NSE7_EFW System Configuration Practice Test 6 — 15 Questions

Question 1

An administrator is configuring a FortiGate to use a redundant interface for WAN connectivity. The redundant interface consists of two physical interfaces, port1 and port2. The administrator wants to ensure that if port1 fails, traffic automatically fails over to port2 without manual intervention. Which configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a redundant interface and add port1 and port2 as members, then assign the IP address to the redundant interface.. A redundant interface groups multiple physical interfaces into a single logical interface for redundancy. The IP address is configured on the redundant interface, and the physical members are enslaved. If one member fails, traffic automatically fails over to the remaining member. This provides seamless failover without manual intervention.

Answer

Create a redundant interface and add port1 and port2 as members, then assign the same IP address to both physical interfaces.

Answer

Create a software switch and add port1 and port2 as members, then assign the IP address to the software switch.

Answer

Create an aggregate interface with LACP mode active and add port1 and port2 as members, then assign the IP address to the aggregate interface.

Question 2

A network administrator is troubleshooting a FortiGate HA cluster. The administrator notices that the primary unit's configuration is not synchronizing to the secondary unit. Which CLI command should the administrator use to verify the HA synchronization status and identify any configuration differences?

Accepted Answer

diagnose sys ha checksum show. The command 'diagnose sys ha checksum show' displays the configuration checksums for all HA members. If the checksums differ, the configurations are not synchronized. This allows the administrator to quickly identify and troubleshoot synchronization issues.

Answer

get system ha status

Answer

diagnose debug application hatalk -1

Answer

execute ha synchronize start

Question 3

A FortiGate administrator configured a redundant interface named 'RED1' using 'config system interface' with 'set type redundant'. The interface is up, but traffic is not passing. Which additional step is required to make the redundant interface operational?

Accepted Answer

Add member interfaces using 'set member' under the redundant interface configuration.. A redundant interface in FortiGate is a logical interface that groups multiple physical interfaces for redundancy. It requires at least one physical member interface to be assigned. Without members, the interface remains down or non-functional. Adding members via 'set member' is the essential step to make it operational.

Answer

Set the redundant interface's IP address to 0.0.0.0 to allow DHCP.

Answer

Configure a virtual MAC address for the redundant interface to avoid ARP conflicts.

Answer

Enable LACP on the redundant interface to allow link aggregation.

Question 4

A network security engineer is deploying a FortiGate in transparent mode. The engineer needs to ensure that the FortiGate can be managed remotely via HTTPS from the management network, while still passing all other traffic transparently. Which configuration is required?

Accepted Answer

Assign a management IP address to the transparent-mode VDOM and enable HTTPS administrative access on the management interface.. In transparent mode, the FortiGate requires a management IP address to be accessible for administration. This IP is assigned to a VDOM, and administrative access protocols like HTTPS must be enabled on the interface connected to the management network. Firewall policies are not used for management traffic.

Answer

Enable 'set allowaccess https' on all interfaces and assign an IP address to each interface.

Answer

Create a firewall policy allowing HTTPS traffic to the FortiGate's management IP and set the action to 'accept'.

Answer

Configure a static route to the management network and enable HTTPS access on the WAN interface.

Question 5

A network administrator is configuring a new FortiGate and needs to set up an administrator account that can only view logs and monitor system status, without making any configuration changes. Which administrator profile should be assigned to this account?

Accepted Answer

read_only. The read_only administrator profile is specifically designed for users who need to monitor the FortiGate without making changes. It grants access to view system status, logs, and configuration but denies any modification privileges. This aligns with the requirement for an account that can only view logs and monitor status. The other profiles either grant too much access or none at all.

Answer

no_access

Answer

prof_admin

Answer

super_admin

Question 6

A FortiGate is deployed as an internal segmentation firewall with VDOMs for each department. The administrator needs to allow a monitoring server in the 'IT' VDOM to reach a syslog server in the 'Mgmt' VDOM over TCP 514. No inter-VDOM links currently exist. What must the administrator configure to permit this traffic while keeping the VDOMs isolated?

Accepted Answer

Create an inter-VDOM link, assign IP addresses from a dedicated transfer subnet to both ends, and add firewall policies in each VDOM.. Inter-VDOM links are the supported method for connecting isolated VDOMs while retaining independent routing tables. The link creates paired interfaces that require IP addressing and firewall policies on both sides. This design lets the administrator permit only TCP 514 from the IT monitoring server to the Mgmt syslog server, maintaining segmentation and explicit control.

Answer

Configure a VDOM exception for the syslog server's IP address in the IT VDOM's firewall policy.

Answer

Assign the monitoring server and syslog server to the same VDOM and use a policy with NAT enabled.

Answer

Enable 'set allow-subnet-overlap enable' on the Mgmt VDOM and add a static route from IT to Mgmt.

Question 7

A network security administrator is deploying a FortiGate 600E in a data center. The requirement is that the device must be able to inspect traffic flowing between two different VDOMs (VDOM-A and VDOM-B) that are configured on the same physical FortiGate. The administrator has already created both VDOMs and assigned interfaces to them. Which additional configuration is required to allow traffic to pass between these VDOMs?

Accepted Answer

Configure a pair of inter-VDOM links (IVLs) and assign IP addresses to them.. To allow traffic to pass between VDOMs on the same FortiGate, you must create inter-VDOM links (IVLs). These virtual interfaces act as a point-to-point connection between two VDOMs. Once IVLs are configured and IP addresses assigned, firewall policies can be created to permit and inspect traffic between the VDOMs. Other options do not provide a functional path for inter-VDOM communication.

Answer

Enable VDOM partitioning and assign the VDOMs to different NP6 processors.

Answer

Configure a firewall policy with the source and destination interfaces set to 'any' and enable NAT.

Answer

Create a VLAN interface on a physical interface and assign it to both VDOMs.

Question 8

A network administrator is configuring a FortiGate HA cluster and wants to prevent ARP cache issues on connected switches by using a virtual MAC address. Which configuration mode should be used?

Accepted Answer

Enable virtual MAC address in HA settings.. The virtual MAC address feature in HA settings ensures that the cluster interfaces use a consistent MAC address, avoiding ARP cache problems on switches. Other options do not provide a stable MAC address across failover events.

Answer

Configure a virtual IP (VIP) for each interface.

Answer

Set the HA mode to Active-Active.

Answer

Enable gratuitous ARP on the HA interfaces.

Question 9

A FortiGate is configured with two VDOMs: 'root' and 'vdom1'. The administrator wants to allow a server in 'vdom1' to be accessed from the internet via a VIP configured in 'root'. The server's default gateway is the FortiGate's interface in 'vdom1'. What must be configured to ensure return traffic from the server to the internet is handled correctly?

Accepted Answer

Configure a static route in 'vdom1' pointing to the inter-VDOM link, and a static route in 'root' pointing to the internet, plus firewall policies to allow traffic.. The server in 'vdom1' has its default gateway set to the FortiGate's interface in 'vdom1'. When it responds to a request that arrived via a VIP in 'root', the return traffic goes to its default gateway in 'vdom1'. To reach the internet, that traffic must be routed from 'vdom1' to 'root' via an inter-VDOM link. Static routes in both VDOMs and appropriate firewall policies are necessary to allow the traffic to flow correctly. This setup maintains the VIP in 'root' while ensuring symmetric routing.

Answer

Create an inter-VDOM link between 'root' and 'vdom1' and configure routing on both sides.

Answer

Enable 'set allow-routing' on the VIP in 'root' and create a firewall policy in 'vdom1' to allow the return traffic.

Answer

Configure a VIP in 'vdom1' instead of 'root' and apply it to the external interface in 'vdom1'.

Question 10

An administrator has a FortiGate 600E running FortiOS 7.2 with VDOMs enabled. The 'root' VDOM is in NAT mode and a 'dmz' VDOM is also in NAT mode. The administrator needs to allow HTTP traffic from the 'dmz' VDOM to a web server in the 'root' VDOM, and wants the traffic to be inspected by the firewall policy in the 'root' VDOM. Which configuration is required to accomplish this?

Accepted Answer

Create a VDOM link between the 'dmz' and 'root' VDOMs, assign IP addresses to both ends, and add firewall policies in both VDOMs to permit the traffic.. To allow traffic between two VDOMs, you must create a VDOM link, which acts as a virtual cable connecting them. Each end of the link needs an IP address, and firewall policies in each VDOM must permit the traffic. This ensures that the 'root' VDOM can apply its security policies to the traffic from the 'dmz' VDOM, meeting the requirement for inspection.

Answer

Configure a firewall policy in the 'dmz' VDOM with the destination interface as the 'root' VDOM's interface, and enable NAT.

Answer

Enable inter-VDOM routing globally with the command 'config system settings' and 'set inter-vdom-routing enable', then create a single policy in the 'root' VDOM.

Answer

Assign the same VDOM ID to both VDOMs and configure a firewall policy with the source interface in 'dmz' and destination interface in 'root'.

Question 11

An administrator is troubleshooting a FortiGate HA cluster in Active-Passive mode. The primary unit unexpectedly failed over to the secondary, and the administrator needs to verify which configuration settings are synchronized between the nodes. Which two configuration elements are synchronized by default in an HA cluster? (Choose two.)

Accepted Answer

Interface IP addresses and static routes. By default, FortiGate HA synchronizes the security and networking configuration, including firewall address objects, policies, interface IP addresses, and static routes. These elements are critical for consistent traffic handling after a failover. Management settings such as hostname, passwords, SNMP, and syslog are not synchronized by default, and HA operational parameters like priority and virtual MAC are handled separately.

Answer

SNMP community strings and syslog server settings

Answer

The FortiGate hostname and administrative passwords

Answer

The cluster's virtual MAC address and HA priority

Question 12

A network administrator is configuring a new FortiGate 100F for the first time. The administrator wants to set the hostname, configure the administrative timeout, and enable SSH access on the WAN interface. Which command-line interface (CLI) command should the administrator use to enter the configuration mode for system settings?

Accepted Answer

config system global. The 'config system global' command is the correct mode for setting global system parameters such as hostname and administrative timeout. To enable SSH on an interface, you would also need to configure the interface under 'config system interface' and allow SSH access, but the initial global settings are in 'system global'.

Answer

config system interface

Answer

config system settings

Answer

config system admin

Question 13

A network administrator is configuring a new FortiGate to replace an existing firewall at the network edge. The administrator wants to ensure that the FortiGate can be managed remotely via HTTPS on its WAN interface. Which configuration step is required to allow this access?

Accepted Answer

Enable HTTPS administrative access on the WAN interface.. Administrative access protocols on interfaces are disabled by default, especially on WAN-facing interfaces. To enable remote HTTPS management, the administrator must explicitly enable HTTPS administrative access on the WAN interface, typically using the command 'set allowaccess https'. This allows the FortiGate to respond to HTTPS management requests on that interface, and best practice is to also configure trusted hosts to restrict access.

Answer

Set the WAN interface to DHCP client mode and enable 'set allowaccess ping'.

Answer

Configure a virtual IP (VIP) mapping the WAN IP to the internal management IP.

Answer

Create a firewall policy from WAN to LAN that allows HTTPS traffic.

Question 14

An administrator needs to ensure that a FortiGate can be managed via SSH only from the internal network, while also allowing SNMP polling from a management server. The administrator wants to restrict access to the management interface. Which configuration should be applied?

Accepted Answer

Use 'set allowaccess' on the management interface to enable only SSH and SNMP, and configure trusted hosts on the administrator accounts.. Management access to a FortiGate is controlled by the administrative access settings on each interface. Enabling only SSH and SNMP on the management interface restricts the protocols. Trusted hosts on administrator accounts further restrict SSH to specific source IPs. SNMP access can be limited by configuring allowed hosts in the SNMP community settings.

Answer

Enable SSH and SNMP on the management interface and use a firewall policy to restrict access based on source IP.

Answer

Create a loopback interface with SSH and SNMP enabled and assign it to a management VDOM.

Answer

Configure an administrator account with a trusted host IP range for the internal network and a separate account for SNMP with the management server IP.

Question 15

A FortiGate is deployed in a large enterprise network with multiple VDOMs. The administrator needs to configure a firewall policy that allows traffic from any source to any destination while logging all sessions. However, the administrator wants to ensure that the policy does not match traffic that is already being handled by a more specific policy. What is the correct order of policy evaluation in FortiOS?

Accepted Answer

Policies are evaluated from top to bottom, and the first matching policy is applied.. Firewall policies in FortiOS are evaluated in the order they appear, from top to bottom. The first policy that matches all criteria is applied, and subsequent policies are ignored. To avoid a general policy overshadowing specific ones, place specific policies above general ones. This ensures that traffic is handled by the intended policy.

Answer

Policies are evaluated based on the most specific match, regardless of their position in the list.

Answer

Policies are evaluated in random order to ensure load balancing.

Answer

Policies are evaluated from bottom to top, and the last matching policy is applied.