FORTINET-NSE7-SPECIALTY Nse7 Enterprise Firewall Security And VPN Practice Test 2 — 15 Questions

Question 1

You notice that an IPsec tunnel is up, but no traffic passes. What is the most common reason related to firewall policy configuration?

Accepted Answer

Missing firewall policy. When an IPsec tunnel is up but no traffic passes, the most common firewall policy-related reason is a missing firewall policy that permits traffic through the tunnel. In FortiGate, IPsec tunnels require explicit firewall policies to allow traffic between the tunnel interface and other interfaces; without them, the implicit deny drops all traffic.

Answer

Missing static route

Answer

Incorrect IKE ID

Answer

Phase 1 lifetime expiration

Question 2

What is the purpose of the 'Any' interface in a firewall policy?

Accepted Answer

To match traffic regardless of the ingress or egress interface. In a FortiGate firewall policy, the 'Any' interface is a wildcard that matches traffic regardless of the incoming or outgoing interface. It is used when you want a policy to apply to traffic from any source interface to any destination interface, simplifying rule creation. This is especially useful for policies that should not be tied to a specific interface, such as certain management or deny rules.

Answer

To force traffic through the hardware switch

Answer

To bypass the routing table

Answer

To match traffic only on the WAN port

Question 3

You are configuring BGP and need to advertise a summary route to your ISP. How do you ensure only the summary route is advertised?

Accepted Answer

Use an aggregate-address with summary-only. The 'aggregate-address' command with the 'summary-only' keyword in BGP creates a summary route and suppresses the advertisement of more specific component routes to BGP peers. This ensures that only the summary route is advertised, which reduces the size of the BGP table on the ISP's routers and provides a clean, aggregated announcement. Without 'summary-only', both the summary and the more specific routes would be advertised.

Answer

Use a distribute-list

Answer

Set the weight to 0

Answer

Configure a route map with a prefix list

Question 4

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

Accepted Answer

To encapsulate ESP packets. When NAT-Traversal is detected, IKE and ESP traffic are encapsulated in UDP datagrams on port 4500 to traverse NAT devices that would otherwise drop or mangle ESP (IP protocol 50). The UDP 4500 port carries both the IKE negotiation (with a non-ESP marker) and the encapsulated ESP payload, allowing the VPN to function through PAT/NAT.

Answer

To replace the AH protocol

Answer

To manage Phase 1 re-keying

Answer

To verify certificate revocation status

Question 5

Which FortiGate feature should be enabled to prevent internal users from accessing malicious websites based on real-time threat intelligence?

Accepted Answer

Web Filter. Web Filter is the FortiGate feature that inspects and controls HTTP/HTTPS traffic to block access to malicious or categorized websites using real-time threat intelligence feeds (FortiGuard). It evaluates URLs against FortiGuard's web filter database and can enforce policies based on categories, reputation, and threat scores. Antivirus, Application Control, and DNS Filter do not provide the same URL-based, real-time web categorization and blocking capability.

Answer

Antivirus profile

Answer

Application Control

Answer

DNS Filter

Question 6

When using an IPS sensor, what is the difference between 'Protect' and 'Monitor' mode?

Accepted Answer

Protect drops traffic; Monitor only logs it. In a FortiGate IPS sensor, 'Protect' mode (also called block) drops or resets matching traffic when a signature is triggered, while 'Monitor' mode only logs the event without blocking it. This allows administrators to test signatures before enforcing them.

Answer

Protect applies only to WAN; Monitor applies to LAN

Answer

Protect requires SSL inspection; Monitor does not

Answer

Protect logs traffic; Monitor drops it

Question 7

What is the primary function of the FortiGate Security Fabric?

Accepted Answer

To synchronize security policies and share intelligence across devices. The FortiGate Security Fabric is an integrated architecture that links FortiGate, FortiAnalyzer, FortiManager, FortiClient, and other Fortinet products so they share threat intelligence, synchronize policies, and coordinate automated responses. Its primary purpose is unified visibility and enforcement across the extended network, not raw throughput or routing.

Answer

To configure OSPF automatically

Answer

To increase the throughput of the firewall

Answer

To replace the need for an IPS sensor

Question 8

What does the 'FortiGuard' service provide to the FortiGate?

Accepted Answer

Real-time threat intelligence and database updates. FortiGuard is Fortinet's subscription-based security intelligence service that delivers real-time threat intelligence and database updates to FortiGate devices. This includes antivirus signatures, IPS signatures, web filtering categories, DNS filtering, and application control signatures, all updated continuously from Fortinet's global threat research.

Answer

User management and authentication

Answer

Local firmware storage

Answer

Hardware acceleration support

Question 9

Which method is the most secure for managing FortiGate devices remotely?

Accepted Answer

HTTPS with restricted access via Trusted Hosts. HTTPS with restricted access via Trusted Hosts is the most secure method because HTTPS encrypts the entire management session using TLS, protecting credentials and configuration data from eavesdropping. Restricting administrative access to specific Trusted Hosts (defined per admin account or per interface) adds a network-layer allowlist so only known source IPs/subnets can even attempt to authenticate, dramatically shrinking the attack surface. Together, encryption plus source restriction satisfies both confidentiality and access-control requirements for remote FortiGate management.

Answer

HTTP with password authentication

Answer

Telnet

Answer

SNMPv1

Question 10

In a site-to-site VPN, you need to allow traffic initiated from the remote site. What configuration is essential on the local FortiGate?

Accepted Answer

A firewall policy allowing traffic from the VPN zone to the Internal zone. For a site-to-site VPN, traffic initiated from the remote site must be allowed by a firewall policy on the local FortiGate. The policy must permit traffic from the VPN zone (the interface/tunnel where the remote site's traffic arrives) to the Internal zone (the local network). Without this policy, the FortiGate's implicit deny drops the traffic, even if the VPN tunnel is up and routes exist.

Answer

An IPSec phase 3 policy

Answer

A static route to the remote subnet

Answer

A NAT rule for the remote subnet

Question 11

What is the effect of changing the IPS 'buffer' size on a FortiGate device?

Accepted Answer

It determines the maximum size of data packets to hold for inspection. The IPS buffer size on a FortiGate determines the maximum amount of data that the IPS engine will hold in memory for inspection before making a decision. A larger buffer allows the engine to reassemble and inspect larger payloads, which can improve detection of attacks that span multiple packets, but it also consumes more memory. The buffer size does not disable hardware acceleration, change signature timeouts, or increase concurrent connections.

Answer

It disables the hardware acceleration engine

Answer

It changes the signature timeout

Answer

It increases the number of concurrent IPS connections

Question 12

You need to inspect traffic between two internal VLANs. How do you ensure this traffic is processed by the FortiGate?

Accepted Answer

Configure firewall policies between the VLAN interfaces. For a FortiGate to inspect traffic between two internal VLANs, it must be the Layer 3 gateway for those VLANs and have firewall policies that permit and inspect traffic between the VLAN interfaces. Simply creating the VLAN interfaces is not enough — without policies, the implicit deny drops the traffic, and without the FortiGate as gateway, traffic never reaches it.

Answer

Enable hardware switching

Answer

Set the firewall mode to Transparent

Answer

Enable inter-VLAN routing on the switches only

Question 13

Which TWO of the following are necessary to successfully deploy an SSL VPN in tunnel mode?

Accepted Answer

A valid SSL certificate for the VPN portal. Option C is correct because tunnel-mode SSL VPN relies on TLS to establish the encrypted session, so the VPN portal must present a valid SSL certificate that clients can validate during the TLS handshake. Option D is correct because once the tunnel is established, traffic from the SSL VPN interface must be permitted by a firewall policy into the Internal zone; otherwise, authenticated users cannot reach internal resources. Option A is incorrect because IPSec phase 1 (IKE SA) applies to IPSec VPNs, not SSL/TLS-based VPNs. Option B is incorrect because BGP is a dynamic routing protocol between routers and is not required for an SSL VPN client tunnel. Option E is incorrect because SSL VPN functionality is a software feature and does not require a dedicated hardware switch.

Answer

An IPSec phase 1 configuration

Answer

A BGP session with the client

Answer

A dedicated hardware switch

Question 14

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

Accepted Answer

Encryption algorithm (e.g., AES-256). During IKEv2 Phase 1 (IKE_SA_INIT and IKE_AUTH), the peers negotiate the encryption algorithm such as AES-256 (option A), which protects the IKE SA itself, making it a core Phase 1 parameter. The authentication method, such as PSK or RSA signatures (option B), is also negotiated and validated in Phase 1 to authenticate the peers and establish trust. The Diffie-Hellman group (option E) is likewise negotiated in Phase 1 to perform the key exchange and derive shared secret keys for the IKE SA. TCP port selection (option C) is not negotiated in Phase 1 because IKE uses UDP ports 500 and 4500, not TCP. Firewall policy ID (option D) is a local configuration construct and is not an IKEv2 Phase 1 negotiation parameter.

Answer

TCP port selection

Answer

Firewall policy ID

Question 15

Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?

Accepted Answer

It uses fewer system resources than proxy-based inspection. Flow-based inspection is beneficial because it uses fewer system resources than proxy-based inspection (B): it scans packets as they stream through the FortiGate without buffering entire files or sessions, so it consumes less CPU and memory. It also provides higher throughput performance (C), since it avoids the store-and-forward buffering and full-session reassembly that proxy-based inspection performs, allowing traffic to pass with lower latency and greater overall speed. The unmarked options do not belong: deep content inspection for all protocols (A) and more granular application control (E) are strengths associated with proxy-based inspection, which fully buffers and reconstructs content, while manual buffer allocation (D) is not a flow-based benefit because flow-based inspection does not require the administrator to manually allocate buffers.

Answer

It supports deep content inspection for all protocols

Answer

It requires manual buffer allocation

Answer

It offers more granular application control