FORTINET-NSE7-SPECIALTY Nse7 Enterprise Firewall Central Management — 25 Questions

Question 1

A FortiManager administrator needs to ensure that logs from all enterprise FortiGates are aggregated and purged based on storage thresholds. Where is this configured?

Accepted Answer

FortiAnalyzer/Log Settings under Device Manager. In FortiManager, log aggregation and purging based on storage thresholds for managed FortiGates are configured under FortiAnalyzer/Log Settings in Device Manager. This section allows you to enable log forwarding to FortiAnalyzer and set disk quota and retention policies. It centralizes log management for all devices in an ADOM.

Answer

System settings under 'Network' tab

Answer

Global Policy settings

Answer

ADOM management settings

Question 2

An enterprise firewall administrator needs to deploy different security profiles to branch offices while sharing the same firewall policy structure. Which feature should be used?

Accepted Answer

Policy Package inheritance and mapping. Policy Package inheritance and mapping in FortiManager allows a base policy package to be shared across multiple ADOMs or managed devices, with per-device or per-branch mapping of security profiles. This means the firewall policy structure (rules, objects, order) remains consistent, while security profiles (AV, IPS, web filter, etc.) can be customized for each branch. The feature is designed exactly for this scenario: centralized policy management with local profile flexibility. It avoids duplication and ensures compliance with the shared policy framework.

Answer

Creating multiple ADOMs for every branch

Answer

Manual copy-paste of rules

Answer

Using CLI templates exclusively

Question 3

An administrator is configuring the FortiManager to manage multiple FortiGate devices across different regions. Which method ensures that the device configuration remains synchronized with the FortiManager policy database during an automatic configuration update?

Accepted Answer

Enable Auto-update in the Device Manager configuration settings. The 'Auto-update' feature in the FortiManager Device Manager ensures that the configuration on the managed device is automatically synchronized with the policy package defined in the FortiManager database.

Answer

Set the FortiGate to 'Read-Only' mode

Answer

Enable ADOM-level scheduling

Answer

Configure a manual CLI script to push updates

Question 4

Which FortiManager feature allows an administrator to test policy changes in a sandbox environment before applying them to production FortiGates?

Accepted Answer

Policy Package Cloning/Revision History. FortiManager's Policy Package Cloning and Revision History features allow administrators to duplicate an existing policy package, modify the clone in a sandbox-like manner, and review changes via revision history before installing them to production FortiGates. This workflow provides a safe testing ground because changes are staged in the FortiManager database and only pushed to devices when the administrator explicitly installs the package. Revision history also enables rollback if a change causes issues.

Answer

Policy Testing Mode

Answer

Global Policy Lockdown

Answer

Device Manager Simulation

Question 5

Which protocol does FortiManager use to communicate with managed FortiGate devices?

Accepted Answer

multiple_choice. FortiManager uses the FortiManager-to-FortiGate (FMG-FGT) protocol, which is built on top of SSL/TLS, often referred to as FGFM.

Answer

HTTPS

Answer

SSH

Answer

SNMP

Question 6

When using FortiAnalyzer integration with FortiManager, where do you view the aggregated log reports?

Accepted Answer

Reports & Analytics tab. In FortiManager, aggregated log reports from FortiAnalyzer integration are viewed under the Reports & Analytics tab (sometimes labeled 'Reports' or 'Analytics' depending on version). This tab is where FortiManager surfaces FortiAnalyzer-sourced log data, report schedules, and dashboards, since FortiManager itself does not store logs but can proxy or federate access to FortiAnalyzer's reporting engine. The other tabs are for device management, policy configuration, and system settings, not log analytics.

Answer

System Settings

Answer

Device Manager

Answer

Policy & Objects

Question 7

Which type of script in FortiManager is designed to run on the FortiManager itself rather than the managed devices?

Accepted Answer

TCL scripts. TCL scripts in FortiManager are executed on the FortiManager appliance itself, not pushed to managed FortiGates. They are used for tasks such as generating reports, manipulating ADOM data, or performing custom automation on the manager, which is why they are the correct answer for a script type that runs locally.

Answer

CLI scripts

Answer

Configuration scripts

Answer

Policy scripts

Question 8

When a policy change is made in FortiManager, it must be 'Installed' to take effect. What is the first stage of the install process?

Accepted Answer

Install Preview. The first stage of the FortiManager install process is Install Preview, which shows a diff of the changes that will be pushed to the managed FortiGate(s). This preview allows the administrator to review exactly what configuration will be installed, catch errors or unintended changes, and confirm the target devices before committing. Only after the preview is accepted does FortiManager proceed to validate the configuration and push it to the devices.

Answer

Database validation

Answer

Config push

Answer

Reboot

Question 9

Which THREE features are specific to the FortiManager 'Enterprise Firewall' management workflow?

Accepted Answer

Object database management. In the FortiManager Enterprise Firewall workflow, object database management (A) is correct because FortiManager maintains a centralized, normalized object database (addresses, services, etc.) that is shared across managed FortiGate devices, enabling consistent object reuse and conflict detection. Revision control (B) is correct because FortiManager stores configuration revisions and policy package versions, allowing administrators to compare, revert, and audit changes made to firewall policies. Centralized policy management (E) is correct because the Enterprise Firewall workflow is built around creating policy packages and assigning them to managed devices or ADOMs, so policies are authored once and deployed centrally. Traffic shaping on routers (C) is not specific to this workflow—it is a routing/QoS function configured on devices, not a FortiManager Enterprise Firewall management feature. Web filter database updates (D) relate to FortiGuard security service updates and content filtering, which are separate from the Enterprise Firewall policy-management workflow.

Answer

Traffic shaping on routers

Answer

Web filter database updates

Question 10

When adding a FortiGate to FortiManager, which mode must the FortiGate be in to allow the FortiManager to manage its configuration and policies?

Accepted Answer

Normal mode. For FortiManager to manage a FortiGate's configuration and policies, the FortiGate must be in Normal mode (the default operating mode). In Normal mode, the FortiGate can be added to FortiManager, and FortiManager can push policy packages, install configuration changes, and retrieve status. Other modes like backup or read-only are not valid FortiGate operational modes for full management.

Answer

Registration-only mode

Answer

Backup mode

Answer

Read-only mode

Question 11

An administrator wants to use FortiManager to push a configuration change to 50 FortiGates simultaneously. Which method minimizes downtime and ensures consistency?

Accepted Answer

Assign devices to a Device Group and push a common Policy Package. Assigning the 50 FortiGates to a Device Group and pushing a common Policy Package lets FortiManager install the same consistent configuration to all devices in one operation. This minimizes downtime because the install is orchestrated centrally with a single revision, and it guarantees consistency since every device receives identical policy objects. It also avoids the human error inherent in per-device changes.

Answer

Create 50 separate ADOMs

Answer

Connect to each FortiGate via SSH and run scripts

Answer

Enable 'Auto-Push' for every change

Question 12

What is the primary purpose of an ADOM in FortiManager?

Accepted Answer

To logically group devices for delegated administration and policy management. An ADOM (Administrative Domain) in FortiManager is a logical container that groups managed devices, policies, and objects for administrative segregation. It enables delegated administration by allowing different administrators to manage only their assigned ADOMs, and it provides a boundary for policy management, ensuring that policies and objects are not shared across ADOMs unless explicitly done via global objects. This makes it the primary mechanism for multi-tenancy and organizational separation in FortiManager.

Answer

To provide high availability for the FortiGate

Answer

To allow external API access to the FortiGate

Answer

To increase the storage capacity of the FortiManager

Question 13

You are troubleshooting a policy installation failure where the FortiManager reports a 'Configuration conflict'. Which action should you perform to identify the root cause of the mismatch?

Accepted Answer

Use the 'Diff' feature in the Policy & Objects tab to compare the database and device config. When FortiManager reports a 'Configuration conflict' during policy installation, the root cause is usually a mismatch between the FortiManager policy package/database and the actual configuration on the FortiGate. The 'Diff' feature in the Policy & Objects tab compares the FortiManager database against the device configuration line-by-line, exposing exactly which objects, policies, or settings differ. This is the correct diagnostic step before deciding whether to import, overwrite, or reconcile.

Answer

Force an 'Import Policy' operation

Answer

Reboot the FortiManager

Answer

Disable the policy package entirely

Question 14

You are setting up an SD-WAN configuration via FortiManager. Which object type is used to group multiple WAN interfaces for SD-WAN member assignment?

Accepted Answer

SD-WAN Zone. In FortiManager SD-WAN configuration, an SD-WAN Zone is the object type used to group multiple WAN interfaces for SD-WAN member assignment. Zones allow you to logically group interfaces so that SD-WAN rules and performance SLAs can be applied to the group rather than individual interfaces. This is the correct object for organizing WAN members in an SD-WAN deployment managed via FortiManager.

Answer

IP Pool

Answer

Virtual Wire Pair

Answer

Interface Group

Question 15

You are managing FortiGates across multiple ADOMs. How can you share common firewall objects (e.g., mail servers, common IP ranges) across these ADOMs?

Accepted Answer

Create objects in the Global Database. In FortiManager, the Global Database (Global ADOM) is the designated object space for creating firewall objects that must be shared across multiple ADOMs. Objects defined there can be referenced by policies in any ADOM, providing a single source of truth for common items like mail servers and IP ranges.

Answer

Manually copy objects to each ADOM

Answer

Use the API to script the creation in every ADOM

Answer

Enable 'Object Sharing' in system settings

Question 16

An administrator is migrating a standalone FortiGate into an existing FortiManager. What happens to the existing firewall policies on the FortiGate during the import process?

Accepted Answer

They are imported and converted into a Policy Package. When importing a standalone FortiGate into FortiManager, the existing firewall policies are imported and converted into a Policy Package within the ADOM. FortiManager creates a policy package named after the device (or a chosen name) containing the imported policies, objects, and interfaces, so the device can then be managed centrally. The policies are not deleted or disabled; they become the managed baseline.

Answer

They are moved to a 'Disabled' state

Answer

They are deleted to ensure a clean slate

Answer

They are merged into the Global Policy

Question 17

An administrator needs to perform a firmware upgrade on 100 FortiGates. Which feature in FortiManager allows this to be done securely with a rollback option?

Accepted Answer

Firmware Management in Device Manager. FortiManager's Firmware Management feature (found under Device Manager) allows administrators to upload firmware images, schedule upgrades, and perform bulk upgrades across multiple FortiGates. It includes a rollback option that can revert devices to a previous firmware version if the upgrade fails or causes issues. This is the secure, centralized method for upgrading many devices.

Answer

Automated patch management

Answer

Manual script pushing

Answer

Global Policy upgrade task

Question 18

You want to automate the onboarding of new FortiGate units. Which FortiManager feature allows you to pre-configure devices before they connect to the network?

Accepted Answer

Provisioning Templates. Provisioning Templates in FortiManager let administrators define a device's full configuration — system settings, interface configs, firewall policies, and more — before the FortiGate ever connects. When the new FortiGate registers with FortiManager (via serial number or pre-shared key), the template is automatically applied, enabling zero-touch onboarding. This is the standard mechanism for pre-configuring devices at scale.

Answer

Scripting

Answer

Device Registration Key

Answer

Policy cloning

Question 19

What is the result of 'Pushing' a policy package from FortiManager to a FortiGate?

Accepted Answer

The FortiGate policy configuration is overwritten with the FortiManager version. When you push a policy package from FortiManager to a managed FortiGate, FortiManager installs its policy package configuration onto the device, replacing the corresponding firewall policy configuration on the FortiGate with the FortiManager version. This is the standard 'install' operation in the FortiManager workflow, and it overwrites the device-level policy configuration rather than merging or appending it. The FortiGate becomes a reflection of the FortiManager policy package for the policy-related objects that are pushed.

Answer

The FortiGate policy is sent to the FortiManager

Answer

The policy is saved in a draft state on the FortiGate

Answer

The FortiManager policy is appended to the existing FortiGate policy

Question 20

An administrator notices that logs are not appearing in FortiManager for a specific FortiGate. What is the first thing to check to ensure log forwarding is active?

Accepted Answer

Log forwarding configuration on the FortiGate. When logs are missing in FortiManager for a specific FortiGate, the first thing to verify is the log forwarding configuration on the FortiGate itself. FortiManager receives logs only if the FortiGate is configured to send them — either via 'config log fortianalyzer setting' (if FortiManager hosts FortiAnalyzer features) or through the Fabric/central management settings. If log forwarding is disabled or misconfigured (wrong FortiManager IP, disabled logging), no logs will appear regardless of other factors.

Answer

The FortiManager license

Answer

The device's physical connection

Answer

The firmware version of the FortiGate