NSE7_EFW Security And VPN — 50 Questions

Question 1

In an OSPF setup, you have a redundant path. You want to ensure traffic prefers one link over another based on cost. Which OSPF command is used?

Accepted Answer

set ospf-cost. The OSPF cost is configured on the interface level to influence link preference.

Answer

set metric-type

Answer

set bandwidth-reference

Answer

set priority

Question 2

In a BGP deployment, your FortiGate is receiving routes from two different ISPs. You want to influence outbound traffic to prefer ISP1 for specific destinations. Which BGP attribute should you modify?

Accepted Answer

Local Preference. Local Preference is a well-known BGP attribute used within an autonomous system to influence outbound path selection. A higher local preference value makes a route preferred, so setting a higher local preference for routes learned from ISP1 causes the FortiGate to prefer ISP1 for those destinations. It is propagated only within the local AS, which is exactly the scope needed here.

Answer

Weight

Answer

AS-Path

Answer

Multi-Exit Discriminator (MED)

Question 3

Which FortiGate feature allows you to bypass SSL inspection for specific known-trusted websites to maintain user privacy?

Accepted Answer

URL Filter category exemption. The URL Filter category exemption allows administrators to bypass SSL inspection for specific URL categories that are considered trusted, such as financial or healthcare sites, to maintain user privacy and comply with regulations. This is configured in the SSL inspection profile by exempting certain categories from deep inspection.

Answer

Firewall address object

Answer

Application Control override

Answer

IPS signature exclusion

Question 4

You are troubleshooting a high CPU issue on a FortiGate. Which utility should you use to identify which process is consuming the most resources?

Accepted Answer

diagnose sys top. The 'get system performance status' command is the primary tool to see process-level CPU usage.

Answer

get system hardware status

Answer

diagnose sniffer packet

Answer

get router info memory

Question 5

In a site-to-site VPN, you need to allow traffic initiated from the remote site. What configuration is essential on the local FortiGate?

Accepted Answer

A firewall policy allowing traffic from the VPN zone to the Internal zone. To allow traffic initiated from the remote site to the local internal network, a firewall policy on the local FortiGate must permit traffic from the VPN zone (where the IPSec tunnel terminates) to the Internal zone. This policy defines the allowed source and destination addresses and services.

Answer

An IPSec phase 3 policy

Answer

A static route to the remote subnet

Answer

A NAT rule for the remote subnet

Question 6

Which THREE of the following are mandatory for a BGP neighbor adjacency to establish?

Accepted Answer

Correct autonomous system numbers. Option B is correct because BGP peers must have compatible autonomous system numbers: an eBGP session requires the remote peer to be in a different AS than the local router, while an iBGP session requires both peers to be in the same AS, and a mismatch prevents the OPEN message from being accepted. Option C is correct because the routers must have IP reachability to each other's neighbor address (typically via a directly connected link for eBGP or via IGP/static routes for iBGP) so the TCP three-way handshake on port 179 can complete before any BGP messages are exchanged. Option E is correct because the BGP version in the OPEN message must match between peers; both sides must agree on the same version (BGP-4 is the current standard), otherwise the session is rejected with a version error. Option A is not required because prefix lists are inbound/outbound route-filtering policies applied after the session is up and do not affect adjacency formation. Option D is not required because router IDs only need to be unique within each AS and do not have to be identical between the two peers for the session to establish.

Answer

Identical prefix lists

Answer

Identical router IDs

Question 7

Which TWO items must be configured to ensure a FortiGate can successfully resolve external hostnames?

Accepted Answer

DNS server IP addresses in system settings. DNS settings are required for the FortiGate itself to resolve external names, and firewall policies must allow DNS traffic if the client uses the FortiGate as a DNS proxy.

Answer

A firewall policy allowing DNS traffic from internal clients to the FortiGate

Answer

An OSPF area configuration

Answer

An IPSec tunnel for DNS traffic

Answer

A static route to the internet

Question 8

Which THREE actions can be performed by the FortiGate when a policy match occurs?

Accepted Answer

Traffic Shaping. When a firewall policy matches traffic, the FortiGate can take one of three fundamental actions: Accept (E), which permits the traffic to pass through the FortiGate; Deny (D), which blocks the traffic and drops it; and Traffic Shaping (C), which applies a shaper or per-IP shaper/policy to control bandwidth for that matched traffic. These three are the standard policy actions configurable in a FortiGate firewall policy (set action accept/deny/ipsec and traffic shaping via set traffic-shaper). Re-routing to a specific switch port (A) is not a FortiGate policy action—it is a Layer 2 switching function performed by switches, not a firewall policy decision. Disabling hardware acceleration (B) is a configuration setting on the policy or global level (e.g., set auto-asic-offload disable) rather than an action the FortiGate performs as the result of a policy match.

Answer

Re-route to a specific switch port

Answer

Disable hardware acceleration

Question 9

A FortiGate is configured with an IPsec VPN to a remote peer using IKEv2. The administrator wants to ensure that only traffic from the 10.0.0.0/24 subnet is encrypted and sent over the tunnel, while all other traffic goes directly to the internet. The VPN is up, but traffic from 10.0.0.0/24 is not being routed through the tunnel. Which configuration step is most likely missing?

Accepted Answer

A firewall policy with source interface as the internal interface, destination interface as the IPsec tunnel, and source address 10.0.0.0/24.. The FortiGate uses firewall policies to determine which traffic is encrypted and sent over an IPsec tunnel. A policy with the internal interface as source, the tunnel interface as destination, and the correct source subnet is required. Without it, traffic from that subnet will not be routed into the tunnel, even if the tunnel is established and routes exist.

Answer

An IKEv2 quick mode selector that includes the 10.0.0.0/24 subnet.

Answer

A static route for 10.0.0.0/24 pointing to the IPsec tunnel interface.

Answer

A phase 2 proposal with matching encryption and authentication algorithms.

Question 10

A FortiGate is configured with two IPsec VPN tunnels to the same remote peer using different WAN links for redundancy. You want the FortiGate to automatically fail over to the secondary tunnel if the primary fails, and to fail back when the primary recovers. Which two configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Enable DPD on both phase-1 configurations and set the primary tunnel's route distance lower than the secondary's.. To achieve automatic failover and failback between two IPsec tunnels, you need both a mechanism to detect tunnel failure and a routing preference. DPD on phase-1 detects dead peers, triggering removal of the primary route. A lower route distance on the primary tunnel ensures it is preferred when active, and the secondary is used only when the primary is down. Together, these provide the desired redundancy.

Answer

Enable 'auto-negotiate' on both phase-1 configurations.

Answer

Enable Dead Peer Detection (DPD) on both phase-2 selectors.

Answer

Configure the primary tunnel with a lower priority value in the phase-1 settings.

Question 11

A FortiGate is configured with a site-to-site IPsec VPN to a remote peer. The administrator notices that the tunnel is up, but traffic is not passing. The administrator runs 'diagnose vpn tunnel list' and sees that the tunnel is established. Which step should the administrator take next to troubleshoot why traffic is not flowing?

Accepted Answer

Check the phase 2 selectors on both peers to ensure they match.. When an IPsec tunnel is up but traffic is not passing, mismatched phase 2 selectors are a frequent cause. They define the encryption domain; if they do not match between peers, traffic is not encrypted or is dropped. Checking selectors is a key troubleshooting step. Other options like restarting daemon or checking policies are less likely to be the first step.

Answer

Verify the firewall policy that allows traffic from the internal network to the VPN tunnel.

Answer

Check the routing table to ensure there is a route to the remote subnet via the tunnel.

Answer

Restart the IPsec daemon to renegotiate the tunnel.

Question 12

A FortiGate is deployed as an IPsec VPN hub with several spokes. The administrator wants to ensure that if the primary WAN link fails, the VPN tunnels automatically re-establish over a secondary WAN link without manual intervention. Which feature should be configured?

Accepted Answer

IPsec tunnel with multiple WAN interfaces and 'route-based' VPN with route redundancy. For automatic IPsec VPN failover, the tunnel must be route-based and associated with multiple WAN interfaces. Routing protocols or static routes with priority then determine which path is active. When the primary link fails, the route is removed, and the tunnel re-establishes over the secondary link. This provides seamless failover without manual intervention.

Answer

IPsec tunnel interface with 'auto-negotiate' enabled

Answer

WAN link load balancing with redundant interfaces and route priorities

Answer

Dead Peer Detection (DPD) with a shorter interval and retry count

Question 13

A FortiGate is configured with a policy-based IPsec VPN. The administrator notices that traffic to a specific remote subnet is not being encrypted, even though the policy is correctly configured. Which action should the administrator take to troubleshoot this issue?

Accepted Answer

Check the phase-2 selectors to ensure they match the remote subnet.. In a policy-based IPsec VPN, the phase-2 selectors determine which traffic is encrypted. If traffic to a remote subnet is not encrypted, the selectors likely do not include that subnet. Checking the selectors is the most direct troubleshooting step. IKE debugging and tunnel status checks are useful for tunnel establishment issues, not for traffic selection problems.

Answer

Verify that the firewall policy has the correct source and destination interfaces.

Answer

Run 'diagnose vpn tunnel list' to check the status of the tunnel.

Answer

Run 'diagnose debug application ike -1' to check IKE negotiation.

Question 14

You are configuring a FortiGate to perform deep inspection of SSL traffic for a specific web server. The server uses a certificate signed by an internal CA. You want to avoid breaking SSL connections to other sites. What must you configure to ensure that the FortiGate only inspects traffic to that specific server?

Accepted Answer

Create a custom SSL inspection profile that uses the FortiGate's default CA, and apply it to a firewall policy that matches only the server's IP address.. To inspect SSL traffic only to a specific server, you must create a firewall policy that matches the server's IP address (or FQDN) and apply an SSL inspection profile to that policy. The profile should use the FortiGate's signing CA. This ensures that only traffic to that server is inspected, while other SSL traffic is not affected. Scoping the policy correctly is key to avoiding breakage.

Answer

Create an SSL inspection profile that uses the internal CA certificate as the signing certificate, and apply it to a firewall policy that matches only the server's IP address.

Answer

Configure a firewall policy that matches the server's IP address and apply an SSL inspection profile set to 'protect' mode with the FortiGate's default CA.

Answer

Enable 'untrusted SSL' inspection on the FortiGate's default CA and apply it to all policies.

Question 15

You are configuring a redundant IPsec VPN setup between two sites using two FortiGates at each site. You want to ensure that if the primary VPN tunnel fails, traffic automatically switches to the secondary tunnel. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Configure two IPsec tunnels (phase 1 and phase 2) with different remote gateway IP addresses and enable dead peer detection (DPD) on both.. To achieve automatic failover between two IPsec tunnels, you need two separate tunnels with DPD enabled to detect failures. Additionally, SD-WAN can be used to group the tunnels and define failover rules based on priority or SLA. Together, these provide a robust redundant VPN setup.

Answer

Configure a single phase 1 with multiple remote gateways and enable redundant tunnel.

Answer

Configure two separate phase 1 interfaces with different remote gateway IP addresses and set them as members of a redundant interface.

Answer

Configure BGP with the two tunnels to dynamically exchange routes and influence path selection.

Question 16

An administrator wants to configure a FortiGate to perform deep SSL inspection for traffic to a specific category of websites, while excluding financial websites from inspection to comply with privacy policies. Which FortiGate feature allows this granular control?

Accepted Answer

SSL inspection exemptions. SSL inspection exemptions are designed to bypass deep inspection for specific destinations or categories. By exempting financial categories, the FortiGate will not decrypt that traffic, respecting privacy policies. Other features like web filtering or application control do not directly control the inspection exemption list.

Answer

FortiGuard category-based SD-WAN rules

Answer

Application control sensor

Answer

Web filter profile with category-based actions

Question 17

A FortiGate is configured with an IPS sensor in monitor mode. The administrator notices that the sensor is detecting attacks but not blocking them. The administrator wants to change the sensor to block attacks while still logging them. Which action should the administrator take?

Accepted Answer

Change the IPS sensor action from Monitor to Block for the relevant signatures.. To block attacks, the IPS sensor's signature actions must be set to Block. Monitor mode only logs, so changing to Block ensures the FortiGate drops malicious packets. This action also logs the event by default, meeting the requirement to both block and log.

Answer

Set the action to 'Reset' for the signatures.

Answer

Change the IPS sensor mode from Monitor to Protect in the global settings.

Answer

Enable 'Block Malicious Traffic' in the firewall policy.

Question 18

A FortiGate is configured with a static route to 10.0.0.0/8 via 192.168.1.1. The administrator wants to ensure that if the primary next-hop becomes unreachable, the FortiGate automatically removes the route from the routing table. Which feature should be configured?

Accepted Answer

Enable 'link-health' on the static route and configure a health check.. Link-health monitoring on a static route enables the FortiGate to track the next-hop's reachability. If the health check fails, the route is withdrawn, allowing a backup route to be used. This is the correct way to achieve automatic failover for static routes without relying on dynamic routing protocols.

Answer

Enable 'blackhole' on the static route.

Answer

Set the route's administrative distance to a lower value.

Answer

Configure a dynamic routing protocol to redistribute the static route.

Question 19

A FortiGate is deployed as the hub in a hub-and-spoke IPsec VPN topology. A spoke's dynamic IP address changes, and the hub must re-establish the tunnel without administrator intervention. The spoke is configured with a pre-shared key and a dynamic DNS hostname. Which configuration on the hub allows the tunnel to recover automatically when the spoke's IP changes?

Accepted Answer

Configure the spoke's remote gateway as a fully qualified domain name (FQDN) on the hub and set the phase 1 interface to the public-facing interface.. Configuring the hub to use the spoke's FQDN as the remote gateway allows the hub to resolve the hostname and update the tunnel endpoint when the spoke's IP changes. This enables automatic recovery without manual intervention. DPD only detects failures, and using 0.0.0.0 is for dial-up scenarios where the hub does not initiate. Aggressive mode is not required for FQDN-based dynamic gateways.

Answer

Set the spoke's remote gateway to 0.0.0.0 and enable the 'dynamic' keyword in the phase 2 selector.

Answer

Set the spoke's remote gateway to the DDNS hostname and configure the hub to use IKEv2 with aggressive mode.

Answer

Enable dead peer detection (DPD) on the hub and set the retry count to 3 with a 10-second interval.

Question 20

You manage a FortiGate 600E cluster running FortiOS 7.2. A new IPsec VPN tunnel to a remote office is configured with IKEv2 and a pre-shared key. The remote office uses a FortiGate 60F behind a NAT device that performs port address translation. The tunnel fails to establish, and debug output shows that the remote gateway is not responding to the initial IKE packets. You verify that the pre-shared keys match and that UDP 500 and 4500 are allowed on both sides. Which configuration change on your local FortiGate is most likely to resolve the issue?

Accepted Answer

Enable NAT traversal (NAT-T) on the IPsec phase-1 configuration.. When a FortiGate is behind a NAT device, IPsec traffic may be dropped because the NAT device modifies the source port or IP address. Enabling NAT traversal on the phase-1 configuration allows the FortiGate to encapsulate IKE and ESP packets in UDP port 4500, which the NAT device can forward. This is the standard solution for IPsec behind NAT.

Answer

Change the IKE version to IKEv1.

Answer

Set the local gateway to use a dynamic IP address.

Answer

Configure a static route to the remote public IP address.