Free NSE7-EFW-7-2 sample questions

Correct answers: `set auto-discovery-sender enable`; `set auto-discovery-receiver enable`

For ADVPN to function, the hub must act as the central point for shortcut negotiation messages (IKE_CREATE_CHILD_SA). `set auto-discovery-sender enable` allows the hub to send shortcut offers to spokes. `set auto-discovery-receiver enable` allows the hub to receive shortcut requests from spokes and forward them to the correct destination spoke. Together, these settings enable the hub to facilitate the dynamic creation of spoke-to-spoke tunnels.

Correct answer: Enable packet logging within the IPS sensor.

To capture the actual packet data that triggers an IPS signature, 'packet logging' must be enabled within the specific IPS sensor applied to the traffic. This feature saves a copy of the triggering packet(s) to the log, which is invaluable for forensic analysis to confirm the attack's nature and payload. Other logging settings, like extended logging or firewall policy logging, do not capture the packet payload for IPS events.

Correct answer: False

This statement is false. When FortiManager is configured as a local FDS, it can serve not only AV and IPS updates but also handle real-time web filtering and antispam rating requests. This allows managed FortiGates in a closed or bandwidth-constrained network to perform these lookups locally against the FortiManager, which then queries the public FortiGuard network on their behalf.

Correct answer: Per-IP traffic shaping is not compatible with NP7 hardware acceleration.

Certain features, by their nature, require CPU processing and are incompatible with hardware acceleration. Per-IP traffic shaping is one such feature. It requires the FortiGate CPU to track and manage bandwidth for each individual IP address, preventing the session from being offloaded to the NP7 processor. To enable offloading, a shared traffic shaper would need to be used instead.

Correct answer: Mismatched interface MTU values.

When an OSPF adjacency is stuck in the `ExStart/Exchange` state, it indicates that the routers are failing to exchange Database Description (DBD) packets successfully. A common cause for this is a mismatched Maximum Transmission Unit (MTU) on the interfaces. If one router sends a DBD packet larger than the other router's interface MTU, the packet will be dropped, and the exchange process cannot complete. Mismatched area IDs or authentication keys would prevent the adjacency from forming at an earlier stage.

Correct answer: Configuring Policy Blocks within the policy package.

Policy Blocks are a FortiManager feature specifically designed for this purpose. They allow an administrator to define a standard, centralized set of policies while also creating placeholders (Policy Blocks) where device-level or group-level policies can be inserted. This provides a hierarchical policy structure, enabling a balance between global standardization and local customization without needing separate policy packages or ADOMs.

Correct answers: Firewall policies to and from the IPsec interface; Static or dynamic routes pointing to the IPsec interface

For a route-based VPN, even if the tunnel (Phase 1 and Phase 2) is successfully established, traffic will not flow unless two other conditions are met. First, there must be firewall policies that explicitly allow traffic from the local network to the VPN interface and vice-versa. Second, the FortiGate's routing table must have a static or dynamic route that directs traffic destined for the remote network to use the virtual IPsec interface as its gateway. Since the tunnel is already up, Phase 1 and Phase 2 settings are likely correct.

Correct answer: Enable SSL/SSH Inspection and apply a 'deep-inspection' profile.

Modern applications, including P2P clients, heavily use SSL/TLS encryption to obfuscate their traffic. Application control can only inspect the content of traffic it can see. By enabling a 'deep-inspection' SSL/SSH Inspection profile on the firewall policy, the FortiGate can decrypt the traffic, allowing the application control engine to accurately identify and block the underlying P2P application. Without decryption, the engine can only rely on less reliable indicators like IP addresses or certificate information.

Correct answer: Create a single policy package in the 'Global' ADOM. Use installation targets to apply the social media blocking policy only to the retail store devices.

The most efficient and scalable solution is to place both the HQ and retail devices in the Global ADOM, which allows management of devices from different ADOMs under a single policy framework. A single policy package can be created containing policies for both HQ and retail. The key is to use installation targets. The social media blocking policy would have its installation target set to the device group containing the 200 retail stores, ensuring it is only installed on those devices. The marketing access policy would be targeted to the HQ device. This avoids ADOM sprawl and simplifies management.

Correct answer: Peer A, because it has a higher LOCAL_PREF.

The BGP path selection process follows a specific order of attributes. One of the earliest and most influential attributes is LOCAL_PREF. A higher LOCAL_PREF value is always preferred. In this scenario, Peer A's route has a LOCAL_PREF of 150, which is higher than Peer B's 100. Therefore, the router will select the path through Peer A, regardless of the shorter AS_PATH from Peer B. The AS_PATH length is considered much later in the selection process.