Free NSE7-EFW-7-0 sample questions

Correct answer: Enable `graceful-restart` under `config router bgp`.

BGP Graceful Restart allows a BGP speaker to inform its neighbors of its impending restart (or in this case, a failover). The neighbors will then retain the routes learned from the restarting speaker for a specified period, preventing the forwarding table from being cleared. This allows traffic to continue flowing while the BGP sessions are re-established on the newly active cluster member, minimizing disruption. `session-pickup` is for user sessions, not control plane protocols like BGP.

Correct answer: The session remains on Route 1 until it times out or is closed.

When `snat-route-change` is disabled (the default setting), FortiOS does not re-evaluate the route for existing sessions when the routing table changes. The session is tied to its original egress interface and next-hop. Therefore, the existing session will continue to use Route 1, even though it is no longer the preferred route, until the session naturally concludes or times out. New sessions would use the new best route (Route 2).

Correct answer: The policy package contains an object or setting that is syntactically invalid or unsupported on the target FortiGate.

A 'commit failure' typically means that FortiManager successfully sent the configuration to the FortiGate, but the FortiGate itself rejected the configuration when trying to commit it to its running config. This is often due to a syntax error, a reference to a non-existent object (like an interface or address object that doesn't exist on that specific FortiGate), or a feature that is not supported by the device's specific hardware model or license.

Correct answers: Create an IPS signature exemption for the specific signature ID, limited to the affected source and destination IPs.; Change the action for the specific signature from 'Block' to 'Monitor' within the IPS sensor.

Creating a targeted exemption is the most precise way to mitigate a false positive. It allows the signature to remain active for all other traffic while permitting the specific, legitimate traffic flow that was being incorrectly blocked.

Changing the signature's action to 'Monitor' allows the traffic to pass but continues to generate logs. This is a good troubleshooting step to confirm the traffic is legitimate and to assess the impact of the signature without causing a service disruption.

Correct answer: False

The statement is false because it confuses the settings for BGP and OSPF. When using OSPF with ADVPN, `net-device` must be *enabled* on the hub for the spokes so that the hub advertises its own IP as the next hop. Conversely, when using BGP with ADVPN, `net-device` must be *disabled* so the hub preserves the original spoke's IP as the next hop, which is required for NHRP to resolve the address and build the shortcut tunnel.

Correct answer: The packet was dropped by the implicit deny policy.

The message `check-is-not-forward failed on policy 0` is the specific debug flow output that indicates the packet did not match any configured firewall policy and was therefore dropped by the invisible, default 'implicit deny' rule (Policy ID 0). This means no explicit policy allowed the traffic to be forwarded.

Correct answer: Review the applied IPS sensors and remove unnecessary signatures or filters, such as those for legacy client/server protections.

The `ipsengine` process load is directly related to the number and complexity of signatures it must evaluate for each packet. A common cause of high CPU is an overly broad IPS sensor. The most effective first step is to tune the sensor by removing signatures that are not relevant to the protected environment (e.g., signatures for servers if only clients are behind the policy, or signatures for operating systems not in use). This reduces the inspection workload without disabling the feature entirely.

Correct answers: A static route pointing to the remote subnet via the IPsec tunnel interface.; A firewall policy allowing traffic from the internal interface to the IPsec tunnel interface.

For a route-based VPN, the FortiGate needs a route in its routing table to direct traffic destined for the remote network into the tunnel interface. Without this route, the FortiGate does not know where to send the packets.

Even with a correct route, traffic will be dropped by the implicit deny rule unless there is a firewall policy explicitly allowing the traffic flow from the source interface (e.g., LAN) to the destination interface (the IPsec tunnel). A corresponding policy is also needed for the return traffic.

Correct answer: The client workstations do not trust the FortiGate's deep inspection CA certificate.

With deep inspection, the FortiGate intercepts the TLS session and re-signs the website's certificate with its own CA certificate. For the browser to accept this, the FortiGate's CA certificate must be installed and trusted in the client's certificate store. If it is not trusted, the browser will display a certificate warning because the certificate issuer (the FortiGate) is unknown.

Correct answer: The interface configurations are out of sync, and the secondary unit may not function correctly after a failover.

The HA checksum is a hash of a specific part of the configuration. A mismatch for `system.interface` indicates that the interface configurations on the primary and secondary units are different. This means synchronization for this part of the configuration has failed. If a failover occurs, the secondary unit will use its incorrect interface configuration, likely leading to a network outage.