I85PREP
⌘ K
Forcepoint NGFW Admin study materials
Forcepoint NGFW Admin study resources

Forcepoint NGFW Admin practice questions

One question at a time. Build your Forcepoint NGFW Admin understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1NGFW Deployment and Installation

In a Forcepoint NGFW deployment, which component is the central management server that stores the security policy and distributes it to engines?

  1. The Web Portal
  2. The Log Server
  3. The Management Server Correct answer.
  4. The Inspection Engine

Explanation

The Management Server (SMC) holds the configuration database and security policy, and it pushes that policy to the engines it manages. Log servers and engines are separate roles, although they can be co-located on the same appliance.

Question 2NGFW Deployment and Installation

You are preparing a physical Forcepoint NGFW appliance for first-time configuration. Which interface is used to reach the engine for initial setup before any management connection exists?

  1. The highest-numbered data interface
  2. The external DNS-facing interface
  3. The heartbeat interface
  4. The dedicated management (MGMT) interface Correct answer.

Explanation

The dedicated management interface is used for initial contact, licensing, and management connectivity. Data interfaces carry inspected traffic and should not be the first-setup path.

Question 3NGFW Deployment and Installation

When an engine is configured in IPS mode with inline interfaces, what happens to a packet that the policy blocks?

  1. It is queued until an administrator approves it.
  2. It is forwarded and only logged.
  3. It is dropped before it reaches the destination. Correct answer.
  4. It is rewritten and forwarded with a warning header.

Explanation

Inline IPS places the engine directly in the traffic path, so blocked traffic is dropped in real time rather than forwarded. This differs from passive or tap modes, where traffic continues and only alerts are generated.

Question 4NGFW Deployment and Installation

Which deployment mode places a Forcepoint NGFW engine outside the traffic path so it analyzes a copy of traffic without affecting forwarding?

  1. Passive (SPAN/tap) mode Correct answer.
  2. Layer 2 bridge mode
  3. Virtual appliance routing mode
  4. Inline IPS mode

Explanation

Passive mode receives a mirrored copy of traffic from a switch SPAN port or tap, so the engine cannot block and does not alter forwarding. Inline and routed modes sit in the path and can enforce drops.

Question 5NGFW Deployment and Installation

What is the purpose of the initial contact / one-time password step when adding a new engine to a Forcepoint NGFW Management Server?

  1. To import the engine's existing third-party firewall rules
  2. To assign the engine its public IP address automatically
  3. To license the engine's IPS signatures offline
  4. To authenticate the engine and establish the management connection securely Correct answer.

Explanation

The one-time password authenticates the engine during its first connection to the management server, allowing the secure management channel to be established. It does not configure addressing or import third-party rules.

Question 6NGFW Deployment and Installation

Which Forcepoint NGFW component is responsible for storing and indexing the traffic and security logs generated by engines?

  1. The Policy Installer
  2. The Log Server Correct answer.
  3. The Management Server
  4. The Inspection Engine

Explanation

Log servers receive, store, and index log data from engines so administrators can search and report on it. The management server handles configuration and policy, not bulk log storage.

Question 7NGFW Deployment and Installation

When deploying a Forcepoint NGFW Virtual Engine, which prerequisite must be satisfied before the engine can be managed?

  1. The engine must use a physical bypass NIC
  2. The hypervisor must run on bare-metal only
  3. The virtual platform must be on the supported hypervisor list for that release Correct answer.
  4. The engine must be licensed as a Log Server

Explanation

Virtual engines are supported only on specific hypervisors and versions documented for each release, so platform compatibility must be verified first. Bare-metal requirements, bypass NICs, and log-server licensing are not general prerequisites.

Question 8NGFW Deployment and Installation

What does a Forcepoint NGFW appliance use its heartbeat interfaces for in a high-availability cluster?

  1. Carrying inspected user traffic between networks
  2. Exchanging state and health information between cluster nodes Correct answer.
  3. Providing out-of-band console access for administrators
  4. Downloading signature updates from the update server

Explanation

Heartbeat interfaces exchange health and state information so cluster nodes can detect failures and coordinate failover. They are dedicated to node communication and should not carry inspected user traffic.

Question 9NGFW Deployment and Installation

An administrator needs to add a new engine to an existing Forcepoint NGFW Management Server. Which sequence reflects the correct onboarding flow?

  1. Install the policy first, then create the engine element and interfaces
  2. Create the log server, then define the engine's data interfaces
  3. Configure the engine's routing, then generate the one-time password last
  4. Create the engine element, define its interfaces and routing, then install the policy Correct answer.

Explanation

The engine element must exist in the management server with its interfaces and routing defined before a policy can be generated and installed to it. Policy installation is the final step that activates the configuration.

Question 10NGFW Deployment and Installation

A Forcepoint NGFW engine in routed mode must forward traffic between an internal network and the internet. What must be configured on the engine for this to work?

  1. IP addresses on the interfaces and a default route toward the internet gateway Correct answer.
  2. A bypass NIC in fail-open mode
  3. A second management server for redundancy
  4. A SPAN port mirroring the internal traffic

Explanation

Routed mode requires interface IP addresses and a routing table that directs traffic to the correct next hop, typically a default route toward the internet. SPAN ports and bypass NICs belong to other deployment modes.

Question 11NGFW Deployment and Installation

You are deploying a Forcepoint NGFW engine in Layer 2 bridge mode between two VLANs. Which statement describes how the engine handles traffic?

  1. It requires a unique IP address on every bridged VLAN
  2. It drops all broadcast traffic to prevent loops
  3. It performs NAT on all bridged traffic by default
  4. It forwards frames between the bridged interfaces without changing IP addressing Correct answer.

Explanation

In Layer 2 bridge mode the engine forwards frames between bridged interfaces transparently, so hosts keep their existing IP addressing. NAT and per-VLAN IP addressing are not inherent to bridging.

Question 12NGFW Deployment and Installation

During a Forcepoint NGFW installation, what is the role of the license/policy refresh after the engine contacts the management server?

  1. It retrieves the engine's license and the initial configuration from the management server Correct answer.
  2. It permanently locks the engine to the first management server it contacts
  3. It converts the engine from IPS mode to passive mode
  4. It disables the management interface for security

Explanation

After initial contact, the engine retrieves its license and configuration from the management server so it can begin enforcing policy. The process does not lock the engine permanently or change its deployment mode.

Question 13NGFW Deployment and Installation

A Forcepoint NGFW cluster uses two nodes in active-standby mode. If the active node fails, what does the standby node do?

  1. It requires a new one-time password before forwarding traffic
  2. It takes over the active role and continues enforcing the same policy Correct answer.
  3. It enters passive monitoring mode until manual intervention
  4. It reloads its configuration from the log server

Explanation

In active-standby HA, the standby node detects the failure through heartbeat and takes over the active role, continuing to enforce the installed policy. No manual re-authentication or log-server reload is required.

Question 14NGFW Deployment and Installation

An administrator is planning a Forcepoint NGFW deployment and wants the management server and log server roles separated onto different appliances. What is a valid reason for this design?

  1. To eliminate the need for heartbeat interfaces
  2. To avoid needing a license for the engine
  3. To distribute processing and storage load across dedicated appliances Correct answer.
  4. To allow the engine to run without a policy

Explanation

Separating management and log server roles lets each appliance dedicate resources to its function, which is useful in large or high-log-volume environments. It does not remove licensing, heartbeat, or policy requirements.

Question 15NGFW Deployment and Installation

You need to deploy a Forcepoint NGFW engine that will inspect traffic for a VMware environment without dedicating a physical appliance per virtual network. Which deployment type fits best?

  1. A physical appliance in passive mode
  2. A standalone log server appliance
  3. A virtual engine on a supported hypervisor Correct answer.
  4. A Layer 2 bridge on dedicated hardware

Explanation

A virtual engine runs on a supported hypervisor and can inspect traffic for virtualized workloads without a dedicated physical appliance per network. Passive, bridge, and log server options do not provide this virtualized inspection role.

Question 16NGFW Deployment and Installation

What is the recommended practice for the management connection between a Forcepoint NGFW engine and its management server in a production deployment?

  1. Place it on a dedicated, protected management network Correct answer.
  2. Share it with the busiest data interface
  3. Route it over the public internet without encryption
  4. Disable it after the initial policy install

Explanation

Management connectivity should be isolated on a protected network to prevent tampering with policy and configuration. Sharing it with data traffic or exposing it unencrypted increases risk.

Question 17NGFW Deployment and Installation

When installing a policy to a Forcepoint NGFW engine, the installation fails with a configuration error. What is the most appropriate first step?

  1. Reinstall the engine's operating system
  2. Delete the log server and recreate it
  3. Review the policy validation messages to identify the conflicting or incomplete element Correct answer.
  4. Replace the engine's heartbeat interface

Explanation

Policy installation failures usually report validation or configuration errors that point to the specific element needing correction. Reinstalling the OS or replacing hardware is disproportionate before reviewing those messages.

Question 18NGFW Deployment and Installation

An administrator wants a Forcepoint NGFW engine to fail open if it loses power, so traffic continues to flow. Which hardware feature supports this?

  1. A bypass NIC that bridges its ports when the engine is powered off Correct answer.
  2. A second management server
  3. A heartbeat interface configured for active-standby
  4. A SPAN port on the upstream switch

Explanation

Bypass NICs physically bridge their ports when the appliance loses power, allowing traffic to continue. Heartbeat, SPAN, and management redundancy do not provide power-loss fail-open behavior.

Question 19NGFW Deployment and Installation

Which factor most directly determines whether a Forcepoint NGFW Virtual Engine can be deployed on a given hypervisor version?

  1. The hypervisor and version appearing on the release's supported platform list Correct answer.
  2. The engine's log retention setting
  3. The management server's web portal theme
  4. The number of physical NICs in the host

Explanation

Virtual engine support is tied to specific hypervisor platforms and versions documented for each release. NIC count, log retention, and portal settings do not determine platform compatibility.

Question 20NGFW Deployment and Installation

A Forcepoint NGFW engine is being deployed in inline IPS mode. Which design consideration is most important for avoiding a single point of failure?

  1. Deploying engines in a high-availability cluster or using bypass NICs Correct answer.
  2. Removing the default route from the engine
  3. Disabling the management interface after installation
  4. Configuring the engine in passive mode instead

Explanation

Because inline engines sit in the traffic path, a failure can interrupt connectivity, so HA clustering or bypass NICs mitigate that risk. Passive mode, routing changes, and disabling management do not address inline availability.

Question 21NGFW Deployment and Installation

An organization must deploy a Forcepoint NGFW where the engine cannot change existing IP addressing on the protected segment, but traffic still needs inspection and blocking. Which deployment approach meets these constraints?

  1. Layer 2 bridge mode with inline inspection Correct answer.
  2. A standalone log server in the path
  3. Passive mode with SPAN mirroring
  4. Routed mode with NAT on all interfaces

Explanation

Bridge mode forwards frames transparently so existing IP addressing is preserved, while inline inspection still allows blocking. Routed NAT changes addressing, passive mode cannot block, and a log server does not inspect traffic.

Question 22NGFW Deployment and Installation

A Forcepoint NGFW cluster is being designed with two nodes. The administrator assigns the same management IP to both nodes and expects failover to work. Why is this design problematic?

  1. The management server cannot manage more than one engine
  2. Heartbeat interfaces cannot coexist with management interfaces
  3. The log server requires a unique address per policy
  4. Each node needs its own management address; a shared cluster address is separate from node management addresses Correct answer.

Explanation

Cluster nodes each require unique node management addresses, while a separate cluster address can be shared for management access. Duplicating the same node address causes conflicts and prevents proper failover management.

Question 23NGFW Deployment and Installation

During a Forcepoint NGFW deployment, an engine is placed inline but the administrator wants alerts without dropping traffic while tuning signatures. Which approach best supports this?

  1. Remove the default route
  2. Disable logging on the engine
  3. Move the engine to passive mode permanently
  4. Configure the relevant rules in a detection-only or alert-only action while retaining inline placement Correct answer.

Explanation

Inline placement can still be used while specific rules are set to alert rather than block, allowing tuning before enforcement. Moving to passive mode or disabling logging sacrifices visibility and control.

Question 24NGFW Deployment and Installation

An administrator must onboard a new Forcepoint NGFW engine but the management server cannot reach the engine's management interface. Which troubleshooting step is most appropriate?

  1. Verify routing and firewall rules between the management server and the engine's management address Correct answer.
  2. Reinstall the engine's IPS signatures
  3. Recreate the log server database
  4. Replace the engine's data interfaces

Explanation

Initial contact requires network reachability between the management server and the engine's management address, so routing and intervening firewall rules should be checked first. Signature, data interface, and log database actions do not address connectivity.

Question 25NGFW Deployment and Installation

Which statement accurately describes the relationship between a Forcepoint NGFW Management Server and the engines it manages?

  1. Engines store the central policy database for the cluster
  2. The management server inspects all traffic directly
  3. The management server defines and distributes policy, while engines enforce it locally Correct answer.
  4. Engines define policy and push it to the management server

Explanation

The management server is the policy authoring and distribution point, and engines enforce the installed policy on traffic. Engines do not author central policy, and the management server does not sit in the traffic path.

Question 26NGFW Deployment and Installation

When planning the installation of a Forcepoint NGFW engine, which component is responsible for providing the initial configuration and policy to the engine?

  1. The Log Server
  2. The external authentication server
  3. The Management Server Correct answer.
  4. The local engine's web UI

Explanation

The Management Server holds the configuration and policy for all managed engines and delivers them during initial contact and subsequent refreshes. The engine itself does not store the authoritative policy; it receives and enforces it. Log and authentication servers serve different roles and do not provision engine configuration.

Question 27NGFW Deployment and Installation

Which statement describes the recommended network placement for the Management Server in a Forcepoint NGFW deployment?

  1. Place it on the same untrusted segment as the public internet edge.
  2. Place it on a dedicated management network that is reachable by all engines. Correct answer.
  3. Place it directly on the engine's heartbeat network to reduce latency.
  4. Place it on the same subnet as the protected internal hosts for visibility.

Explanation

The Management Server should reside on a dedicated, protected management network that all managed engines can reach securely. This isolates management traffic from user and internet traffic and supports consistent policy distribution. Placing it on untrusted or production segments exposes management to unnecessary risk.

Question 28NGFW Deployment and Installation

An administrator is installing a Forcepoint NGFW engine and needs to decide between the default and custom installation modes. Which statement best describes the difference?

  1. Default mode installs only the engine, while custom mode installs only the Management Server.
  2. Default mode uses predefined settings for most parameters, while custom mode allows the administrator to specify each setting. Correct answer.
  3. Default mode is used only for virtual engines, while custom mode is used only for physical appliances.
  4. Default mode requires a license file, while custom mode does not require any license.

Explanation

The default installation mode applies predefined values for most configuration parameters to simplify and speed up deployment. The custom mode prompts the administrator to specify each setting individually, which is useful for nonstandard environments. Both modes can be used with supported engine types and still require proper licensing.

Question 29NGFW Deployment and Installation

Which protocol and port are used by default for the management connection between a Forcepoint NGFW engine and its Management Server?

  1. HTTPS over TCP 443 Correct answer.
  2. SNMP over UDP 161
  3. SSH over TCP 22
  4. Syslog over UDP 514

Explanation

By default, the engine contacts the Management Server over HTTPS on TCP port 443 to retrieve configuration and policy. This encrypted channel protects management data in transit. SSH, SNMP, and syslog serve other purposes and are not the default management channel.

Question 30NGFW Deployment and Installation

During the installation of a Forcepoint NGFW engine, the administrator must provide the Management Server address. What is the purpose of this step?

  1. To specify the DNS server that the engine will use for resolving domain names.
  2. To set the time zone used in log timestamps.
  3. To configure the engine's default gateway for user traffic.
  4. To allow the engine to download its license and initial policy automatically. Correct answer.

Explanation

Providing the Management Server address allows the engine to contact the management server, authenticate, and retrieve its license and initial configuration or policy. This step establishes the management relationship. Default gateway, DNS, and time zone are separate configuration items.

Question 31NGFW Deployment and Installation

An administrator is deploying a Forcepoint NGFW Virtual Engine on a hypervisor. Which prerequisite must be met before the virtual engine can be successfully managed by the Management Server?

  1. The virtual engine must have at least two physical network interfaces assigned.
  2. The virtual engine must be running the same OS version as the Management Server.
  3. The virtual engine must be able to reach the Management Server over the network. Correct answer.
  4. The virtual engine must be licensed through the hypervisor vendor.

Explanation

A virtual engine must have network connectivity to the Management Server so it can retrieve configuration and policy and be managed. The number of interfaces depends on the deployment, and OS version parity is not required. Licensing is handled through Forcepoint, not the hypervisor vendor.

Question 32NGFW Deployment and Installation

An administrator is installing a Forcepoint NGFW engine in a high-availability cluster. Which statement describes the role of the heartbeat interfaces?

  1. They exchange state and health information between cluster nodes. Correct answer.
  2. They synchronize logs between nodes for centralized storage.
  3. They carry user traffic between cluster nodes during failover.
  4. They provide management access to each node from the Management Server.

Explanation

Heartbeat interfaces are dedicated to exchanging health and state information between cluster nodes so that failover can be coordinated. They do not carry user traffic or management server traffic. Log synchronization is handled separately from the heartbeat function.

Question 33NGFW Deployment and Installation

When adding a new engine to an existing Forcepoint NGFW Management Server, which step must be completed before the engine can receive its policy?

  1. The engine must be defined in the Management Server's configuration and associated with a policy. Correct answer.
  2. The engine must be registered with the Log Server before the Management Server.
  3. The engine must be manually assigned a public IP address.
  4. The engine must first be rebooted into maintenance mode.

Explanation

The Management Server must have a definition for the engine, including its network settings and policy association, before the engine can retrieve and enforce policy. This definition is created in the management interface. Rebooting, public IP assignment, or log server registration are not prerequisites for policy delivery.

Question 34NGFW Deployment and Installation

A Forcepoint NGFW engine is being deployed in routed mode. Which configuration must be applied to the engine's interfaces to allow it to forward traffic between networks?

  1. Each interface must be configured as a Layer 2 bridge.
  2. Each interface must be assigned an IP address and associated with a network. Correct answer.
  3. Each interface must be set to discard all traffic by default.
  4. Each interface must be assigned to the same VLAN.

Explanation

In routed mode, interfaces need IP addresses and network associations so the engine can route packets between connected networks. Layer 2 bridging is a different mode, and discarding traffic would prevent forwarding. Assigning all interfaces to one VLAN would not provide routing between distinct networks.

Question 35NGFW Deployment and Installation

During a Forcepoint NGFW installation, the administrator wants to verify that the engine can reach the Management Server before completing the configuration. Which action is most appropriate?

  1. Ping the Management Server from the engine's diagnostic console. Correct answer.
  2. Change the engine's management IP to a public address.
  3. Disable the engine's firewall to allow all traffic.
  4. Restart the Management Server to force a connection.

Explanation

Using the engine's diagnostic console to ping the Management Server verifies basic network reachability without altering the configuration. Disabling the firewall or restarting the server introduces unnecessary risk and does not confirm reachability. Changing the management IP does not address connectivity verification.

Question 36NGFW Deployment and Installation

An administrator is planning a Forcepoint NGFW deployment and needs to decide whether to use a single Management Server or a high-availability Management Server pair. Which factor most directly justifies the high-availability pair?

  1. The need to inspect encrypted traffic at the engine.
  2. The need to manage a large number of engines across multiple sites.
  3. The requirement to avoid a single point of failure for management operations. Correct answer.
  4. The desire to reduce the cost of engine licenses.

Explanation

A high-availability Management Server pair is justified when management operations must continue despite a server failure, eliminating a single point of failure. Managing many engines or multiple sites can be done with a single server, and license cost or traffic inspection are unrelated to management server availability.

Question 37NGFW Deployment and Installation

A Forcepoint NGFW engine is deployed in inline IPS mode. Which design consideration is most important to avoid disrupting production traffic if the engine fails?

  1. Configure the engine to reboot automatically on failure.
  2. Configure the engine to forward traffic without inspection.
  3. Configure the engine to fail open using a bypass mechanism. Correct answer.
  4. Configure the engine to drop all traffic on failure.

Explanation

In inline IPS mode, a failure of the engine can break the network path. Configuring a fail-open bypass mechanism allows traffic to continue flowing if the engine fails, reducing disruption. Dropping all traffic or rebooting does not preserve connectivity, and forwarding without inspection defeats the IPS purpose.

Question 38NGFW Deployment and Installation

An organization must deploy a Forcepoint NGFW where the engine cannot change existing IP addressing on the protected segment. Which engine deployment mode best meets this requirement?

  1. Routed mode with new subnets
  2. Transparent proxy mode
  3. NAT mode with address translation
  4. Layer 2 bridge mode Correct answer.

Explanation

Layer 2 bridge mode allows the engine to be inserted into an existing network without changing IP addressing, because it forwards frames at Layer 2. Routed mode and NAT would require addressing changes or translation. Transparent proxy is not the deployment mode that preserves existing addressing in this way.

Question 39NGFW Deployment and Installation

A Forcepoint NGFW cluster is being designed with two nodes. The administrator assigns the same management IP address to both nodes. What is the result?

  1. The cluster cannot be managed correctly because each node needs a unique management IP. Correct answer.
  2. The shared IP is used only for heartbeat traffic between nodes.
  3. The Management Server automatically resolves the conflict by using the shared IP.
  4. Both nodes can be managed independently using the shared IP.

Explanation

Each cluster node requires a unique management IP address so the Management Server can address it individually. Assigning the same IP to both nodes creates a conflict and prevents correct management. The Management Server does not automatically resolve duplicate addresses, and the heartbeat uses separate interfaces.

Question 40NGFW Deployment and Installation

During a Forcepoint NGFW deployment, an engine is placed inline but the administrator wants alerts without dropping traffic. Which engine mode should be used?

  1. Inline IPS mode with blocking enabled
  2. Layer 2 bridge mode with no inspection
  3. Routed mode with deny-all policy
  4. Inline IPS mode with only alerting enabled Correct answer.

Explanation

Inline IPS mode can be configured to alert without blocking, allowing the engine to inspect traffic and generate alerts while still forwarding packets. Enabling blocking would drop traffic, and disabling inspection or applying a deny-all policy would not meet the goal of alerting without dropping.

Question 41NGFW Engine and Policy Configuration

In Forcepoint NGFW, which policy type determines whether traffic is allowed, discarded, or subjected to further inspection before it reaches the engine's routing decision?

  1. The Inspection policy
  2. The Access rule policy (Firewall policy layer) Correct answer.
  3. The VPN policy
  4. The NAT policy

Explanation

The access/firewall rule policy is evaluated first for each packet and decides whether traffic is allowed, denied, or passed to deeper inspection such as IPS. NAT, inspection, and VPN policies act on traffic that the access rules have already permitted.

Question 42NGFW Engine and Policy Configuration

When a Forcepoint NGFW engine is deployed in IPS (inline) mode rather than in a firewall/VPN context, what happens to traffic that the engine does not need to inspect?

  1. It is passed through without requiring access rules to permit it Correct answer.
  2. It is dropped until an administrator creates an allow rule
  3. It is routed to the management server for a decision
  4. It is queued until the inspection policy finishes running

Explanation

An IPS-mode engine is a transparent inline sensor, so traffic flows through by default and only matching inspection rules act on it. Access rules that permit or deny traffic are the firewall/VPN mode construct.

Question 43NGFW Engine and Policy Configuration

Which element in the Forcepoint NGFW Management Client represents a group of engines that share a common configuration and policy?

  1. An engine group Correct answer.
  2. A template
  3. A policy template
  4. A domain

Explanation

An engine group lets you configure and push a single set of policies to multiple engines at once. Domains are administrative partitions, and templates are reusable configuration objects rather than engine collections.

Question 44NGFW Engine and Policy Configuration

In the Forcepoint NGFW rule table, what is the effect of the Continue action on a matching access rule?

  1. It stops rule evaluation and denies the connection
  2. It redirects the connection to a captive portal
  3. It stops rule evaluation and permits the connection
  4. It records a log entry and continues evaluating subsequent rules Correct answer.

Explanation

The Continue action lets evaluation fall through to later rules, which is how you combine logging or inspection with a final decision made further down the table. A final Allow or Discard action ends evaluation for that connection.

Question 45NGFW Engine and Policy Configuration

Which object type would you create in Forcepoint NGFW to represent a set of IPv4 addresses that can be referenced by many rules and updated in one place?

  1. A network element
  2. An IP address list (network group) Correct answer.
  3. A service element
  4. A policy template

Explanation

IP address lists and network groups hold multiple addresses or networks as a single reusable element, so editing the group updates every rule that references it. Service elements describe protocols and ports, not hosts.

Question 46NGFW Engine and Policy Configuration

What does the Forcepoint NGFW engine do with a connection that matches no rule in the access rule table when the default action is set to Discard?

  1. It holds the connection pending administrator approval
  2. It drops the connection Correct answer.
  3. It forwards the connection for inspection only
  4. It permits the connection and logs it

Explanation

Rules are evaluated top-down and an unmatched connection falls to the default action at the end of the table. With Discard configured, unmatched traffic is dropped rather than inspected or held.

Question 47NGFW Engine and Policy Configuration

Which statement describes the relationship between a policy layer and the rules inside it in the Forcepoint NGFW Management Client?

  1. A layer is a single rule that can be enabled or disabled
  2. A layer contains an ordered set of rules evaluated from top to bottom Correct answer.
  3. A layer stores only NAT translations
  4. A layer is a backup copy of the firewall policy

Explanation

A policy layer is a container for an ordered rule table, and evaluation proceeds from the first rule downward until a terminating action matches. Layers can be nested so that a sub-policy is evaluated at the point where a rule references it.

Question 48NGFW Engine and Policy Configuration

An administrator wants to reuse the same rule set across several branch engines while allowing each site to add local exceptions. Which Forcepoint NGFW feature supports this?

  1. Shared policy layers combined with engine-specific layers Correct answer.
  2. A single engine with multiple virtual firewalls
  3. Engine groups with a shared template policy
  4. Domain separation with one administrator per branch

Explanation

Shared policy layers hold the common rules, and each engine's policy can add its own layer for local exceptions, so changes to the shared layer propagate to all engines. Engine groups alone force identical policy, which prevents per-site exceptions.

Question 49NGFW Engine and Policy Configuration

A rule allows HTTP from the internal network to any external host, and a second rule below it blocks access to a specific external server. Why does traffic to that server still get permitted?

  1. The block rule must be placed in a different policy layer
  2. The allow rule must be converted to a NAT rule
  3. The block rule needs to be moved above the allow rule Correct answer.
  4. The block rule must use the Continue action

Explanation

Rules are evaluated in order and the first terminating match wins, so the broad allow rule ends evaluation before the block rule is reached. Moving the specific block rule above the allow rule makes it match first.

Question 50NGFW Engine and Policy Configuration

Which Forcepoint NGFW element is used to match traffic by TCP or UDP port number within an access rule?

  1. A time expression
  2. An application element
  3. A service element Correct answer.
  4. A network element

Explanation

Service elements define the protocol and port or port range that a rule matches, such as TCP/443 for HTTPS. Network elements match addresses, and application elements match traffic by application signature rather than port.