NSE7 Practice Test 12 — 15 Questions

Question 1

A security analyst wants to use automation stitches on FortiGate to automatically block IP addresses that trigger an IPS signature for 'SSH Brute Force'. Which two components are required to create this automation stitch? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Action: 'Add to Block List'. Option A ('Add to Block List') is correct because the automation stitch must contain an action that actually enforces the block; the 'Add to Block List' action inserts the offending source IP into the FortiGate's local block list so subsequent traffic from that address is dropped. Option D ('IPS Event') is correct because the stitch needs a trigger that fires when the IPS signature for 'SSH Brute Force' is detected, and the IPS Event trigger is the mechanism that initiates the automation stitch upon an IPS log event. Together, the IPS Event trigger and the Add to Block List action form the required trigger-plus-action pair for this scenario. Option B (FortiAnalyzer log query) is not required because automation stitches on FortiGate are triggered by local event/log conditions, not by querying FortiAnalyzer. Option C (Email Notification) is an action that would only notify someone rather than block the IP, so it does not fulfill the blocking requirement. Option E (FortiGuard category) relates to web filtering categorization and is unrelated to blocking an IP that triggered an IPS signature.

Answer

FortiAnalyzer log query

Answer

Action: 'Email Notification'

Answer

FortiGuard category

Question 2

A FortiGate administrator enables Dead Peer Detection (DPD) on an IPsec VPN tunnel. What is the primary purpose of DPD?

Accepted Answer

To detect when the remote peer is no longer reachable. DPD is used to monitor the liveness of the remote peer. If the peer becomes unreachable, DPD detects it and can trigger a failover or tunnel teardown, ensuring traffic does not blackhole.

Answer

To dynamically adjust the tunnel MTU

Answer

To encrypt the IKE negotiation traffic

Answer

To automatically renegotiate the IKE SA before it expires

Question 3

In a hub-and-spoke VPN, spokes cannot communicate with each other directly. The administrator wants to allow direct spoke-to-spoke traffic without routing through the hub. Which technology should be configured?

Accepted Answer

ADVPN with IKEv2. ADVPN (Auto-Discovery VPN) with IKEv2 is Fortinet's proprietary shortcut mechanism that allows spokes to dynamically establish direct tunnels to one another without permanent spoke-to-spoke configuration. The hub acts as a registration point and uses IKEv2 to negotiate shortcut tunnels between spokes on demand, so traffic no longer has to hairpin through the hub. This is the only option that provides dynamic, on-demand direct spoke-to-spoke connectivity.

Answer

Static routes on spokes

Answer

IKEv1 with mode-config

Answer

GRE over IPsec

Question 4

An organization wants to implement multiple layers of defense against advanced persistent threats. Which three Fortinet solutions would be most effective in an ATP strategy? (Choose three.)

Accepted Answer

FortiSandbox. FortiSandbox is correct because it provides dynamic analysis of suspicious files and URLs in a controlled, isolated environment, detecting zero-day and advanced malware that signature-based solutions miss. It integrates with other Fortinet security products to share threat intelligence and automate blocking, forming a critical layer in an ATP strategy by catching threats that evade initial defenses.

Answer

FortiMail

Answer

FortiWeb

Question 5

During a ZTNA deployment, an administrator notices that traffic from a specific internal application is being routed through the ZTNA gateway but is not reaching the destination server. The FortiGate policy allows the traffic, and the client has a valid ZTNA connection. What is the most likely cause of the issue?

Accepted Answer

The ZTNA proxy rule on the FortiGate is misconfigured, pointing to the wrong destination IP or port.. In a ZTNA deployment, the FortiGate acts as a reverse proxy for internal applications. If the ZTNA proxy rule is misconfigured with an incorrect destination IP or port, the FortiGate will forward the traffic to the wrong backend server or service, causing the connection to fail even though the client has a valid ZTNA connection and the firewall policy permits the traffic.

Answer

The client's FortiClient agent is not connected to the EMS server.

Answer

The destination server does not have internet connectivity.

Answer

The FortiGate policy is set to deny traffic from the client's subnet.

Question 6

Which of the following is a requirement for FortiGate to act as a SAML Identity Provider (IdP) for ZTNA?

Accepted Answer

A configured user database and SAML IdP settings. For a FortiGate to act as a SAML Identity Provider for ZTNA, it must have a configured user database (local or remote) and SAML IdP settings enabled, because SAML requires an identity source and IdP metadata to issue assertions. The FortiGate then generates IdP metadata that the SAML SP (such as FortiClient EMS or a ZTNA client) consumes. Without a user store and IdP configuration, no SAML assertions can be produced.

Answer

A public IP address on the WAN interface

Answer

Integration with FortiClient EMS

Answer

An SSL certificate from a public CA

Question 7

A FortiGate running FortiOS 7.2 has multiple VDOMs. The administrator notices that inter-VDOM routing between two VDOMs is not working. Configuration shows a firewall policy allowing the traffic, and the route table shows routes to the destination VDOM. What additional configuration is required?

Accepted Answer

Create a VDOM link interface pair and assign them to the respective VDOMs. Inter-VDOM routing requires a VDOM link, which is a pair of logical interfaces (one in each VDOM) that are directly connected. Without this link, the VDOMs cannot exchange traffic even if firewall policies and routes exist, because they operate as separate virtual firewalls with isolated forwarding tables.

Answer

Configure a static route with a gateway IP in the destination VDOM

Answer

Assign an IP address to the VLAN interface on the source VDOM

Answer

Enable 'inter-vdom' under config system global

Question 8

An administrator applies the above policy but users from 10.0.1.0/24 cannot access web servers at 10.0.2.0/24. However, they can ping the servers. What is the most likely cause?

Accepted Answer

The service 'HTTP' does not include port 443 or the web application is using HTTPS.. The policy allows HTTP traffic (port 80), but the web servers are likely using HTTPS (port 443). Since the service object 'HTTP' in FortiGate typically only includes TCP/80, HTTPS traffic is denied by default. The administrator can ping the servers because ICMP is permitted by an implicit or explicit policy, confirming that routing and connectivity are functional.

Answer

The destination address is incorrect.

Answer

The schedule 'always' is not correctly configured.

Answer

The source interface is incorrect.

Question 9

An administrator is investigating a security incident and needs to view raw logs from a FortiAnalyzer for a specific time range. The administrator wants to ensure the logs are not aggregated or summarized. Which type of log view should be used?

Accepted Answer

Log View. The Log View in FortiAnalyzer displays raw, unaggregated logs exactly as received from FortiGate devices, making it the correct choice for viewing logs without summarization. Unlike other views that pre-process or summarize data, Log View provides direct access to the original log entries for a specified time range, which is essential for detailed incident investigation.

Answer

Event Management

Answer

FortiView

Answer

Reports

Question 10

An administrator configures inter-VDOM routing between VDOM-A and VDOM-B using a VDOM link. The default route in VDOM-A points to a next-hop router, and VDOM-B has a static route to a subnet behind VDOM-A. Users in VDOM-B cannot reach that subnet. The administrator runs 'diagnose ip route list' in both VDOMs and sees the routes are present. What is the most likely cause?

Accepted Answer

Firewall policies are missing on the VDOMs to permit traffic between the VDOM link and the destination interfaces. Even though the routes are present in both VDOMs, inter-VDOM routing via a VDOM link requires explicit firewall policies on each VDOM to permit traffic between the VDOM link interface and the destination interface. Without these policies, the FortiGate drops the traffic at the firewall layer, even though the routing table is correct. This is a common misconfiguration because VDOM links behave like physical interfaces and are subject to firewall policy enforcement.

Answer

The VDOM link MTU is too small for the traffic

Answer

The VDOM link interfaces are administratively down

Answer

The VDOMs are in different administrative domains (ADOMs) on FortiManager

Question 11

A FortiGate is configured with ECMP load balancing for equal-cost routes. The administrator wants to ensure that all traffic from a specific source IP uses the same next hop. Which ECMP load balancing method should be selected?

Accepted Answer

Source-IP-based. Source-IP-based ECMP load balancing ensures that all packets from a specific source IP address are forwarded to the same next hop by hashing only the source IP field. This maintains session consistency for traffic originating from a single host, which is critical for stateful inspection and applications that require symmetric routing.

Answer

Destination-IP-based

Answer

Weighted random

Answer

Round-robin

Question 12

Drag and drop the steps to configure a FortiGate to use an external authentication server (e.g., RADIUS) for admin login into the correct order.

Accepted Answer

Add RADIUS server, configure server details, create user group, assign group to admin, test. The correct sequence ensures that the RADIUS server is defined with full details before it is referenced by a user group, which is then assigned to an admin profile. Testing validates the entire chain, confirming that authentication works as expected.

Answer

Create user group, add RADIUS server, configure server details, assign group to admin, test

Answer

Add RADIUS server, create user group, assign group to admin, configure server details, test

Answer

Test, add RADIUS server, configure server details, create user group, assign group to admin

Question 13

Drag and drop the steps to configure a FortiGate as a DNS server (DNS proxy) into the correct order.

Accepted Answer

Enable DNS proxy → Set interface and port → Configure upstream DNS servers → Set caching → Allow DNS traffic in firewall policies. Enable DNS proxy, set interface and port, configure upstream, set caching, then allow traffic.

Answer

Set interface and port → Enable DNS proxy → Configure upstream DNS servers → Set caching → Allow DNS traffic in firewall policies

Answer

Enable DNS proxy → Set interface and port → Set caching → Configure upstream DNS servers → Allow DNS traffic in firewall policies

Answer

Enable DNS proxy → Set interface and port → Allow DNS traffic in firewall policies → Configure upstream DNS servers → Set caching

Question 14

An administrator is integrating a FortiExtender with a FortiGate. The FortiExtender is connected to port5 and configured with a cellular WAN connection. What must be configured on the FortiGate to allow the FortiExtender to provide WAN connectivity as an SD-WAN member?

Accepted Answer

Enable the 'fortiextender' option on port5 and configure the FortiExtender as an SD-WAN member using the virtual wan interface.. To integrate a FortiExtender as an SD-WAN member, the FortiGate must enable the 'fortiextender' option on the physical port (port5) to which the FortiExtender is connected. This creates a virtual wan interface that represents the FortiExtender's cellular WAN connection, allowing it to be added as an SD-WAN member for load balancing and failover policies. No static route or SIM card configuration is needed on the FortiGate, as the FortiExtender handles cellular authentication and routing internally.

Answer

Create a static route to the FortiExtender's management IP to use it as a gateway.

Answer

Configure port5 as a physical member and assign the FortiExtender's SIM card details.

Answer

Use the FortiExtender as a standalone router and configure policy-based routing on the FortiGate.

Question 15

A customer reports intermittent connectivity issues between two internal subnets separated by a FortiGate firewall. The traffic is allowed by the policy, but users experience timeouts during peak hours. Which troubleshooting step should you take first?

Accepted Answer

Check the session table for session limits and session congestion.. Intermittent connectivity during peak hours strongly suggests session table exhaustion or session congestion. The FortiGate's session table has a finite capacity, and when it fills up, new sessions are dropped, causing timeouts. Checking the session table for limits and congestion is the fastest, least intrusive first step to confirm whether the firewall is running out of session resources before performing more complex diagnostics.

Answer

Run a packet sniffer on the FortiGate to capture traffic between the subnets.

Answer

Disable hardware acceleration on the FortiGate.

Answer

Configure SNAT on the policy to translate the source IP.