FORTINET-NSE7-SPECIALTY Nse7 Enterprise Firewall Central Management Practice Test 2 — 15 Questions

Question 1

An administrator is migrating a standalone FortiGate into an existing FortiManager. What happens to the existing firewall policies on the FortiGate during the import process?

Accepted Answer

They are imported and converted into a Policy Package. When importing a standalone FortiGate into FortiManager, the existing firewall policies are imported and converted into a Policy Package within the ADOM. FortiManager creates a policy package named after the device (or a chosen name) containing the imported policies, objects, and interfaces, so the device can then be managed centrally. The policies are not deleted or disabled; they become the managed baseline.

Answer

They are moved to a 'Disabled' state

Answer

They are deleted to ensure a clean slate

Answer

They are merged into the Global Policy

Question 2

An administrator needs to perform a firmware upgrade on 100 FortiGates. Which feature in FortiManager allows this to be done securely with a rollback option?

Accepted Answer

Firmware Management in Device Manager. FortiManager's Firmware Management feature (found under Device Manager) allows administrators to upload firmware images, schedule upgrades, and perform bulk upgrades across multiple FortiGates. It includes a rollback option that can revert devices to a previous firmware version if the upgrade fails or causes issues. This is the secure, centralized method for upgrading many devices.

Answer

Automated patch management

Answer

Manual script pushing

Answer

Global Policy upgrade task

Question 3

You want to automate the onboarding of new FortiGate units. Which FortiManager feature allows you to pre-configure devices before they connect to the network?

Accepted Answer

Provisioning Templates. Provisioning Templates in FortiManager let administrators define a device's full configuration — system settings, interface configs, firewall policies, and more — before the FortiGate ever connects. When the new FortiGate registers with FortiManager (via serial number or pre-shared key), the template is automatically applied, enabling zero-touch onboarding. This is the standard mechanism for pre-configuring devices at scale.

Answer

Scripting

Answer

Device Registration Key

Answer

Policy cloning

Question 4

What is the result of 'Pushing' a policy package from FortiManager to a FortiGate?

Accepted Answer

The FortiGate policy configuration is overwritten with the FortiManager version. When you push a policy package from FortiManager to a managed FortiGate, FortiManager installs its policy package configuration onto the device, replacing the corresponding firewall policy configuration on the FortiGate with the FortiManager version. This is the standard 'install' operation in the FortiManager workflow, and it overwrites the device-level policy configuration rather than merging or appending it. The FortiGate becomes a reflection of the FortiManager policy package for the policy-related objects that are pushed.

Answer

The FortiGate policy is sent to the FortiManager

Answer

The policy is saved in a draft state on the FortiGate

Answer

The FortiManager policy is appended to the existing FortiGate policy

Question 5

An administrator notices that logs are not appearing in FortiManager for a specific FortiGate. What is the first thing to check to ensure log forwarding is active?

Accepted Answer

Log forwarding configuration on the FortiGate. When logs are missing in FortiManager for a specific FortiGate, the first thing to verify is the log forwarding configuration on the FortiGate itself. FortiManager receives logs only if the FortiGate is configured to send them — either via 'config log fortianalyzer setting' (if FortiManager hosts FortiAnalyzer features) or through the Fabric/central management settings. If log forwarding is disabled or misconfigured (wrong FortiManager IP, disabled logging), no logs will appear regardless of other factors.

Answer

The FortiManager license

Answer

The device's physical connection

Answer

The firmware version of the FortiGate

Question 6

Where can an administrator check the status of the connection between a FortiGate and FortiManager?

Accepted Answer

Device Manager. In FortiManager, the Device Manager pane displays managed FortiGate devices and their status, including the connection state between the FortiGate and FortiManager. Administrators can see whether the device is online, the last update time, and other management details. This is the primary location to verify the FortiGate-FortiManager tunnel status.

Answer

Log View

Answer

Policy & Objects

Answer

System Settings

Question 7

What is the benefit of using 'CLI Templates' in FortiManager?

Accepted Answer

They allow applying configuration commands to multiple devices. CLI Templates in FortiManager are reusable sets of CLI commands that can be assigned to device groups or individual devices, enabling consistent configuration across many FortiGates at once. They are a provisioning and standardization tool, not a GUI replacement or performance enhancer. This makes bulk changes efficient and reduces human error.

Answer

They replace the GUI completely

Answer

They convert the policy to a CLI script

Answer

They improve the FortiGate hardware performance

Question 8

An administrator needs to provide access to FortiManager for a junior team member who should only be able to view logs and reports. Which feature is used to define this access?

Accepted Answer

Administrator Profiles. Administrator Profiles in FortiManager define granular permissions for administrative accounts, including which ADOMs, policy packages, and features (logs, reports, system settings) a user can access. To give a junior team member read-only access to logs and reports, the administrator creates a profile with only those permissions and assigns it to the user account. This is the standard RBAC mechanism in FortiManager.

Answer

Access Control Lists (ACLs)

Answer

ADOM Assignment

Answer

User Groups

Question 9

Which component of FortiManager allows for the centralized management of firmware across multiple devices?

Accepted Answer

Firmware Management. Firmware Management is the FortiManager component that provides centralized firmware upgrade and downgrade capabilities across multiple FortiGate devices. It allows administrators to import firmware images, schedule upgrades, and monitor the firmware status of all managed devices from a single console.

Answer

Policy Database

Answer

Device Templates

Answer

Log View

Question 10

Which TWO methods can be used to authenticate a FortiGate when it registers to a FortiManager?

Accepted Answer

Password/Pre-shared Key. Option C (Password/Pre-shared Key) is correct because when a FortiGate is added to FortiManager using the 'Add Device' wizard, the administrator can specify a pre-shared key (PSK) that the FortiGate must present during the FGFM (FortiGate-FortiManager) registration handshake to authenticate itself. Option D (Serial Number registration) is correct because FortiManager can also authenticate a registering FortiGate by matching its serial number against a pre-authorized device entry, allowing the device to be recognized and added without a PSK. Options A, B, and E are not valid FortiGate-to-FortiManager authentication methods: RADIUS is used for administrative or user authentication, not device registration; SNMP community strings are for monitoring, not registration; and IP-based automatic discovery merely identifies candidate devices on the network but does not authenticate them for FortiManager registration.

Answer

External RADIUS server

Answer

SNMP community string

Answer

IP-based automatic discovery

Question 11

Which THREE items are included in a Policy Package when it is pushed from FortiManager?

Accepted Answer

Service Objects. A Policy Package in FortiManager is the container of the security configuration that gets installed to managed FortiGate devices, and it includes the firewall policy rules themselves (B, Firewall Policies), which define the traffic handling and are the core of the package. It also includes the reusable objects those policies reference, specifically Address Objects (E) and Service Objects (A), which define the source/destination addresses and the TCP/UDP port or protocol matches used inside the policies. These three items travel together as a unit when the policy package is pushed, because the policies cannot function without their referenced address and service objects. By contrast, System interface settings (C) and Routing tables (D) are device-level configuration that belongs to the FortiGate's system and network settings, not to the policy package, so they are not installed as part of a policy package push.

Answer

System interface settings

Answer

Routing tables

Question 12

Which TWO actions can be performed on a Revision History item in FortiManager?

Accepted Answer

Compare with current version. In FortiManager, a Revision History item represents a saved configuration snapshot of an ADOM or policy package, and option A (Compare with current version) is correct because FortiManager provides a diff view that shows the differences between the selected revision and the current running configuration. Option B (Restore to a previous state) is also correct because you can revert the ADOM or policy package back to that saved revision, effectively rolling back configuration changes. Option C (Delete the entire ADOM) is wrong because deleting an ADOM is an ADOM-level administrative action, not an operation available on an individual revision history entry. Option D (Export the revision to an external cloud) is wrong because FortiManager does not offer a cloud export function for revision items; revisions are stored locally in the FortiManager database. Option E (Modify the version permanently) is wrong because revisions are immutable snapshots — you cannot edit a saved revision in place, only compare, restore, or delete it.

Answer

Delete the entire ADOM

Answer

Export the revision to an external cloud

Answer

Modify the version permanently

Question 13

Which TWO administrative actions require a 'Workspace Mode' enabled in FortiManager?

Accepted Answer

Locking policies for editing. In FortiManager, Workspace Mode is the workflow that lets administrators lock objects (such as policies) for editing and then review pending changes before publishing them to managed devices, so options D and E are exactly the actions that require it. Locking policies for editing (D) is only meaningful inside Workspace Mode, because the lock prevents other admins from modifying the same policy while changes are staged. Reviewing changes before publishing (E) is the second half of that workflow, since FortiManager queues modifications in the workspace and requires an explicit review/publish step. The other options do not depend on Workspace Mode: automatic log rotation (A) is a logging/disk-management setting, creating new ADOMs (B) is a system-level administrative task performed outside the workspace workflow, and forcing a reboot (C) is a device/system operation available regardless of workspace state.

Answer

Automatic log rotation

Answer

Creating new ADOMs

Answer

Forcing a reboot

Question 14

Which THREE items can be managed via Device Templates in FortiManager?

Accepted Answer

NTP configuration. Device Templates in FortiManager are used to provision and manage system-level and network-level settings on managed FortiGate devices, including NTP configuration (B), DNS settings (D), and local interface IP settings (E), which are all part of the system/network configuration that templates push to devices. NTP and DNS are system settings commonly configured through the System template, while interface IPs are configured through the Interface template, making all three valid template-managed items. Firewall policies (A) are managed through Policy Packages, not Device Templates, since they are policy objects rather than device-level provisioning settings. Application control databases (C) are updated via FortiGuard services and are not provisioned through Device Templates.

Answer

Firewall policies

Answer

Application control databases

Question 15

Which TWO types of reports can be generated in the FortiAnalyzer module of FortiManager?

Accepted Answer

Custom reports. In the FortiAnalyzer module of FortiManager, reports are generated from log data using report templates, and the two supported report types are Custom reports (A) and Pre-defined reports (B). Custom reports (A) are right because administrators can build them from scratch or by modifying templates, choosing datasets, charts, time periods, and filters to meet specific log-analysis needs. Pre-defined reports (B) are right because FortiAnalyzer ships with built-in report templates (for example, security, traffic, and usage reports) that can be run as-is or used as a starting point. Policy change impact reports (C) do not belong because FortiManager handles policy/configuration management, not impact analysis reporting in the FortiAnalyzer module. Hardware diagnostic reports (D) and Firmware compatibility reports (E) are not FortiAnalyzer report types; hardware diagnostics and firmware compatibility are handled through FortiGate/FortiManager device management and upgrade-path tools, not log-based reporting.

Answer

Policy change impact reports

Answer

Hardware diagnostic reports

Answer

Firmware compatibility reports