NSE7 Practice Test 10 — 10 Questions

Question 1

An administrator notices that after making changes to a policy package in FortiManager, the 'Install Preview' shows that the changes will modify policies on a FortiGate. However, the admin wants to verify what the exact changes will be before installing. What should the admin do?

Accepted Answer

Use the 'Revision History' to compare the current configuration with the previous version. Option C is correct because the Revision History feature in FortiManager allows an administrator to compare the current configuration of a policy package with a previous version, showing a detailed diff of exactly which policies will be added, removed, or modified. This provides a precise verification of changes before installation, unlike the Install Preview which only indicates that changes exist without showing the specific modifications.

Answer

Check the 'Audit Log' for recent changes

Answer

Run 'diagnose dvm device list' on FortiManager

Answer

Use the 'Install Preview' and then click 'View Details' on each device

Question 2

A FortiGate administrator wants to use FortiManager to manage multiple FortiGates in different geographic regions. To isolate configuration changes, the administrator creates separate ADOMs for each region. Which type of ADOM should be used to allow some common objects (like address groups) to be shared across all regions?

Accepted Answer

Global ADOM. The Global ADOM is designed to store and share common objects, such as address groups, policies, and schedules, across all ADOMs in a FortiManager deployment. When an administrator creates separate ADOMs for each region, the Global ADOM acts as a central repository for objects that need to be consistent everywhere, allowing per-region ADOMs to reference these shared objects without duplicating them. This ensures configuration isolation for region-specific settings while maintaining a single source of truth for global resources.

Answer

Per-Device ADOM

Answer

Regular ADOM

Answer

Meta ADOM

Question 3

A network admin needs to apply a common set of firewall rules at the beginning of every policy package for all VDOMs managed by FortiManager. The rules should be automatically inserted and not editable within each VDOM. What should be configured?

Accepted Answer

Policy package header policies. Header policies in policy packages allow global policies that apply before VDOM-specific policies. They are defined at the ADOM level and cannot be modified within individual VDOMs.

Answer

VDOM policy templates

Answer

Global policy objects

Answer

Central management policies

Question 4

A FortiGate administrator is troubleshooting slow network performance. The administrator runs the command 'diagnose sys session filter dst 10.0.0.1' and sees many sessions in a 'proto_state=0a' state. What does this state indicate? (Select TWO.)

Accepted Answer

The session is in FIN_WAIT_2 state. In FortiOS, the 'proto_state=0a' value in session diagnostics indicates the session is in the TCP FIN_WAIT_2 state (hex 0x0a = decimal 10). This state occurs after the local side has sent a FIN and received an ACK, but is still waiting for the remote side to close its connection. It is a normal part of TCP connection teardown, but an excessive number of sessions in this state can indicate that the remote peer is not properly closing connections, potentially contributing to slow performance due to resource exhaustion.

Answer

The session has been reset

Answer

The session is actively transferring data

Answer

The session is in SYN_RECEIVED state

Question 5

Which FortiAnalyzer feature allows administrators to create automated response actions triggered by specific log events, such as blocking an IP address when an intrusion is detected?

Accepted Answer

Playbooks. Playbooks in FortiAnalyzer define automated workflows triggered by events, enabling actions like blocking IPs via FortiGate API calls.

Answer

FortiView

Answer

Reports

Answer

Incidents

Question 6

A FortiGate running FortiOS 7.4.1 has two VDOMs: CustomerA and CustomerB. The administrator wants CustomerA to access an HTTP server in CustomerB. Both VDOMs have appropriate policies. What additional configuration is required?

Accepted Answer

Configure a VDOM link between CustomerA and CustomerB. A VDOM link is required to enable Layer-2 or Layer-3 connectivity between two VDOMs on the same FortiGate. Without a VDOM link, the VDOMs are isolated from each other, even if policies exist. The VDOM link acts as a virtual interface pair that forwards traffic between CustomerA and CustomerB, allowing the HTTP server access.

Answer

Create a policy allowing traffic from CustomerA to CustomerB

Answer

Enable inter-VDOM routing under system settings

Answer

Assign both VDOMs to the same administrative domain in FortiManager

Question 7

An administrator is planning a multi-VDOM deployment with a management VDOM. Which TWO statements about management VDOMs are correct? (Choose two.)

Accepted Answer

The management VDOM can be used for FortiGuard updates. Option A is correct because the management VDOM is specifically designed to handle administrative traffic, including FortiGuard updates. By isolating FortiGuard communications to the management VDOM, administrators ensure that security updates and threat intelligence downloads do not interfere with or consume bandwidth from the data VDOMs, and they can be centrally managed from a single VDOM.

Answer

The management VDOM cannot have firewall policies

Answer

The management VDOM requires a separate license

Answer

All user traffic must pass through the management VDOM

Question 8

A FortiGate is operating in transparent mode. Which of the following statements is true about this mode?

Accepted Answer

The FortiGate operates as a Layer 2 device and does not require IP addresses on its interfaces. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding frames based on MAC addresses without modifying them. It does not require IP addresses on its interfaces for traffic forwarding, though management IP addresses can be assigned. This allows the FortiGate to be inserted into an existing network segment without reconfiguring IP subnets.

Answer

The FortiGate does not modify the MAC addresses of packets

Answer

The FortiGate can route between different VLANs

Answer

The FortiGate can perform NAT

Question 9

An administrator is configuring FortiManager to manage a multi-VDOM FortiGate. The administrator wants to ensure that policy changes are not accidentally applied without review. Which THREE measures should be taken? (Choose three.)

Accepted Answer

Use install preview to review changes before deploying. To prevent accidental deployment, the administrator should use revision history to track changes, enable install preview to review changes before applying, and use ADOM locking to prevent multiple administrators from making concurrent changes. These features provide control and visibility.

Answer

Use the same password for all devices

Answer

Configure meta fields to track device location

Question 10

A FortiGate administrator wants to use FortiManager automation stitches to automatically block IP addresses that trigger multiple intrusion prevention events. Which two components are required to configure an automation stitch? (Choose two.)

Accepted Answer

Trigger. An automation stitch consists of a trigger (event condition) and one or more actions. The trigger defines when the stitch runs; the action defines what happens (e.g., CLI script, email).

Answer

Playbook

Answer

Destination

Answer

Schedule