[Nov 24, 2025] Fully Updated NSE 7 Network Security Architect (NSE7_EFW-7.2) Certification Sample Questions
Latest Fortinet NSE7_EFW-7.2 Real Exam Dumps PDF
Fortinet NSE7_EFW-7.2 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 40
Refer to the exhibit, which contains a TCL script configuration on FortiManager.
An administrator has configured the TCL script on FortiManager, but the TCL script failed to apply any changes to the managed device after being run.
Why did the TCL script fail to make any changes to the managed device?
- A. The TCL procedure run_cmd has not been created.
- B. The TCL script must start with #include.
- C. The TCL procedure lacks the required loop statements to iterate through the changes.
- D. There is no corresponding #! to signify the end of the script.
Answer: A
NEW QUESTION # 41
Refer to the exhibit.
which contains a partial configuration of the global system. What can you conclude from this output?
- A. NPs and CPs are enabled
- B. Only NPs are disabled
- C. Only CPs arc disabled
- D. NPs and CPs arc disabled
Answer: A
Explanation:
The configuration output shows various global settings for a FortiGate device. The terms NP (Network Processor) and CP (Content Processor) relate to FortiGate's hardware acceleration features. However, the provided configuration output does not directly mention the status (enabled or disabled) of NPs and CPs.
Typically, the command to disable or enable hardware acceleration features would specifically mention NP or CP in the command syntax. Therefore, based on the output provided, we cannot conclusively determine the status of NPs and CPs, hence option D is the closest answer since the output does not confirm that they are enabled.
References:
* FortiOS Handbook - CLI Reference for FortiOS 5.2
NEW QUESTION # 42
Exhibit.
Refer to the exhibit, which shows information about an OSPF interlace
What two conclusions can you draw from this command output? (Choose two.)
- A. The OSPF routers are in the area ID of 0.0.0.1.
- B. The port3 network has more man one OSPF router
- C. The interfaces of the OSPF routers match the MTU value that is configured as 1500.
- D. NGFW-1 is the designated router
Answer: B,C
Explanation:
From the OSPF interface command output, we can conclude that the port3 network has more than one OSPF router because the Neighbor Count is 2, indicating the presence of another OSPF router besides NGFW-1.
Additionally, we can deduce that the interfaces of the OSPF routers match the MTU value configured as 1500, which is necessary for OSPF neighbors to form adjacencies. The MTU mismatch would prevent OSPF from forming a neighbor relationship.
References:
* Fortinet FortiOS Handbook: OSPF Configuration
NEW QUESTION # 43
Exhibit.
Refer to exhibit, which shows a central management configuration
Which server will FortiGate choose for web filler rating requests if 10.0.1.240 is experiencing an outage?
- A. 10.0.1.242
- B. 10.0.1.244
- C. Public FortiGuard servers
- D. 10.0.1.243
Answer: B
Explanation:
In the event of an outage at 10.0.1.240, the FortiGate will choose the next server in the sequence for web filter rating requests, which is 10.0.1.244 according to the configuration shown in the exhibit. This is because the server list is ordered by priority, and the server with the lowest priority number is chosen first. If that server is unavailable, the next server with the next lowest priority number is chosen, and so on. The public FortiGuard servers are only used if the include-default-servers option is enabled and all the custom servers are unavailable. Reference := Fortinet Enterprise Firewall Study Guide for FortiOS 7.2, page 132.
NEW QUESTION # 44
Exhibit.
Refer to the exhibit, which shows a partial web filter profile conjuration What can you cone udo from this configuration about access towww.facebook, com, which is categorized as Social Networking?
- A. The access is blocked based on the Content Filter configuration
- B. The access is blocked based on the URL Filter configuration
- C. The access is allowed based on the FortiGuard Category Based Filter configuration
- D. The access is hocked if the local or the public FortiGuard server does not reply
Answer: B
Explanation:
The access to www.facebook.com is blocked based on the URL Filter configuration. In the exhibit, it shows that the URL "www.facebook.com" is specifically set to "Block" under the URL Filter section1. References := Fortigate: How to configure Web Filter function on Fortigate, Web filter | FortiGate / FortiOS 7.0.2 | Fortinet Document Library, FortiGate HTTPS web URL filtering ... - Fortinet ... - Fortinet Community
NEW QUESTION # 45
Refer to the exhibit, which shows an SSL certification inspection configuration.
Which action does FortiGate take if the server name indication (SNI) doesnotmatch either the common name (CN) or any of the subject alternative names (SAN) in the server certificate?
- A. FortiGate closes the connection because this represents an invalid SSL/TLS configuration
- B. FortiGate uses the first entry listed in the SAN field in the server certificate
- C. FortiGate uses the SNI from the user's web browser.
- D. FortiGate uses the CN information from the Subject field in the server certificate
Answer: A
NEW QUESTION # 46
Which two statements about the Security fabric are true? (Choose two.)
- A. Only FortiGate devices with configuration-sync receive and synchronize global CMDB objects that the toot FortiGate sends
- B. Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer
- C. FortiGate uses the FortiTelemetry protocol to communicate with FortiAnatyzer.
- D. Only the root FortiGate sends logs to FortiAnalyzer
Answer: B,C
Explanation:
FortiGate uses the FortiTelemetry protocol to communicate with FortiAnalyzer and other Security Fabric devices to exchange information such as device status, network topology, and security events1. Only the root FortiGate collects network topology information and forwards it to FortiAnalyzer, where it can be viewed and analyzed2. Reference: = Security Fabric - Fortinet Documentation, Fortinet Security Fabric for Securing Digital Innovations
NEW QUESTION # 47
Exhibit.
Refer to the exhibit, which contains the partial ADVPN configuration of a spoke.
Which two parameters must you configure on the corresponding single hub? (Choose two.)
- A. Set ike-version 2
- B. Set auto-discovery-receiver enable
- C. Set auto-discovery-sender enable
- D. Set auto-discovery-forwarder enable
Answer: A,C
Explanation:
For an ADVPN spoke configuration shown, the corresponding hub must have auto-discovery-sender enabled to send shortcut advertisement messages to the spokes. Also, the hub would need to have auto-discovery- forwarder enabled if it is to forward on those shortcut advertisements to other spokes. This allows the hub to inform all spokes about the best path to reach each other. The ike-version does not need to be reconfigured on the hub if it's already set to version 2 and auto-discovery-receiver is not necessary on the hub because it's the one sending the advertisements, not receiving.
NEW QUESTION # 48
Exhibit.
Refer to the exhibit, which shows information about an OSPF interlace
What two conclusions can you draw from this command output? (Choose two.)
- A. The OSPF routers are in the area ID of 0.0.0.1.
- B. The port3 network has more man one OSPF router
- C. The interfaces of the OSPF routers match the MTU value that is configured as 1500.
- D. NGFW-1 is the designated router
Answer: B,C
Explanation:
From the OSPF interface command output, we can conclude that the port3 network has more than one OSPF router because the Neighbor Count is 2, indicating the presence of another OSPF router besides NGFW-1.
Additionally, we can deduce that the interfaces of the OSPF routers match the MTU value configured as
1500, which is necessary for OSPF neighbors to form adjacencies. The MTU mismatch would prevent OSPF from forming a neighbor relationship.
NEW QUESTION # 49
Refer to the exhibit, which contains a partial BGP combination.
You want to configure a loopback as the OGP source.
Which two parameters must you set in the BGP configuration? (Choose two)
- A. ibgp-enfoce-multihop
- B. update-source
- C. recursive-next-hop
- D. ebgp-enforce-multihop
Answer: B,D
Explanation:
To configure a loopback as the BGP source, you need to set the "ebgp-enforce-multihop" and "update-source" parameters in the BGP configuration. The "ebgp-enforce-multihop" allows EBGP connections to neighbor routers that are not directly connected, while "update-source" specifies the IP address that should be used for the BGP session1. References := BGP on loopback, Loopback interface, Technical Tip: Configuring EBGP Multihop Load-Balancing, Technical Tip: BGP routes are not installed in routing table with loopback as update source
NEW QUESTION # 50
While configuring the BGP protocol, an administrator applies the set network-import-check disable command under config network.
What will FortiGate do as a result of this command?
- A. FortiGate will advertise all the prefixes in the BGP network table to its BGP neighbor, even if it is not in the routing table.
- B. FortiGate will not advertise any imported routes received from one BGP neighbor to another.
- C. FortiGate will advertise only the corresponding prefixes in the BGP network table to its BGP neighbor, even if it is not in the routing table.
- D. FortiGate will not advertise the prefixes, if it is not in the routing table.
Answer: A
Explanation:
Fortigate doesn't advertise the prefix. You can change this behavior by disabling the network- import-check setting. After you disable the setting, Fortigate advertises all prefixes in the BGP network table, regardless of the active routes present in the routing table.
NEW QUESTION # 51
Which two statements about metadata variables are true? (Choose two.)
- A. They can be used as variables in scripts.
- B. The metadata format is $<metadata_variable_name>.
- C. They apply only to non-firewall objects.
- D. You create them on FortiGate.
Answer: A,B
Explanation:
https://docs.fortinet.com/document/fortimanager/7.2.0/new-features/218740/metadata-variables- are-supported-in-firewall-objects-configuration
NEW QUESTION # 52
Refer to the exhibit, which shows device registration on FortiManager.
What can you conclude about the Spoke-1 and Spoke-2 configurations with respect to the information cond: Modified (recent auto-updated)?
- A. Spoke-1 and Spoke-2 are sharing the same security policy configuration and the same policy package.
- B. On both Spoke-1 and Spoke-2, the configuration was changed directly on the FortiGate device, and the changes were automatically retrieved by the device database.
- C. Based on the policy configuration on NGFW-1, the configuration on both spokes is modified and automatically updated.
- D. On NGFW-A, the configuration was changed and spokes are wailing for an autoupdate.
Answer: D
NEW QUESTION # 53
While configuring the BGP protocol, an administrator applies the set netuork-inport-check disable command under config network.
What will FortiGate do as a result of this command?
- A. FortiGate will advertise all the prefixes in the BGP network table to its BGP neighbor, even f itis not in the routing table.
- B. FortiGate will not advertise any imported routes received from one BGP neighbor to another.
- C. FortiGate will advertise only the corresponding prefixes in the BGP network table to its BGP neighbor, even if itis not in the routing table.
- D. FortiGate will not advertise the prefixes, if it is not in the routing table.
Answer: A
NEW QUESTION # 54
You want to improve reliability over a lossy IPSec tunnel.
Which combination of IPSec phase 1 parameters should you configure?
- A. dpd and dpd-retryinterval
- B. fec-ingress and fsc-egrsss
- C. fragmentation and fragmentation-mtu
- D. keepalive and keylive
Answer: B
Explanation:
It improves reliability that can overcome adverse WAN conditions such as lossy or noisy links.
NEW QUESTION # 55
Refer to the exhibit, which shows a network diagram.
Which IPsec phase 2 configuration should you impalement so that only one remote site is connected at any time?
- A. Set route-overlap to either use-new or use-old
- B. Set single-source to enable
- C. Set net-device to enable
- D. Set route-overlap to allow.
Answer: A
Explanation:
To ensure that only one remote site is connected at any given time in an IPsec VPN scenario, you should use route-overlap with the option to either use-new or use-old. This setting dictates which routes are preferred and how overlaps in routes are handled, allowing for one connection to take precedence over the other (C).
References:
* FortiOS Handbook - IPsec VPN
NEW QUESTION # 56
Exhibit.
Refer to the exhibit, which contains a partial VPN configuration.
What can you conclude from this configuration1?
- A. The VPN should use the dynamic routing protocol to exchange routing information Through the tunnels.
- B. The routing table shows a single IPSec virtual interface.
- C. Dead peer detection s disabled.
- D. FortiGate creates separate virtual interfaces for each dial up client.
Answer: C
Explanation:
The configuration line "set dpd on-idle" indicates that dead peer detection (DPD) is set to trigger only when the tunnel is idle, not actively disabled1. References: FortiGate IPSec VPN User Guide - Fortinet Document Library From the given VPN configuration, dead peer detection (DPD) is set to 'on-idle', indicating that DPD is enabled and will be used to detect if the other end of the VPN tunnel is still alive when no traffic is detected.
Hence, option C is incorrect. The configuration shows the tunnel set to type 'dynamic', which does not create separate virtual interfaces for each dial-up client (A), and it is not specified that dynamic routing will be used (B). Since this is a phase 1 configuration snippet, the routing table aspect (D) cannot be concluded from this alone.
NEW QUESTION # 57
You want to improve reliability over a lossy IPSec tunnel.
Which combination of IPSec phase 1 parameters should you configure?
- A. fec-ingress and fec-egress
- B. fragmentation and fragmentation-mtu
- C. keepalive and keylive
- D. Odpd and dpd-retryinterval
Answer: D
Explanation:
For improving reliability over a lossy IPSec tunnel, the fragmentation and fragmentation-mtu parameters should be configured. In scenarios where there might be issues with packet size or an unreliable network, setting the IPsec phase 1 to allow for fragmentation will enable large packets to be broken down, preventing them from being dropped due to size or poor network quality. The fragmentation-mtu specifies the size of the fragments. This is aligned with Fortinet's recommendations for handling IPsec VPN over networks with potential packet loss or size limitations.
NEW QUESTION # 58
Which two statements about IKE version 2 fragmentation are true? (Choose two.)
- A. The reassembly timeout default value is 30 seconds.
- B. The maximum number of IKE version 2 fragments is 128.
- C. Only some IKE version 2 packets are considered fragmentable.
- D. It is performed at the IP layer.
Answer: B,C
Explanation:
In IKE version 2, not all packets are fragmentable. Only certain messages within the IKE negotiation process can be fragmented. Additionally, there is a limit to the number of fragments that IKE version 2 can handle, which is 128. This is specified in the Fortinet documentation and ensures that the IKE negotiation process can proceed even in networks that have issues with large packets. The reassembly timeout and the layer at which fragmentation occurs are not specified in this context within Fortinet documentation.
NEW QUESTION # 59
Which statement about network processor (NP) offloading is true?
- A. The NP provides IPS signature matching
- B. You can disable the NP for each firewall policy using the command np-acceleration st to loose.
- C. The NP checks the session key or IPSec SA
- D. For TCP traffic FortiGate CPU offloads the first packets of SYN/ACK and ACK of the three-way handshake to NP
Answer: D
Explanation:
Option A is correct because the FortiGate CPU offloads the first packets of TCP sessions to the NP for faster connection establishment and reduced CPU load1. This feature is called TCP offloading and it is enabled by default on FortiGate models with NP6 or higher2.
Option B is incorrect because the NP does not provide IPS signature matching. The NP only handles the packet forwarding and encryption/decryption functions, while the IPS signature matching is performed by the content processor (CP) or the CPU3.
Option C is incorrect because the command to disable the NP for each firewall policy is set np-acceleration disable, not set np-acceleration st to loose4. This command can be used to prevent certain traffic types from being offloaded to the NP, such as multicast, broadcast, or non-IP packets5.
Option D is incorrect because the NP does not check the session key or IPSec SA. The NP only offloads the IPSec encryption/decryption and tunneling functions, while the session key and IPSec SA are managed by the CPU. Reference: =
1: TCP offloading
2: Network processors (NP6, NP6XLite, NP6Lite, and NP4)
3: Content processors (CP9, CP9XLite, CP9Lite)
4: Disabling NP offloading for firewall policies
5: NP hardware acceleration alters packet flow
6: IPSec VPN concepts
NEW QUESTION # 60
Which FortiGate in a Security I auric sends togs to FortiAnalyzer?
- A. Each FortiGate in the Security fabric.
- B. Only the root FortiGate.
- C. The FortiGate devices performing network address translation (NAT) or unified threat management (UTM). if configured.
- D. Only the last FortiGate that handled a session in the Security Fabric
Answer: A
Explanation:
Option B is correct because each FortiGate in the Security Fabric can send logs to FortiAnalyzer for centralized logging and analysis12. This allows you to monitor and manage the entire Security Fabric from a single console and view aggregated reports and dashboards.
Option A is incorrect because the root FortiGate is not the only device that can send logs to FortiAnalyzer. The root FortiGate is the device that initiates the Security Fabric and acts as the central point of contact for other FortiGate devices3. However, it does not have to be the only log source for FortiAnalyzer.
Option C is incorrect because the FortiGate devices performing NAT or UTM are not the only devices that can send logs to FortiAnalyzer. These devices can perform additional security functions on the traffic that passes through them, such as firewall, antivirus, web filtering, etc4. However, they are not the only devices that generate logs in the Security Fabric.
Option D is incorrect because the last FortiGate that handled a session in the Security Fabric is not the only device that can send logs to FortiAnalyzer. The last FortiGate is the device that terminates the session and applies the final security policy5. However, it does not have to be the only device that reports the session information to FortiAnalyzer. Reference: =
1: Security Fabric - Fortinet Documentation1
2: FortiAnalyzer Demo6
3: Security Fabric topology
4: Security Fabric UTM features
5: Security Fabric session handling
NEW QUESTION # 61
Which two statements about IKE version 2 fragmentation are true? (Choose two.)
- A. The reassembly timeout default value is 30 seconds.
- B. IKEv2 fragmentation is performed at IP layer.
- C. Only some IKE version 2 packets are considered fragmentable.
- D. The maximum number of IKE version 2 fragments are 64.
Answer: C,D
NEW QUESTION # 62
Which statement about network processor (NP) offloading is true?
- A. The NP checks the session key or IPSec SA
- B. The NP provides IPS signature matching
- C. You can disable the NP for each firewall policy using the command np-acceleration st to loose.
- D. For TCP traffic FortiGate CPU offloads the first packets of SYN/ACK and ACK of the three-way handshake to NP
Answer: A
Explanation:
Network processors (NPs) are specialized hardware within FortiGate devices that accelerate certain security functions. One of the primary functions of NPs is to provide IPS signature matching (B), allowing for high- speed inspection of traffic against a database of known threat signatures.
NEW QUESTION # 63
......
Fortinet NSE7_EFW-7.2 Dumps - Secret To Pass in First Attempt: https://pdfexamfiles.actualtestsquiz.com/NSE7_EFW-7.2-test-torrent.html
