via the management interface, which is in the 'root' VDOM. The administrator wants to ensure that logs from all VDOMs are sent to FortiAnalyzer and that the connection is secure. Which two actions must the administrator take? (Choose two.)

Accepted Answer

Enable 'Encrypt Logs' or use the secure connection option when configuring the FortiAnalyzer.. To send logs from all VDOMs to FortiAnalyzer securely, the administrator must enable the global FortiAnalyzer logging setting and specify the FortiAnalyzer IP address. Additionally, enabling encryption ensures the log data is protected in transit. These two actions are sufficient; per-VDOM policies or routes are not required for locally generated log traffic.

Answer

Configure a firewall policy from each VDOM to the management interface to allow log traffic.

Answer

Configure a static route in each VDOM pointing to the FortiAnalyzer network via the management interface.

Answer

Enable 'Log to FortiAnalyzer' in each VDOM's log settings and specify the FortiAnalyzer IP address.

Question 10

An administrator is configuring a FortiGate in HA Active-Passive mode. The cluster has two members: FortiGate-1 and FortiGate-2. The administrator wants to ensure that if the primary unit fails, the secondary unit takes over with minimal disruption. The administrator has configured the HA heartbeat interfaces and set the priority of FortiGate-1 to 200 and FortiGate-2 to 100. However, after a power failure on FortiGate-1, FortiGate-2 does not become the primary. What is the most likely cause?

Accepted Answer

The HA override setting is disabled on both units.. The most likely cause is that HA override is disabled. Without override, the primary unit is elected based on uptime, and if the primary fails, the secondary may not take over if it is waiting for the primary to return. In some firmware versions, if override is disabled, the secondary will not preempt the primary even after a failure, leading to a situation where neither unit is primary until the original primary returns. Enabling override on the desired primary unit ensures it takes over when it comes back online.

Answer

The HA group ID is different on the two units.

Answer

The heartbeat interfaces are not connected to a switch and are directly connected.

Answer

The HA priority values are not identical on both units.

Question 11

An administrator is deploying a new FortiGate in a high-availability (HA) cluster using FGCP. The administrator must ensure that the cluster can synchronize sessions and maintain uptime during a failover. Which two configuration settings must be identical on both FortiGate devices for the HA cluster to form and function correctly? (Choose two.)

Accepted Answer

The heartbeat interface configuration.. For an FGCP HA cluster to form, the HA group name and password must match to authenticate members, and the heartbeat interface configuration must be identical to allow heartbeat communication. Device priority can differ and is used for master election; hostnames can be unique; firmware should match but is not a configuration setting that must be identical for the cluster to form.

Answer

The device priority (priority setting).

Answer

The firmware version.

Answer

The hostname of each FortiGate.

Question 12

What is the impact of changing the 'set vdom-mode' from 'no-vdom' to 'multi-vdom'?

Accepted Answer

System reboot required. Changing the VDOM mode from 'no-vdom' to 'multi-vdom' requires a system reboot because it fundamentally restructures the FortiGate's configuration and operational mode. The device must reinitialize its internal segmentation and management processes, so a reboot is mandatory.

Answer

Automatic disablement of HA

Answer

Loss of all firewall policies

Answer

No impact, immediate change

Question 13

A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?

Accepted Answer

Flood to all ports. In transparent mode, a FortiGate acts as a Layer 2 bridge and does not participate in routing. When it receives a frame destined for a MAC address not present in its forwarding table, it behaves like a standard Layer 2 switch and floods the frame out all ports in the same broadcast domain (except the ingress port). This ensures the frame can reach its intended destination if the MAC is simply unknown to the FortiGate.

Answer

Drop the packet

Answer

Forward to the management interface

Answer

Send an ICMP unreachable message

Question 14

What is the purpose of 'dedicated HA' interfaces?

Accepted Answer

To isolate heartbeat traffic. Dedicated HA interfaces in FortiGate HA (High Availability) are used exclusively for heartbeat and synchronization traffic between cluster members. By isolating this traffic on its own physical interface, you prevent it from competing with user data and ensure reliable, low-latency communication for HA state updates and failover detection. This separation is critical because HA heartbeat packets are small but time-sensitive; any delay or loss can cause split-brain or unnecessary failovers.

Answer

To provide extra management access

Answer

To increase throughput

Answer

To act as a backup WAN port

Question 15

When using SD-WAN, how does the 'member' configuration interact with physical interfaces?

Accepted Answer

Members are logical groups of interfaces. In FortiGate SD-WAN, a member is a logical grouping that references a physical interface (or other interface types) and applies SD-WAN settings such as priority, weight, and health checks. The physical interface retains its IP configuration; the member is an abstraction that allows multiple interfaces to be managed as part of the SD-WAN virtual interface.

Answer

Members replace the IP configuration

Answer

Members require a separate VDOM

Answer

Members must have DHCP enabled