NSE7_EFW Practice Questions

Question 1

An administrator wants to back up the configuration of a FortiGate to a USB drive connected to the device. Which CLI command should the administrator use to perform this backup?

Accepted Answer

execute backup config usb . The correct CLI command to back up the FortiGate configuration to a USB drive is 'execute backup config usb '. This command saves the configuration to the USB device with the specified filename. Other backup options include TFTP, FTP, and SCP, but USB is specifically for local USB drives.

Answer

execute backup config flash <filename>

Answer

execute backup config usb

Answer

execute backup config tftp

Question 2

A network administrator is configuring a new FortiGate and needs to set up an administrator account that can only view logs and monitor system status, without making any configuration changes. Which administrator profile should be assigned to this account?

Accepted Answer

read_only. The read_only administrator profile is specifically designed for users who need to monitor the FortiGate without making changes. It grants access to view system status, logs, and configuration but denies any modification privileges. This aligns with the requirement for an account that can only view logs and monitor status. The other profiles either grant too much access or none at all.

Answer

no_access

Answer

prof_admin

Answer

super_admin

Question 3

A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?

Accepted Answer

Flood to all ports. In transparent mode, a FortiGate acts as a Layer 2 bridge and does not participate in routing. When it receives a frame destined for a MAC address not present in its forwarding table, it behaves like a standard Layer 2 switch and floods the frame out all ports in the same broadcast domain (except the ingress port). This ensures the frame can reach its intended destination if the MAC is simply unknown to the FortiGate.

Answer

Drop the packet

Answer

Forward to the management interface

Answer

Send an ICMP unreachable message

Question 4

A FortiGate is deployed in transparent mode between two routers. The administrator wants to enable IPS inspection on traffic passing through the FortiGate. Which configuration is required to inspect traffic in transparent mode?

Accepted Answer

Create a firewall policy with the incoming and outgoing interfaces set to the transparent bridge pair.. In transparent mode, the FortiGate bridges traffic between interfaces. To inspect traffic, a firewall policy must be created that allows traffic from one bridge interface to the other, with an IPS sensor applied. Interfaces do not have IPs, and IPS is not enabled globally or directly on interfaces. Thus, the policy-based approach is correct.

Answer

Assign IP addresses to the transparent interfaces and enable IPS on those interfaces.

Answer

Configure a VLAN interface for each subnet and apply IPS to the VLAN interfaces.

Answer

Enable IPS globally under System > Config > IPS and select the transparent bridge.

Question 5

A FortiGate is configured with a site-to-site IPsec VPN to a remote peer. The VPN is up, but traffic is not passing. You run 'diagnose vpn tunnel list' and see that the tunnel is up, but the phase-2 selectors show no traffic. You suspect a routing issue. Which command would you use to verify that traffic is being routed correctly through the tunnel?

Accepted Answer

get router info routing-table details . To verify that traffic to a specific destination is routed through the IPsec tunnel, you use the command 'get router info routing-table details '. This shows the exact route that will be used, including the outgoing interface. If the route points to the tunnel interface, routing is correct; if not, you must fix the routing configuration. This command is essential for troubleshooting VPN traffic flow.

Answer

diagnose vpn ike gateway list

Answer

diagnose ip route list

Answer

diagnose firewall iprope list

Question 6

An administrator manages multiple FortiGates in a single ADOM using normalized interfaces. A new policy must reference an interface that has different names on each device (port1 on one, wan1 on another). Which FortiManager object should the administrator use in the policy to ensure correct per-device mapping?

Accepted Answer

Normalized interface. Normalized interfaces provide a logical abstraction that FortiManager resolves to the correct physical interface per device using per-device mappings. This allows one shared policy to reference a stable name while each FortiGate receives the appropriate local interface, such as port1 or wan1, during installation. Zones, dynamic interfaces, and virtual wire pairs operate per device and do not deliver this cross-device mapping.

Answer

Zone

Answer

Virtual wire pair

Answer

Dynamic interface

Question 7

Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?

Accepted Answer

It uses fewer system resources than proxy-based inspection. Flow-based inspection is beneficial because it uses fewer system resources than proxy-based inspection (B): instead of buffering and reassembling full content in a proxy, it inspects packets as they stream through, so it consumes less CPU and memory. It also provides higher throughput performance (C), since the single-pass, stream-oriented engine avoids the store-and-forward overhead and per-protocol proxy processing that slows proxy-based mode. Options A and E are not flow-mode benefits: deep content inspection for all protocols and more granular application control are strengths associated with proxy-based inspection, which can buffer and fully decode traffic. Option D is incorrect because manual buffer allocation is not a requirement or benefit of flow-based inspection; buffering is largely handled automatically and minimized in this mode.

Answer

It supports deep content inspection for all protocols

Answer

It requires manual buffer allocation

Answer

It offers more granular application control

Question 8

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a policy change is made, it is properly validated and installed without causing downtime. Which TWO actions should be taken before installing the policy package? (Choose two.)

Accepted Answer

Review the installation preview to understand the changes. Before installing a policy package, it is essential to run a policy check to catch errors and to review the installation preview to see the exact changes. These steps help ensure that the installation will not cause unintended downtime or security issues. Other actions like workspace mode or scheduling are supplementary but not directly related to validation.

Answer

Schedule the installation during a maintenance window

Answer

Install the policy package to all devices simultaneously

Answer

Enable workspace mode to lock the ADOM

Question 9

Which TWO methods are used to achieve traffic separation in a multi-VDOM environment?

Accepted Answer

Using VLAN sub-interfaces. In a multi-VDOM FortiGate environment, traffic separation is achieved by assigning physical ports to VDOMs (option C), since each VDOM maintains its own independent routing table, firewall policies, and interfaces, so binding distinct physical interfaces to different VDOMs isolates their traffic at Layer 1/2. VLAN sub-interfaces (option A) also achieve traffic separation because a single physical interface can be partitioned into multiple VLAN-tagged sub-interfaces, each of which can be placed in a different VDOM, keeping the VLANs logically isolated even when they share the same physical link. Options B, D, and E do not provide traffic separation: SSL inspection is a security inspection feature, different HA clusters relate to redundancy/device grouping rather than intra-device VDOM traffic isolation, and differing firmware versions are irrelevant (and unsupported) for separating traffic within a multi-VDOM deployment.

Answer

Enabling SSL inspection globally

Answer

Using different HA clusters

Answer

Using different firmware versions

Question 10

Which method is the most secure for managing FortiGate devices remotely?

Accepted Answer

HTTPS with restricted access via Trusted Hosts. HTTPS with restricted access via Trusted Hosts is the most secure option because HTTPS encrypts administrative traffic (protecting credentials and configuration data in transit), and Trusted Hosts limits which source IP addresses or subnets can even attempt to connect to the management interface. This combination provides both confidentiality and access control.

Answer

HTTP with password authentication

Answer

Telnet

Answer

SNMPv1

Question 11

A FortiManager administrator is troubleshooting why a configuration change made directly on a managed FortiGate is not appearing in the FortiManager policy package. The administrator wants to retrieve the FortiGate's current configuration and compare it with the FortiManager database to identify the differences. Which action should the administrator take in FortiManager?

Accepted Answer

Run 'Retrieve Config' from the Device Manager. To identify configuration drift, the administrator must first retrieve the current configuration from the FortiGate into FortiManager. The 'Retrieve Config' action in Device Manager performs this synchronization, updating the FortiManager database with the device's actual settings. Once retrieved, the administrator can compare the device-level configuration with the policy package to see differences and decide on remediation.

Answer

Enable 'Auto-Update' on the device in FortiManager

Answer

Run 'Import Configuration' from the Policy & Objects

Answer

Use the 'Install Wizard' to push the FortiManager configuration to the device

Question 12

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

Accepted Answer

To encapsulate ESP packets. UDP port 4500 is used for NAT-Traversal (NAT-T) to encapsulate ESP packets within UDP. This allows IPsec traffic to pass through NAT devices that would otherwise drop ESP packets.

Answer

To replace the AH protocol

Answer

To manage Phase 1 re-keying

Answer

To verify certificate revocation status

Question 13

An administrator needs to configure a FortiGate to send logs to a FortiAnalyzer device. The FortiAnalyzer is reachable via the management interface. Which CLI command sequence correctly configures the FortiGate to send logs to the FortiAnalyzer?

Accepted Answer

config log fortianalyzer setting; set status enable; set server 10.1.1.100; end. The correct CLI sequence is under 'config log fortianalyzer setting', where you enable the status and specify the server IP. Other options configure different logging destinations or disable the feature. This ensures logs are sent to the FortiAnalyzer for analysis and archiving.

Answer

config log syslogd setting; set status enable; set server 10.1.1.100; end

Answer

config log fortianalyzer setting; set status disable; set server 10.1.1.100; end

Answer

config log memory setting; set status enable; set server 10.1.1.100; end

Question 14

An administrator is using FortiManager to manage a FortiGate device. The administrator notices that the FortiGate's configuration has drifted from the FortiManager policy package. What is the most likely cause of this configuration drift?

Accepted Answer

The FortiGate was configured directly via its CLI or GUI, bypassing FortiManager.. Configuration drift happens when the FortiGate's running configuration differs from the FortiManager policy package. The most common cause is direct configuration changes on the FortiGate, bypassing FortiManager. To maintain consistency, all changes should be made through FortiManager. Other scenarios like pending installations or reboots do not typically cause drift.

Answer

FortiManager automatically updated the policy package without installing it.

Answer

The FortiManager administrator modified the policy package but did not install it.

Answer

The FortiGate device was rebooted without saving its configuration.

Question 15

An administrator is configuring SSL inspection on a FortiGate to inspect traffic to a web server that uses a certificate signed by an internal CA. The FortiGate must decrypt and inspect the traffic without generating certificate errors on client browsers. What must be installed on the client devices?

Accepted Answer

The FortiGate's SSL inspection CA certificate. During SSL inspection, the FortiGate acts as a man-in-the-middle, presenting its own certificate to the client. To avoid certificate warnings, the client must trust the FortiGate's SSL inspection CA. Installing this CA certificate on client devices establishes that trust, allowing seamless inspection without errors.

Answer

A client certificate issued by the internal CA

Answer

The internal CA's root certificate

Answer

The web server's SSL certificate

NSE 7 - Enterprise Firewall NSE7_EFW practice test

Three ways to study

Study NSE7_EFW by domain

Study NSE7_EFW by topic

System Configuration practice questions

Security And VPN practice questions

Central Management practice questions

NSE7_EFW fundamentals practice questions

NSE7_EFW scenario practice questions

NSE7_EFW troubleshooting practice questions

NSE 7 - Enterprise Firewall (NSE7_EFW) practice questions