Question bank
Fortinet NSE 7 - Enterprise Firewall 7.6 Administrator
35 Fortinet NSE 7 - Enterprise Firewall 7.6 Administrator questions with the correct answer and a written explanation, organised across 5 exam domains.
- 35 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Central Management & Monitoring
5 questions in this domain
- Question 1Single Choice
In a FortiGate system configuration, which default TCP port is used by FGFM to communicate with FortiManager?
- ATCP 541Correct answer
- BTCP 443
- CTCP 22
- DUDP 514
Why this is the answer
FGFM is the FortiGate-FortiManager management protocol. It uses TCP port 541 to form the central-management tunnel by default.
- Question 2Multiple Select
Which two event-forwarding mechanisms are commonly enabled on a centrally managed FortiGate to send operational events to external monitoring tools? (Choose two.)
- ASNMP trapsCorrect answer
- BSyslog messagesCorrect answer
- CFGFM tunnel
- DLLDP advertisements
Why this is the answer
SNMP traps send asynchronous alerts, and syslog messages forward events to central collectors. FGFM is a management tunnel, while LLDP is a link-layer discovery protocol.
- Question 3Interactive
The code block shows system configuration settings applied to a FortiGate. Which central monitoring method is enabled?
- ASNMP agentCorrect answer
- BNetFlow/IPFIX flow export
- CSyslog event forwarding
- DSecurity Fabric logging
Why this is the answer
The code enables the SNMP agent and SNMP trap status so central monitoring systems can poll the device and receive SNMP alerts.
- Question 4Single Choice
Which Fortinet product provides centralized system configuration and administrative control for a large number of FortiGate devices?
- AFortiManager platformCorrect answer
- BFortiAnalyzer platform
- CFortiSandbox platform
- DFortiProxy platform
Why this is the answer
FortiManager is the central management platform for system and policy configuration. FortiAnalyzer is responsible for central logging and analytics.
- Question 5Multiple Select
Which two statements correctly describe central configuration and monitoring functions performed by FortiManager in an Enterprise Firewall environment? (Choose two.)
- AApply configuration to managed FortiGate devices.Correct answer
- BGroup managed devices into ADOMs.Correct answer
- CInspect traffic inline as a security proxy.
- DServe as the primary log analytics server.
Why this is the answer
FortiManager applies configuration changes and uses ADOMs to divide devices into logical management domains. It is not a proxy or primarily a log analytics server.
Routing
7 questions in this domain
- Question 6Single Choice
What is the main purpose of the routing table on a FortiGate?
- ATo select the next hop for a destination prefixCorrect answer
- BTo translate private source IP addresses
- CTo map IP addresses to MAC addresses
- DTo scan files for malware
Why this is the answer
The routing table stores known destination prefixes and associated next hops. When the firewall receives traffic, it consults the routing table to decide the next interface and gateway for forwarding.
- Question 7Multiple Select
Which two non-dynamic ways can add routes to a FortiGate routing table? (Choose two.)
- ADirectly connected interfacesCorrect answer
- BIPsec phase1 settings
- CConfigured static routesCorrect answer
- DProxy authentication policies
Why this is the answer
Connected routes are generated automatically when an interface has a valid IP address and is enabled. Static routes are manually configured by an administrator to define explicit paths.
- Question 8Interactive
What is the effect of the FortiOS configuration displayed in the code?
- AIt creates a default route through 10.0.0.1Correct answer
- BIt enables OSPF on the wan1 interface
- CIt sets the device hostname
- DIt configures a DNS server
Why this is the answer
The code enters the static route configuration, defines a destination of 0.0.0.0/0, and sends traffic to gateway 10.0.0.1 through wan1. This is a default static route.
- Question 9Single Choice
Why is administrative distance used in FortiGate routing?
- AIt determines which route source is more trustedCorrect answer
- BIt measures the physical length of network cables
- CIt selects the oldest administrator account
- DIt defines the order of firewall policies
Why this is the answer
Administrative distance is a trust rating assigned to a route source. Lower values are preferred, so the route learned from a more trusted source is selected when there are multiple routes to the same destination.
- Question 10Multiple Select
Which two values does a FortiGate evaluate when more than one route exists to the same destination prefix? (Choose two.)
- AAdministrative distanceCorrect answer
- BRoute metric or costCorrect answer
- CFirewall policy sequence number
- DInterface VLAN ID
Why this is the answer
Administrative distance is evaluated first to compare route source trust. If the distances tie, route metric or cost is compared; lower metric values are preferred.
- Question 11Interactive
Based on the routing output shown in the code, which destination will be forwarded using the default route?
- A192.168.2.10Correct answer
- B10.0.0.25
- C10.0.0.1
- D127.0.0.1
Why this is the answer
The routing table contains a connected route for 10.0.0.0/24 and a default static route via 10.0.0.1. A packet to 192.168.2.10 does not match the connected network, so it is sent through the default route.
- Question 12Single Choice
What is the default administrative distance of a static route on a FortiGate?
- A10Correct answer
- B20
- C1
- D0
Why this is the answer
Connected routes normally have an administrative distance of 0, while static routes have a default administrative distance of 10. Lower values indicate more trusted routes.
Security Profiles
7 questions in this domain
- Question 13Single Choice
How are security profiles applied to traffic in a FortiGate Enterprise Firewall configuration?
- AFirewall policyCorrect answer
- BStatic route
- CInterface alias
- DSNMP community
Why this is the answer
Security profiles are enforcement objects in FortiOS. They inspect traffic only when they are attached to a firewall policy, because the firewall policy defines which traffic is allowed to enter or leave the FortiGate.
- Question 14Multiple Select
Which two of the following are FortiGate security profile types?
- AAntivirusCorrect answer
- BWeb FilterCorrect answer
- CVirtual Domain
- DExternal Storage
Why this is the answer
Antivirus and Web Filter are FortiGate security profile types. Virtual domains and external storage are administrative or system resources, not security inspection profiles.
- Question 15Interactive
Review the antivirus profile output in the code block. Which virus database option is selected for the profile?
- AExtendedCorrect answer
- BRegular
- CQuarantine
- DAllow
Why this is the answer
The FortiGate antivirus profile in the code block includes the command set virus-db extended. This selects the extended antivirus database, while the other options do not describe a valid virus database mode in this command.
- Question 16Single Choice
Which security profile is designed to block known malware during file transfers?
- AAntivirusCorrect answer
- BApplication Control
- CDNS Filter
- DTraffic Shaper
Why this is the answer
Antivirus profiles scan traffic for known malware and can block infected files. Application Control classifies applications, DNS Filter controls DNS requests, and Traffic Shaper manages bandwidth.
- Question 17Multiple Select
Which two statements about FortiGate security profiles are correct?
- AA security profile contains inspection settings grouped by security function.Correct answer
- BA single security profile can be referenced by multiple firewall policies.Correct answer
- CSecurity profiles replace the firewall policy action.
- DSecurity profiles must be configured inside a static route to function.
Why this is the answer
Security profiles are reusable objects that contain settings for a specific security function, such as antivirus or web filtering. They are enforced through firewall policies and do not replace the policy action.
- Question 18Interactive
Inspect the CLI output in the code block. Which category of security profile is assigned to this firewall policy?
- AAntivirus profileCorrect answer
- BWeb filter profile
- CIPS profile
- DApplication control profile
Why this is the answer
The code block contains the line set av-profile \"default\" inside a firewall policy. The av-profile setting identifies the antivirus security profile that will be applied to matching traffic.
- Question 19Single Choice
In a FortiGate security profile, which parameter controls whether detected threats are blocked or only logged?
- AActionCorrect answer
- BInterface
- CMetric
- DLogging level
Why this is the answer
Security profiles use action settings to define how matching traffic should be handled. An administrator can set the action to monitor, block, or reset, while interface and metric relate to network paths rather than profile enforcement.
System Configuration
9 questions in this domain
- Question 20Single Choice
What is the purpose of an administrator profile in FortiGate?
- ADefines GUI and CLI access permissionsCorrect answer
- BAssigns the FortiGate hostname
- CSets the time zone for NTP
- DConfigures the DNS server address
Why this is the answer
Administrative profiles are used to define permission levels and access rights, while hostname, time, and DNS parameters are configured elsewhere in the system.
- Question 21Multiple Select
Which of the following are supported methods for accessing the FortiGate CLI? (Select all that apply.)
- ASSHCorrect answer
- BConsoleCorrect answer
- CHTTPS
- DSNMP
Why this is the answer
SSH and console are direct FortiGate CLI access methods. HTTPS is used for the web GUI, and SNMP is a monitoring protocol, not a CLI access method.
- Question 22Interactive
Review the code block. Which FortiGate configuration mode is shown in the CLI session?
- AAdmin user edit modeCorrect answer
- BGlobal system mode
- CInterface configuration mode
- DRouter configuration mode
Why this is the answer
Within config system admin, the edit admin command enters the administrator user edit context, allowing password or permission settings.
- Question 23Single Choice
Which FortiGate system parameter is used to set the device hostname?
- AhostnameCorrect answer
- Bdefault gateway
- CNTP server
- Dadmin password
Why this is the answer
The hostname is the displayed name that identifies the FortiGate. Other options relate to NTP, gateway, or credentials, not the device label.
- Question 24Multiple Select
Which actions require a FortiGate administrator to have read-write privileges? (Select all that apply.)
- AChanging firewall policiesCorrect answer
- BUpgrading firmwareCorrect answer
- CViewing the dashboard
- DRunning the get command
Why this is the answer
Read-only administration supports monitoring commands only; modifying policies or upgrading firmware requires read-write rights.
- Question 25Interactive
Refer to the code block. What is the hostname reported by the FortiGate?
- AFGT-760-HACorrect answer
- BFortiGate-760
- CFG76000000000000
- Dv7.6.0
Why this is the answer
The output line Hostname: FGT-760-HA indicates the device name used in prompts and logs.
- Question 26Single Choice
What should an administrator do before upgrading FortiGate firmware?
- ABack up the current configurationCorrect answer
- BDelete unused administrator profiles
- CChange the hostname
- DDisable NTP synchronization
Why this is the answer
Backing up configuration before an upgrade preserves current settings and allows rollback. Disabling services and rebooting are not preparation requirements.
- Question 27Multiple Select
Which elements are saved when creating a FortiGate configuration backup? (Select all that apply.)
- ASystem settingsCorrect answer
- BAdministrator accountsCorrect answer
- CLive VPN tunnel state
- DCached DNS replies
Why this is the answer
Backups store configuration objects such as system settings and admin accounts. Session state and packet data are runtime data, not configuration backup.
- Question 28Interactive
Review the code block. Which enabled administration protocols are sent in cleartext and should be disabled? (Select all that apply.)
- AHTTPCorrect answer
- BTelnetCorrect answer
- CHTTPS
- DSSH
Why this is the answer
HTTP and Telnet transmit data without encryption. HTTPS and SSH are secure management protocols.
VPN
7 questions in this domain
- Question 29Single Choice
Which FortiGate system service should be enabled so the device clock stays synchronized for VPN certificate validation?
- ANTP synchronizationCorrect answer
- BDHCP address assignment
- CSNMP trap reporting
- DWeb proxy caching
Why this is the answer
NTP keeps the FortiGate clock synchronized, which is required for judging certificate validity periods during VPN authentication.
- Question 30Multiple Select
Which two FortiGate system settings must be available before an IPsec VPN peer can be reached by its fully qualified domain name?
- ADNS server addressesCorrect answer
- BA route that can reach the DNS serverCorrect answer
- CSNMP read-only community
- DConsole idle timeout
Why this is the answer
A fully-qualified domain name must be resolved by DNS servers, and the FortiGate needs a route to reach those servers.
- Question 31Interactive
Review the FortiGate command block. What system function does this configuration define?
- ADNS server addressesCorrect answer
- BNTP server addresses
- CFirewall address objects
- DAdministrative LDAP servers
Why this is the answer
The block enters the DNS configuration context and assigns primary and secondary DNS servers.
- Question 32Single Choice
Which command permanently saves modified FortiGate system configuration in the CLI?
- AwriteCorrect answer
- Bexecute reboot
- Cget system status
- Ddiagnose debug
Why this is the answer
The write command saves the running configuration to the flash-based startup configuration.
- Question 33Multiple Select
Which two system-level settings should be checked when preparing FortiGate for an IPsec or SSL VPN deployment?
- ASystem clock synchronized by NTPCorrect answer
- BDNS servers configured for FQDN resolutionCorrect answer
- CSNMP read-only community configured
- DDHCP IP pool configured
Why this is the answer
NTP keeps certificates valid by synchronized time; DNS is needed when VPN peers are specified by FQDN.
- Question 34Interactive
Refer to the CLI configuration. Which system interface configuration is represented?
- AThe interface obtains its IP address by DHCPCorrect answer
- BThe interface acts as an IPsec tunnel endpoint
- CThe interface is assigned a static IP address
- DThe interface is a hardware switch member
Why this is the answer
The mode dhcp setting tells the interface to obtain an IP address dynamically from a DHCP server.
- Question 35Single Choice
In a route-based IPsec VPN, which system routing entry must be present to make the remote private network available through the VPN tunnel interface?
- AStatic route to the remote LAN through the tunnel interfaceCorrect answer
- BDefault route through the DNS server
- CNull route to the tunnel interface
- DStatic route to the WAN gateway only
Why this is the answer
Route-based IPsec determines tunnel usage from the routing table, so a route to the remote network via the tunnel interface is required.
Frequently asked questions
Everything about the Fortinet NSE 7 - Enterprise Firewall 7.6 Administrator question bank and how to use it.