NSE7-EFW-7-0 Sample Questions & Answers

Creating a targeted exemption is the most precise way to mitigate a false positive. It allows the signature to remain active for all other traffic while permitting the specific, legitimate traffic flow that was being incorrectly blocked.

Changing the signature's action to 'Monitor' allows the traffic to pass but continues to generate logs. This is a good troubleshooting step to confirm the traffic is legitimate and to assess the impact of the signature without causing a service disruption.

The statement is false because it confuses the settings for BGP and OSPF. When using OSPF with ADVPN, net-device must be enabled on the hub for the spokes so that the hub advertises its own IP as the next hop. Conversely, when using BGP with ADVPN, net-device must be disabled so the hub preserves the original spoke's IP as the next hop, which is required for NHRP to resolve the address and build the shortcut tunnel.

The message check-is-not-forward failed on policy 0 is the specific debug flow output that indicates the packet did not match any configured firewall policy and was therefore dropped by the invisible, default 'implicit deny' rule (Policy ID 0). This means no explicit policy allowed the traffic to be forwarded.

The ipsengine process load is directly related to the number and complexity of signatures it must evaluate for each packet. A common cause of high CPU is an overly broad IPS sensor. The most effective first step is to tune the sensor by removing signatures that are not relevant to the protected environment (e.g., signatures for servers if only clients are behind the policy, or signatures for operating systems not in use). This reduces the inspection workload without disabling the feature entirely.

For a route-based VPN, the FortiGate needs a route in its routing table to direct traffic destined for the remote network into the tunnel interface. Without this route, the FortiGate does not know where to send the packets.

Even with a correct route, traffic will be dropped by the implicit deny rule unless there is a firewall policy explicitly allowing the traffic flow from the source interface (e.g., LAN) to the destination interface (the IPsec tunnel). A corresponding policy is also needed for the return traffic.

With deep inspection, the FortiGate intercepts the TLS session and re-signs the website's certificate with its own CA certificate. For the browser to accept this, the FortiGate's CA certificate must be installed and trusted in the client's certificate store. If it is not trusted, the browser will display a certificate warning because the certificate issuer (the FortiGate) is unknown.

The HA checksum is a hash of a specific part of the configuration. A mismatch for system.interface indicates that the interface configurations on the primary and secondary units are different. This means synchronization for this part of the configuration has failed. If a failover occurs, the secondary unit will use its incorrect interface configuration, likely leading to a network outage.

A route map is a powerful policy tool used in BGP to control and modify routing information. Its primary purposes are to filter which routes are accepted from or advertised to a neighbor (using match statements) and to modify BGP path attributes (like local preference, MED, or community) for traffic engineering purposes (using set statements).

The diagnose log test command is a comprehensive tool for testing the entire logging mechanism. It generates test logs for all configured destinations (including FortiAnalyzer, memory, disk) and reports on the status of the connection, including encryption, registration, and log transmission statistics. This is the best command to quickly verify if the logging daemon (logd) can successfully connect and send logs to the configured FortiAnalyzer.

Dead Peer Detection (DPD) is a mechanism used to detect when an IPsec peer is no longer available. The FortiGate sends periodic DPD messages (IKEv1 R-U-THERE or IKEv2 INFORMATIONAL exchanges) to its peer. If it does not receive a response after a configured number of retries, it considers the peer 'dead' and tears down the VPN tunnel. This allows for faster failure detection and failover to a redundant tunnel.