FORTINET-NSE7-SPECIALTY Practice Test 2 — 30 Questions

Question 1

What is the purpose of the 'Any' interface in a firewall policy?

Accepted Answer

To match traffic regardless of the ingress or egress interface. The 'Any' interface enables the policy to match traffic originating from or destined to any physical or logical interface on the FortiGate.

Answer

To force traffic through the hardware switch

Answer

To bypass the routing table

Answer

To match traffic only on the WAN port

Question 2

In a site-to-site VPN, you need to allow traffic initiated from the remote site. What configuration is essential on the local FortiGate?

Accepted Answer

A firewall policy allowing traffic from the VPN zone to the Internal zone. A local firewall policy must exist to permit traffic arriving from the VPN interface and destined for the internal network.

Answer

An IPSec phase 3 policy

Answer

A static route to the remote subnet

Answer

A NAT rule for the remote subnet

Question 3

An administrator is troubleshooting an issue where hardware acceleration is not working after upgrading firmware. Which command identifies if the NP configuration has changed?

Accepted Answer

diag hardware npu np6 port-list. 'diag hardware npu np6 port-list' or similar status commands help verify the current operational state and mapping of physical ports to NPU cores.

Answer

config system npu

Answer

diagnose firewall npu

Answer

get hardware status

Question 4

What is the result of 'Pushing' a policy package from FortiManager to a FortiGate?

Accepted Answer

The FortiGate policy configuration is overwritten with the FortiManager version. Pushing a policy package replaces the current policy configuration on the FortiGate with the version stored in the FortiManager database.

Answer

The FortiGate policy is sent to the FortiManager

Answer

The policy is saved in a draft state on the FortiGate

Answer

The FortiManager policy is appended to the existing FortiGate policy

Question 5

What is the primary purpose of an ADOM in FortiManager?

Accepted Answer

To logically group devices for delegated administration and policy management. Administrative Domains (ADOMs) allow the segregation of managed devices based on geography, customer, or business unit for delegated administration.

Answer

To provide high availability for the FortiGate

Answer

To allow external API access to the FortiGate

Answer

To increase the storage capacity of the FortiManager

Question 6

Which TWO options are available when configuring an SD-WAN rule in FortiManager?

Accepted Answer

Source/Destination criteria. SD-WAN rules allow setting traffic steering based on criteria like source/destination and strategy (load balancing/manual).

Answer

Interface physical speed

Answer

MAC address spoofing

Answer

Hardware acceleration toggle

Question 7

What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?

Accepted Answer

Implicit Deny. The implicit deny policy is the last rule in the firewall policy list and drops all non-matching traffic.

Answer

Send to local DNS

Answer

Route to DMZ

Answer

Allow

Question 8

Which THREE factors influence log storage efficiency on a FortiAnalyzer/FortiManager?

Accepted Answer

Log compression settings. Log compression, log retention settings, and disk quota management determine how long logs persist and how much space they consume.

Answer

The firewall firmware version

Answer

The number of active users

Question 9

You notice that an IPsec tunnel is up, but no traffic passes. What is the most common reason related to firewall policy configuration?

Accepted Answer

Missing firewall policy. Even if the tunnel is up, a policy must exist to allow traffic to flow between the internal network and the tunnel interface.

Answer

Missing static route

Answer

Incorrect IKE ID

Answer

Phase 1 lifetime expiration

Question 10

In a high availability (HA) cluster, which THREE settings are synchronized between the primary and secondary units?

Accepted Answer

Address objects. HA synchronization ensures that policies, objects, and configurations are mirrored to provide seamless failover.

Answer

Hardware serial numbers

Answer

Management IP address

Question 11

A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?

Accepted Answer

Flood to all ports. In transparent mode, the FortiGate acts as a Layer 2 bridge and will flood the unknown frame to all interfaces in the bridge domain except the incoming port.

Answer

Drop the packet

Answer

Forward to the management interface

Answer

Send an ICMP unreachable message

Question 12

When adding a FortiGate to FortiManager, which mode must the FortiGate be in to allow the FortiManager to manage its configuration and policies?

Accepted Answer

Normal mode. The FortiGate must be in 'Normal' mode; if it is in 'Backup' or 'Read-only' mode, full management is not possible.

Answer

Registration-only mode

Answer

Backup mode

Answer

Read-only mode

Question 13

An administrator needs to perform a firmware upgrade on 100 FortiGates. Which feature in FortiManager allows this to be done securely with a rollback option?

Accepted Answer

Firmware Management in Device Manager. The 'Firmware Management' feature in Device Manager allows for scheduled upgrades and provides options for managing firmware versions across groups.

Answer

Automated patch management

Answer

Manual script pushing

Answer

Global Policy upgrade task

Question 14

Which THREE steps are involved in the 'Policy Package Installation' workflow?

Accepted Answer

Select the target device. The workflow involves selecting the package, choosing the target device, and executing the installation (with a preview).

Answer

Perform a factory reset

Answer

Reboot the target device

Question 15

Which THREE items are included in a Policy Package when it is pushed from FortiManager?

Accepted Answer

Service Objects. Policy packages include firewall policies, address objects, and services used within those policies.

Answer

System interface settings

Answer

Routing tables

Question 16

You are managing FortiGates across multiple ADOMs. How can you share common firewall objects (e.g., mail servers, common IP ranges) across these ADOMs?

Accepted Answer

Create objects in the Global Database. Using the 'Global Database' or 'Global Policy' objects allows administrators to define objects once and share them across multiple ADOMs.

Answer

Manually copy objects to each ADOM

Answer

Use the API to script the creation in every ADOM

Answer

Enable 'Object Sharing' in system settings

Question 17

Which TWO items must be configured within an SD-WAN template for SD-WAN traffic steering to work?

Accepted Answer

SD-WAN Members. You must define the members (interfaces) and the rules (policies) that dictate how traffic is steered.

Answer

DHCP server settings

Answer

VLAN tagging

Answer

Local users

Question 18

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

Accepted Answer

Use a route map in the OSPF redistribute configuration. A route map must be applied during redistribution to filter the prefixes being injected.

Answer

Configure a distribute-list in the OSPF process

Answer

Use an IP prefix list under the OSPF area command

Answer

Use an access list under the interface configuration

Question 19

Which FortiGate feature allows you to bypass SSL inspection for specific known-trusted websites to maintain user privacy?

Accepted Answer

URL Filter category exemption. SSL Inspection Exemptions allow bypassing decryption for specific categories or domains.

Answer

Firewall address object

Answer

Application Control override

Answer

IPS signature exclusion

Question 20

Which THREE aspects of the FortiGate system are affected by changing the global 'set vdom-mode' to 'multi-vdom'?

Accepted Answer

CLI command hierarchy. Changing the VDOM mode affects the CLI hierarchy, the available memory for VDOMs, and how system resources are partitioned.

Answer

The HA cluster size

Answer

The physical port order