How should I use these Scenario practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Scenario questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Scenario domain.

NSE7_EFW · topic practice

Scenario practice questions

Practise NSE 7 - Enterprise Firewall (NSE7_EFW) Scenario practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

7 questionsDomain: Scenario

Practice 10 questions Browse domain →

What the exam tests

What to know about Scenario

Scenario questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Scenario exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Scenario questions

7 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full VPN explanation →

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

Trap 1: To replace the AH protocol

UDP 4500 carries ESP-in-UDP encapsulated traffic and IKE negotiations once NAT-T is detected, not AH replacement. It is tempting because AH is incompatible with NAT, but the correct mechanism for that incompatibility is using ESP, not repurposing port 4500.

Trap 2: To manage Phase 1 re-keying

Phase 1 re-keying occurs over the IKE negotiation channel, which shifts to UDP 4500 under NAT-T, but re-keying is not the port's primary purpose. It is tempting because IKE does traverse 4500, yet the defining role is encapsulating ESP packets so NAT devices can translate them.

Trap 3: To verify certificate revocation status

Certificate revocation checking uses CRL or OCSP over HTTP, not UDP 4500. It is tempting because certificates authenticate peers during IKE, but revocation status is verified separately from the NAT-T encapsulation channel that port 4500 provides.

Study all Scenario common traps →

A
To replace the AH protocol
Why it fails: UDP 4500 carries ESP-in-UDP encapsulated traffic and IKE negotiations once NAT-T is detected, not AH replacement. It is tempting because AH is incompatible with NAT, but the correct mechanism for that incompatibility is using ESP, not repurposing port 4500.
B
To manage Phase 1 re-keying
Why it fails: Phase 1 re-keying occurs over the IKE negotiation channel, which shifts to UDP 4500 under NAT-T, but re-keying is not the port's primary purpose. It is tempting because IKE does traverse 4500, yet the defining role is encapsulating ESP packets so NAT devices can translate them.
C
To encapsulate ESP packets
UDP 4500 carries ESP packets encapsulated inside UDP datagrams, which is what NAT-Traversal requires. Because NAT devices cannot translate ESP (IP protocol 50) reliably, wrapping it in UDP 4500 lets the traffic traverse NAT boundaries while preserving confidentiality and integrity. This directly satisfies the NAT-T constraint in the stem.
D
To verify certificate revocation status
Why it fails: Certificate revocation checking uses CRL or OCSP over HTTP, not UDP 4500. It is tempting because certificates authenticate peers during IKE, but revocation status is verified separately from the NAT-T encapsulation channel that port 4500 provides.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Scenario explanation →

An administrator is using FortiManager to manage a FortiGate device. The administrator notices that the FortiGate's configuration has drifted from the FortiManager policy package. What is the most likely cause of this configuration drift?

Trap 1: FortiManager automatically updated the policy package without…

FortiManager does not automatically update policy packages without administrator action. Even if a policy package is updated in FortiManager, it must be installed to take effect on the device. Therefore, this would not cause drift; it would simply mean the device is not yet updated. Drift is caused by direct device changes.

Trap 2: The FortiManager administrator modified the policy package but did…

If the administrator modifies the policy package but does not install it, the FortiGate remains with the previous configuration. This does not cause drift; it simply means the new policy is pending installation. Drift occurs when the device is changed outside of FortiManager, not when FortiManager changes are not yet installed.

Trap 3: The FortiGate device was rebooted without saving its configuration.

A reboot without saving configuration would revert to the last saved configuration, which might be the one managed by FortiManager. This could cause a mismatch if the FortiManager policy was installed but not saved, but typically FortiManager installations are saved automatically. This is not a common cause of drift; direct changes are the primary cause.

Study all Scenario common traps →

A
FortiManager automatically updated the policy package without installing it.
Why it fails: FortiManager does not automatically update policy packages without administrator action. Even if a policy package is updated in FortiManager, it must be installed to take effect on the device. Therefore, this would not cause drift; it would simply mean the device is not yet updated. Drift is caused by direct device changes.
B
The FortiGate was configured directly via its CLI or GUI, bypassing FortiManager.
Configuration drift occurs when changes are made directly on the FortiGate device, either through CLI or GUI, without updating FortiManager. FortiManager is the central management point, and direct changes can cause the device configuration to differ from the policy package. To prevent drift, all changes should be made through FortiManager. The other options do not typically cause drift.
C
The FortiManager administrator modified the policy package but did not install it.
Why it fails: If the administrator modifies the policy package but does not install it, the FortiGate remains with the previous configuration. This does not cause drift; it simply means the new policy is pending installation. Drift occurs when the device is changed outside of FortiManager, not when FortiManager changes are not yet installed.
D
The FortiGate device was rebooted without saving its configuration.
Why it fails: A reboot without saving configuration would revert to the last saved configuration, which might be the one managed by FortiManager. This could cause a mismatch if the FortiManager policy was installed but not saved, but typically FortiManager installations are saved automatically. This is not a common cause of drift; direct changes are the primary cause.

Full breakdown with real-world context →

Question 3mediummulti select

Read the full Scenario explanation →

Which TWO of the following are valid methods for user authentication on a FortiGate?

Trap 1: BGP

BGP is a routing protocol that exchanges network reachability between autonomous systems; it carries no user identity or credential exchange, so it cannot authenticate anyone. It is tempting because BGP appears in FortiGate configuration for dynamic routing and SD-WAN, and it would be the correct choice when peering with routers rather than authenticating users.

Trap 2: IGMP

IGMP is a multicast group management protocol, carrying no user credentials and performing no authentication. It is tempting because it is a valid FortiGate-supported protocol, but for multicast traffic handling, not identity verification. Authentication requires methods such as LDAP, RADIUS, TACACS+ or local passwords.

Trap 3: RIP

RIP is a distance-vector routing protocol for exchanging network reachability, not a user authentication mechanism. It is tempting because it is a legitimate FortiGate feature, but it belongs in routing configuration. Authentication uses LDAP, RADIUS, TACACS+, Kerberos or local user databases.

Study all Scenario common traps →

A
BGP
Why it fails: BGP is a routing protocol that exchanges network reachability between autonomous systems; it carries no user identity or credential exchange, so it cannot authenticate anyone. It is tempting because BGP appears in FortiGate configuration for dynamic routing and SD-WAN, and it would be the correct choice when peering with routers rather than authenticating users.
B
RADIUS
RADIUS is a supported remote authentication protocol on FortiGate, letting the firewall forward user credentials to an external RADIUS server for validation. This satisfies the question's requirement for a valid user authentication method, alongside local and LDAP or TACACS+ options.
C
LDAP
LDAP lets the FortiGate query an external directory server directly for user credentials, satisfying the requirement for a valid authentication method. The FortiGate binds to the LDAP server and validates the supplied username and password against directory entries, unlike local password databases or certificate-based schemes.
D
IGMP
Why it fails: IGMP is a multicast group management protocol, carrying no user credentials and performing no authentication. It is tempting because it is a valid FortiGate-supported protocol, but for multicast traffic handling, not identity verification. Authentication requires methods such as LDAP, RADIUS, TACACS+ or local passwords.
E
RIP
Why it fails: RIP is a distance-vector routing protocol for exchanging network reachability, not a user authentication mechanism. It is tempting because it is a legitimate FortiGate feature, but it belongs in routing configuration. Authentication uses LDAP, RADIUS, TACACS+, Kerberos or local user databases.

Full breakdown with real-world context →

Question 4easymultiple choice

Read the full Scenario explanation →

An administrator is using FortiManager to manage a FortiGate. The administrator notices that the FortiGate's configuration in FortiManager is different from the actual configuration on the device. To resolve this, the administrator wants to update FortiManager with the current configuration from the FortiGate. Which action should the administrator take?

Trap 1: Import the FortiGate's configuration file manually.

Manually importing a configuration file is a cumbersome process and is typically used for initial setup or migration, not for synchronizing an already managed device. It would require exporting the configuration from the FortiGate and then importing it into FortiManager, which is unnecessary when a direct retrieve option exists.

Trap 2: Synchronize the ADOM with the FortiGate.

Synchronizing the ADOM is not a standard FortiManager operation for updating a single device's configuration. ADOM synchronization is not a feature that retrieves device configurations. The correct method is to retrieve the configuration directly from the device, not to synchronize the entire ADOM.

Trap 3: Install the policy package to the FortiGate.

Installing the policy package pushes the FortiManager configuration to the FortiGate, which would overwrite the FortiGate's current configuration with FortiManager's version. This is the opposite of what is needed; the administrator wants to retrieve the FortiGate's configuration into FortiManager, not push FortiManager's configuration to the device.

Study all Scenario common traps →

A
Import the FortiGate's configuration file manually.
Why it fails: Manually importing a configuration file is a cumbersome process and is typically used for initial setup or migration, not for synchronizing an already managed device. It would require exporting the configuration from the FortiGate and then importing it into FortiManager, which is unnecessary when a direct retrieve option exists.
B
Synchronize the ADOM with the FortiGate.
Why it fails: Synchronizing the ADOM is not a standard FortiManager operation for updating a single device's configuration. ADOM synchronization is not a feature that retrieves device configurations. The correct method is to retrieve the configuration directly from the device, not to synchronize the entire ADOM.
C
Install the policy package to the FortiGate.
Why it fails: Installing the policy package pushes the FortiManager configuration to the FortiGate, which would overwrite the FortiGate's current configuration with FortiManager's version. This is the opposite of what is needed; the administrator wants to retrieve the FortiGate's configuration into FortiManager, not push FortiManager's configuration to the device.
D
Retrieve the configuration from the FortiGate.
Retrieving the configuration from the FortiGate pulls the current configuration from the device into FortiManager, updating FortiManager's database to match the device. This resolves the discrepancy by ensuring FortiManager reflects the actual configuration on the FortiGate, which is exactly what the administrator needs.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full VPN explanation →

A FortiGate is configured with a route-based IPsec VPN to a remote peer. The tunnel is up, but users report that traffic to the remote subnet intermittently fails. You suspect that the VPN is not being used for all traffic because of a routing issue. Which FortiGate CLI command would you use to verify which route is selected for a specific destination IP address?

Trap 1: diagnose firewall iprope list <destination_ip>

This command lists the IP rope entries, which are used for policy routing and firewall session handling, not for checking the main routing table. While it can show policy routes, it does not directly answer which route is selected for a given destination IP in the main routing table, so it is not the best tool for this scenario.

Trap 2: show route-map <destination_ip>

This command is not valid on FortiGate. FortiGate does not use route-maps in the same way as some routers; route-maps are used in BGP and OSPF configurations, but 'show route-map' is not a command to check the active routing table. It would not help determine the selected route for a destination IP.

Trap 3: diagnose ip route list <destination_ip>

This command does not exist on FortiGate. The correct diagnostic commands for routing are under 'get router info routing-table' or 'diagnose ip route'. Using an invalid command would not provide the needed routing information, and it could mislead the administrator into thinking there is a routing problem when the command simply fails.

Study all Scenario common traps →

A
get router info routing-table details <destination_ip>
This command displays the routing table entry that matches the specified destination IP, including the outgoing interface and gateway. In this scenario, it helps confirm whether traffic to the remote subnet is routed through the IPsec tunnel interface or another path, which is critical for troubleshooting intermittent VPN traffic failures.
B
diagnose firewall iprope list <destination_ip>
Why it fails: This command lists the IP rope entries, which are used for policy routing and firewall session handling, not for checking the main routing table. While it can show policy routes, it does not directly answer which route is selected for a given destination IP in the main routing table, so it is not the best tool for this scenario.
C
show route-map <destination_ip>
Why it fails: This command is not valid on FortiGate. FortiGate does not use route-maps in the same way as some routers; route-maps are used in BGP and OSPF configurations, but 'show route-map' is not a command to check the active routing table. It would not help determine the selected route for a destination IP.
D
diagnose ip route list <destination_ip>
Why it fails: This command does not exist on FortiGate. The correct diagnostic commands for routing are under 'get router info routing-table' or 'diagnose ip route'. Using an invalid command would not provide the needed routing information, and it could mislead the administrator into thinking there is a routing problem when the command simply fails.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full VPN explanation →

A FortiGate is configured with an IPsec VPN to a remote peer. The administrator wants to ensure that only specific subnets are allowed over the tunnel, and that traffic from any other subnet is dropped. Which configuration element on the FortiGate directly enforces this?

Trap 1: Static routes with higher priority

Static routes determine path selection, not tunnel encryption or allowed subnets. They can direct traffic toward the tunnel, but they do not drop traffic from unauthorized subnets. Routing alone cannot enforce the specific subnet filter required here.

Trap 2: Firewall address objects

Firewall address objects are used in policies to match traffic, but they do not inherently restrict which subnets can traverse the IPsec tunnel. Without phase 2 selectors, traffic might still be routed incorrectly. Address objects alone do not enforce tunnel-level subnet restrictions.

Trap 3: IPsec phase 1 proposals

Phase 1 proposals define encryption and authentication algorithms for the IKE negotiation, not the subnets allowed through the tunnel. They are essential for establishing the VPN but do not control which traffic is permitted over it. Subnet filtering is handled at phase 2.

Study all Scenario common traps →

A
Static routes with higher priority
Why it fails: Static routes determine path selection, not tunnel encryption or allowed subnets. They can direct traffic toward the tunnel, but they do not drop traffic from unauthorized subnets. Routing alone cannot enforce the specific subnet filter required here.
B
Firewall address objects
Why it fails: Firewall address objects are used in policies to match traffic, but they do not inherently restrict which subnets can traverse the IPsec tunnel. Without phase 2 selectors, traffic might still be routed incorrectly. Address objects alone do not enforce tunnel-level subnet restrictions.
C
IPsec phase 1 proposals
Why it fails: Phase 1 proposals define encryption and authentication algorithms for the IKE negotiation, not the subnets allowed through the tunnel. They are essential for establishing the VPN but do not control which traffic is permitted over it. Subnet filtering is handled at phase 2.
D
Phase 2 selectors
Phase 2 selectors define the local and remote subnets that are permitted through the IPsec tunnel. If traffic does not match these selectors, it is not encrypted or sent over the tunnel, effectively dropping it. This directly enforces the subnet restriction at the tunnel level.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full Scenario explanation →

A security administrator is using FortiManager to manage a large number of FortiGates. The administrator needs to ensure that when a new FortiGate is added to FortiManager, it automatically receives a base configuration including system settings and administrative accounts. Which FortiManager feature should be used?

Trap 1: Device Groups

Device Groups are used to logically group devices for policy assignment and monitoring, but they do not automatically push configuration to new devices. They are a means of organizing devices, not a provisioning tool. While policies can be assigned to device groups, system settings and administrative accounts are not handled through device groups.

Trap 2: Policy Packages

Policy Packages are used to define firewall policies, security profiles, and related objects, but they do not include system-level settings like administrative accounts or interface configurations. While policy packages are essential for security enforcement, they do not provide the base system configuration required here. They are applied after the device is provisioned.

Trap 3: ADOM Revisions

ADOM Revisions are snapshots of the entire ADOM configuration, used for backup and rollback. They are not a mechanism to automatically apply configuration to new devices. While revisions can be used to restore an ADOM to a previous state, they do not target individual new devices or provide a template-based approach for initial provisioning.

Study all Scenario common traps →

A
Device Groups
Why it fails: Device Groups are used to logically group devices for policy assignment and monitoring, but they do not automatically push configuration to new devices. They are a means of organizing devices, not a provisioning tool. While policies can be assigned to device groups, system settings and administrative accounts are not handled through device groups.
B
Policy Packages
Why it fails: Policy Packages are used to define firewall policies, security profiles, and related objects, but they do not include system-level settings like administrative accounts or interface configurations. While policy packages are essential for security enforcement, they do not provide the base system configuration required here. They are applied after the device is provisioned.
C
Provisioning Templates
Provisioning Templates in FortiManager are used to automatically apply a set of configuration settings to managed devices. They can include system settings, administrative accounts, and other baseline configurations. When a device is added to FortiManager, a provisioning template can be assigned to it, ensuring consistent base configuration. This is the correct feature for automating initial device setup.
D
ADOM Revisions
Why it fails: ADOM Revisions are snapshots of the entire ADOM configuration, used for backup and rollback. They are not a mechanism to automatically apply configuration to new devices. While revisions can be used to restore an ADOM to a previous state, they do not target individual new devices or provide a template-based approach for initial provisioning.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Scenario sessions

Start a Scenario only practice session

Every question in these sessions is drawn from the Scenario domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Scenario questions →Mixed NSE7_EFW session

Frequently asked questions

What does the NSE7_EFW exam test about Scenario?: Scenario questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Scenario questions in a focused session?: Yes — the session launcher on this page draws every question from the Scenario domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other NSE7_EFW topics?: Use the topic links above to move to related areas, or go back to the NSE7_EFW question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the NSE7_EFW exam covers. They are not copied from any real exam or dump site.

Scenario only

10 questions 20 questions 30 questions 50 questions

Mixed NSE7_EFW session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All NSE7_EFW questions Scenario domain overview NSE7_EFW exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Scenario practice questions

What to know about Scenario

Common Scenario exam traps

Scenario questions

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

An administrator is using FortiManager to manage a FortiGate device. The administrator notices that the FortiGate's configuration has drifted from the FortiManager policy package. What is the most likely cause of this configuration drift?

Which TWO of the following are valid methods for user authentication on a FortiGate?

A FortiGate is configured with an IPsec VPN to a remote peer. The administrator wants to ensure that only specific subnets are allowed over the tunnel, and that traffic from any other subnet is dropped. Which configuration element on the FortiGate directly enforces this?

Track your progress over time

Start a Scenario only practice session

Related NSE7_EFW topic practice pages

System Configuration practice questions

Security And VPN practice questions

Central Management practice questions

NSE7_EFW fundamentals practice questions

NSE7_EFW scenario practice questions

NSE7_EFW troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid