NSE 7 - Enterprise Firewall (NSE7_EFW) (NSE7_EFW) — Questions 76–150

Mode-config is used in dial-up IPsec VPNs to assign IP addresses to remote peers. By specifying an IP pool, each connecting FortiClient receives an address from that pool, which can then be used in firewall policies to control access to internal subnets. This is the correct method to meet the requirement of dedicated IP assignment.

This command displays sessions that are offloaded to the NP6 processor. It provides details such as the session ID, protocol, and offload status. This is the most direct way to verify which sessions are being accelerated by the NP6 and thus bypassing the CPU. The administrator can use this to confirm if traffic is offloaded and troubleshoot why security profiles are not applied.

SSL inspection requires the FortiGate's inspection CA certificate, not the server's, to be trusted on endpoints. Installing this CA lets the FortiGate re-sign intercepted sessions, so browsers validate the substituted certificate and no warning appears.

The 'Source IP' load-balancing algorithm in SD-WAN distributes traffic based on the source IP address. All sessions from the same source IP will use the same link, providing session persistence. This is ideal for scenarios where you want to avoid breaking sessions that may not handle mid-session link changes well. It is a simple and effective method for load balancing while maintaining consistency per source.

In a VDOM-enabled FortiGate, administrator accounts can be bound to individual VDOMs, limiting each admin's visibility and configuration rights to those virtual domains. This scoping satisfies the stem's requirement for how accounts are managed across multiple VDOMs.

FortiManager processes each device in the install scope independently. Online FortiGates receive the compiled configuration and move to a synchronized state, while the unreachable device fails or is skipped and remains flagged as out of sync. When it reconnects, the administrator can install again to bring it current.

In FortiManager, managed FortiGate clusters are treated as a single device. Firewall policies are installed on the cluster as a whole, and the cluster synchronizes the configuration to all units. There is no mechanism to install a policy only on the primary unit. The primary unit is responsible for synchronizing configuration to secondary units. Therefore, it is not possible to target a policy to only the primary unit; the policy will be present on all units.

Administrator Profiles bundle granular permissions, including read-only access to logs and reports, and are assigned to the junior member's account. This satisfies the stem's least-privilege requirement, restricting the user to viewing without granting configuration or deployment rights.

The Global Database in FortiManager is designed to hold objects that can be shared across multiple ADOMs. By creating objects there, they become available for assignment to any ADOM. This is the first step to enable cross-ADOM object sharing. Without this, objects are confined to a single ADOM and cannot be used elsewhere.

An ADOM partitions FortiManager into independent administrative domains, each holding its own devices, policies and objects. This satisfies the delegated administration constraint: administrators gain scoped access to only their assigned ADOM, while policy packages and objects remain isolated from other domains.

This is correct because placing each tenant's devices in a separate ADOM is the fundamental way to achieve isolation. ADOMs are logical containers that separate devices, policies, and objects. By assigning the tenant's administrative user to only their ADOM, they cannot see or modify other ADOMs, ensuring tenant isolation.

Switching from no-vdom to multi-vdom restructures the entire configuration into multiple virtual domains, a fundamental change to how policies, interfaces and routing are stored, so FortiGate requires a reboot before the new mode takes effect.

Security Fabric links FortiGates and fabric-connected devices so they synchronise policies and share threat intelligence automatically. This satisfies the requirement for centralised, coordinated enforcement across the estate, rather than each device operating in isolation with its own local configuration.

Configuration revision in FortiManager automatically saves a copy of the device configuration each time it is changed and installed. It allows administrators to view, compare, and revert to previous revisions. Enabling this feature ensures daily backups are taken when changes occur, and provides a rollback mechanism.

Policy lookup is a tool in the FortiGate GUI and CLI that allows administrators to simulate a traffic flow by specifying source, destination, and service. It then shows which policy would match, or if no policy matches. This directly helps troubleshoot policy ordering issues by revealing the matching policy for specific traffic parameters.

This command sequence enables logging to FortiAnalyzer and specifies the server IP address. It is the correct syntax under the 'config log fortianalyzer setting' context. The 'set status enable' activates the feature, and 'set server' defines the FortiAnalyzer's IP.

Device detection must be enabled on the interfaces that connect to other fabric devices. This allows the FortiGate to discover FortiSwitches, FortiAPs, and other FortiGates. Without device detection, the root FortiGate cannot automatically identify and authorize new devices. This is a critical step for automatic discovery.

Link aggregation distributes traffic based on a hashing algorithm, which typically uses source and destination IP addresses, and sometimes Layer 4 ports. If the traffic is a single flow (same source and destination IP and ports), all packets will hash to the same link, causing imbalance. This is a common limitation of link aggregation; it does not load-balance per-packet but per-flow. To achieve better distribution, multiple flows with varying IPs/ports are needed.

The Install Wizard in FortiManager pushes the current configuration from FortiManager to the selected managed devices. It compares the FortiManager configuration with the device configuration and installs the changes, ensuring all devices are synchronized. This is the intended method for distributing configuration without logging into each FortiGate individually.

In Advanced ADOM mode, FortiManager supports ADOM assignment rules that can automatically assign devices to specific ADOMs based on criteria such as model and firmware version. This allows for automated placement of new FortiGates into the correct ADOM without manual intervention, meeting the scenario's requirement.

Provisioning Templates let you define a device-level model, then assign it to a FortiGate serial number before the unit ever contacts FortiManager. When the FortiGate first registers, FortiManager automatically pushes the pre-staged configuration, satisfying the requirement to pre-configure devices prior to network connection.

This command queries the FortiGate routing table and returns the matching route plus its detail for the specified destination IP, confirming which interface and gateway traffic will use. That directly satisfies the connectivity troubleshooting requirement.

In a dial-up VPN with multiple phase-1 interfaces, the FortiGate selects the gateway based on the peer ID sent by the client. If the peer ID does not match any configured remote gateway, the FortiGate cannot associate the connection with the correct PSK, resulting in the 'no matching gateway' error. The user must configure the correct peer ID on the client to match the server's phase-1 configuration.

The command get router info routing-table all displays the complete routing table, and when executed within a specific VDOM context it returns that VDOM's routes. This satisfies the requirement to view the current routing table for a specific VDOM rather than the management or global routing instance.

SSL/TLS decryption and deep inspection are CPU-intensive tasks that are not offloaded to the NP6 processor. The NP6 handles basic firewall functions like forwarding, NAT, and some IPS, but encrypted traffic must be decrypted and inspected by the CPU. This can cause significant CPU load, especially with high volumes of HTTPS traffic.

Release notes document the supported upgrade path, firmware compatibility, and known issues for the target FortiOS version. Reviewing them before upgrading confirms the HA cluster can move between versions without breaking synchronisation or clustering behaviour.

FortiGate always uses the CPU for the first packet to perform routing, policy lookup, and session creation. Only after the session is established is it offloaded to the NP6. The administrator's observation is correct and expected; no configuration change is needed. This is a core concept of NP offload architecture.

In transparent mode, broadcast forwarding is a global setting that, when enabled, allows the FortiGate to forward broadcast packets received on one interface to all other interfaces except the ingress interface. This is essential for protocols like DHCP to function across the FortiGate. The setting is found under System > Network > Interfaces, but it applies globally to all interfaces. This matches the requirement to allow DHCP broadcasts.

A VDOM link is a virtual point-to-point connection internal to the FortiGate. Assigning each end to a VDOM and adding policies that reference the vlink interfaces enables direct inter-VDOM routing without external hardware. This is the standard method to allow traffic between VDOMs on the same device.

This is correct because a VDOM link is a virtual point-to-point connection that connects two VDOMs. You must assign IP addresses to both ends of the link, then create firewall policies in each VDOM to allow traffic to traverse the link. This allows the 'root' VDOM to inspect the traffic with its own policies, satisfying the requirement.

The 'Retrieve Config' action pulls the current configuration from the managed FortiGate into FortiManager, updating the device-level database. This allows the administrator to see the actual running configuration and compare it with the policy package. It is essential for identifying configuration drift and deciding whether to import changes or overwrite them.

An ADOM (Administrative Domain) is the primary construct in FortiManager for isolating devices, policies, and objects. Each ADOM has its own database, and devices within an ADOM cannot see or affect devices in another ADOM. This makes ADOMs ideal for multi-tenant environments where complete separation is required.

This is correct because importing the configuration allows FortiManager to retrieve the current device settings, including the CLI changes. The administrator can then review the differences, decide which changes to keep, and update the policy package accordingly. This ensures that FortiManager and the FortiGate are synchronized without losing valid local modifications.

Virtual MAC configuration lets an HA cluster present a single shared MAC address for its interfaces, so switches and hosts keep a consistent ARP mapping during failover. This prevents stale ARP cache entries pointing at the failed node, satisfying the stated requirement.

The Diff feature compares the FortiManager policy database against the managed device's running configuration, exposing the exact object or setting causing the conflict. This directly identifies the root cause of the policy installation failure rather than merely reporting that a mismatch exists.

A VDOM link creates a virtual point-to-point connection between two VDOMs. Traffic traversing this link can be inspected by firewall policies applied to the link's interfaces, enabling security profiles. This is the standard method for inter-VDOM inspection.

To authenticate against LDAP, the FortiGate needs an LDAP server object that includes the server address, port, and the credentials (bind DN and password) used to query the directory. The common name identifier (e.g., sAMAccountName) is also required to map the username. This object is then referenced in a user group. Without this, the FortiGate cannot bind to the LDAP server and search for users.

Inter-VDOM links are virtual point-to-point interfaces that allow traffic to be routed between VDOMs within the same FortiGate. By creating a pair of IVLs and assigning IP addresses, the FortiGate can apply security policies between the VDOMs. This is the standard method for inter-VDOM routing and inspection.

In FortiManager, changes to firewall policies are made in the policy package. To apply these changes to the managed FortiGate, the administrator must install the policy package. This process pushes the updated configuration to the device. Until the installation is performed, the FortiGate continues to use the previously installed policy set. This is the required step to activate the changes.

Active session tables synchronise between HA members so that established flows continue uninterrupted after a failover, satisfying the requirement for session continuity. FortiGate HA replicates session state across the heartbeat link, letting the secondary device forward existing traffic without re-establishing connections when it assumes the primary role.

This is correct because FortiManager administrative profiles allow granular control over permissions. By creating a custom profile with read-write access only to Firewall Objects and Policy & Objects, and assigning the user to the specific ADOM, the subordinate can manage addresses and policies without accessing other ADOMs or system settings. This follows the principle of least privilege.

This policy correctly matches traffic originating from the local subnet, entering the internal interface, and leaving through the VPN tunnel interface. It restricts the service to HTTP and HTTPS, which meets the requirement. With route-based VPN, the tunnel interface is used as the outgoing interface, and source/destination addresses are the local and remote subnets respectively.

Retrieving the configuration from the FortiGate pulls the current configuration from the device into FortiManager, updating FortiManager's database to match the device. This resolves the discrepancy by ensuring FortiManager reflects the actual configuration on the FortiGate, which is exactly what the administrator needs.

IKEv2 Phase 1 negotiates the IKE security association itself, and AES-256 is an encryption algorithm proposed and agreed in that exchange. It protects the control-plane messages, distinct from Phase 2 algorithms that secure actual tunnel traffic.

The 'config system global' command enters the global system configuration mode. Within this mode, you can set the hostname with 'set hostname', configure the administrative timeout with 'set admintimeout', and enable SSH on interfaces using 'set ssh-port' and other related settings. This is the correct starting point for these global system parameters.

The command 'diagnose ip route get <destination>' shows the exact route that the FortiGate will use for that destination, including the outgoing interface and gateway. It is the correct tool to verify routing decisions. This command is available in the FortiGate CLI and provides detailed information about the selected route.

Interface IP addresses and static routes are core network settings that must match across HA nodes. They are synchronized by default to ensure that after a failover, the new primary unit can immediately forward traffic using the same addressing and routing information without manual reconfiguration.

HTTP and HTTPS carry the bulk of web-borne attacks, including SQL injection, cross-site scripting and malicious downloads. IPS policies inspect these protocols because their request and response payloads expose exploitable content, making them primary signatures targets.

In a FortiGate firewall policy, you can enable logging to record traffic that matches the policy. This is done by enabling the 'Log Allowed Traffic' option and selecting whether to log all sessions or only security events. Enabling logging in the policy settings is the correct action to log traffic for that specific policy. Without this, no logs will be generated for the allowed traffic.

The 'Any' interface is a wildcard zone object that matches packets irrespective of which physical or logical interface they arrive on or leave through. It lets a single policy rule cover traffic across all interfaces, removing the need to enumerate each ingress and egress pair explicitly.

Importing a standalone FortiGate creates a new Policy Package containing its existing firewall policies, preserving their order and object references. This satisfies the migration constraint: the device's configuration is absorbed into FortiManager's centralised policy model rather than discarded, so the administrator can subsequently manage and push those policies from FortiManager.

The FortiGate must be configured with the FortiManager's IP address or hostname under Central Management. This tells the FortiGate where to send registration requests and from where to accept management commands. This setting is essential for the initial connection and ongoing communication between the FortiGate and FortiManager.

Provisioning Templates in FortiManager allow administrators to define and push standardized configurations to managed FortiGates. They can include system settings like DNS, NTP, and other administrative parameters. When a new device is added, the template can be automatically applied, ensuring consistent base configuration. This is the primary method for automating initial device setup and meeting the requirement.

Address objects form part of the configuration table synchronised across an HA cluster, ensuring both units resolve the same IP addresses and subnets in policy. This keeps firewall rules consistent so failover does not alter traffic handling.

The firewall policy handling outbound traffic must have an SSL inspection profile applied. This profile determines the inspection mode (deep or certificate inspection) and the protected domains. Without enabling SSL inspection on the policy, the FortiGate will not intercept and inspect HTTPS traffic, and no certificate re-signing occurs.

ADOMs are administrative domains that logically separate devices, policies, and objects. By placing each HA cluster in its own ADOM, the administrator ensures that policies and objects are isolated, and installation targets only the devices within that ADOM. This prevents accidental policy pushes to the other cluster and maintains independence, which is exactly what the scenario requires.

In Monitor mode, the IPS sensor does not block traffic; it only generates logs for detected attacks. To block traffic, the sensor must be in Protect mode. The administrator observed that traffic is allowed, which aligns with Monitor mode behavior. Changing the sensor to Protect mode would enforce blocking. This is the correct explanation for the observed behavior.

Dedicated HA interfaces carry only synchronisation and heartbeat traffic between cluster members, keeping it off the data plane. This prevents production throughput from delaying or dropping heartbeat packets, satisfying the requirement for reliable failover detection without contending with user traffic.

The IPS buffer defines how much packet data is queued for inspection, so it caps the maximum packet size examined. Larger buffers let the engine reassemble and scan bigger payloads; smaller buffers drop or truncate oversized packets before pattern matching, affecting detection coverage.

To send alert emails, the FortiGate must be configured with an SMTP server address, port, and authentication if required. This is done under System Settings > Alert Email. Without a valid SMTP server, the FortiGate cannot send emails. The administrator must also specify sender and recipient addresses, but the SMTP server is the essential first step.

FortiManager's Global Object Database allows administrators to create and manage objects that can be shared across multiple ADOMs. When an object is created in the global database, it can be referenced in policies within any ADOM that has been configured to use global objects. This eliminates the need to duplicate objects in each ADOM, ensuring consistency and reducing administrative overhead.

By default, the FortiGate initiates the connection to FortiManager using the FortiManager protocol (FGFM) on TCP port 541. This outbound connection allows the FortiGate to register with FortiManager even if the FortiGate is behind NAT, because no inbound access to the FortiGate is required. This is the standard method for adding devices behind NAT.

Log forwarding must be enabled and correctly configured on the FortiGate itself before logs can reach FortiManager. Verifying that local configuration confirms whether the device is actually sending logs, isolating the fault at its source.

Administrator profiles in FortiManager define the permissions for administrative users, specifying which areas they can access and what actions they can perform. By assigning profiles, you can restrict users to read-only or limit them to specific ADOMs. This is the primary method to enforce role-based access control and ensure only authorized personnel can modify policies.

Source and destination criteria define which traffic the SD-WAN rule matches, using addresses, users, services and applications. Without these match objects the rule cannot identify flows to steer, so they are fundamental configurable fields when building an SD-WAN rule in FortiManager.

Device Manager displays managed FortiGate devices with their connection status to FortiManager, letting the administrator confirm whether the tunnel is up. This directly satisfies the requirement to verify the FortiGate-to-FortiManager link without inspecting logs elsewhere.

This command displays the routing table entry that matches the specified destination IP, including the outgoing interface and gateway. In this scenario, it helps confirm whether traffic to the remote subnet is routed through the IPsec tunnel interface or another path, which is critical for troubleshooting intermittent VPN traffic failures.

Locking policies for editing demands Workspace Mode because FortiManager must isolate each administrator's uncommitted changes in a private workspace before committing them to the shared ADOM database. Without it, concurrent edits would overwrite one another, so the lock workflow depends on that per-session staging layer.

The command 'execute backup config usb <filename>' correctly backs up the current configuration to a USB drive with the specified filename. This is the standard CLI syntax for backing up the configuration to an external USB device. The administrator must provide a filename, and the backup will be saved in the root directory of the USB drive.

In FortiGate HA, override is disabled by default, so a rebooted or recovered unit does not automatically reclaim the primary role. This satisfies the stem's default-behaviour constraint: priority values are ignored unless override is enabled, preventing unnecessary failovers and keeping the currently active primary stable.

The read_only administrator profile is a built-in profile that allows users to view configuration and monitor system status but prevents any changes. It is exactly designed for users who need to observe without modifying. Assigning this profile ensures the account can only view logs and status, meeting the requirement.

A redundant interface must have at least one physical member interface assigned. Without members, the interface has no active link and cannot pass traffic. The 'set member' command under the redundant interface configuration adds physical interfaces to the group, enabling failover and traffic forwarding.

A policy package in FortiManager is a container for firewall policies, objects, and other settings that can be assigned to one or more managed FortiGates. By creating a dedicated policy package, you can include the policy referencing the global address object and then assign that package only to the specific FortiGates you want. This ensures the policy is installed only on those devices, while other devices remain unaffected. This is the standard method for scoping policy deployment in FortiManager.

In transparent mode the FortiGate forwards frames by MAC address without routing. When the destination MAC is unknown, it floods the frame out all ports except the ingress port, exactly as a learning bridge does, until the address is learned.

In transparent mode, the FortiGate acts as a Layer 2 bridge. To inspect traffic, you must create a firewall policy that references the bridge interfaces (the pair) as source and destination. This policy can then have an IPS sensor applied. Without such a policy, traffic is not inspected. This is the correct approach.