31 questions · Nse7 Enterprise Firewall Security And VPN · All types, answers revealed
When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?
This ensures confidentiality.
Why this answer
IKEv2 negotiates encryption, integrity, and Diffie-Hellman groups during the initial exchange.
A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?
Clients must trust the CA that signs the re-issued certificates.
Why this answer
The FortiGate acts as a man-in-the-middle, so the client must trust the CA certificate generated by the FortiGate.
What is the effect of changing the IPS 'buffer' size on a FortiGate device?
The buffer directly manages memory for flow-based inspection.
Why this answer
Adjusting the IPS buffer affects how much data is held in memory for inspection, which can prevent packet drops during heavy traffic but increases memory load.
In an OSPF setup, you have a redundant path. You want to ensure traffic prefers one link over another based on cost. Which OSPF command is used?
This command adjusts the interface cost within the OSPF configuration.
Why this answer
The OSPF cost is configured on the interface level to influence link preference.
A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?
Route maps provide the necessary granularity to filter prefixes during redistribution.
Why this answer
A route map must be applied during redistribution to filter the prefixes being injected.
Which TWO items must be configured to ensure a FortiGate can successfully resolve external hostnames?
This is required if the FortiGate acts as a DNS server.
Why this answer
DNS settings are required for the FortiGate itself to resolve external names, and firewall policies must allow DNS traffic if the client uses the FortiGate as a DNS proxy.
What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?
The implicit deny policy is the default safety catch-all.
Why this answer
The implicit deny policy is the last rule in the firewall policy list and drops all non-matching traffic.
Which FortiGate feature should be enabled to prevent internal users from accessing malicious websites based on real-time threat intelligence?
Web filtering specifically categorizes URLs for security policy.
Why this answer
Web Filtering using categories provides real-time protection by checking URLs against the FortiGuard database.
Which THREE of the following are mandatory for a BGP neighbor adjacency to establish?
The peers must know their AS relationship.
Why this answer
BGP requires the correct AS numbers, reachable IPs, and matching timers or specific parameters to form a connection.
You need to inspect traffic between two internal VLANs. How do you ensure this traffic is processed by the FortiGate?
The FortiGate requires a policy to permit traffic between zones/interfaces.
Why this answer
Since VLANs are logical interfaces, the FortiGate will act as a gateway if the devices are configured to use the FortiGate's IP as their default gateway.
You are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?
This allows targeted tuning of individual signatures.
Why this answer
Using an IPS sensor override or a specific signature exemption allows you to modify the behavior for a single signature without disabling it globally.
You are configuring BGP and need to advertise a summary route to your ISP. How do you ensure only the summary route is advertised?
This command effectively suppresses specific routes.
Why this answer
The 'aggregate-address' command with the 'summary-only' option is the correct way to advertise only the summary and suppress specific component routes.
Which TWO of the following are necessary to successfully deploy an SSL VPN in tunnel mode?
A trusted certificate is required for secure handshakes.
Why this answer
Tunnel mode requires a configured portal and a policy allowing the VPN tunnel interface to the internal network.
In a BGP deployment, your FortiGate is receiving routes from two different ISPs. You want to influence outbound traffic to prefer ISP1 for specific destinations. Which BGP attribute should you modify?
Local Preference is the standard BGP attribute for controlling outbound path selection.
Why this answer
Local Preference is used to influence outbound traffic selection within an AS.
You notice that an IPsec tunnel is up, but no traffic passes. What is the most common reason related to firewall policy configuration?
Policies are mandatory to permit inter-zone traffic flow.
Why this answer
Even if the tunnel is up, a policy must exist to allow traffic to flow between the internal network and the tunnel interface.
Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?
It avoids the overhead of buffering the entire object.
Why this answer
Flow-based inspection is generally faster and provides better performance than proxy-based inspection.
What is the primary function of the FortiGate Security Fabric?
This is the core value proposition of the Security Fabric.
Why this answer
The Security Fabric integrates multiple devices to provide coordinated, end-to-end security visibility and control.
Which TWO of the following are valid methods for user authentication on a FortiGate?
RADIUS is a standard for enterprise authentication.
Why this answer
FortiGate supports both local user databases and integration with external enterprise servers like RADIUS and LDAP.
When using an IPS sensor, what is the difference between 'Protect' and 'Monitor' mode?
'Protect' implies active enforcement.
Why this answer
'Protect' drops the traffic if a signature matches, whereas 'Monitor' logs the hit without dropping the traffic.
Which THREE actions can be performed by the FortiGate when a policy match occurs?
Limits bandwidth usage.
Why this answer
Firewall policies can accept, deny, or perform traffic shaping and logging depending on the configured profile settings.
Which FortiGate feature allows you to bypass SSL inspection for specific known-trusted websites to maintain user privacy?
Exempting categories like 'Finance' or 'Health' is standard practice.
Why this answer
SSL Inspection Exemptions allow bypassing decryption for specific categories or domains.
What is the purpose of the 'Any' interface in a firewall policy?
'Any' is a wildcard for interface matching.
Why this answer
The 'Any' interface enables the policy to match traffic originating from or destined to any physical or logical interface on the FortiGate.
In a site-to-site VPN, you need to allow traffic initiated from the remote site. What configuration is essential on the local FortiGate?
This policy enables the inbound connection flow.
Why this answer
A local firewall policy must exist to permit traffic arriving from the VPN interface and destined for the internal network.
In a high availability (HA) cluster, which THREE settings are synchronized between the primary and secondary units?
Objects must be consistent across the cluster.
Why this answer
HA synchronization ensures that policies, objects, and configurations are mirrored to provide seamless failover.
What does the 'FortiGuard' service provide to the FortiGate?
This allows the FortiGate to block the latest threats.
Why this answer
FortiGuard provides real-time updates for security signatures, including IPS, Antivirus, and Web Filtering.
In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?
UDP 4500 is used to traverse NAT for IPsec.
Why this answer
NAT-T encapsulates ESP packets in UDP 4500 to allow them to pass through NAT devices that would otherwise break ESP integrity.
You are implementing SSL VPN and need to ensure that only compliant corporate laptops can connect. Which feature should you use?
Host check verifies endpoint security posture.
Why this answer
Host check allows the FortiGate to verify the presence of specific software like Antivirus before allowing the VPN connection.
Which method is the most secure for managing FortiGate devices remotely?
Restricting management access to specific IPs is a security best practice.
Why this answer
SSH with key-based authentication or HTTPS with restricted access is standard; HTTPS is common for GUI access.
You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?
Phase 2 requires matching local and remote subnets/selectors.
Why this answer
Phase 2 failure is usually due to mismatched selectors (proxy IDs) or mismatched encryption/authentication algorithms.
Which TWO of the following can be used to optimize IPsec VPN performance?
AES-NI optimizes the encryption process.
Why this answer
Hardware acceleration (ASIC) and selecting efficient encryption algorithms like AES-NI (hardware-accelerated AES) improve VPN throughput.
Which THREE types of traffic are typically inspected by an IPS policy?
Web traffic is a primary vector for attacks.
Why this answer
IPS is designed to detect and block threats in common protocols like HTTP, FTP, and SMTP.
Ready to test yourself?
Try a timed practice session using only Nse7 Enterprise Firewall Security And VPN questions.