NSE7 Enterprise Firewall and VDOMs — 25 Questions

Question 1

Which TWO statements about the Security Fabric and FortiManager are correct? (Choose two.)

Accepted Answer

FortiManager can manage multiple Security Fabrics.. FortiManager can manage multiple Security Fabrics because it is designed as a centralized management platform that can oversee multiple independent FortiGate clusters or fabric topologies. Each Security Fabric is a logical grouping of FortiGate devices that share a common root FortiGate, and FortiManager can be configured to manage several such fabrics simultaneously, each with its own root and member devices, without requiring separate management servers. Additionally, when a Security Fabric is formed, the first FortiGate added to the fabric automatically becomes the root FortiGate, which serves as the central point for fabric communication and policy enforcement. This root FortiGate is responsible for coordinating fabric-wide operations and sharing information with other member devices.

Answer

FortiGate devices must be in transparent mode to join the fabric.

Answer

FortiAnalyzer must be deployed to use the Security Fabric.

Answer

A FortiGate can be part of multiple Security Fabrics simultaneously.

Question 2

Which TWO statements about Security Fabric deployment are correct? (Choose two.)

Accepted Answer

The root FortiGate must have a management IP address that is reachable from all downstream devices.. Options B and C are correct. Option B is correct because the root FortiGate acts as the central coordination point for the Security Fabric; all downstream devices must be able to reach its management IP to establish and maintain communication, which uses TCP port 8013 (HTTPS) for the initial handshake and keepalive messages. Option C is correct because each FortiGate device in the Fabric must have a unique serial number to ensure proper identification and avoid conflicts within the Fabric topology.

Answer

A Security Fabric can contain a maximum of 50 FortiGate devices.

Answer

All FortiGate devices in the Fabric must be managed by the same FortiManager.

Answer

A FortiGate can only belong to one Security Fabric at a time.

Question 3

An HA cluster is configured with two FortiGates in active-passive mode. The administrator wants to ensure that the secondary unit automatically takes over if the primary unit fails. Which TWO settings must be configured?

Accepted Answer

Set ha-mode to active-passive. Setting ha-mode to active-passive (Option A) defines the failover model where the secondary unit remains in standby until the primary fails, enabling automatic takeover. Enabling configuration synchronization (Option D) ensures that the secondary unit has the same configuration as the primary, which is necessary for it to function correctly when it takes over. Without synchronization, the secondary may lack the proper configuration to handle traffic. Options B, C, and E are not required for automatic takeover: priority influences but does not guarantee takeover, active-active mode does not provide a clear secondary takeover role, and session-pickup preserves sessions but does not enable the takeover mechanism itself.

Answer

Set ha-priority to 100 on primary

Answer

Set ha-mode to active-active

Answer

Enable session-pickup

Question 4

A company has two FortiGate firewalls in an HA active-passive cluster. They want to separate network traffic for different departments using VDOMs. After configuring VDOMs on both units, the HA status shows 'synchronized' but traffic for one VDOM is not passing through the active unit. What is the most likely cause?

Accepted Answer

The administrator account used to configure VDOMs lacks permission.. In an HA active-passive cluster, traffic forwarding on the active unit depends entirely on its own configuration. A missing VDOM link on the passive unit does not affect active traffic forwarding. The most likely cause for traffic not passing for a specific VDOM is a misconfiguration within that VDOM on the active unit, such as missing routes or firewall policies. This could stem from the administrator account lacking sufficient permissions to apply complete VDOM configurations, leading to incomplete settings.

Answer

The HA mode must be active-active to use VDOMs.

Answer

A VDOM link is missing on the passive unit.

Answer

HA is not compatible with VDOMs.

Question 5

An administrator is configuring a FortiGate in transparent mode for a retail store. The store has a flat network with a single subnet. Which TWO of the following statements about transparent mode are correct? (Select TWO.)

Accepted Answer

The FortiGate uses a management IP address for administrative access. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses. It does not perform routing (so C is incorrect). A management IP is required for administrative access (B is correct) because the bridged interfaces do not have IPs. Firewall policies can be applied to bridge interfaces to control traffic (E is correct). VIPs for destination NAT are not supported in transparent mode because NAT is a Layer 3 function (A is incorrect). No default route is needed for user traffic as the device is not routing; management traffic may require a route but the question is about user traffic (D is incorrect).

Answer

Virtual IPs (VIPs) can be used for destination NAT

Answer

The FortiGate will perform routing between VLANs

Answer

The FortiGate requires a default route to forward user traffic

Question 6

An administrator runs 'diagnose sys session filter dport 443' and sees:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in SYN_SENT state. The output shows `proto=6`, indicating TCP. The `proto_state=01` corresponds to the TCP SYN_SENT state, meaning the session is in the process of establishing a connection. The `duration=3600` and `expire=3599` show the session has been active for 3600 seconds and will expire in 3599 seconds, which is typical for a session in SYN_SENT state that has not yet transitioned to ESTABLISHED. Therefore, option C is correct.

Answer

The session is a UDP session

Answer

The session is in TIME_WAIT state

Answer

The session is in ESTABLISHED state

Question 7

A FortiGate is operating in transparent mode. Which of the following statements is true about this mode?

Accepted Answer

The FortiGate does not modify the MAC addresses of packets. In transparent mode, the FortiGate acts as a Layer 2 bridge, forwarding frames based on MAC addresses without modifying them (making option A correct). It operates as a Layer 2 device and does not require IP addresses on its interfaces for traffic forwarding, though management IP addresses can be assigned (making option D correct). Options B and C are incorrect because transparent mode does not perform routing or NAT; those functions are used in NAT/Route mode.

Answer

The FortiGate can route between different VLANs

Answer

The FortiGate can perform NAT

Question 8

A security analyst notices that an automation stitch in FortiManager did not trigger when a specific event occurred on a managed FortiGate. Which three possible reasons could explain why the stitch did not fire? (Choose three.)

Accepted Answer

The trigger event type does not match the actual event. An automation stitch triggers only when the event type matches the actual event. Option D is correct because if the stitch is disabled, it cannot trigger. Option E is correct because a network connectivity issue between FortiManager and FortiGate can prevent the trigger from being received. Option C is incorrect because a condition is evaluated after the stitch triggers; an unmet condition would prevent the action from executing, not the triggering of the stitch itself. Option B is incorrect because FortiManager does not impose a license limit on automation stitches.

Answer

The FortiGate has reached its license limit for automation stitches

Answer

The automation stitch was configured with a condition that was not met

Question 9

A network engineer wants to deploy a FortiGate in transparent mode and have it managed by FortiManager. The FortiGate should not participate in routing, but must be able to send logs to FortiAnalyzer. Which two settings must be configured on the FortiGate to achieve this?

Accepted Answer

Configure a management IP address on the FortiGate. In transparent mode, the FortiGate operates as a Layer 2 bridge and does not participate in routing. However, to be managed by FortiManager and send logs to FortiAnalyzer, the FortiGate must have a management IP address (option B) so that it can be reached as a management endpoint. Additionally, a static route (option D) is required to direct traffic to the management and logging servers, since the FortiGate cannot rely on dynamic routing protocols in transparent mode.

Answer

Enable DHCP client on the management interface

Answer

Enable NAT on the management interface

Answer

Set the interface IP address in the same subnet as the upstream router

Question 10

An organization is deploying multiple FortiGate devices across different geographic locations. The central IT team manages all devices from a single FortiManager. The remote FortiGates connect to FortiManager over a WAN link. Which feature should be enabled on FortiManager to ensure that configuration changes are applied consistently and without interruption to the remote FortiGates?

Accepted Answer

Use the 'Install on Next Reboot' option in the install wizard. The 'Install on Next Reboot' option ensures that configuration changes are staged on the remote FortiGate and applied atomically when the device reboots. This prevents partial or inconsistent application over an unreliable WAN link, as the FortiManager pushes the full configuration revision to the device, which then applies it during the boot process without requiring a persistent management session.

Answer

Enable auto-link configuration on the FortiManager

Answer

Use 'Install Wizard' with 'Immediate Install' option

Answer

Enable 'Configuration Override' on the managed FortiGates

Question 11

A company is implementing a Security Fabric with multiple FortiGate devices. They want to use FortiAnalyzer for centralized logging and FortiManager for centralized management. Which of the following is a prerequisite for adding a FortiGate to the Security Fabric?

Accepted Answer

The FortiGate must have network connectivity to the FortiManager. For a FortiGate to join a Security Fabric, it must have network connectivity to the FortiManager that manages the fabric. FortiManager acts as the fabric root or controller, and the FortiGate registers with it using the FortiManager IP or FQDN. Without this connectivity, the FortiGate cannot be added to the Security Fabric topology.

Answer

The FortiGate must have FortiAnalyzer configured as a log device

Answer

The FortiGate's management IP must be configured via DHCP

Answer

The FortiGate must be operating in transparent mode

Question 12

A network administrator is troubleshooting a FortiGate that is not appearing in the Security Fabric topology on FortiManager. The FortiGate is reachable from FortiManager via ping. What is the most likely cause?

Accepted Answer

The FortiGate is not authorized in FortiManager. For a FortiGate to appear in the Security Fabric topology on FortiManager, it must first be authorized in FortiManager. Even if the FortiGate is reachable via ping, without authorization, FortiManager will not accept its registration or include it in the topology view. This is a prerequisite step that must occur before any fabric communication can be established.

Answer

FortiAnalyzer is not configured on the FortiGate

Answer

SNMP community string is mismatched

Answer

The FortiGate firewall policy is blocking traffic to FortiManager

Question 13

An organization uses FortiManager to manage multiple FortiGate devices in a Security Fabric. The administrator wants to push a new firewall policy that includes an FQDN address object. Which statement is true regarding FQDN objects in FortiManager policies?

Accepted Answer

FortiManager resolves the FQDN to IP addresses at installation time and updates the policy accordingly. When an administrator pushes a policy containing an FQDN address object from FortiManager, FortiManager resolves the FQDN to its current IP addresses at installation time. The resolved IPs are then written into the policy on the managed FortiGate, ensuring the policy is immediately effective without requiring the FortiGate to perform DNS resolution. This behavior is specific to FortiManager-managed policies and differs from locally configured FQDN objects on FortiGate.

Answer

FQDN objects must be defined on each managed FortiGate individually

Answer

The FQDN resolution is done automatically every 60 seconds by FortiManager

Answer

FQDN objects cannot be used in policies pushed from FortiManager

Question 14

Which THREE actions can an administrator perform using FortiManager in a Security Fabric environment? (Choose three.)

Accepted Answer

Upgrade the firmware of multiple FortiGates at once. FortiManager supports centralized firmware management, allowing administrators to upgrade the firmware of multiple FortiGates simultaneously via the 'Firmware Upgrade' wizard in the Device Manager. This leverages the FortiManager's role as a central management point, which can stage and push firmware images to managed devices in a Security Fabric, reducing downtime and ensuring consistency across the fabric.

Answer

Terminate IPsec VPN tunnels on the FortiManager

Answer

Configure FortiGate to manage the FortiManager

Question 15

Refer to the exhibit. A FortiGate is configured with the above settings. The FortiManager at 192.168.1.100 cannot establish a management connection to the FortiGate. What is the most likely cause?

Accepted Answer

The FortiGate's port1 IP is not in the same subnet as the FortiManager. The FortiGate's port1 IP (10.0.1.1/24) is on a different subnet (10.0.1.0/24) than the FortiManager's IP (192.168.1.100), which is on the 192.168.1.0/24 subnet. For a management connection to be established, the FortiGate and FortiManager must be able to route to each other, typically requiring them to be on the same subnet unless a gateway or static route is configured. Since no routing is mentioned, the subnet mismatch is the most likely cause of the failure.

Answer

HTTPS access is not enabled on port1

Answer

The admin user 'admin' is not configured correctly

Answer

The trusthost configuration does not include the FortiManager IP

Question 16

Refer to the exhibit. A FortiGate is connected to the Security Fabric and registered with FortiManager. However, the administrator notices that the FortiGate is not receiving policy updates from FortiManager. What is the most likely cause?

Accepted Answer

The policy package on FortiManager is not assigned to the correct device group or policy target. FortiManager uses policy packages that must be explicitly assigned to a device group or specific FortiGate. Even if the FortiGate is registered and part of the Security Fabric, if the policy package is not assigned to the correct device group or policy target, the FortiGate will not receive policy updates. This is a common misconfiguration where the policy package exists but is not linked to the device.

Answer

The Fabric Root serial number is incorrect

Answer

The FortiGate is not registered with FortiManager

Answer

The Security Fabric is not fully connected

Question 17

A network engineer is troubleshooting a Security Fabric where a downstream FortiGate (model 60F) is not appearing in the Fabric topology of the root FortiGate (model 600E). Both devices are running FortiOS 7.4. The root FortiGate shows the downstream device as 'Unreachable' in the Security Fabric widget. The engineer has verified that the downstream FortiGate can ping the root FortiGate's management IP. What is the most likely cause of this issue?

Accepted Answer

The downstream FortiGate has insufficient memory to support Security Fabric features.. The FortiGate 60F has limited memory (typically 512 MB or less), and FortiOS 7.4 enforces a minimum memory requirement for downstream devices to participate in the Security Fabric. When the downstream device has insufficient memory, the root FortiGate marks it as 'Unreachable' even though basic IP connectivity (ping) works. This is a known hardware limitation for lower-end models like the 60F when running newer FortiOS versions.

Answer

The root FortiGate does not have HTTPS access to the downstream FortiGate.

Answer

The downstream FortiGate's management interface is configured on a different VLAN.

Answer

The administrator account on the downstream FortiGate does not have 'super_admin' privileges.

Question 18

A company is deploying a Security Fabric with multiple FortiGate devices managed by FortiManager. The administrator wants to apply a policy package to multiple FortiGate devices in the Fabric. However, after assigning the policy package to the devices in FortiManager and installing the configuration, the policies are not applied consistently across all devices. The administrator notices that some devices have local policies that override the policy package. What is the best practice to ensure that the policy package is enforced on all devices?

Accepted Answer

Enable 'Central Management' in FortiManager and use 'Install On Policy Package' to push policies.. Enabling 'Central Management' in FortiManager ensures that the policy package is the authoritative source for all managed FortiGate devices. When 'Install On Policy Package' is used, FortiManager overwrites any local policies on the devices, enforcing consistent policy application across the Security Fabric. Without central management, local policies can persist and override the pushed policy package, leading to inconsistencies.

Answer

Disable the 'Auto Update' feature on the managed devices.

Answer

Use the same policy package name on all devices and manually sync them.

Answer

Ensure that the Security Fabric is fully established and all devices are visible in the topology.

Question 19

An administrator needs to monitor traffic flows across multiple FortiGate devices in a Security Fabric. The administrator wants to see a unified view of all traffic, including inter-device traffic, from a single pane. Which Fortinet tool provides this capability?

Accepted Answer

FortiAnalyzer. FortiAnalyzer is the correct tool because it aggregates logs and traffic data from multiple FortiGate devices within a Security Fabric, providing a unified view of all traffic, including inter-device flows. It uses the FortiTelemetry protocol to collect logs and supports the Security Fabric's topology mapping, allowing administrators to monitor cross-device traffic from a single pane of glass.

Answer

FortiAP

Answer

FortiManager

Answer

FortiGate local logs

Question 20

A company has deployed a Security Fabric with a root FortiGate 600E and two downstream FortiGate 200E devices. The network also includes a FortiAnalyzer and a FortiManager. The administrator notices that the Security Fabric topology in FortiGate is not showing the downstream devices. The root FortiGate can ping the management IPs of the downstream devices. Additionally, the administrator has configured the downstream devices with the correct root IP and authorization mode is set to 'none'. However, when running 'diagnose sys fabric list' on the root, it shows the downstream devices with status 'Pending'. The root FortiGate's firewall policy allows all traffic from the downstream subnets. What is the most likely cause of the issue?

Accepted Answer

The downstream devices are missing the root FortiGate's serial number in the 'downstream-authorization' configuration.. The 'Pending' status in the output of 'diagnose sys fabric list' indicates that the root FortiGate has discovered the downstream devices but they have not completed the authorization handshake. Even though the authorization mode is set to 'none', each downstream FortiGate must still have the root FortiGate's serial number explicitly listed in its 'downstream-authorization' configuration to be accepted into the Security Fabric. Without this entry, the root will not finalize the adjacency, leaving the downstream devices in a pending state.

Answer

The FortiAnalyzer is not configured to receive logs from the downstream devices.

Answer

The downstream devices are using a different management port than the root.

Answer

The root FortiGate's firewall policy is blocking the downstream devices' Fabric traffic.