NSE 7 - Enterprise Firewall (NSE7_EFW) (NSE7_EFW) — Questions 1–75

CLI Templates store reusable sets of FortiGate CLI commands that FortiManager can push to many managed devices at once, ensuring consistent configuration across the estate. This satisfies the requirement to apply commands to multiple devices efficiently.

Selecting the target device identifies which gateway or cluster the policy package will be installed onto, since installation is scoped per managed object. Without this selection the workflow cannot proceed, satisfying the requirement to define where the policy is applied.

The 'set allowaccess' command on an interface controls which management protocols are enabled. By enabling only SSH and SNMP, other protocols are blocked. Additionally, trusted hosts on administrator accounts restrict SSH access to specific IPs. For SNMP, the community string and allowed hosts can be configured separately.

Even in transparent mode, firewall policies are required to permit traffic between interfaces. The FortiGate acts as a Layer 2 bridge, but security inspections (AV, IPS, etc.) are applied via firewall policies. Without policies allowing traffic from the internal interface to the external interface, traffic will be blocked, and no inspection will occur.

Workspace Mode in FortiManager allows administrators to make configuration changes in a private workspace without affecting the live configuration. Changes are saved in the workspace and must be committed and then installed to devices. This supports change control because multiple administrators can work independently, and changes can be reviewed before being applied. It provides a staging area for approval workflows.

IKE version mismatch is a common cause of IPsec VPN failures between different vendors. FortiGate and Cisco ASA must use the same IKE version (IKEv1 or IKEv2) for the tunnel to establish. If one peer is configured for IKEv2 and the other for IKEv1, they cannot negotiate phase-1, and the tunnel will fail. The administrator should verify and align the IKE version on both devices.

When workspace mode is enabled, changes are staged in a workspace and not saved to the main database until committed. Committing saves the changes to the FortiManager database. After that, the administrator must install the policy package to push the updated configuration to the FortiGate. This two-step process ensures the change is both saved and deployed.

Link monitors (also called link health monitors) can detect when a next-hop is unreachable. By enabling 'update-static-route', the FortiGate will remove static routes that use the monitored interface or next-hop when the link monitor fails. This ensures the route is withdrawn if the next-hop becomes unreachable.

SD-WAN zones group multiple WAN interfaces into a single logical object, and FortiManager assigns members to that zone rather than to individual interfaces. This satisfies the stem's requirement for grouping WAN interfaces before SD-WAN member assignment, letting you reference one zone across policies and health checks.

Objects created within an ADOM are local to that ADOM and cannot be seen or used by other ADOMs. This provides the necessary isolation. The administrator can create firewall addresses and services in the specific ADOM, and they will be available only to devices within that ADOM. This is the most straightforward and efficient method to achieve the requirement.

Pushing installs the FortiManager policy package onto the managed FortiGate, replacing its local policy configuration with the FortiManager version. The device's policy set is therefore overwritten, ensuring the centralised configuration becomes authoritative and consistent across managed devices.

The Install Wizard allows administrators to select specific devices or groups for installation. By choosing only the devices that require the policy changes, the administrator avoids unnecessary installations to other devices, reducing network load and processing time. This targeted approach is a best practice for efficient policy deployment in large environments.

Session pickup enables the primary unit to synchronize session state to the backup, so established TCP sessions can continue after a failover. Without it, the new primary would not know about existing connections and would drop them. This directly addresses the requirement for session continuity during an HA failover.

Firewall policies govern whether the FortiGate forwards or inspects traffic between interfaces. Without a policy permitting the VLAN-to-VLAN flow, traffic is denied; adding one ensures the FortiGate processes the packets rather than bypassing inspection at layer 2.

In a route-based IPsec VPN, a virtual tunnel interface is created (e.g., VPN_Tunnel). Firewall policies must reference this interface to allow traffic into and out of the tunnel. The tunnel interface is also used for routing and for monitoring the tunnel status via Dead Peer Detection (DPD).

Firmware Management centralises firmware deployment across managed FortiGate devices, letting administrators stage images, schedule upgrades by device group, and track version compliance from one console. This directly satisfies the stem's requirement for centralised firmware control across multiple devices, rather than per-device manual uploads.

Even if the tunnel is up and policies allow traffic, the FortiGate needs a route to direct packets destined for the remote subnet into the VPN tunnel. Without a static route pointing to the tunnel interface (or a route learned via routing protocol), traffic will not be sent through the tunnel and may be dropped or routed incorrectly.

Custom reports are user-defined, letting you select specific datasets, filters and layout in FortiAnalyzer, so they satisfy the stem's requirement for a generatable report type. Unlike fixed templates, they are built from the Log View and Report Wizard, confirming FortiAnalyzer supports them as a distinct report category.

Flow-based inspection streams packets through the FortiGate without buffering whole files or reassembling full payloads, so it consumes less CPU and memory than proxy-based inspection, which terminates and rebuilds each session. This resource efficiency is the benefit the option names.

Route-based VPNs create virtual tunnel interfaces that can be monitored. By configuring two tunnels and using link health monitoring or routing protocols, the FortiGate can detect a failure and remove the route to the failed tunnel, causing traffic to use the remaining tunnel. This provides automatic failover. This is the recommended design for redundant IPsec VPNs.

FortiGate-FortiManager (FGFM) is the proprietary protocol used for communication between FortiManager and managed FortiGates. It operates over TCP port 541 and provides secure, reliable transport for configuration, monitoring, and management tasks. FGFM is designed specifically for this purpose and is the default protocol for device registration and management.

A firewall policy is required to permit traffic from the SSL VPN tunnel interface to the internal network. Without this policy, even if users authenticate, their traffic will be blocked. This policy should specify the source as the SSL VPN users or groups and the destination as the internal subnet.

Inter-VDOM links create a virtual point-to-point interface pair between the two VDOMs. Assigning a unique transfer subnet allows routing between them, and firewall policies in both the IT and Mgmt VDOMs control the permitted TCP 514 traffic. This preserves isolation because no other traffic can cross without explicit policies.

In a route-based VPN, traffic is sent through the tunnel based on routing. However, the remote FortiGate must have a firewall policy that allows traffic from the VPN tunnel to the internal network. If the remote site lacks an appropriate policy, incoming packets will be dropped, and no return traffic will be sent. This matches the symptom of packets leaving the local FortiGate but not returning.

Selecting ADOM version 7.0 ensures that the ADOM can only manage FortiGate devices running FortiOS 7.0. This version setting determines the available features and object schemas, and it restricts device compatibility to that specific firmware version. It is the correct choice to meet the requirement of managing only FortiOS 7.0 devices.

An ADOM is a logical container that separates management configurations, including devices, policies, and objects. Devices in the same ADOM can share policy packages and objects, while devices in different ADOMs are isolated. Creating an ADOM for each group of devices that share the same security policies is the correct approach to achieve logical separation and efficient management.

802.3ad Aggregate bundles multiple physical interfaces into a single logical link, providing Layer 2 redundancy and increased throughput. If one member link fails, traffic continues over the remaining links, satisfying the stem's requirement for redundancy at Layer 2. This differs from Layer 3 redundancy mechanisms such as VRRP, which operate on IP addresses rather than interface aggregation.

For certificate-based authentication, the FortiGate must verify the client's certificate. Therefore, the client must have a personal certificate issued by a CA that the FortiGate trusts. The FortiGate checks the certificate's signature against its trusted CA list. This certificate is presented during the IKE or SSL VPN authentication phase to prove the client's identity.

FortiManager treats a FortiGate HA cluster as a single managed device. When a policy package is installed to the cluster, FortiManager communicates with the primary unit, which then synchronizes the configuration to all secondary members. This ensures consistency across the cluster without manual intervention.

The phase 2 selector, also known as the quick mode selector, defines the source and destination subnets that are permitted through the IPsec tunnel. By specifying local and remote subnets, the administrator controls which traffic is encrypted and sent over the VPN. Any traffic not matching the selector is not allowed through the tunnel, effectively dropping it. This directly fulfills the requirement to allow only specific subnets.

When deep inspection is enabled, the FortiGate acts as a man-in-the-middle, generating certificates for websites signed by its CA certificate. The client must trust this CA to avoid errors and allow inspection. Therefore, the CA certificate must be installed on client devices.

An IPsec tunnel can negotiate successfully at IKE and IPsec levels while firewall policy silently drops the encapsulated traffic. Without a policy permitting the tunnel's traffic, no packets pass despite the tunnel showing as up.

When NAT is enabled and set to use the outgoing interface address, the FortiGate performs source NAT (SNAT), replacing the internal client's source IP with the IP address of the interface that sends the traffic. This allows the internal client to access external resources while hiding its private IP.

Normal mode lets the FortiGate be fully managed by FortiManager, which pushes configuration and policy packages to it. The alternative, backup mode, restricts FortiManager to read-only retrieval, so it cannot satisfy the requirement to manage configuration and policies.

Integrating the FortiGate with the LDAP directory allows authentication against existing credentials. By creating a user group that references the LDAP server and applying it to a firewall policy, only members of that group can access the web application. This leverages centralized user management and enforces access control.

This is the correct configuration. The redundant interface acts as a single logical interface, and the IP address is assigned to it. The physical member interfaces are enslaved and do not have IP addresses. Failover occurs automatically if one member fails.

To handle return traffic, 'vdom1' needs a route to send internet-bound traffic to 'root' via an inter-VDOM link. 'root' then routes to the internet. Firewall policies must allow traffic from 'vdom1' to 'root' and from 'root' to the internet. This ensures that the server's return traffic is correctly forwarded through the VDOMs, maintaining the VIP in 'root'.

Objects created in the Global Database are inherited by every ADOM, so a mail server or IP range defined once is available to all managed FortiGates without duplication. This directly satisfies the cross-ADOM sharing requirement, unlike per-ADOM objects, which remain isolated within their own administrative domain.

Certificate pinning is a security mechanism where the application or browser expects a specific certificate or public key. When the FortiGate performs deep inspection, it re-signs the server certificate with its own CA. If the client pins the original certificate, it will detect a mismatch and display a warning or block the connection.

Multi-VDOM mode allows interfaces to be assigned to VDOMs and supports creating subinterfaces within the same VDOM. The correct sequence is to assign the physical interface first, then create the VLAN subinterface under that interface while operating in the 'internal' VDOM context. This provides proper isolation and management.

This command enables real-time debugging of the IKE process, showing detailed negotiation messages, including proposals, errors, and authentication steps. It is the most granular tool for troubleshooting IKE phase 1 and phase 2 issues. The output can be extensive, so it is often used with filters.

When creating an ADOM, you must specify the firmware version of the managed devices. This determines the available features and object models. For a new branch office with FortiGates running a specific firmware, you must select the correct version to ensure compatibility. This is a required step because FortiManager uses the version to format configuration and policies appropriately for the devices.

Phase 2 selectors define the local and remote subnets that are permitted through the IPsec tunnel. If traffic does not match these selectors, it is not encrypted or sent over the tunnel, effectively dropping it. This directly enforces the subnet restriction at the tunnel level.

A Device Group with a shared Policy Package lets FortiManager install one consistent configuration to all 50 FortiGates in a single coordinated push, avoiding per-device drift and reducing the window of inconsistent policy states that sequential individual installs would create.

In transparent mode, the FortiGate operates as a layer 2 bridge, forwarding frames based on MAC addresses. It inspects the traffic but does not perform NAT or routing, so IP addresses remain unchanged. This allows the FortiGate to be inserted into an existing network without changing IP addressing schemes, which is the desired behavior.

This command displays the checksums of the configuration for each HA cluster member. By comparing the checksums, the administrator can identify if the configurations are out of sync. It is the correct tool for verifying HA synchronization status.

Provisioning Templates in FortiManager are used to automatically apply a set of configuration settings to managed devices. They can include system settings, administrative accounts, and other baseline configurations. When a device is added to FortiManager, a provisioning template can be assigned to it, ensuring consistent base configuration. This is the correct feature for automating initial device setup.

Before upgrading, the firmware image must be available on FortiManager. The 'Import Firmware' option under Device Manager > Firmware allows uploading the image. This is a prerequisite for any upgrade, including staged rollouts. Without the image, the upgrade wizard cannot proceed.

Web mode allows users to access specific web applications through a portal without a full tunnel. It provides granular control because you can define which web servers are available in the portal. This meets the requirement of accessing only specific internal web servers, as each bookmark can be controlled.

Web Filter enforces URL and category-based policies using FortiGuard real-time threat intelligence, blocking malicious sites before content loads. It satisfies the stem's requirement to prevent internal users reaching malicious websites by inspecting HTTP/HTTPS requests against continuously updated FortiGuard classifications, unlike DNS Filter, which only resolves or blocks domain lookups.

When the FortiGate performs SSL inspection, it acts as a man-in-the-middle and generates certificates for each website on the fly, signed by its own CA certificate. To avoid certificate warnings, the client must trust this CA certificate. Installing the FortiGate's SSL inspection CA certificate on client endpoints ensures that the generated certificates are trusted, preventing browser warnings.

Host check enforces endpoint compliance before granting SSL VPN access, verifying antivirus status, OS patches and firewall settings on the connecting device. It satisfies the stem's constraint that only compliant corporate laptops may connect, blocking non-compliant or unmanaged endpoints at authentication.

FortiOS evaluates firewall policies sequentially from the top of the list to the bottom. The first policy that matches the traffic's source, destination, service, and other criteria is applied, and no further policies are evaluated. Therefore, more specific policies should be placed above more general ones to ensure they are matched first.

Creating administrator accounts with strong passwords and assigning appropriate profiles ensures that only authorized personnel can access FortiManager and that they have the necessary permissions. This is a fundamental step for access control and is required to meet the scenario's goal of restricting access to authorized users.

Install Preview generates the exact CLI script that FortiManager will push to the managed FortiGate during installation, including the sequence of config commands. This lets the administrator validate syntax, ordering, and object references before committing the change, which is precisely the requested pre-install validation step in this scenario.

FortiManager's firmware management allows administrators to schedule automatic download of firmware images from FortiGuard. By configuring a schedule, FortiManager can retrieve new firmware versions as they become available, storing them in the repository for later installation. This reduces manual effort and ensures that firmware is ready when needed, while still allowing controlled installation.

Phase 2 selectors, also known as quick mode selectors, define the source and destination subnets that are allowed to traverse the IPsec tunnel. By configuring the local and remote subnets as 10.0.0.0/24, only traffic between these subnets is encrypted. This directly meets the requirement to encrypt only that specific subnet's traffic.

Firmware Management in Device Manager pushes signed images to managed FortiGates over the FGFM tunnel, letting the administrator schedule upgrades across all 100 devices and revert to the previous firmware if a unit fails, satisfying the secure rollback requirement.

A multi-VDOM interface is a special interface type that can be assigned to multiple VDOMs simultaneously. Each VDOM gets its own logical instance of the interface, with separate IP addresses and routing. This is the intended FortiOS feature for sharing a single physical port across VDOMs.

FortiManager is designed to handle FortiGate reboots gracefully. After the FortiGate reboots, it will re-establish the management tunnel with FortiManager. FortiManager will then retrieve the current configuration and verify that the installed changes are present. This automatic reconnection and verification ensure that the management link is restored without manual intervention.

Provisioning templates in FortiManager allow administrators to define a set of configurations, including security profiles and firewall objects, that are automatically applied to devices when they are added or when the template is assigned. This ensures consistent configuration across new devices without manual intervention.

For route-based VPNs, the tunnel interface must be referenced in a firewall policy that permits traffic from the local subnet to the remote subnet, with the tunnel interface as the outgoing interface. Without this policy, the FortiGate will not encrypt traffic and may fall back to another route, sending it unencrypted.

The command 'execute backup config usb' is used to back up the current configuration to a USB drive connected to the FortiGate. This command is available in the CLI and will save the configuration file to the USB storage. It is the correct method for backing up to USB, provided the USB drive is properly formatted and inserted. This meets the administrator's requirement.

Role-based administration in FortiManager allows creating administrator accounts with specific permissions. By assigning an administrator profile that grants read-write access only to the policy package of the specific FortiGate, the regional team can manage firewall policies without access to system settings or other devices. This meets the delegation requirement while retaining overall control.

Provisioning Templates in FortiManager allow administrators to define a set of configuration settings that can be automatically applied to a FortiGate when it is added or when the template is assigned. This includes interface settings, static routes, and administrative accounts. This feature is designed for automated initial configuration, making it the correct choice.

The Add Device wizard in FortiManager is the correct starting point. It allows the administrator to specify the device's IP address, credentials, and the ADOM to which it should belong. Once added, the device is managed and its policies can be viewed and modified. This is the essential first step for integrating a FortiGate into FortiManager.

Inter-VDOM links create a dedicated virtual interface pair connecting two VDOMs, enabling traffic to route and be inspected by firewall policies between them. This satisfies the requirement to inspect inter-VDOM traffic, since VDOMs otherwise remain isolated and cannot pass traffic for policy enforcement without such a link.

User certificates are stored within the FortiGate configuration file, including imported local certificates and their associated private keys used for VPN or inspection. They are therefore captured in configuration backups and restored alongside other settings.

AES-NI is a CPU instruction set that offloads AES encryption from software to dedicated silicon. Selecting AES-NI supported ciphers lets the FortiGate encrypt and decrypt IPsec payloads far faster, raising throughput and lowering CPU load versus software-only cipher processing.

For deep inspection, the FortiGate re-signs server certificates with a certificate generated by a CA. For clients to trust this re-signed certificate without warnings, the CA certificate must be installed in the clients' trusted root store. This allows the client to verify the signature and establish trust, preventing warnings when the FortiGate intercepts SSL traffic.

When adding an HA cluster to FortiManager, you add the cluster using the primary unit's serial number. FortiManager recognizes the HA configuration and manages the cluster as a single entity. When installing policies, FortiManager pushes the configuration to the primary, which then synchronizes to the secondary units. This ensures both units receive the configuration.

By default, administrative access protocols are disabled on WAN interfaces for security. Enabling HTTPS administrative access on the WAN interface specifically allows remote management via HTTPS. This is a deliberate configuration step that must be performed, and it is often combined with restricting trusted hosts to limit exposure.

Dynamic objects in FortiManager allow you to define objects whose values are resolved at install time based on the FortiGate's own configuration. For example, you can create a dynamic object that represents the WAN interface IP address, and FortiManager will automatically substitute the correct IP for each device when the policy is installed. This ensures that the same policy can be used across devices with different WAN IPs without manual per-device edits.

Protect mode actively blocks matching traffic by dropping packets inline, while Monitor mode permits all matching traffic to pass and records events for analysis. This satisfies the stem's requirement to distinguish the two IPS sensor actions: enforcement versus visibility only, with no traffic disruption in Monitor.

Importing the configuration pulls the FortiGate's running configuration into FortiManager, creating the device database and policy package baseline. This is the standard step after adding a device so that FortiManager reflects the current state and can manage it. Once imported, subsequent changes can be made centrally and installed back to the device.