NSE7 Enterprise Firewall and VDOMs — Timed 10 Questions

Question 1

A network engineer wants to deploy a FortiGate in transparent mode and have it managed by FortiManager. The FortiGate should not participate in routing, but must be able to send logs to FortiAnalyzer. Which two settings must be configured on the FortiGate to achieve this?

Accepted Answer

Configure a management IP address on the FortiGate. In transparent mode, the FortiGate operates as a Layer 2 bridge and does not participate in routing. However, to be managed by FortiManager and send logs to FortiAnalyzer, the FortiGate must have a management IP address (option B) so that it can be reached as a management endpoint. Additionally, a static route (option D) is required to direct traffic to the management and logging servers, since the FortiGate cannot rely on dynamic routing protocols in transparent mode.

Answer

Enable DHCP client on the management interface

Answer

Enable NAT on the management interface

Answer

Set the interface IP address in the same subnet as the upstream router

Question 2

An organization is deploying multiple FortiGate devices across different geographic locations. The central IT team manages all devices from a single FortiManager. The remote FortiGates connect to FortiManager over a WAN link. Which feature should be enabled on FortiManager to ensure that configuration changes are applied consistently and without interruption to the remote FortiGates?

Accepted Answer

Use the 'Install on Next Reboot' option in the install wizard. Option B is correct because the 'Install on Next Reboot' option ensures that configuration changes are staged on the remote FortiGate and applied atomically when the device reboots. This prevents partial or inconsistent application over an unreliable WAN link, as the FortiManager pushes the full configuration revision to the device, which then applies it during the boot process without requiring a persistent management session.

Answer

Enable auto-link configuration on the FortiManager

Answer

Use 'Install Wizard' with 'Immediate Install' option

Answer

Enable 'Configuration Override' on the managed FortiGates

Question 3

A company is implementing a Security Fabric with multiple FortiGate devices. They want to use FortiAnalyzer for centralized logging and FortiManager for centralized management. Which of the following is a prerequisite for adding a FortiGate to the Security Fabric?

Accepted Answer

The FortiGate must have network connectivity to the FortiManager. For a FortiGate to join a Security Fabric, it must have network connectivity to the FortiManager that manages the fabric. FortiManager acts as the fabric root or controller, and the FortiGate registers with it using the FortiManager IP or FQDN. Without this connectivity, the FortiGate cannot be added to the Security Fabric topology.

Answer

The FortiGate must have FortiAnalyzer configured as a log device

Answer

The FortiGate's management IP must be configured via DHCP

Answer

The FortiGate must be operating in transparent mode

Question 4

A network administrator is troubleshooting a FortiGate that is not appearing in the Security Fabric topology on FortiManager. The FortiGate is reachable from FortiManager via ping. What is the most likely cause?

Accepted Answer

The FortiGate is not authorized in FortiManager. For a FortiGate to appear in the Security Fabric topology on FortiManager, it must first be authorized in FortiManager. Even if the FortiGate is reachable via ping, without authorization, FortiManager will not accept its registration or include it in the topology view. This is a prerequisite step that must occur before any fabric communication can be established.

Answer

FortiAnalyzer is not configured on the FortiGate

Answer

SNMP community string is mismatched

Answer

The FortiGate firewall policy is blocking traffic to FortiManager

Question 5

An organization uses FortiManager to manage multiple FortiGate devices in a Security Fabric. The administrator wants to push a new firewall policy that includes an FQDN address object. Which statement is true regarding FQDN objects in FortiManager policies?

Accepted Answer

FortiManager resolves the FQDN to IP addresses at installation time and updates the policy accordingly. When an administrator pushes a policy containing an FQDN address object from FortiManager, FortiManager resolves the FQDN to its current IP addresses at installation time. The resolved IPs are then written into the policy on the managed FortiGate, ensuring the policy is immediately effective without requiring the FortiGate to perform DNS resolution. This behavior is specific to FortiManager-managed policies and differs from locally configured FQDN objects on FortiGate.

Answer

FQDN objects must be defined on each managed FortiGate individually

Answer

The FQDN resolution is done automatically every 60 seconds by FortiManager

Answer

FQDN objects cannot be used in policies pushed from FortiManager

Question 6

Which TWO statements about the Security Fabric and FortiManager are correct? (Choose two.)

Accepted Answer

FortiManager can manage multiple Security Fabrics.. FortiManager can manage multiple Security Fabrics because it is designed as a centralized management platform that can oversee multiple independent FortiGate clusters or fabric topologies. Each Security Fabric is a logical grouping of FortiGate devices that share a common root FortiGate, and FortiManager can be configured to manage several such fabrics simultaneously, each with its own root and member devices, without requiring separate management servers.

Answer

FortiGate devices must be in transparent mode to join the fabric.

Answer

FortiAnalyzer must be deployed to use the Security Fabric.

Answer

A FortiGate can be part of multiple Security Fabrics simultaneously.

Question 7

Which THREE actions can an administrator perform using FortiManager in a Security Fabric environment? (Choose three.)

Accepted Answer

Upgrade the firmware of multiple FortiGates at once. Option A is correct because FortiManager supports centralized firmware management, allowing administrators to upgrade the firmware of multiple FortiGates simultaneously via the 'Firmware Upgrade' wizard in the Device Manager. This leverages the FortiManager's role as a central management point, which can stage and push firmware images to managed devices in a Security Fabric, reducing downtime and ensuring consistency across the fabric.

Answer

Terminate IPsec VPN tunnels on the FortiManager

Answer

Configure FortiGate to manage the FortiManager

Question 8

Refer to the exhibit. A FortiGate is configured with the above settings. The FortiManager at 192.168.1.100 cannot establish a management connection to the FortiGate. What is the most likely cause?

Accepted Answer

The FortiGate's port1 IP is not in the same subnet as the FortiManager. The FortiGate's port1 IP (192.168.2.1/24) is on a different subnet (192.168.2.0/24) than the FortiManager's IP (192.168.1.100), which is on the 192.168.1.0/24 subnet. For a management connection to be established, the FortiGate and FortiManager must be able to route to each other, typically requiring them to be on the same subnet unless a gateway or static route is configured. Since no routing is mentioned, the subnet mismatch is the most likely cause of the failure.

Answer

HTTPS access is not enabled on port1

Answer

The admin user 'admin' is not configured correctly

Answer

The trusthost configuration does not include the FortiManager IP

Question 9

Refer to the exhibit. A FortiGate is connected to the Security Fabric and registered with FortiManager. However, the administrator notices that the FortiGate is not receiving policy updates from FortiManager. What is the most likely cause?

Accepted Answer

The policy package on FortiManager is not assigned to the correct device group or policy target. Option C is correct because FortiManager uses policy packages that must be explicitly assigned to a device group or specific FortiGate. Even if the FortiGate is registered and part of the Security Fabric, if the policy package is not assigned to the correct device group or policy target, the FortiGate will not receive policy updates. This is a common misconfiguration where the policy package exists but is not linked to the device.

Answer

The Fabric Root serial number is incorrect

Answer

The FortiGate is not registered with FortiManager

Answer

The Security Fabric is not fully connected

Question 10

A network engineer is troubleshooting a Security Fabric where a downstream FortiGate (model 60F) is not appearing in the Fabric topology of the root FortiGate (model 600E). Both devices are running FortiOS 7.4. The root FortiGate shows the downstream device as 'Unreachable' in the Security Fabric widget. The engineer has verified that the downstream FortiGate can ping the root FortiGate's management IP. What is the most likely cause of this issue?

Accepted Answer

The downstream FortiGate has insufficient memory to support Security Fabric features.. The FortiGate 60F has limited memory (typically 512 MB or less), and FortiOS 7.4 enforces a minimum memory requirement for downstream devices to participate in the Security Fabric. When the downstream device has insufficient memory, the root FortiGate marks it as 'Unreachable' even though basic IP connectivity (ping) works. This is a known hardware limitation for lower-end models like the 60F when running newer FortiOS versions.

Answer

The root FortiGate does not have HTTPS access to the downstream FortiGate.

Answer

The downstream FortiGate's management interface is configured on a different VLAN.

Answer

The administrator account on the downstream FortiGate does not have 'super_admin' privileges.