NSE7 Practice Test 10 — 10 Questions

Question 1

A FortiGate administrator is planning to deploy VDOMs to separate customer traffic. The administrator wants to use FortiManager for centralized management. Which TWO prerequisites must be met before the VDOMs can be managed from FortiManager?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The FortiGate must be assigned to an ADOM. FortiManager uses ADOMs (Administrative Domains) to logically group managed devices, and a FortiGate must be assigned to an ADOM before its VDOMs can be managed. Option D is correct because the FortiGate must be added to the FortiManager device list (via model or managed registration) to establish communication and allow policy/object provisioning to its VDOMs.

Answer

Inter-VDOM routing must be enabled

Answer

FortiAnalyzer must be registered with FortiManager

Answer

All VDOMs must be in the same ADOM

Question 2

An administrator is troubleshooting why a new firewall policy on a managed FortiGate is not taking effect. The policy was created in FortiManager and installed successfully. Which TWO steps should the administrator verify to identify the issue? (Select TWO.)

Accepted Answer

Check if the policy is disabled. Option C is correct because a policy that exists in FortiManager and installs successfully can still be administratively disabled on the managed FortiGate, in which case it will never match traffic; the administrator should confirm the policy's status is enabled. Option D is correct because firewall policies are evaluated top-down and the first matching policy wins, so if a broader or conflicting policy appears above the new policy in the policy list, the new policy will never be hit; verifying its position in the order is essential. Option A is not appropriate because rebooting the FortiGate does not resolve a policy configuration or ordering problem and would only cause unnecessary downtime. Option B is not the right focus because routing determines whether traffic reaches the FortiGate and which interface/next-hop is used, but the scenario states the policy itself is not taking effect, not that traffic is failing to route. Option E is not relevant because HA status affects failover and session synchronization, not whether a specific installed policy matches traffic.

Answer

Reboot the FortiGate

Answer

Review the FortiGate's routing table

Answer

Verify the FortiGate's HA status

Question 3

An admin creates a VDOM named 'CustomerA' with inter-VDOM link to the management VDOM. The admin wants CustomerA administrators to manage only their own VDOM. Which configuration step is required?

Accepted Answer

Create a new administrator and set the 'VDOM' field to 'CustomerA' and assign a profile with appropriate permissions. To restrict a VDOM administrator to manage only their own VDOM, you must create a new administrator account and explicitly set the 'VDOM' field to that VDOM (e.g., 'CustomerA') and assign a profile with the necessary permissions. This ensures the admin's scope is limited to that VDOM, preventing access to the management VDOM or other VDOMs.

Answer

Use the 'config system admin' command and set trusthost to the admin's IP

Answer

Place the management VDOM and CustomerA in different administrative domains (ADOMs) in FortiManager

Answer

Enable admin-role override in the VDOM settings

Question 4

An administrator wants to verify that a BGP route is being advertised to a neighbor. Which command displays the routes that FortiGate is advertising to a specific BGP neighbor?

Accepted Answer

get router info bgp neighbor advertised-routes. The command 'get router info bgp neighbor advertised-routes' is the specific FortiOS CLI command that displays the BGP routes that the FortiGate has advertised to a particular BGP neighbor. This command queries the BGP table for routes that have been sent to the neighbor and are in the Adj-RIB-Out, which is exactly what the administrator needs to verify outbound route advertisement.

Answer

get router info bgp network

Answer

diagnose ip router bgp routes

Answer

show ip bgp summary

Question 5

Which FortiClient ATP feature provides protection against zero-day malware by monitoring process behavior and blocking suspicious activities at the endpoint?

Accepted Answer

FortiClient Exploit Prevention. FortiClient Exploit Prevention is correct because it uses real-time behavioral monitoring of process activities—such as API calls, memory access patterns, and code injection attempts—to detect and block zero-day malware that has no known signature. Unlike signature-based detection, this feature identifies malicious behavior at runtime, making it effective against previously unseen threats.

Answer

FortiClient Web Filtering

Answer

FortiClient Cloud Sandbox

Answer

FortiClient Vulnerability Scan

Question 6

An administrator is troubleshooting a ZTNA issue where users are able to authenticate but the application access is still blocked. The ZTNA status on FortiClient shows 'Connected' but the application does not load. What is the MOST likely cause?

Accepted Answer

The user's FortiClient does not have the required ZTNA tags assigned. When users can authenticate and the ZTNA status shows 'Connected' on FortiClient, but the application still fails to load, the most likely cause is that the client lacks the required ZTNA tags. ZTNA tags are used by the FortiGate to enforce access policies; without the correct tags, the FortiGate will block the application traffic even though the tunnel is established. This scenario indicates a tag assignment or synchronization issue between FortiClient and EMS.

Answer

The ZTNA application is not configured with HTTPS

Answer

The FortiClient EMS server is not reachable from the FortiGate

Answer

The FortiGate is not configured with the correct ZTNA application gateway

Question 7

What is the role of FortiGuard Outbreak Prevention in FortiGate's security suite?

Accepted Answer

To deliver real-time threat intelligence and block fast-spreading outbreaks. FortiGuard Outbreak Prevention is a real-time threat intelligence service that proactively blocks fast-spreading outbreaks by delivering immediate signature updates and threat data to FortiGate devices. Unlike scheduled updates, it uses a push mechanism to rapidly deploy protections against emerging threats, reducing the window of vulnerability during zero-day or widespread attacks.

Answer

To provide offline signature updates for antivirus

Answer

To perform sandbox analysis of files

Answer

To manage endpoint security policies

Question 8

An administrator wants to integrate FortiGate with an external threat intelligence feed to block known malicious IP addresses automatically. Which object should be used to consume the feed?

Accepted Answer

External Threat Intelligence Feed. The External Threat Intelligence Feed object in FortiGate is specifically designed to consume external threat intelligence feeds (e.g., STIX/TAXII, CSV, or plain text lists) and automatically update a dynamic address object with indicators of compromise (IoCs) such as malicious IP addresses. This enables automated blocking of known malicious sources without manual intervention, making it the correct choice for integrating an external feed.

Answer

IP Pool

Answer

Address Group

Answer

Security Profile Group

Question 9

An organization wants to prevent zero-day attacks by using Content Disarm and Reconstruction (CDR) on email attachments. Which Fortinet product provides this capability?

Accepted Answer

FortiMail. FortiMail is the correct answer because it natively integrates Content Disarm and Reconstruction (CDR) to sanitize email attachments by removing active content (e.g., macros, scripts, embedded objects) and rebuilding the file in a safe format. This prevents zero-day exploits that bypass signature-based detection, as CDR does not rely on threat intelligence but instead strips potentially malicious elements before delivery.

Answer

FortiWeb

Answer

FortiGate

Answer

FortiSandbox

Question 10

An administrator needs to monitor the FortiGate's CPU usage in real-time from the CLI. Which command should be used?

Accepted Answer

diagnose sys top. 'diagnose sys top' is the FortiGate CLI command that provides a real-time, top-like display of CPU usage per process, including process IDs and CPU consumption percentages. This command is specifically designed for live performance monitoring and troubleshooting from the CLI, unlike static snapshots or debug outputs.

Answer

diagnose debug application httpsd

Answer

diagnose hardware sysinfo memory

Answer

get system performance status