NSE7 Practice Test 12 — 15 Questions

Question 1

An organization wants to deploy a web application firewall (WAF) to protect a public-facing web application. They are evaluating FortiGate versus FortiWeb. Which of the following is a key advantage of using FortiWeb over FortiGate for WAF functionality?

Accepted Answer

FortiWeb offers advanced bot detection and positive security model. FortiWeb is a dedicated web application firewall that provides advanced bot detection and a positive security model, which allows only explicitly allowed traffic based on a whitelist of known good patterns. This is a key advantage over FortiGate, which primarily uses a negative security model (signature-based) and lacks the same depth of bot mitigation and positive enforcement for web-specific threats.

Answer

FortiGate can perform SSL deep inspection without performance impact

Answer

FortiGate supports a larger number of web servers behind a single policy

Answer

FortiGate can automatically patch web application vulnerabilities

Question 2

An administrator configures an automation stitch on FortiGate to automatically block an IP address when a specific IPS signature triggers. What must be configured as the trigger and action?

Accepted Answer

Trigger: 'Event Log' with filter for the IPS signature; Action: 'Add IP to Blocklist'. Option A is correct because an automation stitch in FortiGate requires a trigger that defines the event that starts the automation, and an action that defines what happens when the trigger fires. For automatically blocking an IP when a specific IPS signature triggers, the trigger must be 'Event Log' with a filter for that IPS signature, and the action must be 'Add IP to Blocklist', which directly adds the source IP to the FortiGate's blocklist (banned IP list). This combination ensures that when the IPS signature is logged, the stitch extracts the source IP and applies a block.

Answer

Trigger: 'Incoming Webhook'; Action: 'CLI Script'

Answer

Trigger: 'FortiOS CLI'; Action: 'Alert Email'

Answer

Trigger: 'Schedule'; Action: 'Banned IP'

Question 3

A FortiGate administrator configures a custom IPS signature with the pattern 'attack' in the HTTP request URI. After applying the signature, no alerts are generated even though the traffic matches. What is the MOST likely cause?

Accepted Answer

The signature's protocol decoder is not set to 'HTTP'. The custom IPS signature pattern 'attack' will only be inspected against the HTTP request URI if the signature's protocol decoder is explicitly set to 'HTTP'. Without this decoder assignment, the IPS engine does not know which protocol layer to parse, and the pattern is never matched against the URI, resulting in no alerts despite matching traffic.

Answer

The signature's protocol decoder is set to 'HTTP'

Answer

The signature action is set to 'pass'

Answer

The signature severity is too low

Question 4

During a security incident, the SOC team receives an alert from FortiSIEM about a user accessing a known malicious IP. The team wants to automatically block the IP on the FortiGate. Which FortiGate feature can be used to create an automated response based on a threat intelligence feed?

Accepted Answer

Automation Stitch. Option A is correct because Automation Stitch in FortiOS allows you to create automated responses triggered by events such as threat intelligence feeds. By configuring an Automation Stitch with a trigger from FortiSIEM (e.g., via a webhook or syslog) and an action to add a block entry to the FortiGate's local address group or dynamic block list, the SOC team can automatically block the malicious IP without manual intervention.

Answer

Local-in Policy

Answer

FortiGuard Outbreak Prevention

Answer

FortiGate VPN

Question 5

A security engineer wants to implement advanced threat protection for email using FortiMail. Which THREE features should be enabled to provide comprehensive protection against sophisticated email threats? (Choose three.)

Accepted Answer

URL rewriting and click-time protection. URL rewriting and click-time protection (A) is correct because it proactively neutralizes malicious URLs in emails by rewriting them to route through FortiMail's proxy, enabling real-time inspection at the time of click. This defends against phishing and credential-harvesting attacks that use URLs to deliver payloads or steal credentials, even if the URL was benign at delivery time.

Answer

Anti-Spam filter

Answer

Attachment size limits

Question 6

An administrator configures a WAF profile on FortiGate to protect a web application. They notice that SQL injection attacks are not being blocked. What is the MOST likely reason?

Accepted Answer

The FortiGuard Web Filtering subscription is inactive. Option B is correct because the FortiGuard Web Filtering subscription provides the signature database required to detect and block SQL injection attacks within a WAF profile. Without an active subscription, the WAF profile cannot update or use the latest attack signatures, rendering it unable to identify SQL injection patterns even if the profile is enabled and applied correctly.

Answer

The web application uses HTTPS without SSL inspection

Answer

The WAF profile is set to monitor mode

Answer

The WAF profile is applied to the wrong firewall policy

Question 7

Which Fortinet product provides endpoint detection and response (EDR) capabilities, including automated threat containment?

Accepted Answer

FortiEDR. FortiEDR is the correct answer because it is Fortinet's dedicated endpoint detection and response solution that provides real-time behavioral analysis, automated threat containment, and forensic investigation capabilities. Unlike traditional antivirus, FortiEDR uses machine learning and pre-execution analysis to detect and block advanced threats, and it can automatically isolate compromised endpoints from the network to prevent lateral movement.

Answer

FortiClient

Answer

FortiSandbox

Answer

FortiGuard

Question 8

What is the purpose of FortiDeceptor in an enterprise security architecture?

Accepted Answer

To simulate real assets and detect attackers attempting to interact with decoys. FortiDeceptor is a deception-based threat detection solution that deploys decoys (simulated real assets like servers, databases, or IoT devices) across the network. When an attacker probes or interacts with these decoys, FortiDeceptor generates high-fidelity alerts, enabling early detection of lateral movement or reconnaissance without relying on signatures. This aligns with the Advanced Threat Protection domain by shifting from reactive blocking to proactive deception.

Answer

To provide VPN access for remote users

Answer

To encrypt all data at rest on endpoints

Answer

To block all inbound traffic from suspicious IP addresses

Question 9

A security team is configuring FortiMail for email security. They want to ensure that incoming emails are authenticated using SPF, DKIM, and DMARC, and that emails failing authentication are quarantined. Which THREE settings must be configured in FortiMail? (Choose three.)

Accepted Answer

Enable DKIM verification in the anti-spam policy. Option A is correct because DKIM verification must be explicitly enabled in the anti-spam policy to allow FortiMail to validate the DKIM signature on incoming emails. Without this setting, DKIM authentication is not performed, and the email's DKIM status will not be evaluated.

Answer

Enable TLS encryption for incoming SMTP

Answer

Configure a recipient verification policy

Question 10

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is an established TCP session with about one hour remaining before timeout. The output shows a TCP session (proto=6) with state 01, which in Fortinet's session table indicates an established TCP connection. The duration of 3600 seconds and expire value of 3599 seconds mean the session has been active for about one hour and has approximately one hour remaining before the idle timeout expires. This matches option B.

Answer

The session is in SYN_SENT state and cannot be established

Answer

The session is a UDP session using port 443

Answer

The session has a duration of 3600 seconds and will expire immediately

Question 11

An administrator wants to create an automation stitch that automatically blocks an IP address when a high-severity IPS alert is triggered. The administrator creates a trigger for 'IPS event' and an action of 'Add to Blocked IPs'. However, the action fails to execute. Which of the following is the most likely cause?

Accepted Answer

The admin account used to configure the stitch does not have permission to modify the blocked IP list. Option D is correct because the admin account used to configure the automation stitch must have the necessary permissions to modify the blocked IP list. In FortiOS, the automation stitch action 'Add to Blocked IPs' requires write access to the firewall address object or the blocked IP list. If the admin account has read-only or restricted privileges, the action will fail silently, even if the trigger and action are correctly configured.

Answer

The automation stitch is set to execute every 5 minutes, not immediately

Answer

The blocked IP list has reached its maximum size

Answer

The IPS event trigger does not support IP address extraction

Question 12

An administrator wants to configure FortiGate to use the machine learning engine for advanced antivirus detection. Which setting must be enabled in the antivirus profile?

Accepted Answer

Enable 'Machine Learning Engine' in the antivirus profile. Option A is correct because the machine learning engine for advanced antivirus detection is a dedicated feature within the antivirus profile that must be explicitly enabled. This engine uses behavioral analysis and heuristics to detect unknown or zero-day malware without relying solely on signature-based detection. Enabling this setting allows FortiGate to leverage on-device ML models to identify malicious files based on patterns and anomalies.

Answer

Enable 'Detect All' in the antivirus profile

Answer

Set 'Scan Mode' to 'Quick' in the antivirus profile

Answer

Enable 'Use FortiSandbox' in the antivirus profile

Question 13

An admin configures Content Disarm and Reconstruction (CDR) on FortiGate to protect against malicious macros in Office documents. After applying the CDR profile to a firewall policy, users complain that documents are not being delivered. What is the most likely cause?

Accepted Answer

The firewall policy is configured for flow-based inspection. CDR requires proxy-based inspection to intercept, disarm, and reconstruct documents. Flow-based inspection bypasses the deep inspection engine, so CDR cannot process the files, causing delivery failures. FortiGate must use proxy-based inspection mode for CDR to function correctly.

Answer

The CDR profile has 'File Filter' enabled that blocks the file type

Answer

The FortiGate is running in transparent mode

Answer

The antivirus profile is not applied to the same policy

Question 14

When configuring FortiGate with FortiSandbox integration, an administrator wants to block files that are rated 'High Risk' by the sandbox. Which setting must be enabled in the antivirus profile to automatically quarantine these files?

Accepted Answer

Enable 'Submit Files to FortiSandbox' and set action to 'Block'. Option C is correct because the 'Submit Files to FortiSandbox' setting in the antivirus profile, when set to 'Block', directly instructs FortiGate to quarantine files that receive a 'High Risk' verdict from FortiSandbox. This action is part of the antivirus profile's sandbox integration, not a separate automation or IPS feature, and it automatically handles the quarantine without requiring additional configuration.

Answer

Configure an automation stitch to quarantine files based on sandbox verdict

Answer

Enable 'File Filter' in the antivirus profile and add a rule for high-risk files

Answer

Enable 'FortiSandbox Quarantine' in the IPS profile

Question 15

An administrator is configuring FortiGate automation stitches to respond to a detected brute-force attack against an internal web server. The trigger is set to 'Event' with a condition matching repeated failed login attempts. Which TWO actions are appropriate to mitigate the attack? (Choose two.)

Accepted Answer

Add the source IP to a local address group that is used in a block policy. Option A is correct because adding the source IP to a local address group that is referenced in a block policy dynamically updates the firewall rule set to drop all traffic from that IP. This is a common automation stitch action in FortiGate that leverages the local address object and policy to enforce immediate blocking without manual intervention.

Answer

Enable quarantine on the web server

Answer

Shut down the web server interface

Answer

Run a CLI script to disable the user account