FORTINET-NSE7-SPECIALTY Practice Test 2 — 25 Questions

Question 1

Which THREE features are specific to the FortiManager 'Enterprise Firewall' management workflow?

Accepted Answer

Object database management. Centralized policy management, object database management, and revision control are key parts of the enterprise workflow.

Answer

Traffic shaping on routers

Answer

Web filter database updates

Question 2

What happens if you modify an SD-WAN template that is already applied to a FortiGate?

Accepted Answer

The configuration status shows 'Modified' and requires an installation task. The change creates a configuration difference, which must be pushed to the device to take effect.

Answer

The changes take effect immediately without a push

Answer

The FortiGate automatically pulls the new config

Answer

The FortiGate configuration is reverted

Question 3

Which THREE items are included in the configuration file of a FortiGate?

Accepted Answer

User certificates. The configuration file contains system settings, policy rules, and interface definitions.

Answer

FortiGuard cached updates

Answer

Real-time session tables

Question 4

A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?

Accepted Answer

The FortiGate CA certificate used for SSL inspection. The FortiGate acts as a man-in-the-middle, so the client must trust the CA certificate generated by the FortiGate.

Answer

The FortiGate's local device certificate

Answer

The Fortinet_Factory CA certificate

Answer

A third-party public CA certificate

Question 5

Where can an administrator check the status of the connection between a FortiGate and FortiManager?

Accepted Answer

Device Manager. The 'Device Manager' page lists all managed devices and displays their status (e.g., 'Up', 'Down', 'Synchronized').

Answer

Log View

Answer

Policy & Objects

Answer

System Settings

Question 6

What is the purpose of the 'Any' interface in a firewall policy?

Accepted Answer

To match traffic regardless of the ingress or egress interface. The 'Any' interface enables the policy to match traffic originating from or destined to any physical or logical interface on the FortiGate.

Answer

To force traffic through the hardware switch

Answer

To bypass the routing table

Answer

To match traffic only on the WAN port

Question 7

In a site-to-site VPN, you need to allow traffic initiated from the remote site. What configuration is essential on the local FortiGate?

Accepted Answer

A firewall policy allowing traffic from the VPN zone to the Internal zone. A local firewall policy must exist to permit traffic arriving from the VPN interface and destined for the internal network.

Answer

An IPSec phase 3 policy

Answer

A static route to the remote subnet

Answer

A NAT rule for the remote subnet

Question 8

An administrator is troubleshooting an issue where hardware acceleration is not working after upgrading firmware. Which command identifies if the NP configuration has changed?

Accepted Answer

diag hardware npu np6 port-list. 'diag hardware npu np6 port-list' or similar status commands help verify the current operational state and mapping of physical ports to NPU cores.

Answer

config system npu

Answer

diagnose firewall npu

Answer

get hardware status

Question 9

What is the result of 'Pushing' a policy package from FortiManager to a FortiGate?

Accepted Answer

The FortiGate policy configuration is overwritten with the FortiManager version. Pushing a policy package replaces the current policy configuration on the FortiGate with the version stored in the FortiManager database.

Answer

The FortiGate policy is sent to the FortiManager

Answer

The policy is saved in a draft state on the FortiGate

Answer

The FortiManager policy is appended to the existing FortiGate policy

Question 10

What is the primary purpose of an ADOM in FortiManager?

Accepted Answer

To logically group devices for delegated administration and policy management. Administrative Domains (ADOMs) allow the segregation of managed devices based on geography, customer, or business unit for delegated administration.

Answer

To provide high availability for the FortiGate

Answer

To allow external API access to the FortiGate

Answer

To increase the storage capacity of the FortiManager

Question 11

Which TWO options are available when configuring an SD-WAN rule in FortiManager?

Accepted Answer

Source/Destination criteria. SD-WAN rules allow setting traffic steering based on criteria like source/destination and strategy (load balancing/manual).

Answer

Interface physical speed

Answer

MAC address spoofing

Answer

Hardware acceleration toggle

Question 12

What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?

Accepted Answer

Implicit Deny. The implicit deny policy is the last rule in the firewall policy list and drops all non-matching traffic.

Answer

Send to local DNS

Answer

Route to DMZ

Answer

Allow

Question 13

Which THREE factors influence log storage efficiency on a FortiAnalyzer/FortiManager?

Accepted Answer

Log compression settings. Log compression, log retention settings, and disk quota management determine how long logs persist and how much space they consume.

Answer

The firewall firmware version

Answer

The number of active users

Question 14

You notice that an IPsec tunnel is up, but no traffic passes. What is the most common reason related to firewall policy configuration?

Accepted Answer

Missing firewall policy. Even if the tunnel is up, a policy must exist to allow traffic to flow between the internal network and the tunnel interface.

Answer

Missing static route

Answer

Incorrect IKE ID

Answer

Phase 1 lifetime expiration

Question 15

In a high availability (HA) cluster, which THREE settings are synchronized between the primary and secondary units?

Accepted Answer

Address objects. HA synchronization ensures that policies, objects, and configurations are mirrored to provide seamless failover.

Answer

Hardware serial numbers

Answer

Management IP address

Question 16

A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?

Accepted Answer

Flood to all ports. In transparent mode, the FortiGate acts as a Layer 2 bridge and will flood the unknown frame to all interfaces in the bridge domain except the incoming port.

Answer

Drop the packet

Answer

Forward to the management interface

Answer

Send an ICMP unreachable message

Question 17

When adding a FortiGate to FortiManager, which mode must the FortiGate be in to allow the FortiManager to manage its configuration and policies?

Accepted Answer

Normal mode. The FortiGate must be in 'Normal' mode; if it is in 'Backup' or 'Read-only' mode, full management is not possible.

Answer

Registration-only mode

Answer

Backup mode

Answer

Read-only mode

Question 18

An administrator needs to perform a firmware upgrade on 100 FortiGates. Which feature in FortiManager allows this to be done securely with a rollback option?

Accepted Answer

Firmware Management in Device Manager. The 'Firmware Management' feature in Device Manager allows for scheduled upgrades and provides options for managing firmware versions across groups.

Answer

Automated patch management

Answer

Manual script pushing

Answer

Global Policy upgrade task

Question 19

Which THREE steps are involved in the 'Policy Package Installation' workflow?

Accepted Answer

Select the target device. The workflow involves selecting the package, choosing the target device, and executing the installation (with a preview).

Answer

Perform a factory reset

Answer

Reboot the target device

Question 20

Which THREE items are included in a Policy Package when it is pushed from FortiManager?

Accepted Answer

Service Objects. Policy packages include firewall policies, address objects, and services used within those policies.

Answer

System interface settings

Answer

Routing tables