Courseiva

CCNA Nse7 Enterprise Firewall Central Management Questions

24 questions · Nse7 Enterprise Firewall Central Management · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

You are managing FortiGates across multiple ADOMs. How can you share common firewall objects (e.g., mail servers, common IP ranges) across these ADOMs?

A.Create objects in the Global Database
B.Manually copy objects to each ADOM
C.Use the API to script the creation in every ADOM
D.Enable 'Object Sharing' in system settings
AnswerA

Objects created in the Global Database are inherited by every ADOM, so common firewall addresses and services are defined once and referenced everywhere. This satisfies the cross-ADOM sharing requirement without duplicating objects in each ADOM, though per-ADOM objects cannot be shared upward.

Why this answer

In FortiManager, the Global Database (Global ADOM) is the designated object space for creating firewall objects that must be shared across multiple ADOMs. Objects defined there can be referenced by policies in any ADOM, providing a single source of truth for common items like mail servers and IP ranges.

Exam trap

The trap is assuming there is a per-ADOM sharing setting or that scripting is the intended solution; Fortinet exams test knowledge of the Global Database as the native cross-ADOM object mechanism.

How to eliminate wrong answers

Option B is wrong because manually copying objects into each ADOM creates duplication and drift, defeating the purpose of centralized management. Option C is wrong because scripting object creation via the API in every ADOM still results in duplicated objects and does not provide native cross-ADOM sharing. Option D is wrong because there is no 'Object Sharing' toggle in system settings that enables cross-ADOM object reuse; the correct mechanism is the Global Database.

Practice this question →
2
Multi-Selectmedium

Which TWO options are available when configuring an SD-WAN rule in FortiManager?

Select 2 answers
A.Interface physical speed
B.Source/Destination criteria
C.Traffic steering strategy
D.MAC address spoofing
E.Hardware acceleration toggle
AnswersB, C

Source and destination criteria are configurable match conditions within an SD-WAN rule, letting administrators scope traffic by subnet, address object or geography before applying the rule. This satisfies the stem's requirement for available SD-WAN rule options in FortiManager, alongside other match fields such as application, service and DSCP.

Why this answer

In FortiManager, an SD-WAN rule (the equivalent of a policy route within the SD-WAN zone) is defined primarily by matching traffic through source/destination criteria, so option B is correct: you specify source addresses, destination addresses, users, services, and applications to identify which traffic the rule applies to. Option C is also correct because every SD-WAN rule must select a traffic steering strategy — such as best quality, lowest cost, maximize bandwidth (SLA), or manual — which determines how the rule chooses among the SD-WAN members. Option A is not a configurable match or action in an SD-WAN rule; interface speed is a link attribute used by some steering strategies but is not itself a rule setting.

Option D is incorrect because MAC address spoofing is not a FortiManager SD-WAN rule parameter. Option E is incorrect because hardware acceleration is a per-firewall-policy/interface setting, not an SD-WAN rule configuration option.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between SD-WAN rule components and unrelated interface or security settings, so candidates may mistakenly select options like interface speed or hardware acceleration, which are not part of the rule configuration.

Practice this question →
3
MCQhard

An administrator is migrating a standalone FortiGate into an existing FortiManager. What happens to the existing firewall policies on the FortiGate during the import process?

A.They are moved to a 'Disabled' state
B.They are deleted to ensure a clean slate
C.They are merged into the Global Policy
D.They are imported and converted into a Policy Package
AnswerD

During import, FortiManager reads the standalone FortiGate's configuration and converts its firewall policies into a managed Policy Package. This satisfies the migration requirement, since the existing policies are preserved as a package rather than discarded or left unmanaged.

Why this answer

When importing a standalone FortiGate into FortiManager, the existing firewall policies are imported and converted into a Policy Package within the ADOM. FortiManager creates a policy package named after the device (or a chosen name) containing the imported policies, objects, and interfaces, so the device can then be managed centrally. The policies are not deleted or disabled; they become the managed baseline.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the misconception that importing a device deletes or disables its policies; in reality, they are imported and converted into a managed policy package.

How to eliminate wrong answers

Option A is wrong because policies are not moved to a Disabled state during import; they remain active and are represented in the policy package. Option B is wrong because import does not delete policies — deletion would break the device's security posture and is not part of the import workflow. Option C is wrong because Global Policy is a separate ADOM-level feature for shared policies across multiple devices; import does not merge device policies into Global Policy automatically.

Practice this question →
4
MCQhard

An administrator notices that logs are not appearing in FortiManager for a specific FortiGate. What is the first thing to check to ensure log forwarding is active?

A.The FortiManager license
B.The device's physical connection
C.Log forwarding configuration on the FortiGate
D.The firmware version of the FortiGate
AnswerC

Log forwarding must be configured on the FortiGate itself, specifying FortiManager as the remote log server, before any logs can reach it. Checking this setting first confirms whether the source device is actually sending logs.

Why this answer

When logs are missing in FortiManager for a specific FortiGate, the first thing to verify is the log forwarding configuration on the FortiGate itself. FortiManager receives logs only if the FortiGate is configured to send them — either via 'config log fortianalyzer setting' (if FortiManager hosts FortiAnalyzer features) or through the Fabric/central management settings. If log forwarding is disabled or misconfigured (wrong FortiManager IP, disabled logging), no logs will appear regardless of other factors.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the troubleshooting sequence — the trap is jumping to licensing or firmware (complex causes) instead of first verifying the basic log forwarding configuration on the source device, which is the most common and easily overlooked cause.

How to eliminate wrong answers

Option A is wrong because a FortiManager license issue would typically affect all managed devices or specific features, not just one FortiGate's logs — and licensing is not the first troubleshooting step when a single device's logs are missing. Option B is wrong because a physical connection issue would prevent FortiManager from managing the device at all (no policy pushes, no status), not just log forwarding; also, management connectivity is usually verified before log troubleshooting. Option D is wrong because firmware version mismatches may cause compatibility issues but would not selectively stop log forwarding for one device if the device is otherwise managed; firmware is checked after basic configuration.

Practice this question →
5
MCQmedium

What is the benefit of using 'CLI Templates' in FortiManager?

A.They replace the GUI completely
B.They convert the policy to a CLI script
C.They allow applying configuration commands to multiple devices
D.They improve the FortiGate hardware performance
AnswerC

CLI Templates in FortiManager store reusable command snippets that can be assigned to multiple managed devices, pushing identical configuration without manual repetition. This satisfies the stem's requirement by enabling consistent, bulk command deployment across device groups.

Why this answer

CLI Templates in FortiManager are reusable sets of CLI commands that can be assigned to device groups or individual devices, enabling consistent configuration across many FortiGates at once. They are a provisioning and standardization tool, not a GUI replacement or performance enhancer. This makes bulk changes efficient and reduces human error.

Exam trap

The trap is assuming CLI Templates are about converting policies or boosting performance, when they are actually a bulk configuration-deployment mechanism for multiple devices.

How to eliminate wrong answers

Option A is wrong because CLI Templates complement the GUI; they do not replace it, and FortiManager still uses the GUI for most management tasks. Option B is wrong because converting a policy to a CLI script is a different feature (policy package installation or script export), not the purpose of CLI Templates. Option D is wrong because CLI Templates affect configuration, not hardware performance — no software template can improve FortiGate CPU or throughput.

Practice this question →
6
MCQeasy

Which component of FortiManager allows for the centralized management of firmware across multiple devices?

A.Policy Database
B.Device Templates
C.Log View
D.Firmware Management
AnswerD

Firmware Management centralises firmware deployment across managed devices, letting administrators stage images and push upgrades to device groups from one console. This directly satisfies the stem's requirement for centralised firmware control across multiple FortiGate units, rather than configuring each appliance individually.

Why this answer

Firmware Management is the FortiManager component that provides centralized firmware upgrade and downgrade capabilities across multiple FortiGate devices. It allows administrators to import firmware images, schedule upgrades, and monitor the firmware status of all managed devices from a single console.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the specific FortiManager module names, expecting candidates to distinguish Firmware Management from Policy Database, Device Templates, and Log View, which serve different purposes.

How to eliminate wrong answers

Option A is wrong because the Policy Database stores firewall policies and objects, not firmware images or upgrade tasks. Option B is wrong because Device Templates are used to provision configuration settings like interfaces and routing, not to manage firmware versions. Option C is wrong because Log View displays logs and events, not firmware management functions.

Practice this question →
7
MCQmedium

An administrator wants to use FortiManager to push a configuration change to 50 FortiGates simultaneously. Which method minimizes downtime and ensures consistency?

A.Create 50 separate ADOMs
B.Assign devices to a Device Group and push a common Policy Package
C.Connect to each FortiGate via SSH and run scripts
D.Enable 'Auto-Push' for every change
AnswerB

A Device Group with a shared Policy Package installs one consistent configuration across all 50 FortiGates in a single push, avoiding per-device drift and sequential edits. This satisfies the simultaneous, consistency-critical requirement while minimising downtime through centralised, atomic deployment.

Why this answer

Assigning the 50 FortiGates to a Device Group and pushing a common Policy Package lets FortiManager install the same consistent configuration to all devices in one operation. This minimizes downtime because the install is orchestrated centrally with a single revision, and it guarantees consistency since every device receives identical policy objects. It also avoids the human error inherent in per-device changes.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the difference between centralized policy push (Device Group + Policy Package) and per-device scripting, so candidates who value 'automation via SSH' over FortiManager's native orchestration pick the wrong answer.

How to eliminate wrong answers

Option A is wrong because creating 50 separate ADOMs fragments management, multiplies administrative overhead, and prevents a single consistent policy push — it is the opposite of consistency. Option C is wrong because connecting to each FortiGate via SSH and running scripts is manual, error-prone, and does not guarantee identical results across devices; it also risks downtime from typos or partial execution. Option D is wrong because enabling 'Auto-Push' for every change pushes each individual change immediately, which can cause inconsistent intermediate states and unexpected downtime rather than a controlled, atomic rollout.

Practice this question →
8
MCQhard

An administrator needs to perform a firmware upgrade on 100 FortiGates. Which feature in FortiManager allows this to be done securely with a rollback option?

A.Automated patch management
B.Manual script pushing
C.Firmware Management in Device Manager
D.Global Policy upgrade task
AnswerC

Firmware Management in Device Manager lets the administrator stage images and push upgrades to all 100 FortiGates in one coordinated task, satisfying the bulk-upgrade constraint. It retains the previous firmware per device, enabling rollback if an upgrade fails, which the scenario explicitly requires.

Why this answer

FortiManager's Firmware Management feature (found under Device Manager) allows administrators to upload firmware images, schedule upgrades, and perform bulk upgrades across multiple FortiGates. It includes a rollback option that can revert devices to a previous firmware version if the upgrade fails or causes issues. This is the secure, centralized method for upgrading many devices.

Exam trap

The trap is selecting generic-sounding options like 'Automated patch management' or 'Manual script pushing' — candidates must know the exact FortiManager feature name 'Firmware Management' and that it includes rollback, which scripts do not.

How to eliminate wrong answers

Option A is wrong because 'Automated patch management' is not a specific FortiManager feature name — while FortiManager can automate some tasks, the firmware upgrade feature is called Firmware Management. Option B is wrong because manually pushing scripts is not secure or efficient for 100 devices and does not provide a built-in rollback option. Option D is wrong because 'Global Policy upgrade task' is not a firmware upgrade feature — Global Policy is for managing policies across multiple ADOMs, not for firmware upgrades.

Practice this question →
9
MCQeasy

What is the result of 'Pushing' a policy package from FortiManager to a FortiGate?

A.The FortiGate policy is sent to the FortiManager
B.The policy is saved in a draft state on the FortiGate
C.The FortiManager policy is appended to the existing FortiGate policy
D.The FortiGate policy configuration is overwritten with the FortiManager version
AnswerD

Pushing a policy package installs the FortiManager policy package onto the FortiGate, replacing the device's local policy configuration with the FortiManager version. This satisfies the scenario: the FortiGate's policy configuration is overwritten, not merged or merely backed up.

Why this answer

When you push a policy package from FortiManager to a managed FortiGate, FortiManager installs its policy package configuration onto the device, replacing the corresponding firewall policy configuration on the FortiGate with the FortiManager version. This is the standard 'install' operation in the FortiManager workflow, and it overwrites the device-level policy configuration rather than merging or appending it. The FortiGate becomes a reflection of the FortiManager policy package for the policy-related objects that are pushed.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the direction and effect of FortiManager operations, trapping candidates who confuse 'push/install' (FortiManager to FortiGate, overwriting device config) with 'import/retrieve' (FortiGate to FortiManager) or who assume policies are merged rather than replaced.

How to eliminate wrong answers

Option A is wrong because it describes the reverse direction — retrieving or importing configuration from the FortiGate into FortiManager, not pushing from FortiManager to the FortiGate. Option B is wrong because FortiManager does not push policies into a draft state on the FortiGate; draft or pending states exist within FortiManager's workflow (e.g., policy package status), not as a device-side draft of the pushed policy. Option C is wrong because FortiManager does not append its policy package to the existing FortiGate policy; installation replaces the relevant policy configuration rather than concatenating it, so any device-local policy changes not reflected in FortiManager can be lost.

Practice this question →
10
Multi-Selectmedium

Which TWO methods can be used to authenticate a FortiGate when it registers to a FortiManager?

Select 2 answers
A.External RADIUS server
B.SNMP community string
C.Password/Pre-shared Key
D.Serial Number registration
E.IP-based automatic discovery
AnswersC, D

Password or pre-shared key authentication satisfies the registration constraint by having the FortiGate present a shared secret that FortiManager validates before accepting the device. This credential is configured on both sides during initial setup, so no certificate infrastructure or external identity provider is required for the FortiGate to register.

Why this answer

Option C (Password/Pre-shared Key) is correct because when a FortiGate is added to FortiManager using the 'Add Device' wizard, the administrator can specify a pre-shared key (PSK) that the FortiGate must present during the FGFM (FortiGate-FortiManager) registration handshake to authenticate itself. Option D (Serial Number registration) is correct because FortiManager can also authenticate a registering FortiGate by matching its serial number against a pre-authorized device entry, allowing the device to be recognized and added without a PSK. Options A, B, and E are not valid FortiGate-to-FortiManager authentication methods: RADIUS is used for administrative or user authentication, not device registration; SNMP community strings are for monitoring, not registration; and IP-based automatic discovery merely identifies candidate devices on the network but does not authenticate them for FortiManager registration.

Exam trap

The trap is picking IP-based discovery as an authentication method — discovery and authentication are separate steps, and candidates conflate the two because discovery is the first thing they see in the FortiManager workflow.

Practice this question →
11
Multi-Selectmedium

Which TWO administrative actions require a 'Workspace Mode' enabled in FortiManager?

Select 2 answers
A.Automatic log rotation
B.Creating new ADOMs
C.Forcing a reboot
D.Locking policies for editing
E.Reviewing changes before publishing
AnswersD, E

Workspace Mode creates a private editing workspace so an administrator can lock policies while modifying them, preventing concurrent edits by others. Locking policies for editing therefore requires Workspace Mode, satisfying the stem's condition for actions unavailable in normal workflow mode.

Why this answer

In FortiManager, Workspace Mode is the workflow that lets administrators lock objects (such as policies) for editing and then review pending changes before publishing them to managed devices, so options D and E are exactly the actions that require it. Locking policies for editing (D) is only meaningful inside Workspace Mode, because the lock prevents other admins from modifying the same policy while changes are staged. Reviewing changes before publishing (E) is the second half of that workflow, since FortiManager queues modifications in the workspace and requires an explicit review/publish step.

The other options do not depend on Workspace Mode: automatic log rotation (A) is a logging/disk-management setting, creating new ADOMs (B) is a system-level administrative task performed outside the workspace workflow, and forcing a reboot (C) is a device/system operation available regardless of workspace state.

Exam trap

The trap is assuming any administrative action requires Workspace Mode, when in fact only actions involving staged editing, locking, and review/publish workflows do.

Practice this question →
12
Multi-Selectmedium

Which TWO actions can be performed on a Revision History item in FortiManager?

Select 2 answers
A.Compare with current version
B.Restore to a previous state
C.Delete the entire ADOM
D.Export the revision to an external cloud
E.Modify the version permanently
AnswersA, B

Revision History entries can be compared against the current configuration, displaying a side-by-side or inline diff of changed objects. This satisfies the requirement to identify exactly what differs between a saved revision and the live FortiManager database before deciding whether to restore it.

Why this answer

In FortiManager, a Revision History item represents a saved configuration snapshot of an ADOM or policy package, and option A (Compare with current version) is correct because FortiManager provides a diff view that shows the differences between the selected revision and the current running configuration. Option B (Restore to a previous state) is also correct because you can revert the ADOM or policy package back to that saved revision, effectively rolling back configuration changes. Option C (Delete the entire ADOM) is wrong because deleting an ADOM is an ADOM-level administrative action, not an operation available on an individual revision history entry.

Option D (Export the revision to an external cloud) is wrong because FortiManager does not offer a cloud export function for revision items; revisions are stored locally in the FortiManager database. Option E (Modify the version permanently) is wrong because revisions are immutable snapshots — you cannot edit a saved revision in place, only compare, restore, or delete it.

Exam trap

Fortinet NSE7 exams often test whether candidates know the exact scope of Revision History actions — the trap is picking plausible-sounding but non-existent features like 'export to cloud' or 'modify version permanently,' when the only real actions are compare and restore.

Practice this question →
13
MCQhard

You are troubleshooting a policy installation failure where the FortiManager reports a 'Configuration conflict'. Which action should you perform to identify the root cause of the mismatch?

A.Force an 'Import Policy' operation
B.Reboot the FortiManager
C.Disable the policy package entirely
D.Use the 'Diff' feature in the Policy & Objects tab to compare the database and device config
AnswerD

The 'Diff' feature compares FortiManager's policy database against the managed device's running configuration, exposing exactly which objects or rules diverge. This directly satisfies the stem's need to identify the root cause of the 'Configuration conflict' mismatch before remediation, rather than guessing or reinstalling blindly.

Why this answer

When FortiManager reports a 'Configuration conflict' during policy installation, the root cause is usually a mismatch between the FortiManager policy package/database and the actual configuration on the FortiGate. The 'Diff' feature in the Policy & Objects tab compares the FortiManager database against the device configuration line-by-line, exposing exactly which objects, policies, or settings differ. This is the correct diagnostic step before deciding whether to import, overwrite, or reconcile.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates jump to 'Import Policy' as a fix for conflicts — but Import overwrites FortiManager's intent, whereas Diff is the diagnostic tool that reveals the actual mismatch.

How to eliminate wrong answers

Option A is wrong because forcing an Import Policy would overwrite FortiManager's database with the device config, potentially destroying the intended policy design and masking the root cause rather than identifying it. Option B is wrong because rebooting FortiManager does not resolve configuration mismatches and may disrupt other managed devices. Option C is wrong because disabling the policy package removes it from installation scope entirely, which does not diagnose the conflict and leaves the device unmanaged.

Practice this question →
14
Multi-Selectmedium

Which TWO types of reports can be generated in the FortiAnalyzer module of FortiManager?

Select 2 answers
A.Custom reports
B.Pre-defined reports
C.Policy change impact reports
D.Hardware diagnostic reports
E.Firmware compatibility reports
AnswersA, B

Custom reports let administrators define datasets, filters, and layouts beyond shipped templates, satisfying the requirement for tailored output. FortiAnalyzer's report engine supports both this and pre-defined formats, so custom reports are one of the two valid types.

Why this answer

In the FortiAnalyzer module of FortiManager, reports are generated from log data using report templates, and the two supported report types are Custom reports (A) and Pre-defined reports (B). Custom reports (A) are right because administrators can build them from scratch or by modifying templates, choosing datasets, charts, time periods, and filters to meet specific log-analysis needs. Pre-defined reports (B) are right because FortiAnalyzer ships with built-in report templates (for example, security, traffic, and usage reports) that can be run as-is or used as a starting point.

Policy change impact reports (C) do not belong because FortiManager handles policy/configuration management, not impact analysis reporting in the FortiAnalyzer module. Hardware diagnostic reports (D) and Firmware compatibility reports (E) are not FortiAnalyzer report types; hardware diagnostics and firmware compatibility are handled through FortiGate/FortiManager device management and upgrade-path tools, not log-based reporting.

Exam trap

FORTINET-NSE7-SPECIALTY often tests whether candidates can distinguish FortiAnalyzer's actual report types from plausible-sounding but non-existent categories — the trap is selecting options like 'policy change impact' or 'firmware compatibility' that sound like reporting features but actually belong to FortiManager or other tools.

Practice this question →
15
MCQeasy

When adding a FortiGate to FortiManager, which mode must the FortiGate be in to allow the FortiManager to manage its configuration and policies?

A.Registration-only mode
B.Backup mode
C.Normal mode
D.Read-only mode
AnswerC

Normal mode permits FortiManager to push configuration and policy packages, because the FortiGate retains its own local configuration while accepting centralised management. This satisfies the stem's requirement for full configuration and policy management. Other modes, such as backup, restrict FortiManager to read-only monitoring, so they cannot fulfil the management constraint.

Why this answer

For FortiManager to manage a FortiGate's configuration and policies, the FortiGate must be in Normal mode (the default operating mode). In Normal mode, the FortiGate can be added to FortiManager, and FortiManager can push policy packages, install configuration changes, and retrieve status. Other modes like backup or read-only are not valid FortiGate operational modes for full management.

Exam trap

The trap is inventing non-existent modes like 'Registration-only' or 'Read-only' — candidates may confuse FortiManager administrative permissions with FortiGate operating modes, but the FortiGate must always be in Normal mode for full management.

How to eliminate wrong answers

Option A is wrong because 'Registration-only mode' is not a valid FortiGate mode — while there is a concept of registering a device with FortiManager, the FortiGate itself must be in Normal mode to be managed. Option B is wrong because 'Backup mode' is not a FortiGate operating mode; FortiGate modes are NAT/Route, Transparent, and there is no 'Backup mode' for management purposes. Option D is wrong because 'Read-only mode' is not a FortiGate mode — FortiManager can have read-only administrative accounts, but the FortiGate itself must be in Normal mode for FortiManager to push configuration.

Practice this question →
16
Multi-Selecthard

Which THREE items are included in a Policy Package when it is pushed from FortiManager?

Select 3 answers
A.Service Objects
B.Firewall Policies
C.System interface settings
D.Routing tables
E.Address Objects
AnswersA, B, E

Service Objects are bundled into the policy package, since firewall policies reference them for port and protocol matching. Pushing the package installs these objects on the managed FortiGate alongside the policies that depend on them.

Why this answer

A Policy Package in FortiManager is the container of the security configuration that gets installed to managed FortiGate devices, and it includes the firewall policy rules themselves (B, Firewall Policies), which define the traffic handling and are the core of the package. It also includes the reusable objects those policies reference, specifically Address Objects (E) and Service Objects (A), which define the source/destination addresses and the TCP/UDP port or protocol matches used inside the policies. These three items travel together as a unit when the policy package is pushed, because the policies cannot function without their referenced address and service objects.

By contrast, System interface settings (C) and Routing tables (D) are device-level configuration that belongs to the FortiGate's system and network settings, not to the policy package, so they are not installed as part of a policy package push.

Exam trap

The trap is assuming that all configuration is included in a policy package — candidates may include interface or routing settings, but these are device-level and not part of the policy package.

Practice this question →
17
MCQeasy

What is the primary purpose of an ADOM in FortiManager?

A.To logically group devices for delegated administration and policy management
B.To provide high availability for the FortiGate
C.To allow external API access to the FortiGate
D.To increase the storage capacity of the FortiManager
AnswerA

An ADOM partitions FortiManager into independent administrative domains, each holding its own devices, policies and objects. This directly satisfies the delegated administration and policy management requirement, letting separate teams manage their own device groups without affecting others. It is not merely a folder or a backup container; it is the fundamental management boundary within FortiManager.

Why this answer

An ADOM (Administrative Domain) in FortiManager is a logical container that groups managed devices, policies, and objects for administrative segregation. It enables delegated administration by allowing different administrators to manage only their assigned ADOMs, and it provides a boundary for policy management, ensuring that policies and objects are not shared across ADOMs unless explicitly done via global objects. This makes it the primary mechanism for multi-tenancy and organizational separation in FortiManager.

Exam trap

The trap here is confusing ADOMs with high availability or API features, as candidates might think ADOMs provide redundancy or external access, but they are purely for logical grouping and delegated administration.

How to eliminate wrong answers

Option B is wrong because high availability for FortiGate is achieved through FortiGate HA (FGCP or FGSP) or FortiManager HA for the manager itself, not through ADOMs. Option C is wrong because external API access to FortiGate is provided by the FortiGate REST API or FortiManager JSON API, which are independent of ADOM structure. Option D is wrong because ADOMs do not increase storage capacity; they are logical partitions, and storage capacity is determined by the FortiManager hardware or VM resources.

Practice this question →
18
Multi-Selecthard

Which THREE factors influence log storage efficiency on a FortiAnalyzer/FortiManager?

Select 3 answers
A.Log compression settings
B.Log retention days
C.The firewall firmware version
D.Disk quota for specific devices
E.The number of active users
AnswersA, B, D

Log compression settings directly reduce the disk footprint of stored logs by encoding them more compactly, so enabling compression increases storage efficiency. This satisfies the stem's requirement as one of the three factors influencing log storage efficiency on FortiAnalyzer/FortiManager.

Why this answer

Log compression settings (A) directly influence log storage efficiency because FortiAnalyzer/FortiManager can compress logs (e.g., using gzip) to reduce the physical disk space consumed by stored logs. Log retention days (B) determine how long logs are kept before being purged, so a longer retention period increases the total volume of logs stored and thus affects storage efficiency. Disk quota for specific devices (D) limits how much storage each device's logs can consume, directly controlling storage allocation and preventing one device from exhausting the analyzer's disk.

The firewall firmware version (C) does not itself govern log storage efficiency, though it may affect log format or features, and the number of active users (E) is unrelated to how efficiently logs are stored on the FortiAnalyzer/FortiManager.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between factors that directly affect storage efficiency (compression, retention, quotas) and those that indirectly influence log volume (firmware version, user count), causing candidates to select the latter.

Practice this question →
19
MCQmedium

You are setting up an SD-WAN configuration via FortiManager. Which object type is used to group multiple WAN interfaces for SD-WAN member assignment?

A.IP Pool
B.Virtual Wire Pair
C.SD-WAN Zone
D.Interface Group
AnswerC

SD-WAN zones group multiple WAN interfaces into a single logical object, and FortiManager assigns members to that zone. This satisfies the stem's requirement for grouping WAN interfaces during SD-WAN member assignment, rather than configuring each interface individually.

Why this answer

In FortiManager SD-WAN configuration, an SD-WAN Zone is the object type used to group multiple WAN interfaces for SD-WAN member assignment. Zones allow you to logically group interfaces so that SD-WAN rules and performance SLAs can be applied to the group rather than individual interfaces. This is the correct object for organizing WAN members in an SD-WAN deployment managed via FortiManager.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the specific FortiManager object name for SD-WAN grouping, and candidates confuse it with generic interface groups or virtual wire pairs that serve entirely different purposes.

How to eliminate wrong answers

Option A is wrong because an IP Pool is a range of IP addresses used for NAT or DHCP, not for grouping WAN interfaces. Option B is wrong because a Virtual Wire Pair is a pair of interfaces configured in transparent mode to pass traffic without routing — it is unrelated to SD-WAN member grouping. Option D is wrong because 'Interface Group' is not the FortiManager object type used for SD-WAN; while interface groups exist for other purposes (like aggregate links), SD-WAN specifically uses zones.

Practice this question →
20
MCQeasy

Where can an administrator check the status of the connection between a FortiGate and FortiManager?

A.Log View
B.Device Manager
C.Policy & Objects
D.System Settings
AnswerB

Device Manager in FortiManager lists managed FortiGates and shows each device's connection state, so the administrator can confirm whether the tunnel to FortiManager is up. This directly satisfies the requirement to check the FortiGate-to-FortiManager connection status, displaying synchronisation and online/offline indicators per device.

Why this answer

In FortiManager, the Device Manager pane displays managed FortiGate devices and their status, including the connection state between the FortiGate and FortiManager. Administrators can see whether the device is online, the last update time, and other management details. This is the primary location to verify the FortiGate-FortiManager tunnel status.

Exam trap

The trap is confusing configuration panes (Policy & Objects, System Settings) with the monitoring pane (Device Manager) where connection status is actually displayed.

How to eliminate wrong answers

Option A is wrong because Log View displays logs (traffic, event, security) from managed devices or FortiManager itself; it does not show the live connection status of the management tunnel. Option C is wrong because Policy & Objects is used to configure firewall policies, objects, and packages; it does not display device connection status. Option D is wrong because System Settings contains FortiManager's own system configuration (administrators, network, HA), not the status of managed devices.

Practice this question →
21
MCQmedium

You want to automate the onboarding of new FortiGate units. Which FortiManager feature allows you to pre-configure devices before they connect to the network?

A.Provisioning Templates
B.Scripting
C.Device Registration Key
D.Policy cloning
AnswerA

Provisioning Templates let you pre-stage configuration — such as interface settings, static routes and security profiles — against a device model or serial number before the FortiGate ever contacts FortiManager. When the unit later registers, FortiManager automatically pushes that pre-configured template, satisfying the stem's requirement to onboard devices without manual intervention.

Why this answer

Provisioning Templates in FortiManager let administrators define a device's full configuration — system settings, interface configs, firewall policies, and more — before the FortiGate ever connects. When the new FortiGate registers with FortiManager (via serial number or pre-shared key), the template is automatically applied, enabling zero-touch onboarding. This is the standard mechanism for pre-configuring devices at scale.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between Provisioning Templates (pre-config before connect) and Scripting (post-management automation), since both sound like automation tools.

How to eliminate wrong answers

Option B is wrong because Scripting executes CLI or Tcl scripts on already-managed devices; it does not provide the pre-registration template framework that auto-applies config on first connect. Option C is wrong because a Device Registration Key is only an authentication credential used during initial FortiManager registration — it does not carry configuration. Option D is wrong because policy cloning duplicates existing policies between devices or ADOMs and requires the target device to already exist and be managed.

Practice this question →
22
Multi-Selecthard

Which THREE steps are involved in the 'Policy Package Installation' workflow?

Select 3 answers
A.Select the target device
B.Perform a factory reset
C.Review the install preview
D.Select the policy package
E.Reboot the target device
AnswersA, C, D

Selecting the target device identifies which managed FortiGate receives the policy package. Installation is device-scoped, so this step satisfies the workflow requirement of defining the destination before the package can be pushed and committed to that firewall.

Why this answer

In the Policy Package Installation workflow, you must first select the policy package (D) that you intend to deploy, since the package defines the set of rules and objects to be installed. Next, you select the target device (A) — the managed gateway, cluster, or VSX — to which that package will be pushed. Before committing, you review the install preview (C), which shows the changes, warnings, and potential impacts so you can confirm or cancel the installation.

Options B and E are not part of this workflow: a factory reset (B) is a device-recovery action unrelated to policy deployment, and rebooting the target device (E) is neither required nor a defined step in installing a policy package.

Exam trap

The trap is including unrelated operational steps like factory reset or reboot — candidates may think a reboot is needed for policy changes, but FortiManager applies policies dynamically without rebooting.

Practice this question →
23
MCQhard

An administrator needs to provide access to FortiManager for a junior team member who should only be able to view logs and reports. Which feature is used to define this access?

A.Administrator Profiles
B.Access Control Lists (ACLs)
C.ADOM Assignment
D.User Groups
AnswerA

Administrator Profiles bundle per-domain read/write permissions, so a profile granting read-only access to logs and reports lets the junior member view those areas without configuration rights. Assigning that profile to the administrator account enforces the least-privilege constraint the scenario demands.

Why this answer

Administrator Profiles in FortiManager define granular permissions for administrative accounts, including which ADOMs, policy packages, and features (logs, reports, system settings) a user can access. To give a junior team member read-only access to logs and reports, the administrator creates a profile with only those permissions and assigns it to the user account. This is the standard RBAC mechanism in FortiManager.

Exam trap

FORTINET-NSE7-SPECIALTY often tests the distinction between ADOM Assignment (which ADOMs a user sees) and Administrator Profiles (what actions a user can perform) — candidates pick ADOM Assignment thinking it controls permissions, but it only scopes visibility.

How to eliminate wrong answers

Option B is wrong because ACLs in FortiManager are used for network-level access control (e.g., trusted hosts, interface restrictions), not for defining what a logged-in administrator can view or modify. Option C is wrong because ADOM Assignment determines which ADOMs a user can see, but it does not by itself restrict the user to logs and reports — that requires a profile with the appropriate permissions. Option D is wrong because User Groups are used for authentication and policy matching (e.g., in firewall policies or VPN), not for defining administrative permissions within FortiManager.

Practice this question →
24
Multi-Selecthard

Which THREE items can be managed via Device Templates in FortiManager?

Select 3 answers
A.Firewall policies
B.NTP configuration
C.Application control databases
D.DNS settings
E.Local interface IP settings
AnswersB, D, E

NTP configuration is provisioned through Device Templates, which push shared settings such as time synchronisation to managed FortiGates. This satisfies the requirement by grouping NTP servers and authentication under centralised template management rather than per-device manual configuration.

Why this answer

Device Templates in FortiManager are used to provision and manage system-level and network-level settings on managed FortiGate devices, including NTP configuration (B), DNS settings (D), and local interface IP settings (E), which are all part of the system/network configuration that templates push to devices. NTP and DNS are system settings commonly configured through the System template, while interface IPs are configured through the Interface template, making all three valid template-managed items. Firewall policies (A) are managed through Policy Packages, not Device Templates, since they are policy objects rather than device-level provisioning settings.

Application control databases (C) are updated via FortiGuard services and are not provisioned through Device Templates.

Exam trap

The trap here is confusing Device Templates with Policy Packages; candidates often assume that any configuration item can be managed via Device Templates, but firewall policies and application control databases are not part of Device Templates.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Nse7 Enterprise Firewall Central Management questions.

Start 20-question session