NSE7 Practice Test 13 — 15 Questions

Question 1

An administrator configures automation stitches on FortiManager to trigger a script when a specific event log is received. The script should block the source IP on the firewall. However, the script does not run when the event occurs. What is a likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The event handler filter does not match the log. Automation stitches on FortiManager rely on event handler filters to match specific log IDs or patterns. If the filter does not match the incoming event log (e.g., wrong log ID, incorrect field value, or mismatched severity), the trigger condition is never met, and the script will not execute. This is the most common misconfiguration when setting up event-driven automation.

Answer

The FortiGate is in transparent mode

Answer

The script is not compiled

Answer

The script is set to run on all managed devices

Question 2

A FortiGate is configured with a WAF profile to protect a web server. The administrator notices that SQL injection attacks are still reaching the server despite the WAF being enabled. What is the MOST likely reason?

Accepted Answer

The SQL injection signature set is disabled in the WAF profile. The WAF profile contains signature sets that detect and block common attack patterns, including SQL injection. If the SQL injection signature set is disabled within the profile, the WAF will not inspect traffic for those patterns, allowing attacks to pass through. This is the most direct and likely reason why SQL injection attacks are reaching the server despite the WAF being enabled.

Answer

The attack is coming from a trusted IP

Answer

The web server is using HTTPS without SSL inspection

Answer

The WAF profile is not applied to the correct policy

Question 3

A FortiGate administrator is troubleshooting why files are not being submitted to FortiSandbox for analysis. Which THREE conditions must be met for file submission to work? (Choose three.)

Accepted Answer

The file type must be in FortiSandbox's supported list. FortiSandbox only supports analysis for specific file types (e.g., PE, PDF, Office documents). If the file type is not in the supported list, the FortiGate will not submit it, even if all other conditions are met. This is a fundamental filtering step in the FortiGate-FortiSandbox integration.

Answer

SSL inspection must be disabled for the policy

Answer

The FortiSandbox must be in inline scanning mode

Question 4

An organization deploys FortiEDR to protect endpoints. Which component is responsible for collecting and sending telemetry data to the FortiEDR management console?

Accepted Answer

FortiEDR Sensor (Agent). The FortiEDR Sensor (Agent) is the endpoint-resident component that collects telemetry data—such as process creation, network connections, file system changes, and registry modifications—and securely transmits it to the FortiEDR management console (Controller) for analysis and threat detection. Without the sensor, the management console has no visibility into endpoint activity.

Answer

FortiGate firewall

Answer

FortiAnalyzer

Answer

FortiClient EMS

Question 5

An administrator uses FortiManager automation stitches to respond to an incident. The stitch includes a trigger, one or more actions, and conditions. Which THREE components are valid action types in an automation stitch?

Accepted Answer

CLI script execution. CLI script execution is a valid action type in FortiManager automation stitches because it allows the administrator to run a predefined CLI script on a managed FortiGate device directly from the stitch. This enables automated configuration changes or troubleshooting commands in response to a trigger, such as blocking an IP address after an intrusion detection event.

Answer

FortiGate reboot

Answer

FortiAnalyzer report generation

Question 6

A network admin configures FortiGate to submit files to FortiSandbox for analysis. After submission, the FortiGate logs show that files are being sent but no verdict is returned. The FortiSandbox is reachable and licensed. What is the most likely cause?

Accepted Answer

The FortiGate does not have a FortiGuard Security Rating subscription. FortiGate requires a valid FortiGuard Security Rating subscription to receive verdicts from FortiSandbox. Without this subscription, the FortiGate can submit files and see them as sent in logs, but it cannot process the returned verdicts, resulting in no action taken on the files. The Security Rating subscription enables the communication channel for verdict retrieval, distinct from the basic FortiSandbox license.

Answer

The FortiGate is using proxy-based inspection instead of flow-based

Answer

The FortiSandbox server's IP is not added to the FortiGate's trusted hosts

Answer

The antivirus profile is set to block without scanning

Question 7

An administrator configures a FortiGate with a management VDOM. Which of the following is true about the management VDOM?

Accepted Answer

The management VDOM cannot have any firewall policies. The management VDOM is a special-purpose VDOM used exclusively for out-of-band management traffic (e.g., GUI, SSH, SNMP). It operates in a separate management plane and cannot contain firewall policies because it is not designed to inspect or forward data-plane traffic. This isolation ensures that management access remains available even if the data-plane VDOMs are overloaded or misconfigured.

Answer

The management VDOM supports inter-VDOM routing

Answer

The management VDOM can be used to route production traffic

Answer

The management VDOM can be shared across multiple FortiGates in a HA cluster

Question 8

A FortiGate administrator wants to block a custom protocol anomaly where a client sends an HTTP request with a malformed header containing a null byte. Which advanced IPS feature should be used?

Accepted Answer

Enable Protocol Anomaly Detection in the IPS sensor. Protocol Anomaly Detection in the IPS sensor is designed to identify deviations from standard protocol behavior, such as malformed headers or null bytes in HTTP requests. This feature inspects traffic for known protocol violations without requiring custom signatures, making it the correct choice for blocking a null byte anomaly in HTTP headers.

Answer

Create a custom IPS signature to match the null byte pattern

Answer

Enable 'Outbreak Prevention' in the IPS sensor

Answer

Use the 'http-policy' setting in the WAF profile

Question 9

Which technology uses DMARC reports to help administrators identify unauthorized use of their email domain?

Accepted Answer

DMARC. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the correct answer because it specifically uses aggregate and forensic reports (DMARC reports) to provide administrators with visibility into how their email domain is being used, including unauthorized or spoofed emails. These reports are generated by receiving mail servers and sent back to the domain owner, detailing authentication results from SPF and DKIM checks, which helps identify and mitigate domain abuse.

Answer

SPF

Answer

DKIM

Answer

FortiMail

Question 10

A network administrator is troubleshooting a FortiGate IPS sensor that is not generating alerts for a custom signature they created. The custom signature uses the pattern 'malicious. The signature is enabled and applied to a firewall policy. What is the MOST likely cause of the issue?

Accepted Answer

The custom signature is missing the 'protocol' parameter. The custom signature is missing the 'protocol' parameter, which is mandatory for FortiGate custom IPS signatures. Without specifying the protocol (e.g., TCP, UDP, HTTP), the IPS engine cannot match the pattern against any traffic flow, so no alerts are generated even if the signature is enabled and applied to a policy.

Answer

The signature severity is set to 'Low' and logging is disabled for low severity

Answer

The IPS sensor is configured in 'Passive' mode

Answer

The firewall policy is using 'Flow-based' inspection

Question 11

A FortiGate administrator notices that traffic classified as 'unknown' by the antivirus is being allowed. The administrator wants to ensure that such files are submitted to FortiSandbox for analysis and blocked until a verdict is received. Which configuration is required?

Accepted Answer

Enable FortiSandbox in the antivirus profile and set 'Action for unknown files' to 'Block'. When FortiSandbox is enabled in the antivirus profile and 'Action for unknown files' is set to 'Block', the FortiGate will submit files that cannot be identified by the local antivirus engine to FortiSandbox for analysis. While the file is being analyzed, it is blocked from reaching the client, ensuring that no potentially malicious content is delivered until a verdict (clean or malicious) is received. This directly addresses the administrator's requirement to block unknown files pending sandbox analysis.

Answer

Create a custom IPS signature for unknown files

Answer

Enable outbreak prevention in the antivirus profile

Answer

Enable FortiSandbox in the antivirus profile and set 'Action for known files' to 'Block'

Question 12

A security administrator wants to block email spoofing attacks against their organization's domain. They configure SPF, DKIM, and DMARC records. Which protocol authenticates the domain of the email sender by verifying the email's signature against a public key published in DNS?

Accepted Answer

DKIM. DKIM (DomainKeys Identified Mail) is the correct answer because it provides email authentication by allowing the sender to cryptographically sign an email with a private key. The receiving mail server then retrieves the sender's public key from a DNS TXT record and verifies the signature, confirming that the email was not tampered with and originates from a domain the sender is authorized to use.

Answer

SPF

Answer

ARC

Answer

DMARC

Question 13

A company uses FortiGate as a web application firewall (WAF) to protect a public web server. The security team wants to block SQL injection attacks. Which WAF signature category should the administrator enable?

Accepted Answer

SQL Injection. SQL injection attacks specifically target database queries by injecting malicious SQL statements through input fields. FortiGate's WAF signature category for SQL Injection is designed to detect and block these patterns, such as 'OR 1=1' or UNION-based injections, by matching against known attack signatures in the HTTP request payload.

Answer

Server-Side Request Forgery

Answer

Command Injection

Answer

Cross-Site Scripting

Question 14

An administrator wants to create an automation stitch that responds to a high-severity IPS event by blocking the attacker IP. Which THREE components are required to build this automation stitch?

Accepted Answer

Trigger (e.g., IPS Event). An automation stitch in FortiOS requires a trigger to initiate the workflow. In this scenario, the IPS event trigger is specifically designed to fire when a high-severity IPS signature match occurs, providing the necessary event data (e.g., attacker IP) to pass to subsequent actions. Without a trigger, the stitch would have no starting point.

Answer

Schedule (e.g., run every hour)

Answer

Condition (e.g., severity threshold)

Question 15

A security administrator wants to implement automated threat response using FortiGate automation stitches. Which THREE components are mandatory when creating an automation stitch? (Choose three.)

Accepted Answer

Action (e.g., 'CLI Script', 'Add IP to Blocklist'). An automation stitch requires at least one action to execute when triggered. Actions define the actual response, such as running a CLI script, adding an IP to a blocklist, or sending an email. Without an action, the stitch would have no effect on the network.

Answer

Schedule (e.g., daily at midnight)

Answer

Stitch name