NSE7_EFW Timed Practice Test 1 — 10 Questions

Question 1

An administrator wants to back up the configuration of a FortiGate to a USB drive connected to the device. Which CLI command should the administrator use to perform this backup?

Accepted Answer

execute backup config usb . The correct CLI command to back up the FortiGate configuration to a USB drive is 'execute backup config usb '. This command saves the configuration to the USB device with the specified filename. Other backup options include TFTP, FTP, and SCP, but USB is specifically for local USB drives.

Answer

execute backup config flash <filename>

Answer

execute backup config usb

Answer

execute backup config tftp

Question 2

A network administrator is configuring a new FortiGate and needs to set up an administrator account that can only view logs and monitor system status, without making any configuration changes. Which administrator profile should be assigned to this account?

Accepted Answer

read_only. The read_only administrator profile is specifically designed for users who need to monitor the FortiGate without making changes. It grants access to view system status, logs, and configuration but denies any modification privileges. This aligns with the requirement for an account that can only view logs and monitor status. The other profiles either grant too much access or none at all.

Answer

no_access

Answer

prof_admin

Answer

super_admin

Question 3

A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?

Accepted Answer

Flood to all ports. In transparent mode, a FortiGate acts as a Layer 2 bridge and does not participate in routing. When it receives a frame destined for a MAC address not present in its forwarding table, it behaves like a standard Layer 2 switch and floods the frame out all ports in the same broadcast domain (except the ingress port). This ensures the frame can reach its intended destination if the MAC is simply unknown to the FortiGate.

Answer

Drop the packet

Answer

Forward to the management interface

Answer

Send an ICMP unreachable message

Question 4

A FortiGate is deployed in transparent mode between two routers. The administrator wants to enable IPS inspection on traffic passing through the FortiGate. Which configuration is required to inspect traffic in transparent mode?

Accepted Answer

Create a firewall policy with the incoming and outgoing interfaces set to the transparent bridge pair.. In transparent mode, the FortiGate bridges traffic between interfaces. To inspect traffic, a firewall policy must be created that allows traffic from one bridge interface to the other, with an IPS sensor applied. Interfaces do not have IPs, and IPS is not enabled globally or directly on interfaces. Thus, the policy-based approach is correct.

Answer

Assign IP addresses to the transparent interfaces and enable IPS on those interfaces.

Answer

Configure a VLAN interface for each subnet and apply IPS to the VLAN interfaces.

Answer

Enable IPS globally under System > Config > IPS and select the transparent bridge.

Question 5

A FortiGate is configured with a site-to-site IPsec VPN to a remote peer. The VPN is up, but traffic is not passing. You run 'diagnose vpn tunnel list' and see that the tunnel is up, but the phase-2 selectors show no traffic. You suspect a routing issue. Which command would you use to verify that traffic is being routed correctly through the tunnel?

Accepted Answer

get router info routing-table details . To verify that traffic to a specific destination is routed through the IPsec tunnel, you use the command 'get router info routing-table details '. This shows the exact route that will be used, including the outgoing interface. If the route points to the tunnel interface, routing is correct; if not, you must fix the routing configuration. This command is essential for troubleshooting VPN traffic flow.

Answer

diagnose vpn ike gateway list

Answer

diagnose ip route list

Answer

diagnose firewall iprope list

Question 6

An administrator manages multiple FortiGates in a single ADOM using normalized interfaces. A new policy must reference an interface that has different names on each device (port1 on one, wan1 on another). Which FortiManager object should the administrator use in the policy to ensure correct per-device mapping?

Accepted Answer

Normalized interface. Normalized interfaces provide a logical abstraction that FortiManager resolves to the correct physical interface per device using per-device mappings. This allows one shared policy to reference a stable name while each FortiGate receives the appropriate local interface, such as port1 or wan1, during installation. Zones, dynamic interfaces, and virtual wire pairs operate per device and do not deliver this cross-device mapping.

Answer

Zone

Answer

Virtual wire pair

Answer

Dynamic interface

Question 7

Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?

Accepted Answer

It uses fewer system resources than proxy-based inspection. Flow-based inspection is beneficial because it uses fewer system resources than proxy-based inspection (B): instead of buffering and reassembling full content in a proxy, it inspects packets as they stream through, so it consumes less CPU and memory. It also provides higher throughput performance (C), since the single-pass, stream-oriented engine avoids the store-and-forward overhead and per-protocol proxy processing that slows proxy-based mode. Options A and E are not flow-mode benefits: deep content inspection for all protocols and more granular application control are strengths associated with proxy-based inspection, which can buffer and fully decode traffic. Option D is incorrect because manual buffer allocation is not a requirement or benefit of flow-based inspection; buffering is largely handled automatically and minimized in this mode.

Answer

It supports deep content inspection for all protocols

Answer

It requires manual buffer allocation

Answer

It offers more granular application control

Question 8

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a policy change is made, it is properly validated and installed without causing downtime. Which TWO actions should be taken before installing the policy package? (Choose two.)

Accepted Answer

Review the installation preview to understand the changes. Before installing a policy package, it is essential to run a policy check to catch errors and to review the installation preview to see the exact changes. These steps help ensure that the installation will not cause unintended downtime or security issues. Other actions like workspace mode or scheduling are supplementary but not directly related to validation.

Answer

Schedule the installation during a maintenance window

Answer

Install the policy package to all devices simultaneously

Answer

Enable workspace mode to lock the ADOM

Question 9

Which TWO methods are used to achieve traffic separation in a multi-VDOM environment?

Accepted Answer

Using VLAN sub-interfaces. In a multi-VDOM FortiGate environment, traffic separation is achieved by assigning physical ports to VDOMs (option C), since each VDOM maintains its own independent routing table, firewall policies, and interfaces, so binding distinct physical interfaces to different VDOMs isolates their traffic at Layer 1/2. VLAN sub-interfaces (option A) also achieve traffic separation because a single physical interface can be partitioned into multiple VLAN-tagged sub-interfaces, each of which can be placed in a different VDOM, keeping the VLANs logically isolated even when they share the same physical link. Options B, D, and E do not provide traffic separation: SSL inspection is a security inspection feature, different HA clusters relate to redundancy/device grouping rather than intra-device VDOM traffic isolation, and differing firmware versions are irrelevant (and unsupported) for separating traffic within a multi-VDOM deployment.

Answer

Enabling SSL inspection globally

Answer

Using different HA clusters

Answer

Using different firmware versions

Question 10

Which method is the most secure for managing FortiGate devices remotely?

Accepted Answer

HTTPS with restricted access via Trusted Hosts. HTTPS with restricted access via Trusted Hosts is the most secure option because HTTPS encrypts administrative traffic (protecting credentials and configuration data in transit), and Trusted Hosts limits which source IP addresses or subnets can even attempt to connect to the management interface. This combination provides both confidentiality and access control.

Answer

HTTP with password authentication

Answer

Telnet

Answer

SNMPv1