NSE7 Enterprise Firewall and VDOMs Practice Test 4 — 15 Questions

Question 1

Match each Fortinet security feature to its primary function.

Accepted Answer

IPS: Inspects traffic for malicious patterns and exploits. Fortinet security features have distinct functions: IPS inspects network traffic for exploits, Application Control identifies applications, Web Filtering controls web access, and Antivirus scans for malware. Common confusions involve swapping these roles.

Answer

IPS: Scans files and content for malware

Answer

Application Control: Blocks access to malicious websites

Question 2

Match each Fortinet component to its description.

Accepted Answer

FortiGate: Next-generation firewall (NGFW) with integrated security features. FortiGate is the NGFW, FortiManager manages devices, FortiAnalyzer handles logging/analytics, and FortiClient is an endpoint agent. Common confusions involve swapping these roles.

Answer

FortiGate: Centralized management for Fortinet devices

Answer

FortiManager: Next-generation firewall (NGFW) with integrated security features

Question 3

Match each FortiGate routing concept to its description.

Accepted Answer

Policy-based routing: Routes packets based on criteria other than destination IP, such as source IP or protocol. Correct matches: PBR, Route redistribution, Administrative distance, and Static route are correctly paired. ECMP and Metric are swapped; ECMP distributes traffic across equal-cost paths, while Metric compares routes within a protocol.

Answer

ECMP: A numeric value used to compare routes within the same routing protocol

Answer

Metric: Distributes traffic across multiple equal-cost paths to the same destination

Question 4

Match each FortiGate authentication method to its protocol.

Accepted Answer

LDAP: Lightweight Directory Access Protocol. FortiGate supports multiple authentication methods, each using a specific protocol. LDAP uses LDAP, RADIUS uses RADIUS, TACACS+ uses TACACS+, and SAML uses SAML. Common confusions include swapping LDAP and RADIUS definitions.

Answer

LDAP: Remote Authentication Dial-In User Service

Answer

RADIUS: Lightweight Directory Access Protocol

Question 5

An administrator configures a VDOM on a FortiGate and assigns two interfaces (port1, port2) to it. The administrator wants to route traffic between two different subnets within the same VDOM. Which configuration is required?

Accepted Answer

Configure static or dynamic routing. Routing between two subnets within the same VDOM is standard intra-VDOM routing. Since both interfaces (port1, port2) belong to the same VDOM, no inter-VDOM constructs are needed; the FortiGate simply requires a route (static or dynamic) to forward packets between the subnets. A firewall policy allowing the traffic is also necessary, but the question specifically asks for the routing configuration.

Answer

Configure a VDOM link

Answer

Create a policy with inter-VDOM link

Answer

Enable inter-VDOM routing

Question 6

A FortiGate in transparent mode with multiple VDOMs is deployed at a customer site. The customer reports that traffic between two VLANs on the same physical segment is not being forwarded. The administrator verifies that the firewall policies are configured correctly. What is the most likely cause?

Accepted Answer

The FortiGate is in transparent mode and does not route between VLANs without a VLAN interface. In transparent mode, a FortiGate acts as a Layer 2 bridge and does not perform IP routing. To forward traffic between VLANs on the same physical segment, you must create VLAN subinterfaces on the FortiGate and assign them to the appropriate VDOMs. Without these VLAN interfaces, the FortiGate cannot distinguish or forward traffic between the VLANs, even if firewall policies are correctly configured.

Answer

The VDOMs are not configured with management IP addresses

Answer

The VDOM limit has been exceeded

Answer

Inter-VDOM routing is disabled between the VDOMs

Question 7

A network administrator wants to delegate management of a specific VDOM to a junior administrator. The junior should be able to modify firewall policies and objects within that VDOM but not change system settings or other VDOMs. Which administrative access configuration meets this requirement?

Accepted Answer

Create a local user with an admin profile that has permissions for that VDOM only. FortiGate allows you to create a local user with an admin profile that has permissions scoped to a specific VDOM. By assigning the junior administrator to that VDOM-only profile, they can modify firewall policies and objects within that VDOM but cannot change system settings or access other VDOMs. This is the standard method for delegating VDOM-specific administrative access without granting global or multi-VDOM privileges.

Answer

Place the VDOM in transparent mode to allow full access

Answer

Create a RADIUS user that is assigned to the VDOM group

Answer

Use the management VDOM feature to assign the junior admin to the VDOM

Question 8

An administrator runs the command 'diagnose sys session filter dport 443' on a FortiGate and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in SYN_SENT state, meaning the three-way handshake is incomplete. The output shows `proto=6` (TCP), `proto_state=01`, `duration=3600`, and `expire=3599`. In FortiGate's session table, `proto_state=01` represents the TCP state `SYN_SENT`, which means the session has sent a SYN but has not yet received a SYN-ACK, so the three-way handshake is incomplete. The `expire=3599` indicates the session will time out in 3599 seconds if the handshake does not complete, but the session is not yet established.

Answer

The session is fully established and will expire in about 3599 seconds

Answer

The traffic is being blocked by the firewall policy

Answer

The session is using HTTPS and has been inspected

Question 9

A FortiGate is configured with multiple VDOMs. The administrator needs to allow traffic from a VDOM named 'CustomerA' to reach a server in VDOM 'SharedServices'. Both VDOMs are on the same FortiGate. Which configuration is necessary?

Accepted Answer

Enable inter-VDOM routing and create policies allowing traffic between the VDOMs. Inter-VDOM routing is required to route traffic between VDOMs on the same FortiGate. This is enabled globally via the CLI command 'config system global' and 'set inter-vdom-routing enable'. Once enabled, you must create firewall policies between the VDOMs (using the VDOM link or directly referencing the VDOMs in policies) to permit the traffic. Without inter-VDOM routing, VDOMs are isolated Layer 3 domains and cannot communicate.

Answer

Place both VDOMs in the same ADOM in FortiManager

Answer

Create a VDOM link between the two VDOMs

Answer

Configure the FortiGate in transparent mode

Question 10

An administrator wants to ensure that all traffic from VDOM 'Guest' is logged to a FortiAnalyzer that is managed by FortiManager. What must be configured in FortiManager to achieve this?

Accepted Answer

Configure the VDOM's log settings and assign the device to an ADOM with log forwarding enabled. FortiManager manages log forwarding at the ADOM level. To forward logs from a specific VDOM (Guest) to FortiAnalyzer, the administrator must configure the VDOM's log settings to send logs to FortiAnalyzer and assign the FortiGate to an ADOM that has log forwarding enabled. This ensures that logs from the Guest VDOM are properly forwarded to the FortiAnalyzer managed by FortiManager.

Answer

Enable FortiView on the FortiGate

Answer

Configure a log forwarding policy in the Global ADOM

Answer

Create an automation stitch to forward logs

Question 11

A FortiGate administrator notices that traffic from a specific subnet is not being inspected by the Intrusion Prevention System (IPS) profile applied to the firewall policy. The policy is configured with the correct profile, and the IPS engine is enabled. What is the most likely cause?

Accepted Answer

The protocol in the IPS profile is not enabled for the application being used. The most likely cause is that the protocol in the IPS profile is not enabled for the application being used. Even when an IPS profile is applied to a firewall policy and the IPS engine is running, the profile must have the specific protocol (e.g., HTTP, SMTP, FTP) enabled for inspection. If the protocol is disabled or not selected, the IPS engine will bypass traffic of that type, resulting in no intrusion detection or prevention for that traffic.

Answer

The traffic is encrypted and SSL inspection is not enabled

Answer

The IPS profile is configured for signature-based detection only

Answer

The firewall policy is set to accept mode instead of explicit proxy

Question 12

An administrator is deploying a FortiGate in transparent mode to seamlessly integrate into an existing network. The administrator needs to manage the FortiGate remotely over the network. Which configuration is required?

Accepted Answer

Configure a management IP address under the VDOM settings. In transparent mode, FortiGate operates as a Layer 2 bridge and does not route traffic, so physical interfaces cannot have IP addresses. To enable remote management, a dedicated management IP must be configured under the VDOM settings, which allows the FortiGate to be reachable via protocols like HTTPS, SSH, or SNMP without participating in Layer 3 forwarding.

Answer

Create a VLAN interface and assign an IP

Answer

Assign an IP address to the physical interfaces

Answer

Enable DHCP client on the interfaces

Question 13

An administrator needs to back up the configuration of a FortiGate managed by FortiManager before making major changes. Which feature in FortiManager should the administrator use?

Accepted Answer

Revision history. Revision History in FortiManager allows administrators to create, view, and restore previous configuration versions of managed FortiGate devices. This is the correct feature for backing up a configuration before making major changes, as it provides a point-in-time snapshot that can be rolled back if needed.

Answer

Policy package import/export

Answer

Automation stitch

Answer

Install preview

Question 14

In FortiManager, an administrator wants to apply a set of firewall policies to multiple FortiGates in different ADOMs. The policies must be centrally managed. What is the best approach?

Accepted Answer

Use the Global ADOM to define global policies that apply to all ADOMs. The Global ADOM in FortiManager allows administrators to define firewall policies that are automatically inherited by all ADOMs, ensuring consistent, centrally managed policy enforcement across multiple FortiGates without manual duplication. This approach leverages FortiManager's hierarchical policy model, where global policies are pushed to each ADOM's policy packages and take precedence over local policies unless overridden.

Answer

Create a policy package in each ADOM and use the same policies

Answer

Configure the policies directly on each FortiGate

Answer

Use automation stitches to copy policies between ADOMs

Question 15

An administrator configures an automation stitch in FortiManager to execute a CLI script on a FortiGate when a specific event is triggered. The automation stitch is enabled but does not run when the event occurs. What is the most likely cause?

Accepted Answer

The automation stitch has not been installed to the FortiGate. In FortiManager, automation stitches are created and stored in the central management database but must be explicitly installed to the managed FortiGate via the 'Install Wizard' or a direct policy/object install. Until the stitch is installed, the FortiGate does not have the configuration locally, so even if the stitch is enabled in FortiManager and the event occurs, the FortiGate will not execute the CLI script. This is a common oversight where administrators assume enabling the stitch in FortiManager automatically pushes it to the device.

Answer

The event trigger is set to high severity only

Answer

The FortiGate does not support automation stitches

Answer

The CLI script contains an invalid command