FORTINET-NSE7-SPECIALTY Nse7 Enterprise Firewall Security And VPN Practice Test 1 — 15 Questions

Question 1

In a BGP deployment, your FortiGate is receiving routes from two different ISPs. You want to influence outbound traffic to prefer ISP1 for specific destinations. Which BGP attribute should you modify?

Accepted Answer

Local Preference. Local Preference is a well-known BGP attribute used within an autonomous system to influence outbound traffic path selection. A higher local preference value is preferred, and it is propagated only within the local AS (iBGP), not to external peers. By setting a higher local preference for routes learned from ISP1 for specific destinations, the FortiGate will prefer ISP1 for outbound traffic to those destinations. This is the standard method for outbound traffic engineering in BGP.

Answer

Weight

Answer

AS-Path

Answer

Multi-Exit Discriminator (MED)

Question 2

In an OSPF setup, you have a redundant path. You want to ensure traffic prefers one link over another based on cost. Which OSPF command is used?

Accepted Answer

set ospf-cost. In FortiOS OSPF configuration, the interface-level command 'set ospf-cost' (or 'set cost' in some contexts) directly sets the OSPF cost metric on an interface, allowing administrators to influence path selection so traffic prefers one redundant link over another. Lower cost values are preferred in OSPF's shortest-path-first calculation. This is the direct mechanism for manipulating OSPF path preference based on cost.

Answer

set metric-type

Answer

set bandwidth-reference

Answer

set priority

Question 3

Which command is used to troubleshoot connectivity by checking the routing table of a specific IP address on the FortiGate?

Accepted Answer

get router info routing-table detail <ip>. The 'get router info route detail' or 'execute router info routing-table' commands are standard for verifying paths.

Answer

diagnose sniffer packet

Answer

get system status

Answer

exec ping-options

Question 4

Which FortiGate feature allows you to bypass SSL inspection for specific known-trusted websites to maintain user privacy?

Accepted Answer

URL Filter category exemption. FortiGate's SSL inspection exemption can be applied via URL filter categories or explicit exemption lists, allowing specific trusted destinations to bypass deep inspection. The URL Filter category exemption is the feature that lets administrators exclude known-trusted sites from SSL inspection to preserve privacy and avoid breaking certificate-pinned applications.

Answer

Firewall address object

Answer

Application Control override

Answer

IPS signature exclusion

Question 5

You are troubleshooting a high CPU issue on a FortiGate. Which utility should you use to identify which process is consuming the most resources?

Accepted Answer

diagnose sys top. The 'get system performance status' command is the primary tool to see process-level CPU usage.

Answer

get system hardware status

Answer

diagnose sniffer packet

Answer

get router info memory

Question 6

Which TWO items must be configured to ensure a FortiGate can successfully resolve external hostnames?

Accepted Answer

A firewall policy allowing DNS traffic from internal clients to the FortiGate. Option A is correct because the FortiGate only answers DNS queries from internal clients when a firewall policy explicitly permits DNS (UDP/TCP port 53) traffic from those clients to the FortiGate interface, so without such a policy the clients' DNS requests are dropped and resolution fails. Option D is correct because the FortiGate itself needs DNS server IP addresses configured under system settings (config system dns / set primary and secondary) so it can forward or resolve external hostnames; without upstream DNS servers it has no resolver to query. Option B is not required because OSPF is a dynamic routing protocol and has nothing to do with name resolution. Option C is not required because DNS does not need to be tunneled through an IPSec VPN unless a specific design demands it, and it is not a general prerequisite. Option E is not required because a static default route to the internet is only needed if the FortiGate lacks any other route to reach the DNS servers, and it is not one of the two items that must be configured for DNS resolution itself.

Answer

An OSPF area configuration

Answer

An IPSec tunnel for DNS traffic

Answer

A static route to the internet

Question 7

In a high availability (HA) cluster, which THREE settings are synchronized between the primary and secondary units?

Accepted Answer

Address objects. In an HA cluster, the configuration that defines how traffic is inspected and controlled is synchronized from the primary to the secondary unit, so address objects (C) are replicated because they are referenced by policy and NAT rules and must exist identically on both peers. The user authentication database (D) is also synchronized so that authenticated sessions and user-to-group mappings remain valid after a failover, avoiding re-authentication or policy mismatches. Firewall policies (E) are synchronized because they are the core security configuration that must be identical on both units for the secondary to take over seamlessly. Hardware serial numbers (A) are not synchronized since each appliance has its own unique serial number, and the management IP address (B) is not synchronized because each unit needs its own distinct management address to be individually reachable.

Answer

Hardware serial numbers

Answer

Management IP address

Question 8

Which THREE actions can be performed by the FortiGate when a policy match occurs?

Accepted Answer

Traffic Shaping. When a firewall policy matches traffic, the FortiGate can apply Traffic Shaping (C), which enforces bandwidth limits or guarantees via the policy's shared or per-IP shaper, making it a valid policy action. It can also Deny (D) the traffic, dropping the matching packets and optionally logging them, and Accept (E) the traffic, permitting it to pass and then be subject to further inspection such as UTM or NAT. These three are standard policy actions configurable in the policy's Action/Shaping fields. Re-route to a specific switch port (A) is not a FortiGate policy action, since the FortiGate is a firewall/gateway and does not control Layer 2 switch port forwarding. Disable hardware acceleration (B) is a global or per-policy setting for NP offload, not an action triggered by a policy match.

Answer

Re-route to a specific switch port

Answer

Disable hardware acceleration

Question 9

You manage a FortiGate HA cluster in active-passive mode. After a failover, the new primary FortiGate is not passing traffic for a recently added firewall policy that uses a VIP (virtual IP). The VIP is configured and synchronized, but sessions fail. What is the most likely cause?

Accepted Answer

The new primary FortiGate does not send gratuitous ARP for the VIP after failover, so upstream devices still send traffic to the old primary's MAC address.. After an HA failover, the new primary FortiGate must send gratuitous ARP packets to inform the network that the VIP's MAC address has moved. Without this, upstream devices continue to use the old MAC address, and traffic never reaches the new primary, causing session failures. Ensuring gratuitous ARP is sent is critical for seamless VIP operation in HA.

Answer

The VIP is not included in the HA synchronization because its external interface is not monitored.

Answer

The firewall policy referencing the VIP is not synchronized because it was added while the cluster was out of sync.

Answer

The VIP's external interface is not configured as a monitored interface in the HA settings.

Question 10

You are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?

Accepted Answer

Create an IPS sensor override for the specific signature ID. Creating an IPS sensor override for the specific signature ID allows you to selectively disable or modify the action of only the offending signature, eliminating the false positive while keeping all other IPS protections active. This is the most surgical and efficient approach because it preserves the security posture of the entire sensor profile. FortiGate IPS sensors support per-signature overrides (set status disable, set action pass, or set log-packet enable) without affecting unrelated signatures.

Answer

Change the IPS mode from blocking to monitoring

Answer

Disable the entire IPS sensor profile

Answer

Increase the IPS packet buffer size

Question 11

You are implementing SSL VPN and need to ensure that only compliant corporate laptops can connect. Which feature should you use?

Accepted Answer

Host check. Host check (also called host integrity or endpoint compliance check) is the SSL VPN feature that inspects the connecting endpoint before granting access, verifying that required security software, OS patches, antivirus definitions, and registry keys are present. Only endpoints that pass the defined compliance rules are allowed to establish the tunnel or access protected resources. This directly satisfies the requirement that only compliant corporate laptops can connect.

Answer

SSL VPN portal settings

Answer

Two-factor authentication

Answer

PKI user authentication

Question 12

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

Accepted Answer

Use a route map in the OSPF redistribute configuration. On FortiGate, redistribution into OSPF is controlled with a route map applied under 'config router ospf' > 'config redistribute connected'. The route map can match a specific prefix (via an IP prefix list or access list) and permit only that subnet, so only the desired connected route is redistributed.

Answer

Configure a distribute-list in the OSPF process

Answer

Use an IP prefix list under the OSPF area command

Answer

Use an access list under the interface configuration

Question 13

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?

Accepted Answer

Mismatched Phase 2 selectors. Phase 2 (Quick Mode) failures in IPsec VPNs are most commonly caused by mismatched Phase 2 selectors — the local and remote subnet definitions (proxy IDs) must mirror each other exactly. If the source/destination subnets do not match on both peers, the Phase 2 SA will not establish.

Answer

Incorrect IKE version

Answer

Expired certificate

Answer

Mismatched pre-shared key

Question 14

What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?

Accepted Answer

Implicit Deny. FortiGate firewalls, like most stateful firewalls, follow a default-deny security posture. When a packet does not match any explicit firewall policy, it is dropped by the implicit deny rule. This implicit deny is not visible in the policy list but is always present at the bottom, ensuring that only traffic explicitly permitted by a policy is allowed. This behavior aligns with the principle of least privilege and is a fundamental security best practice.

Answer

Send to local DNS

Answer

Route to DMZ

Answer

Allow

Question 15

A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?

Accepted Answer

The FortiGate CA certificate used for SSL inspection. When a FortiGate performs SSL deep inspection, it acts as a man-in-the-middle: it intercepts the client's TLS connection, presents its own certificate to the client, and establishes a separate TLS session to the real server. For the client browser to trust this substituted certificate without warnings, the FortiGate's CA certificate (the one used for SSL inspection, typically Fortinet_CA_SSL or a custom CA) must be installed in the client's trusted root store. This allows the browser to validate the certificate chain back to a trusted CA.

Answer

The FortiGate's local device certificate

Answer

The Fortinet_Factory CA certificate

Answer

A third-party public CA certificate