91 questions total · 2pages · All types, answers revealed
Page 1 of 2
Page 2What is the benefit of using 'CLI Templates' in FortiManager?
Templates provide bulk configuration.
Why this answer
CLI templates allow you to push specific configuration lines to multiple devices, which is useful for settings not covered by the GUI policy editor.
Which THREE steps are involved in the 'Policy Package Installation' workflow?
Target selection is required.
Why this answer
The workflow involves selecting the package, choosing the target device, and executing the installation (with a preview).
Which THREE of the following are mandatory for a BGP neighbor adjacency to establish?
The peers must know their AS relationship.
You are setting up an SD-WAN configuration via FortiManager. Which object type is used to group multiple WAN interfaces for SD-WAN member assignment?
Zones allow grouping of SD-WAN members.
Why this answer
The 'SD-WAN Zone' object is used in FortiManager to group multiple interfaces together for use in SD-WAN policies.
What is the result of 'Pushing' a policy package from FortiManager to a FortiGate?
Pushing overwrites the device config.
Why this answer
Pushing a policy package replaces the current policy configuration on the FortiGate with the version stored in the FortiManager database.
You need to inspect traffic between two internal VLANs. How do you ensure this traffic is processed by the FortiGate?
The FortiGate requires a policy to permit traffic between zones/interfaces.
Why this answer
Since VLANs are logical interfaces, the FortiGate will act as a gateway if the devices are configured to use the FortiGate's IP as their default gateway.
Which component of FortiManager allows for the centralized management of firmware across multiple devices?
This is the correct module for firmware.
Why this answer
The 'Firmware Management' tool is dedicated to tracking, uploading, and deploying firmware to managed FortiGates.
Which TWO types of reports can be generated in the FortiAnalyzer module of FortiManager?
Admins can build custom reports.
Why this answer
FortiAnalyzer provides both pre-defined reports and custom reports for tailored analysis.
Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?
It avoids the overhead of buffering the entire object.
Why this answer
Flow-based inspection is generally faster and provides better performance than proxy-based inspection.
Which FortiGate feature is used to group multiple physical interfaces for redundancy at Layer 2?
This provides port-channel functionality.
Why this answer
802.3ad Link Aggregation (LACP) is the standard for binding physical ports into a single logical interface.
Policies are mandatory to permit inter-zone traffic flow.
Why this answer
Even if the tunnel is up, a policy must exist to allow traffic to flow between the internal network and the tunnel interface.
When adding a FortiGate to FortiManager, which mode must the FortiGate be in to allow the FortiManager to manage its configuration and policies?
Normal mode is required for full management.
Why this answer
The FortiGate must be in 'Normal' mode; if it is in 'Backup' or 'Read-only' mode, full management is not possible.
You are managing FortiGates across multiple ADOMs. How can you share common firewall objects (e.g., mail servers, common IP ranges) across these ADOMs?
Global database objects are available to all ADOMs.
Why this answer
Using the 'Global Database' or 'Global Policy' objects allows administrators to define objects once and share them across multiple ADOMs.
An administrator wants to use FortiManager to push a configuration change to 50 FortiGates simultaneously. Which method minimizes downtime and ensures consistency?
Device groups enable bulk management.
Why this answer
Using 'Provisioning Templates' or 'Device Groups' allows the administrator to push changes to multiple devices in a controlled, unified manner.
Which THREE factors influence the Master election in an HA cluster?
Longest uptime wins if priority matches.
Why this answer
The election process considers the monitor status, the override setting, and the priority values of the devices.
In a site-to-site VPN, you need to allow traffic initiated from the remote site. What configuration is essential on the local FortiGate?
This policy enables the inbound connection flow.
When using FortiAnalyzer integration with FortiManager, where do you view the aggregated log reports?
This is where reports are generated.
Why this answer
Reports are generated and viewed within the FortiAnalyzer module, which is embedded in the FortiManager.
Which FortiGate feature should be enabled to prevent internal users from accessing malicious websites based on real-time threat intelligence?
Web filtering specifically categorizes URLs for security policy.
Why this answer
Web Filtering using categories provides real-time protection by checking URLs against the FortiGuard database.
In a BGP deployment, your FortiGate is receiving routes from two different ISPs. You want to influence outbound traffic to prefer ISP1 for specific destinations. Which BGP attribute should you modify?
Local Preference is the standard BGP attribute for controlling outbound path selection.
Why this answer
Local Preference is used to influence outbound traffic selection within an AS.
Which administrative access type is recommended to be disabled on public-facing interfaces for security best practices?
HTTP sends credentials in cleartext and should be restricted.
Host check verifies endpoint security posture.
Why this answer
Host check allows the FortiGate to verify the presence of specific software like Antivirus before allowing the VPN connection.
An administrator needs to perform a firmware upgrade on 100 FortiGates. Which feature in FortiManager allows this to be done securely with a rollback option?
This manages upgrades across devices.
Why this answer
The 'Firmware Management' feature in Device Manager allows for scheduled upgrades and provides options for managing firmware versions across groups.
An enterprise firewall administrator needs to deploy different security profiles to branch offices while sharing the same firewall policy structure. Which feature should be used?
Inheritance allows sharing of policy structures.
Why this answer
Policy Packages allow for the grouping of policies, while the use of 'Global Policy' or 'Package Inheritance' allows for common policies to be shared across various ADOMs or device groups.
Which THREE items can be managed via Device Templates in FortiManager?
NTP is a standard template item.
You need to ensure that session synchronization between HA nodes is as efficient as possible. Which parameter should be tuned in the HA configuration?
This setting allows delaying session pickup, which can reduce CPU utilization during high-frequency session creation.
Why this answer
The 'session-pickup' setting, specifically 'session-pickup-delay', helps manage the timing and load of session synchronization to prevent CPU spikes.
You need to inspect traffic between two VDOMs. Which mechanism is required?
This is the native FortiGate feature for VDOM-to-VDOM communication.
Why this answer
Inter-VDOM links are virtual interfaces used to route traffic between distinct VDOMs, essentially creating a 'cable' between them.
Which THREE items are included in the configuration file of a FortiGate?
Stored in the config file.
Why this answer
The configuration file contains system settings, policy rules, and interface definitions.
AES-NI optimizes the encryption process.
Why this answer
Hardware acceleration (ASIC) and selecting efficient encryption algorithms like AES-NI (hardware-accelerated AES) improve VPN throughput.
An administrator is configuring the FortiManager to manage multiple FortiGate devices across different regions. Which method ensures that the device configuration remains synchronized with the FortiManager policy database during an automatic configuration update?
Auto-update ensures configuration synchronization.
Why this answer
The 'Auto-update' feature in the FortiManager Device Manager ensures that the configuration on the managed device is automatically synchronized with the policy package defined in the FortiManager database.
If a FortiGate is in Active-Passive HA mode, what happens to the secondary device if the heartbeat is lost?
The loss of heartbeat triggers the election process.
Why this answer
If heartbeat is lost, the secondary assumes the master is down and attempts to promote itself to primary if it has the higher priority or preemption settings configured.
When using an IPS sensor, what is the difference between 'Protect' and 'Monitor' mode?
'Protect' implies active enforcement.
Why this answer
'Protect' drops the traffic if a signature matches, whereas 'Monitor' logs the hit without dropping the traffic.
A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?
Clients must trust the CA that signs the re-issued certificates.
Why this answer
The FortiGate acts as a man-in-the-middle, so the client must trust the CA certificate generated by the FortiGate.
In a VDOM-enabled environment, how are administrative accounts managed?
This is the primary benefit of administrative VDOM access control.
Why this answer
Administrative accounts can be restricted to specific VDOMs (Global admin vs. VDOM admin) for granular access control.
An administrator needs to provide access to FortiManager for a junior team member who should only be able to view logs and reports. Which feature is used to define this access?
Profiles control feature-level access.
Why this answer
Administrators create 'Administrator Profiles' to restrict access to specific modules and permissions.
What is the primary purpose of an ADOM in FortiManager?
ADOMs provide administrative segmentation.
Why this answer
Administrative Domains (ADOMs) allow the segregation of managed devices based on geography, customer, or business unit for delegated administration.
What is the impact of changing the 'set vdom-mode' from 'no-vdom' to 'multi-vdom'?
The configuration migration requires a system reload.
Why this answer
Changing the VDOM mode triggers a system reboot because it fundamentally changes how the kernel handles memory allocation and resource segmentation.
What is the primary function of the FortiGate Security Fabric?
This is the core value proposition of the Security Fabric.
Why this answer
The Security Fabric integrates multiple devices to provide coordinated, end-to-end security visibility and control.
Which type of script in FortiManager is designed to run on the FortiManager itself rather than the managed devices?
TCL scripts run on the FMG.
Why this answer
TCL scripts can be used to automate FortiManager functions, whereas CLI scripts typically target the managed devices.
You want to automate the onboarding of new FortiGate units. Which FortiManager feature allows you to pre-configure devices before they connect to the network?
Templates enable automated configuration.
Why this answer
Provisioning Templates allow you to define configuration settings that are applied automatically when the device registers with the FortiManager.
Which command is used to troubleshoot connectivity by checking the routing table of a specific IP address on the FortiGate?
This shows the exact routing lookup for the given IP.
Why this answer
The 'get router info route detail' or 'execute router info routing-table' commands are standard for verifying paths.
Which command allows you to view the current routing table for a specific VDOM?
This displays the routing table for the current context.
Why this answer
The 'get router info' command is context-aware and must be prefixed with the VDOM scope or executed within the VDOM context.
Which TWO actions should be taken when preparing to upgrade a FortiGate HA cluster?
Crucial for known issues and upgrade paths.
Why this answer
A configuration backup is mandatory, and checking the release notes for firmware-specific HA behavior is critical for a smooth upgrade.
Which THREE types of traffic are typically NOT offloaded by the NP6 processor?
Proxy modes are CPU-intensive and generally not NP-offloaded.
Why this answer
Traffic that requires complex inspection, such as encrypted traffic that hasn't been decrypted or specific types of tunnels without hardware support, is handled by the CPU.
A FortiManager administrator needs to ensure that logs from all enterprise FortiGates are aggregated and purged based on storage thresholds. Where is this configured?
Log settings define disk management for logs.
Why this answer
The log retention and storage settings are managed in the FortiManager's 'FortiView' or 'Device Settings' regarding log management, specifically under 'Log Settings' where disk quota and retention policies are defined.
Which TWO methods can be used to authenticate a FortiGate when it registers to a FortiManager?
Passwords are used for secure registration.
Why this answer
Registration can be secured using a serial number/password combination or by adding the device's IP and certificate/serial in the FMG.
Which configuration mode allows you to define a virtual MAC address for an HA cluster to prevent ARP cache issues on switches?
Using a virtual MAC ensures the downstream switches do not need to relearn the MAC address during failover.
Why this answer
The 'ha-mgmt-status' and virtual MAC features ensure that the cluster presents a consistent MAC regardless of which node is master.
You are troubleshooting a policy installation failure where the FortiManager reports a 'Configuration conflict'. Which action should you perform to identify the root cause of the mismatch?
The Diff tool is the standard method for resolving conflicts.
Why this answer
The 'Check Configuration' or 'Diff' tool in the Policy & Objects tab allows administrators to compare the database version against the running device configuration to pinpoint the exact setting causing the conflict.
Which TWO actions can be performed on a Revision History item in FortiManager?
Diff/Compare identifies changes.
Why this answer
Revision history allows you to compare versions (diff) and restore to a previous state.
Which THREE conditions must be met for a successful Inter-VDOM link?
Point-to-point links require an L3 subnet.
Why this answer
Inter-VDOM links require pairing, routing, and specific interface assignment within the relevant VDOMs.
Which TWO components are synchronized between HA members?
Essential for seamless failover.
Why this answer
The configuration and the session table are the primary elements that must be synchronized for transparent failover.
When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?
This ensures confidentiality.
Why this answer
IKEv2 negotiates encryption, integrity, and Diffie-Hellman groups during the initial exchange.
Which THREE types of traffic are typically inspected by an IPS policy?
Web traffic is a primary vector for attacks.
What is the purpose of the 'Any' interface in a firewall policy?
'Any' is a wildcard for interface matching.
Why this answer
The 'Any' interface enables the policy to match traffic originating from or destined to any physical or logical interface on the FortiGate.
An administrator is migrating a standalone FortiGate into an existing FortiManager. What happens to the existing firewall policies on the FortiGate during the import process?
The import process captures existing policies into the database.
Why this answer
When importing, the FortiManager imports the configuration and creates a Policy Package; the existing policies are added to the 'Policy & Objects' database.
In a high availability (HA) cluster, which THREE settings are synchronized between the primary and secondary units?
Objects must be consistent across the cluster.
Why this answer
HA synchronization ensures that policies, objects, and configurations are mirrored to provide seamless failover.
What is the purpose of 'dedicated HA' interfaces?
Dedicated interfaces prevent data traffic from interfering with HA signaling.
Why this answer
They isolate heartbeat traffic from data traffic to prevent jitter and ensure cluster stability.
What is the effect of changing the IPS 'buffer' size on a FortiGate device?
The buffer directly manages memory for flow-based inspection.
Why this answer
Adjusting the IPS buffer affects how much data is held in memory for inspection, which can prevent packet drops during heavy traffic but increases memory load.
When configuring an aggregate interface (LACP) on a FortiGate, which mode must be set to ensure traffic is distributed across links based on source and destination IP?
Selecting an appropriate hash algorithm ensures traffic distribution based on L4 headers.
Why this answer
The 'LACP-mode' set to 'active' or 'passive' relates to negotiation, but the distribution algorithm is governed by the 'dst-mac' or 'ip' hash settings in the interface configuration.
An administrator notices that logs are not appearing in FortiManager for a specific FortiGate. What is the first thing to check to ensure log forwarding is active?
FGT must be configured to send logs.
Why this answer
Checking the 'Log Settings' on the FortiGate to ensure the 'Remote Logging' feature is enabled and pointing to the correct FortiManager/FortiAnalyzer IP.
When a policy change is made in FortiManager, it must be 'Installed' to take effect. What is the first stage of the install process?
Previewing is the first phase of verification.
Why this answer
The install process begins with an 'Install Preview' to verify the configuration changes before they are actually pushed to the device.
Which TWO options are available when configuring an SD-WAN rule in FortiManager?
Traffic matching is standard.
Why this answer
SD-WAN rules allow setting traffic steering based on criteria like source/destination and strategy (load balancing/manual).
Where can an administrator check the status of the connection between a FortiGate and FortiManager?
Device Manager shows connectivity status.
Why this answer
The 'Device Manager' page lists all managed devices and displays their status (e.g., 'Up', 'Down', 'Synchronized').
Which TWO administrative actions require a 'Workspace Mode' enabled in FortiManager?
Workspace mode enables locking.
Why this answer
Workspace mode is required for concurrent editing and locking of policies by multiple administrators.
What is the default behavior for 'override' in FortiGate HA?
The default setting is disabled to ensure stability.
Why this answer
Override is disabled by default to prevent unnecessary failbacks and flapping in the cluster.
A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?
Standard bridging behavior for unknown unicast/broadcast frames.
Why this answer
In transparent mode, the FortiGate acts as a Layer 2 bridge and will flood the unknown frame to all interfaces in the bridge domain except the incoming port.
Which FortiGate feature allows you to bypass SSL inspection for specific known-trusted websites to maintain user privacy?
Exempting categories like 'Finance' or 'Health' is standard practice.
Why this answer
SSL Inspection Exemptions allow bypassing decryption for specific categories or domains.
A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?
The HA Group ID must match to allow devices to discover each other.
Why this answer
In an HA cluster, devices must share identical HA group IDs, passwords, and heartbeats to form a cluster.
Which THREE items are included in a Policy Package when it is pushed from FortiManager?
Services define ports/protocols for policies.
Why this answer
Policy packages include firewall policies, address objects, and services used within those policies.
An administrator is troubleshooting an issue where hardware acceleration is not working after upgrading firmware. Which command identifies if the NP configuration has changed?
This allows verification of the port-to-NPU mapping.
Why this answer
'diag hardware npu np6 port-list' or similar status commands help verify the current operational state and mapping of physical ports to NPU cores.
Which TWO methods are used to achieve traffic separation in a multi-VDOM environment?
Logical separation on a single port.
Why this answer
Physical port assignment and VLAN tagging are the standard methods for segmenting traffic at the network edge in VDOMs.
Which THREE features are specific to the FortiManager 'Enterprise Firewall' management workflow?
Objects are managed globally.
Why this answer
Centralized policy management, object database management, and revision control are key parts of the enterprise workflow.
Which method is the most secure for managing FortiGate devices remotely?
Restricting management access to specific IPs is a security best practice.
Phase 2 requires matching local and remote subnets/selectors.
Why this answer
Phase 2 failure is usually due to mismatched selectors (proxy IDs) or mismatched encryption/authentication algorithms.
UDP 4500 is used to traverse NAT for IPsec.
You are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?
This allows targeted tuning of individual signatures.
Why this answer
Using an IPS sensor override or a specific signature exemption allows you to modify the behavior for a single signature without disabling it globally.
Page 1 of 2
Page 2Practice NSE7_EFW by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →