NSE7_EFW System Configuration Practice Test 7 — 15 Questions

Question 1

A network administrator needs to configure a FortiGate to send logs to a FortiAnalyzer. The administrator wants to ensure that logs are sent securely and that the FortiGate can verify the FortiAnalyzer's identity. Which protocol should be used for log transmission?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OFTP over TLS. The FortiGate uses OFTP over TLS to send logs to FortiAnalyzer securely. This protocol encrypts the logs and uses certificates to authenticate the FortiAnalyzer, ensuring that logs are not intercepted or sent to an unauthorized server. Other syslog options lack the necessary security features.

Answer

SNMPv3

Answer

Syslog over UDP

Answer

Syslog over TCP

Question 2

A FortiGate is deployed in transparent mode between an internal network and a router. Users behind the FortiGate cannot reach the internet, but the FortiGate can ping external addresses. The administrator confirms the forwarding domain is enabled on both interfaces. Which action should the administrator take next to allow traffic to pass through the FortiGate?

Accepted Answer

Create a firewall policy from the internal interface to the external interface with NAT disabled and the action set to ACCEPT.. In transparent mode, the FortiGate bridges traffic between interfaces and does not perform NAT or routing. A firewall policy must be created to allow traffic from the internal interface to the external interface, with NAT disabled. Without this policy, traffic is dropped by the implicit deny. The policy action must be ACCEPT to permit the traffic.

Answer

Create a firewall policy from the internal interface to the external interface with NAT enabled.

Answer

Configure a static route on the FortiGate pointing to the external router.

Answer

Enable DHCP on the internal interface to provide IP addresses to users.

Question 3

An administrator wants to back up the configuration of a FortiGate to a USB drive connected to the device. Which CLI command should the administrator use to perform this backup?

Accepted Answer

execute backup config usb . The correct CLI command to back up the FortiGate configuration to a USB drive is 'execute backup config usb '. This command saves the configuration to the USB device with the specified filename. Other backup options include TFTP, FTP, and SCP, but USB is specifically for local USB drives.

Answer

execute backup config flash <filename>

Answer

execute backup config usb

Answer

execute backup config tftp

Question 4

A network administrator is troubleshooting a FortiGate 300E that is experiencing high CPU usage. The administrator suspects that a large amount of traffic is being processed by the CPU instead of being offloaded to the NP6 processor. Which type of traffic is typically NOT offloaded by the NP6 processor and therefore may contribute to high CPU usage?

Accepted Answer

Traffic requiring deep inspection with SSL/TLS decryption.. The NP6 processor offloads many common traffic types, but it cannot handle SSL/TLS decryption and deep inspection. These tasks require the main CPU because they involve complex cryptographic operations and content inspection. When a FortiGate is configured to decrypt and inspect HTTPS traffic, the CPU load can increase significantly, especially with high throughput. Other listed traffic types are typically offloaded and do not cause high CPU usage.

Answer

Traffic that is subject to simple firewall policies without UTM.

Answer

Traffic that uses NAT with a small number of concurrent sessions.

Answer

Traffic that is routed between VLAN interfaces on the same physical interface.

Question 5

An administrator is configuring a new FortiGate cluster in an HA environment. The administrator wants to ensure that if the primary unit fails, the secondary unit takes over with minimal disruption to existing sessions. Which HA setting should be configured to allow the secondary unit to maintain session state?

Accepted Answer

Enable session pickup on both HA nodes.. To maintain session state during an HA failover, session pickup must be enabled. This synchronizes session information between the primary and secondary units, allowing the secondary to take over existing sessions without interruption. Other settings like HA mode, priority, or gratuitous ARP do not provide session synchronization.

Answer

Enable gratuitous ARP on the HA cluster.

Answer

Set the HA priority higher on the secondary unit.

Answer

Configure the HA mode to active-active.

Question 6

An administrator needs to back up the FortiGate configuration to a USB drive for disaster recovery. The FortiGate has a USB port and the administrator inserts a USB drive. Which command should the administrator use to perform the backup?

Accepted Answer

execute backup config usb. The correct command to back up the FortiGate configuration to a USB drive is 'execute backup config usb'. This command saves the configuration file to the connected USB storage device. Other backup options like TFTP or flash do not meet the requirement of using a USB drive. Therefore, the administrator should use this command.

Answer

execute backup config tftp

Answer

execute backup full-config usb

Answer

execute backup config flash

Question 7

A FortiGate is configured with two VDOMs: 'root' and 'dmz'. The administrator wants to use a single physical interface to carry traffic for both VDOMs, keeping the traffic logically separated. Which interface type must be configured to achieve this?

Accepted Answer

Multi-VDOM interface. A multi-VDOM interface allows a single physical interface to be used by more than one VDOM, each with its own IP address and routing table. This satisfies the requirement of using one port for both VDOMs while maintaining logical separation. Other interface types are either single-VDOM or serve different purposes such as inter-VDOM links or L2 retransmission.

Answer

NPU VDOM link

Answer

VLAN subinterface

Answer

EMAC-VLAN

Question 8

An administrator needs to configure a FortiGate to send logs to a FortiAnalyzer device. The FortiAnalyzer is reachable via the management interface. Which CLI command sequence correctly configures the FortiGate to send logs to the FortiAnalyzer?

Accepted Answer

config log fortianalyzer setting; set status enable; set server 10.1.1.100; end. The correct CLI sequence is under 'config log fortianalyzer setting', where you enable the status and specify the server IP. Other options configure different logging destinations or disable the feature. This ensures logs are sent to the FortiAnalyzer for analysis and archiving.

Answer

config log syslogd setting; set status enable; set server 10.1.1.100; end

Answer

config log fortianalyzer setting; set status disable; set server 10.1.1.100; end

Answer

config log memory setting; set status enable; set server 10.1.1.100; end

Question 9

An administrator is configuring a FortiGate in transparent mode. The FortiGate will be placed between an internal network and a router. The administrator wants to ensure that the FortiGate can be managed remotely and that it can still perform security inspections. Which two configurations are required? (Choose two.)

Accepted Answer

Configure firewall policies to allow traffic between the internal network and the router.. In transparent mode, the FortiGate forwards traffic at Layer 2, so data interfaces do not have IP addresses. To manage the device remotely, an IP address must be assigned to a management interface or a VLAN interface. Additionally, firewall policies are required to allow traffic between the internal and external interfaces; these policies also enable security inspections. Without these, traffic would be blocked, and the FortiGate would not be manageable remotely.

Answer

Enable NAT on the external interface to allow internal hosts to access the internet.

Answer

Configure a default gateway on the FortiGate to route management traffic.

Answer

Set the FortiGate to NAT mode instead of transparent mode to enable security inspections.

Question 10

A FortiGate is configured with a redundant interface (also known as a link aggregation group) using two physical interfaces. The administrator notices that traffic is not being distributed evenly across the two links; one link is heavily utilized while the other is nearly idle. Which factor is most likely causing this imbalance?

Accepted Answer

The hashing algorithm used for distributing traffic is based on source and destination IP addresses, and the traffic consists of a single large flow.. Link aggregation (redundant interface) on FortiGate uses a hashing algorithm to distribute traffic across member links. The hash typically includes source and destination IP addresses, and possibly Layer 4 ports. If the traffic consists of a single flow, all packets will have the same hash value and will be sent over the same link, causing the imbalance. To achieve even distribution, there must be multiple flows with different source/destination IPs or ports. This is a fundamental characteristic of link aggregation, not a fault.

Answer

One of the physical interfaces is faulty and is dropping packets, causing all traffic to fail over to the other link.

Answer

The FortiGate's redundant interface does not support load balancing; it only provides redundancy.

Answer

The FortiGate's redundant interface is configured in Active-Passive mode, so only one link is used at a time.

Question 11

A FortiGate is deployed in a VDOM-enabled configuration. The administrator needs to allow inter-VDOM routing between the 'LAN' VDOM and the 'DMZ' VDOM without sending traffic to an external device. Which action must be performed?

Accepted Answer

Create a VDOM link (vlink) and assign each end to the respective VDOMs, then configure firewall policies referencing the vlink interfaces.. Inter-VDOM routing requires a VDOM link, which creates a virtual interface pair internal to the FortiGate. Each end is assigned to a VDOM, and firewall policies referencing those interfaces control the traffic. This avoids external cabling and allows full inspection. The other options either reference non-existent features or misunderstand VDOM isolation.

Answer

Enable 'set inter-vdom-routing enable' under the global system settings.

Answer

Create a firewall policy with source and destination interfaces in different VDOMs without any VDOM link.

Answer

Assign the same VLAN ID to interfaces in both VDOMs and rely on Layer 2 switching within the FortiGate.

Question 12

A FortiGate is configured with a static route to a destination network via a next-hop IP. The administrator wants to ensure that if the next-hop becomes unreachable, the route is removed from the routing table. Which feature should be configured?

Accepted Answer

Configure a link monitor on the interface associated with the next-hop and enable 'update-static-route'.. Link monitors actively probe a target IP (often the next-hop) and can trigger actions such as removing static routes when the probe fails. Enabling 'update-static-route' ensures that static routes associated with the monitored interface or next-hop are removed from the routing table if the link monitor detects a failure. This provides automatic failover or route withdrawal.

Answer

Enable 'set link-down-failover' on the static route.

Answer

Set the route's distance to a higher value than other routes to the same destination.

Answer

Enable 'set blackhole enable' on the static route.

Question 13

A network administrator needs to configure a FortiGate to send logs to a FortiAnalyzer. The administrator wants to ensure that logs are sent securely and that the FortiGate can verify the FortiAnalyzer's identity. Which protocol should be used for log transmission?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OFTP. OFTP is the proprietary protocol used by FortiGate to securely send logs to FortiAnalyzer. It encrypts logs using SSL/TLS, ensuring confidentiality and integrity. The other protocols either lack encryption or are not intended for log forwarding. Therefore, OFTP is the correct choice when encryption is required.

Answer

Syslog over TCP

Answer

SNMPv3

Answer

Syslog over UDP

Question 14

An administrator is troubleshooting a FortiGate that is not applying a security profile to traffic. The administrator suspects that the traffic is being offloaded to a network processor (NP6) and bypassing the CPU. Which CLI command can be used to verify whether traffic is being offloaded and which sessions are affected?

Accepted Answer

diagnose npu np6 session list. The command 'diagnose npu np6 session list' specifically lists sessions offloaded to the NP6 processor. This allows the administrator to see which traffic is bypassing the CPU and therefore not subject to security profiles. The other commands either do not focus on offload or do not provide the necessary details.

Answer

diagnose sys session stat

Answer

diagnose debug flow filter

Answer

diagnose sys session list

Question 15

A network administrator is configuring a FortiGate in transparent mode. The FortiGate is deployed between an internal network and a router. The administrator wants to ensure that the FortiGate forwards traffic without modifying the source or destination IP addresses. Which statement describes the correct behavior of a FortiGate in transparent mode?

Accepted Answer

The FortiGate forwards frames based on MAC addresses and does not modify the IP headers of the packets it inspects.. In transparent mode, the FortiGate acts as a layer 2 bridge, forwarding traffic based on MAC addresses without modifying IP addresses. This allows it to be inserted into an existing network seamlessly. The other options describe behaviors of NAT/route mode or incorrect assumptions about transparent mode.

Answer

The FortiGate must be configured with a unique IP address on each interface to participate in routing protocols.

Answer

The FortiGate performs NAT by default and requires a VIP to allow inbound traffic.

Answer

The FortiGate acts as a layer 3 router and requires IP addresses on its interfaces to forward traffic.