FORTINET-NSE7-SPECIALTY Nse7 Enterprise Firewall Security And VPN — 20 Questions

Question 1

In a BGP deployment, your FortiGate is receiving routes from two different ISPs. You want to influence outbound traffic to prefer ISP1 for specific destinations. Which BGP attribute should you modify?

Accepted Answer

Local Preference. Local Preference is a well-known BGP attribute used within an autonomous system to influence outbound traffic path selection. A higher local preference value is preferred, and it is propagated only within the local AS (iBGP), not to external peers. By setting a higher local preference for routes learned from ISP1 for specific destinations, the FortiGate will prefer ISP1 for outbound traffic to those destinations. This is the standard method for outbound traffic engineering in BGP.

Answer

Weight

Answer

AS-Path

Answer

Multi-Exit Discriminator (MED)

Question 2

In an OSPF setup, you have a redundant path. You want to ensure traffic prefers one link over another based on cost. Which OSPF command is used?

Accepted Answer

set ospf-cost. In FortiOS OSPF configuration, the interface-level command 'set ospf-cost' (or 'set cost' in some contexts) directly sets the OSPF cost metric on an interface, allowing administrators to influence path selection so traffic prefers one redundant link over another. Lower cost values are preferred in OSPF's shortest-path-first calculation. This is the direct mechanism for manipulating OSPF path preference based on cost.

Answer

set metric-type

Answer

set bandwidth-reference

Answer

set priority

Question 3

Which command is used to troubleshoot connectivity by checking the routing table of a specific IP address on the FortiGate?

Accepted Answer

get router info routing-table detail <ip>. The 'get router info route detail' or 'execute router info routing-table' commands are standard for verifying paths.

Answer

diagnose sniffer packet

Answer

get system status

Answer

exec ping-options

Question 4

Which FortiGate feature allows you to bypass SSL inspection for specific known-trusted websites to maintain user privacy?

Accepted Answer

URL Filter category exemption. FortiGate's SSL inspection exemption can be applied via URL filter categories or explicit exemption lists, allowing specific trusted destinations to bypass deep inspection. The URL Filter category exemption is the feature that lets administrators exclude known-trusted sites from SSL inspection to preserve privacy and avoid breaking certificate-pinned applications.

Answer

Firewall address object

Answer

Application Control override

Answer

IPS signature exclusion

Question 5

You are troubleshooting a high CPU issue on a FortiGate. Which utility should you use to identify which process is consuming the most resources?

Accepted Answer

diagnose sys top. The 'get system performance status' command is the primary tool to see process-level CPU usage.

Answer

get system hardware status

Answer

diagnose sniffer packet

Answer

get router info memory

Question 6

Which TWO items must be configured to ensure a FortiGate can successfully resolve external hostnames?

Accepted Answer

A firewall policy allowing DNS traffic from internal clients to the FortiGate. Option A is correct because the FortiGate only answers DNS queries from internal clients when a firewall policy explicitly permits DNS (UDP/TCP port 53) traffic from those clients to the FortiGate interface, so without such a policy the clients' DNS requests are dropped and resolution fails. Option D is correct because the FortiGate itself needs DNS server IP addresses configured under system settings (config system dns / set primary and secondary) so it can forward or resolve external hostnames; without upstream DNS servers it has no resolver to query. Option B is not required because OSPF is a dynamic routing protocol and has nothing to do with name resolution. Option C is not required because DNS does not need to be tunneled through an IPSec VPN unless a specific design demands it, and it is not a general prerequisite. Option E is not required because a static default route to the internet is only needed if the FortiGate lacks any other route to reach the DNS servers, and it is not one of the two items that must be configured for DNS resolution itself.

Answer

An OSPF area configuration

Answer

An IPSec tunnel for DNS traffic

Answer

A static route to the internet

Question 7

In a high availability (HA) cluster, which THREE settings are synchronized between the primary and secondary units?

Accepted Answer

Address objects. In an HA cluster, the configuration that defines how traffic is inspected and controlled is synchronized from the primary to the secondary unit, so address objects (C) are replicated because they are referenced by policy and NAT rules and must exist identically on both peers. The user authentication database (D) is also synchronized so that authenticated sessions and user-to-group mappings remain valid after a failover, avoiding re-authentication or policy mismatches. Firewall policies (E) are synchronized because they are the core security configuration that must be identical on both units for the secondary to take over seamlessly. Hardware serial numbers (A) are not synchronized since each appliance has its own unique serial number, and the management IP address (B) is not synchronized because each unit needs its own distinct management address to be individually reachable.

Answer

Hardware serial numbers

Answer

Management IP address

Question 8

Which THREE actions can be performed by the FortiGate when a policy match occurs?

Accepted Answer

Traffic Shaping. When a firewall policy matches traffic, the FortiGate can apply Traffic Shaping (C), which enforces bandwidth limits or guarantees via the policy's shared or per-IP shaper, making it a valid policy action. It can also Deny (D) the traffic, dropping the matching packets and optionally logging them, and Accept (E) the traffic, permitting it to pass and then be subject to further inspection such as UTM or NAT. These three are standard policy actions configurable in the policy's Action/Shaping fields. Re-route to a specific switch port (A) is not a FortiGate policy action, since the FortiGate is a firewall/gateway and does not control Layer 2 switch port forwarding. Disable hardware acceleration (B) is a global or per-policy setting for NP offload, not an action triggered by a policy match.

Answer

Re-route to a specific switch port

Answer

Disable hardware acceleration

Question 9

You manage a FortiGate HA cluster in active-passive mode. After a failover, the new primary FortiGate is not passing traffic for a recently added firewall policy that uses a VIP (virtual IP). The VIP is configured and synchronized, but sessions fail. What is the most likely cause?

Accepted Answer

The new primary FortiGate does not send gratuitous ARP for the VIP after failover, so upstream devices still send traffic to the old primary's MAC address.. After an HA failover, the new primary FortiGate must send gratuitous ARP packets to inform the network that the VIP's MAC address has moved. Without this, upstream devices continue to use the old MAC address, and traffic never reaches the new primary, causing session failures. Ensuring gratuitous ARP is sent is critical for seamless VIP operation in HA.

Answer

The VIP is not included in the HA synchronization because its external interface is not monitored.

Answer

The firewall policy referencing the VIP is not synchronized because it was added while the cluster was out of sync.

Answer

The VIP's external interface is not configured as a monitored interface in the HA settings.

Question 10

You are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?

Accepted Answer

Create an IPS sensor override for the specific signature ID. Creating an IPS sensor override for the specific signature ID allows you to selectively disable or modify the action of only the offending signature, eliminating the false positive while keeping all other IPS protections active. This is the most surgical and efficient approach because it preserves the security posture of the entire sensor profile. FortiGate IPS sensors support per-signature overrides (set status disable, set action pass, or set log-packet enable) without affecting unrelated signatures.

Answer

Change the IPS mode from blocking to monitoring

Answer

Disable the entire IPS sensor profile

Answer

Increase the IPS packet buffer size

Question 11

You are implementing SSL VPN and need to ensure that only compliant corporate laptops can connect. Which feature should you use?

Accepted Answer

Host check. Host check (also called host integrity or endpoint compliance check) is the SSL VPN feature that inspects the connecting endpoint before granting access, verifying that required security software, OS patches, antivirus definitions, and registry keys are present. Only endpoints that pass the defined compliance rules are allowed to establish the tunnel or access protected resources. This directly satisfies the requirement that only compliant corporate laptops can connect.

Answer

SSL VPN portal settings

Answer

Two-factor authentication

Answer

PKI user authentication

Question 12

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

Accepted Answer

Use a route map in the OSPF redistribute configuration. On FortiGate, redistribution into OSPF is controlled with a route map applied under 'config router ospf' > 'config redistribute connected'. The route map can match a specific prefix (via an IP prefix list or access list) and permit only that subnet, so only the desired connected route is redistributed.

Answer

Configure a distribute-list in the OSPF process

Answer

Use an IP prefix list under the OSPF area command

Answer

Use an access list under the interface configuration

Question 13

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?

Accepted Answer

Mismatched Phase 2 selectors. Phase 2 (Quick Mode) failures in IPsec VPNs are most commonly caused by mismatched Phase 2 selectors — the local and remote subnet definitions (proxy IDs) must mirror each other exactly. If the source/destination subnets do not match on both peers, the Phase 2 SA will not establish.

Answer

Incorrect IKE version

Answer

Expired certificate

Answer

Mismatched pre-shared key

Question 14

What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?

Accepted Answer

Implicit Deny. FortiGate firewalls, like most stateful firewalls, follow a default-deny security posture. When a packet does not match any explicit firewall policy, it is dropped by the implicit deny rule. This implicit deny is not visible in the policy list but is always present at the bottom, ensuring that only traffic explicitly permitted by a policy is allowed. This behavior aligns with the principle of least privilege and is a fundamental security best practice.

Answer

Send to local DNS

Answer

Route to DMZ

Answer

Allow

Question 15

A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?

Accepted Answer

The FortiGate CA certificate used for SSL inspection. When a FortiGate performs SSL deep inspection, it acts as a man-in-the-middle: it intercepts the client's TLS connection, presents its own certificate to the client, and establishes a separate TLS session to the real server. For the client browser to trust this substituted certificate without warnings, the FortiGate's CA certificate (the one used for SSL inspection, typically Fortinet_CA_SSL or a custom CA) must be installed in the client's trusted root store. This allows the browser to validate the certificate chain back to a trusted CA.

Answer

The FortiGate's local device certificate

Answer

The Fortinet_Factory CA certificate

Answer

A third-party public CA certificate

Question 16

You notice that an IPsec tunnel is up, but no traffic passes. What is the most common reason related to firewall policy configuration?

Accepted Answer

Missing firewall policy. When an IPsec tunnel is up but no traffic passes, the most common firewall policy-related reason is a missing firewall policy that permits traffic through the tunnel. In FortiGate, IPsec tunnels require explicit firewall policies to allow traffic between the tunnel interface and other interfaces; without them, the implicit deny drops all traffic.

Answer

Missing static route

Answer

Incorrect IKE ID

Answer

Phase 1 lifetime expiration

Question 17

What is the purpose of the 'Any' interface in a firewall policy?

Accepted Answer

To match traffic regardless of the ingress or egress interface. In a FortiGate firewall policy, the 'Any' interface is a wildcard that matches traffic regardless of the incoming or outgoing interface. It is used when you want a policy to apply to traffic from any source interface to any destination interface, simplifying rule creation. This is especially useful for policies that should not be tied to a specific interface, such as certain management or deny rules.

Answer

To force traffic through the hardware switch

Answer

To bypass the routing table

Answer

To match traffic only on the WAN port

Question 18

You are configuring BGP and need to advertise a summary route to your ISP. How do you ensure only the summary route is advertised?

Accepted Answer

Use an aggregate-address with summary-only. The 'aggregate-address' command with the 'summary-only' keyword in BGP creates a summary route and suppresses the advertisement of more specific component routes to BGP peers. This ensures that only the summary route is advertised, which reduces the size of the BGP table on the ISP's routers and provides a clean, aggregated announcement. Without 'summary-only', both the summary and the more specific routes would be advertised.

Answer

Use a distribute-list

Answer

Set the weight to 0

Answer

Configure a route map with a prefix list

Question 19

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

Accepted Answer

To encapsulate ESP packets. When NAT-Traversal is detected, IKE and ESP traffic are encapsulated in UDP datagrams on port 4500 to traverse NAT devices that would otherwise drop or mangle ESP (IP protocol 50). The UDP 4500 port carries both the IKE negotiation (with a non-ESP marker) and the encapsulated ESP payload, allowing the VPN to function through PAT/NAT.

Answer

To replace the AH protocol

Answer

To manage Phase 1 re-keying

Answer

To verify certificate revocation status

Question 20

Which FortiGate feature should be enabled to prevent internal users from accessing malicious websites based on real-time threat intelligence?

Accepted Answer

Web Filter. Web Filter is the FortiGate feature that inspects and controls HTTP/HTTPS traffic to block access to malicious or categorized websites using real-time threat intelligence feeds (FortiGuard). It evaluates URLs against FortiGuard's web filter database and can enforce policies based on categories, reputation, and threat scores. Antivirus, Application Control, and DNS Filter do not provide the same URL-based, real-time web categorization and blocking capability.

Answer

Antivirus profile

Answer

Application Control

Answer

DNS Filter