Free NSE7-EFW-7-2 sample questions

Correct answer: config system ha > set configuration-sync-mode incremental

The `set configuration-sync-mode incremental` command under `config system ha` ensures that any configuration changes, including those made via the CLI, are synchronized incrementally and immediately to the secondary unit. This is crucial for maintaining configuration parity for compliance and operational consistency. `session-pickup` relates to synchronizing session tables, not configuration. The other options are not valid FortiOS commands.

Correct answer: Multi-Exit Discriminator (MED)

The Multi-Exit Discriminator (MED) is a non-transitive BGP attribute used to influence how a neighboring AS enters your AS when multiple entry points exist. A lower MED value is preferred. This makes it the ideal attribute for regional border routers to signal to other regions which entry point is optimal. Local Preference influences outbound traffic, AS Path Prepending also influences inbound traffic but is less granular, and Weight is local to the router.

Correct answers: `set auto-discovery-sender enable`; `set auto-discovery-receiver enable`

For ADVPN to function, the hub must act as the central point for shortcut negotiation messages (IKE_CREATE_CHILD_SA). `set auto-discovery-sender enable` allows the hub to send shortcut offers to spokes. `set auto-discovery-receiver enable` allows the hub to receive shortcut requests from spokes and forward them to the correct destination spoke. Together, these settings enable the hub to facilitate the dynamic creation of spoke-to-spoke tunnels.

Correct answer: Enable packet logging within the IPS sensor.

To capture the actual packet data that triggers an IPS signature, 'packet logging' must be enabled within the specific IPS sensor applied to the traffic. This feature saves a copy of the triggering packet(s) to the log, which is invaluable for forensic analysis to confirm the attack's nature and payload. Other logging settings, like extended logging or firewall policy logging, do not capture the packet payload for IPS events.

Correct answer: False

This statement is false. When FortiManager is configured as a local FDS, it can serve not only AV and IPS updates but also handle real-time web filtering and antispam rating requests. This allows managed FortiGates in a closed or bandwidth-constrained network to perform these lookups locally against the FortiManager, which then queries the public FortiGuard network on their behalf.

Correct answer: Per-IP traffic shaping is not compatible with NP7 hardware acceleration.

Certain features, by their nature, require CPU processing and are incompatible with hardware acceleration. Per-IP traffic shaping is one such feature. It requires the FortiGate CPU to track and manage bandwidth for each individual IP address, preventing the session from being offloaded to the NP7 processor. To enable offloading, a shared traffic shaper would need to be used instead.

Correct answer: Mismatched interface MTU values.

When an OSPF adjacency is stuck in the `ExStart/Exchange` state, it indicates that the routers are failing to exchange Database Description (DBD) packets successfully. A common cause for this is a mismatched Maximum Transmission Unit (MTU) on the interfaces. If one router sends a DBD packet larger than the other router's interface MTU, the packet will be dropped, and the exchange process cannot complete. Mismatched area IDs or authentication keys would prevent the adjacency from forming at an earlier stage.

Correct answer: Configuring Policy Blocks within the policy package.

Policy Blocks are a FortiManager feature specifically designed for this purpose. They allow an administrator to define a standard, centralized set of policies while also creating placeholders (Policy Blocks) where device-level or group-level policies can be inserted. This provides a hierarchical policy structure, enabling a balance between global standardization and local customization without needing separate policy packages or ADOMs.

Correct answers: Firewall policies to and from the IPsec interface; Static or dynamic routes pointing to the IPsec interface

For a route-based VPN, even if the tunnel (Phase 1 and Phase 2) is successfully established, traffic will not flow unless two other conditions are met. First, there must be firewall policies that explicitly allow traffic from the local network to the VPN interface and vice-versa. Second, the FortiGate's routing table must have a static or dynamic route that directs traffic destined for the remote network to use the virtual IPsec interface as its gateway. Since the tunnel is already up, Phase 1 and Phase 2 settings are likely correct.

Correct answer: Enable SSL/SSH Inspection and apply a 'deep-inspection' profile.

Modern applications, including P2P clients, heavily use SSL/TLS encryption to obfuscate their traffic. Application control can only inspect the content of traffic it can see. By enabling a 'deep-inspection' SSL/SSH Inspection profile on the firewall policy, the FortiGate can decrypt the traffic, allowing the application control engine to accurately identify and block the underlying P2P application. Without decryption, the engine can only rely on less reliable indicators like IP addresses or certificate information.