NSE7 Practice Test 12 — 15 Questions

Question 1

A network engineer needs to collect logs from multiple FortiGates and generate compliance reports. Which TWO FortiAnalyzer features should be used?

Accepted Answer

Log analytics. Log analytics (option B) is correct because it provides the ability to search, filter, and visualize logs from multiple FortiGates, enabling the identification of trends and anomalies necessary for compliance reporting. Reports (option C) is correct because FortiAnalyzer includes a dedicated reporting engine that can generate scheduled or on-demand compliance reports based on collected logs, with pre-defined templates for standards like PCI DSS, HIPAA, and SOX.

Answer

ADOM configuration

Answer

Automation stitches

Answer

Policy packages

Question 2

A FortiManager administrator wants to push policy package changes to a managed FortiGate, but wants to see what changes will be applied before committing. Which FortiManager feature should the administrator use?

Accepted Answer

Install preview. Install preview is the correct feature because it allows the administrator to simulate the installation of policy package changes on a managed FortiGate without actually applying them. This provides a detailed diff of what will be added, modified, or removed, enabling verification before committing the changes. It is specifically designed for pre-commit validation in FortiManager's centralized management workflow.

Answer

Meta fields

Answer

Automation stitch

Answer

Revision history

Question 3

A network administrator configures SD-WAN on a FortiGate with two WAN members (port1, port2). They set up a performance SLA to measure latency to 8.8.8.8. The SLA shows both members are 'alive'. However, traffic matching an SD-WAN rule with 'best quality' strategy is not using the lowest-latency link. What is the MOST likely cause?

Accepted Answer

The performance SLA does not have 'latency' as the first metric in the priority order. The 'best quality' strategy selects the link with the highest priority based on the performance SLA's metric order. If latency is not the first metric in the priority list (e.g., jitter or packet loss is first), the algorithm will prefer the link that best satisfies the first metric, not necessarily the lowest latency. Thus, even though both links are alive, the link with lower latency may be deprioritized if it performs worse on the first metric.

Answer

Both WAN members have the same cost in the SD-WAN configuration

Answer

The SD-WAN rule is configured with 'manual' strategy

Answer

The SD-WAN rule has 'set-match' enabled for source IP

Question 4

What is the purpose of a global ADOM in FortiManager?

Accepted Answer

To provide a common object repository that can be referenced by other ADOMs. A global ADOM in FortiManager serves as a shared object repository (e.g., addresses, services, schedules) that can be referenced by other ADOMs, enabling centralized management of common objects across multiple administrative domains. This avoids duplication and ensures consistency, as changes in the global ADOM propagate to all ADOMs that reference those objects. It does not directly create or push firewall policies; instead, it provides the building blocks for policies within individual ADOMs.

Answer

To create global firewall policies applicable to all devices

Answer

To manage all devices in a single ADOM regardless of location

Answer

To store global logs from all FortiGates

Question 5

A FortiGate administrator is planning a multi-VDOM deployment for a service provider. Which TWO statements are true about VDOM limitations and best practices?

Accepted Answer

It is recommended to use a dedicated management VDOM. Using a dedicated management VDOM is a best practice in multi-VDOM deployments. It isolates administrative traffic (e.g., HTTPS, SSH, SNMP) from data-plane VDOMs, ensuring that management access remains available even if a data VDOM fails or is misconfigured. This also simplifies auditing and RBAC by centralizing admin access without exposing production traffic.

Answer

There is no limit to the number of VDOMs supported

Answer

All VDOMs must share the same routing table

Answer

VDOMs cannot operate in transparent mode

Question 6

A FortiGate admin runs the following command: 'diagnose sys session filter dport 443' and sees output indicating sessions with state 'proto_state=01' and 'duration=3600, expire=3599'. What does this indicate about the session?

Accepted Answer

The session is established and has been active for 3600 seconds. The command 'diagnose sys session filter dport 443' filters sessions with destination port 443 (HTTPS). The output shows 'duration=3600, expire=3599', meaning the session has been active for 3600 seconds and will expire in 3599 seconds. The 'proto_state=01' indicates a TCP session in the established state (state 1 = TCP_ESTABLISHED). This confirms the session is fully established and actively tracked by the FortiGate session table.

Answer

The session has timed out and is being removed

Answer

The session is in a closing state

Answer

The session is in a half-open state

Question 7

Which TWO statements about VDOM limits on FortiGate are correct? (Choose TWO.)

Accepted Answer

VDOM support requires a valid FortiGate license. VDOM support on FortiGate is a licensed feature. Without a valid FortiGate license (e.g., an Advanced or Enterprise license bundle), the VDOM functionality is disabled, and the device operates in a single-VDOM (split-task) mode. This licensing requirement ensures that only authorized models and configurations can utilize VDOM isolation.

Answer

VDOMs can be created only in NAT mode

Answer

All FortiGate models support at least 10 VDOMs

Answer

VDOMs can be added without additional memory

Question 8

A FortiGate in an HA cluster with VDOMs enabled experiences a failover. After the failover, traffic that was passing before is now being dropped. The configuration is synchronized between the primary and secondary units. What is the most likely reason?

Accepted Answer

Session synchronization is not enabled between HA members. The most likely reason is that session synchronization is not enabled between HA members. When a failover occurs, the new primary FortiGate does not have the existing session table entries from the original primary, so it treats incoming packets as new connections and may drop them if they do not match a firewall policy's initial handshake state. Even though the configuration is synchronized, session information is not shared unless session synchronization is explicitly configured, causing traffic to be dropped after failover.

Answer

The new primary has a different VDOM configuration

Answer

The firewall policies are not synchronized

Answer

VDOM link interfaces are down on the new primary

Question 9

An organization uses FortiAnalyzer for centralized logging. The security team wants to use playbooks to automate responses to detected incidents. Which THREE components are essential for a playbook to function?

Accepted Answer

Trigger. A trigger is essential because it defines the event or condition that initiates the playbook execution. Without a trigger, the playbook has no starting point and cannot automate responses to detected incidents. In FortiAnalyzer, triggers can be based on log events, alerts, or scheduled intervals.

Answer

A report schedule

Answer

A dashboard visualization

Question 10

A FortiGate administrator is troubleshooting a ZTNA access proxy issue. The ZTNA rule is configured to require the tag 'AV_Installed' and 'OS_Updated'. Users with compliant devices are still denied access. The admin checks the ZTNA connection monitor and sees 'Tag mismatch'. What is the MOST likely cause?

Accepted Answer

The FortiClient EMS is not configured as an endpoint control source on the FortiGate. ZTNA tags are assigned by FortiClient EMS based on device posture. If the FortiGate does not trust the EMS server or the tag names are mismatched, the tag check fails. The EMS must be configured as an endpoint control source and the tags must exactly match those defined in EMS.

Answer

The FortiGate does not have a valid PKI certificate for the ZTNA proxy

Answer

The user is not authenticated via SAML

Answer

The ZTNA rule is using the wrong port number

Question 11

A FortiGate administrator is configuring a multi-VDOM deployment. The administrator wants to use a single physical interface for multiple VDOMs. Which TWO methods allow this?

Accepted Answer

Use NP6 virtual interfaces (e.g., virtual wire) on supported models. On supported FortiGate models with NP6 processors, you can create NP6 virtual interfaces (e.g., virtual wire pairs) that allow a single physical interface to be shared across multiple VDOMs without VLAN tagging. Option C is correct because VLAN subinterfaces can be created on a physical interface and each subinterface assigned to a different VDOM, enabling multi-VDOM use of the same physical port.

Answer

Use the same physical interface in multiple VDOMs directly

Answer

Create a software switch interface and assign it to multiple VDOMs

Answer

Configure inter-VDOM routing to share the same IP subnet

Question 12

An administrator needs to view real-time traffic logs and top applications for a specific VDOM on FortiAnalyzer. Which tool should be used?

Accepted Answer

FortiView. FortiView is the correct tool because it provides real-time traffic logs and top applications per VDOM on FortiAnalyzer. It uses live data streams from FortiGate logs to display current network activity, allowing administrators to filter by VDOM and view metrics like top applications, sources, and destinations without running a report or script.

Answer

Playbooks

Answer

Incident Management

Answer

Reports

Question 13

A network administrator is configuring FortiManager to manage multiple FortiGates with different VDOMs. The admin needs to ensure that each FortiGate's VDOMs can be independently managed. What is the correct configuration step?

Accepted Answer

Enable per-VDOM ADOM mode in FortiManager to manage each VDOM as a separate ADOM. FortiManager's per-VDOM ADOM mode allows each VDOM on a FortiGate to be treated as an independent ADOM, enabling separate management of policies, objects, and settings per VDOM. This is essential when different VDOMs serve distinct tenants or departments and must not share configuration contexts.

Answer

Use a single ADOM for all FortiGates

Answer

Configure each FortiGate as a separate device in the Global ADOM

Answer

Use the same policy package for all VDOMs

Question 14

An administrator configures a FortiGate with VDOMs and notices that the 'config vdom' command lists multiple VDOMs, but only one VDOM is shown in the 'show full-configuration' output. What is the most likely reason?

Accepted Answer

The administrator is in the context of a specific VDOM. The 'config vdom' command lists all VDOMs configured on the FortiGate because it operates in the global context. However, 'show full-configuration' only displays the configuration of the current VDOM context. If the administrator is inside a specific VDOM (e.g., after executing 'config vdom' and 'edit <vdom-name>'), the output is scoped to that VDOM, not the global configuration. This is a fundamental behavior of VDOM-based CLI navigation in FortiOS.

Answer

The VDOMs are not properly synchronized

Answer

The VDOMs are not assigned any interfaces

Answer

The FortiGate is in transparent mode

Question 15

A FortiGate administrator needs to delegate firewall policy management to different teams for different departments. Each team should have full control over their policies but should not see or modify policies of other departments. Which feature allows this separation?

Accepted Answer

Administrative profiles (admin profiles) with restricted VDOM access. Administrative profiles with restricted VDOM access allow a FortiGate administrator to assign specific VDOMs to different admin accounts. By creating separate VDOMs for each department and granting admin accounts access only to their respective VDOMs, each team can fully manage firewall policies within their VDOM without seeing or modifying policies in other VDOMs. This leverages FortiGate's VDOM-based multi-tenancy and role-based access control (RBAC) to enforce strict policy isolation.

Answer

ADOMs in FortiAnalyzer

Answer

Policy packages in FortiManager

Answer

Security fabric tags