NSE7 Enterprise Firewall and VDOMs Practice Test 11 — 15 Questions

Question 1

An administrator is configuring a FortiGate with multiple VDOMs. The administrator wants to ensure that the 'root' VDOM is used for management access and that other VDOMs cannot be accessed directly from the management network. Which feature should the administrator configure to restrict management access to the root VDOM only?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure administrative access (HTTPS, SSH, etc.) only on the management interface in the root VDOM and disable it on all other interfaces in other VDOMs.. To restrict management access to the root VDOM, you must control which interfaces have administrative protocols enabled. By enabling HTTPS, SSH, and other management protocols only on the management interface within the root VDOM, and disabling them on all other interfaces in other VDOMs, you ensure that administrators can only connect via the root VDOM. This leverages the per-interface 'allowaccess' setting, which is the correct way to control management access in a multi-VDOM environment.

Answer

Create a firewall policy in each non-root VDOM that denies traffic from the management network to the VDOM's interfaces.

Answer

Use 'set allowaccess' on each VDOM's interfaces to remove all management protocols, except in the root VDOM.

Answer

Enable 'management-vdom' under system global settings and assign the root VDOM.

Question 2

A company is implementing a Security Fabric with multiple FortiGate devices. They want to use FortiAnalyzer for centralized logging and FortiManager for centralized management. Which of the following is a prerequisite for adding a FortiGate to the Security Fabric?

Accepted Answer

The FortiGate must have network connectivity to the FortiManager. For a FortiGate to join a Security Fabric, it must have network connectivity to the FortiManager that manages the fabric. FortiManager acts as the fabric root or controller, and the FortiGate registers with it using the FortiManager IP or FQDN. Without this connectivity, the FortiGate cannot be added to the Security Fabric topology.

Answer

The FortiGate must have FortiAnalyzer configured as a log device

Answer

The FortiGate's management IP must be configured via DHCP

Answer

The FortiGate must be operating in transparent mode

Question 3

Which THREE actions can an administrator perform using FortiManager in a Security Fabric environment? (Choose three.)

Accepted Answer

Upgrade the firmware of multiple FortiGates at once. FortiManager supports centralized firmware management, allowing administrators to upgrade the firmware of multiple FortiGates simultaneously via the 'Firmware Upgrade' wizard in the Device Manager. This leverages the FortiManager's role as a central management point, which can stage and push firmware images to managed devices in a Security Fabric, reducing downtime and ensuring consistency across the fabric.

Answer

Terminate IPsec VPN tunnels on the FortiManager

Answer

Configure FortiGate to manage the FortiManager

Question 4

Refer to the exhibit. A FortiGate is connected to the Security Fabric and registered with FortiManager. However, the administrator notices that the FortiGate is not receiving policy updates from FortiManager. What is the most likely cause?

Accepted Answer

The policy package on FortiManager is not assigned to the correct device group or policy target. FortiManager uses policy packages that must be explicitly assigned to a device group or specific FortiGate. Even if the FortiGate is registered and part of the Security Fabric, if the policy package is not assigned to the correct device group or policy target, the FortiGate will not receive policy updates. This is a common misconfiguration where the policy package exists but is not linked to the device.

Answer

The Fabric Root serial number is incorrect

Answer

The FortiGate is not registered with FortiManager

Answer

The Security Fabric is not fully connected

Question 5

An administrator needs to monitor traffic flows across multiple FortiGate devices in a Security Fabric. The administrator wants to see a unified view of all traffic, including inter-device traffic, from a single pane. Which Fortinet tool provides this capability?

Accepted Answer

FortiAnalyzer. FortiAnalyzer is the correct tool because it aggregates logs and traffic data from multiple FortiGate devices within a Security Fabric, providing a unified view of all traffic, including inter-device flows. It uses the FortiTelemetry protocol to collect logs and supports the Security Fabric's topology mapping, allowing administrators to monitor cross-device traffic from a single pane of glass.

Answer

FortiAP

Answer

FortiManager

Answer

FortiGate local logs

Question 6

During a failover test in an HA cluster, the administrator observes that the secondary unit becomes primary but does not have the latest configuration. What is the most likely cause?

Accepted Answer

Config sync is not enabled. Config sync is the mechanism that replicates configuration changes from the primary unit to the secondary unit in a FortiGate HA cluster. If config sync is not enabled, the secondary unit will not receive configuration updates, so when it becomes primary after a failover, it will operate with an outdated or default configuration. This directly explains why the secondary unit lacks the latest configuration after the failover.

Answer

The password encryption is mismatched

Answer

The HA priority is set too low

Answer

session-pickup is disabled

Question 7

An administrator has configured two VDOMs on a FortiGate. One VDOM is in NAT mode and the other in transparent mode. The administrator wants traffic from the transparent mode VDOM to be routed through the NAT mode VDOM. What must be configured to allow inter-VDOM routing?

Accepted Answer

Create an inter-VDOM link. Inter-VDOM routing between VDOMs in different modes (NAT and transparent) requires a dedicated inter-VDOM link (IVL), which is a virtual internal connection that allows traffic to pass between VDOMs without consuming physical ports. The IVL creates a pair of virtual interfaces, one in each VDOM, and firewall policies must be configured to permit traffic across them. This is the only method that supports routing between VDOMs of different modes on the same FortiGate.

Answer

Use a physical interface to connect the VDOMs

Answer

Enable NPU offloading

Answer

Configure firewall policies between the VDOMs

Question 8

An administrator is reviewing the HA configuration shown in the exhibit. The primary unit has failed, and the secondary unit (with priority 100) has taken over. However, the administrator notices that the secondary unit has an IP address of 10.10.10.2 on port3, but cannot ping the management gateway 10.10.10.1. What is the most likely cause?

Accepted Answer

The HA management interface IP is not active on the secondary. When the secondary unit takes over in an HA cluster, the HA management interface IP (configured under config system ha) is only active on the primary unit by default. Even after failover, the secondary unit does not automatically activate this IP unless the 'management-interface-ip' is explicitly configured to be active on the secondary. Since the secondary unit has IP 10.10.10.2 on port3 but cannot ping the management gateway 10.10.10.1, the most likely cause is that the HA management interface IP is not active on the secondary, meaning the secondary unit is using its own port3 IP (10.10.10.2) but the gateway expects the management IP to be reachable from that subnet, which it is not.

Answer

The hbdev configuration is incorrect

Answer

The override setting is preventing the secondary from taking over management

Answer

session-pickup is not enabled

Question 9

An administrator configures two VDOMs as shown in the exhibit. They create an inter-VDOM link between VDOM1 and VDOM2. They then add a firewall policy in VDOM1 allowing traffic from port1 to the inter-VDOM link, and a policy in VDOM2 allowing traffic from the inter-VDOM link to port2. However, traffic from 192.168.1.10 to 10.10.10.50 fails. What is the most likely cause?

Accepted Answer

Missing route in VDOM1 for the 10.10.10.0/24 network. Inter-VDOM link traffic requires routing in both VDOMs. Even with correct firewall policies, VDOM1 must have a route to the destination network (10.10.10.0/24) pointing to the inter-VDOM link interface. Without this route, VDOM1 drops the packet before it can be forwarded across the link, causing the failure.

Answer

Firewall policies are not correctly configured

Answer

The inter-VDOM link is not configured

Answer

The allowaccess setting on port2 does not include ping

Question 10

An administrator configures two FortiGate units in an active-passive HA cluster. During a failover test, the administrator notices that the secondary unit becomes primary but the session table is empty, causing all existing connections to drop. Which configuration change should be made to preserve session information during failover?

Accepted Answer

Enable session pickup and configure HA session synchronization. Session pickup and HA session synchronization are specifically designed to replicate the session table from the primary FortiGate to the secondary unit in an active-passive cluster. Without this feature, the secondary unit becomes primary but has no knowledge of existing sessions, causing all active connections to drop. Enabling session synchronization ensures that session state information is continuously mirrored to the standby unit, allowing seamless failover without disrupting established flows.

Answer

Enable FGCP configuration synchronization

Answer

Configure dead gateway detection on the FortiGate units

Answer

Enable link-failover on the monitored interfaces

Question 11

A FortiGate HA cluster is configured with two units in active-passive mode. The administrator needs to perform a firmware upgrade on the cluster with minimal downtime. The current firmware version is 7.2.5 and the target is 7.2.7. The cluster uses FGCP with session synchronization enabled. Which procedure should the administrator follow?

Accepted Answer

Upgrade the passive unit first, perform a graceful failover, then upgrade the new passive unit. It follows the recommended upgrade procedure for an active-passive FGCP cluster with session synchronization. By upgrading the passive unit first, then performing a graceful failover (which preserves existing sessions via FGCP session sync), and finally upgrading the new passive unit, the administrator ensures that the cluster remains operational throughout the process with minimal traffic disruption. This method avoids a full cluster outage and maintains session continuity.

Answer

Upgrade only the primary unit and let the secondary synchronize automatically

Answer

Disable HA, upgrade both units, then re-enable HA

Answer

Upgrade both units at the same time by connecting to each via console

Question 12

An administrator has configured a FortiGate HA cluster with two units. The cluster uses a virtual cluster for load balancing in active-active mode. The administrator notices that traffic from one VDOM is not being load-balanced and is only handled by one unit. What is the most likely cause?

Accepted Answer

The VDOM is not assigned to any virtual cluster. In an active-active HA cluster with virtual clusters, each VDOM must be explicitly assigned to a virtual cluster to participate in load balancing. If a VDOM is not assigned to any virtual cluster, it defaults to being handled only by the primary unit, regardless of the cluster mode. This explains why traffic from that VDOM is not load-balanced.

Answer

Session pickup is disabled

Answer

The HA priority is set to 0 on the secondary unit

Answer

The management interface is not configured on the VDOM

Question 13

A company has deployed two FortiGate-600Es in an active-passive HA cluster. The cluster is configured with three VDOMs: VDOM-A (corporate LAN), VDOM-B (guest Wi-Fi), and VDOM-C (DMZ). Each VDOM has its own set of interfaces and policies. The cluster is also configured to use FGCP with session pickup enabled. Recently, the network team noticed that after a failover event, some user sessions in VDOM-B are not being picked up, causing disruption for guest users. The session pickup feature is enabled globally. The administrator checks the configuration and finds the following settings on the primary FortiGate:

- config system ha
  set session-pickup enable
  set session-pickup-connectionless enable
  end

- config vdom
  edit VDOM-A
    config system ha
      set session-pickup enable
    end
  next
  edit VDOM-B
    config system ha
      set session-pickup disable
    end
  next
  edit VDOM-C
    config system ha
      set session-pickup enable
    end
  next

Based on this configuration, what is the most likely reason that sessions in VDOM-B are not being picked up?

Accepted Answer

Session pickup is disabled specifically for VDOM-B in the per-VDOM HA configuration.. The per-VDOM HA configuration for VDOM-B explicitly disables session pickup with 'set session-pickup disable'. Even though the global HA settings enable session pickup, the per-VDOM setting overrides the global setting for that VDOM. As a result, after a failover, sessions in VDOM-B are not synchronized to the standby FortiGate and are not picked up, causing disruption for guest users.

Answer

The HA priority of the cluster is set too low, causing session pickup to fail for VDOM-B.

Answer

Session pickup for connectionless protocols is not enabled, so UDP sessions in VDOM-B are not picked up.

Answer

The interfaces assigned to VDOM-B do not have session pickup enabled.

Question 14

Drag and drop the steps to configure a site-to-site IPsec VPN on a FortiGate firewall into the correct order.

Accepted Answer

Phase 1, then Phase 2, then Routing, then Policies. Phase 1 establishes the IKE SA, Phase 2 creates the IPsec SA, then routing and policies are applied to allow traffic through the tunnel.

Answer

Phase 2, then Phase 1, then Routing, then Policies

Answer

Phase 1, then Policies, then Phase 2, then Routing

Answer

Policies, then Routing, then Phase 1, then Phase 2

Question 15

Drag and drop the steps to configure a FortiGate to send logs to a FortiAnalyzer into the correct order.

Accepted Answer

Add log device, then set IP and authentication, then choose log types, then apply filters, then test connectivity. The correct sequence to configure a FortiGate to send logs to FortiAnalyzer is: first add the FortiAnalyzer as a log device, then configure its IP address and shared key for authentication, then choose which log types (e.g., traffic, event, etc.) to forward, optionally apply filters to refine the logs, and finally test the connectivity to verify the configuration. This order ensures that each step builds upon the previous one, avoiding errors such as trying to configure a device that hasn't been added yet or testing before all settings are in place.

Answer

Set IP and authentication, then choose log types, then add log device, then apply filters, then test connectivity

Answer

Choose log types, then add log device, then set IP and authentication, then test connectivity, then apply filters

Answer

Apply filters, then add log device, then set IP and authentication, then choose log types, then test connectivity