NSE7 Practice Test 14 — 15 Questions

Question 1

A FortiGate in transparent mode is deployed between a router and a switch. The administrator needs to apply a deep inspection profile to HTTP traffic. What is the correct configuration for the interfaces?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a management IP on the VDOM and apply the inspection profile to the policy. In transparent mode, FortiGate acts as a Layer 2 bridge, so interfaces do not require IP addresses. Deep inspection of HTTP traffic is applied via a firewall policy that references a deep inspection profile, and a management IP must be configured on the VDOM to allow the FortiGate to participate in management traffic (e.g., DNS, NTP, or proxy operations). Option A correctly identifies that the management IP is set on the VDOM and the inspection profile is applied to the policy.

Answer

Place both interfaces in the same VDOM and enable DHCP

Answer

Switch to NAT mode to enable deep inspection

Answer

Assign IPs to both interfaces and create a policy from LAN to WAN

Question 2

A FortiGate administrator wants to use SAML SSO to authenticate VPN users. The FortiGate will act as the service provider (SP) and an external identity provider (IdP) will be used. Which of the following must be configured on the FortiGate to enable SAML authentication for SSL VPN?

Accepted Answer

A user group with SAML authentication method and an SSL VPN portal referencing that group.. To enable SAML SSO for SSL VPN on FortiGate, the administrator must configure a user group with the SAML authentication method that references the external IdP, and then reference that group in the SSL VPN portal settings. This establishes the trust relationship where FortiGate acts as the SP and redirects authentication to the IdP. Without the user group and portal binding, SAML authentication cannot be applied to VPN users.

Answer

A RADIUS server pointing to the IdP and an authentication rule.

Answer

An LDAP server with the IdP's certificate and a matching policy.

Answer

A local user with SAML attributes and a firewall policy referencing that user.

Question 3

A FortiGate administrator is investigating a security incident and needs to identify which user initiated a specific outbound connection to a malicious IP address. The company uses FSSO for authentication. Which THREE pieces of information from FortiAnalyzer logs would be MOST useful? (Choose three.)

Accepted Answer

Username from the FortiGate authentication log. FSSO (Fortinet Single Sign-On) maps network sessions to Active Directory usernames via the FortiGate authentication log. When investigating which user initiated an outbound connection to a malicious IP, the username from this log directly ties the session to a specific identity, enabling attribution beyond just IP addresses.

Answer

Destination IP address

Answer

Event type (e.g., traffic, event, attack)

Question 4

A FortiGate administrator is configuring ZTNA to provide secure access to an internal application. The application is hosted on a server with IP 10.0.1.100 and port 8080. The administrator creates a ZTNA rule on the FortiGate as an access proxy. What is the correct configuration for the ZTNA rule's 'Application Access' entry?

Accepted Answer

External port: 443, Mapped port: 8080, Destination: 10.0.1.100. For ZTNA access proxy, the external port is the port clients connect to (typically 443 for HTTPS), and the mapped port is the internal server port (8080). The destination is the internal server IP. Therefore, option D is correct: external port 443, mapped port 8080, destination 10.0.1.100.

Answer

External port: 0, Mapped port: 8080, Destination: 10.0.1.100

Answer

External port: 8080, Mapped port: 443, Destination: 10.0.1.100

Answer

External port: 443, Mapped port: 443, Destination: 10.0.1.100

Question 5

A FortiGate administrator wants to ensure that only devices with an up-to-date antivirus and OS patch level can access a sensitive application published via ZTNA. Which ZTNA component should the administrator configure to enforce this requirement?

Accepted Answer

ZTNA tags with posture checks. ZTNA tags with posture checks allow the FortiGate to verify endpoint compliance (e.g., antivirus version, OS patch level) before granting access to a ZTNA-published application. The FortiGate collects posture data from the FortiClient endpoint and compares it against configured compliance rules; only devices that meet the requirements receive the appropriate ZTNA tag and are allowed through the ZTNA proxy.

Answer

ZTNA proxy configuration

Answer

SSL VPN portal settings

Answer

Firewall policy with application control

Question 6

An administrator configures FortiAnalyzer to receive logs from multiple FortiGates. They want to create a report that shows only incidents involving 'critical' severity and specific attack types. Which FortiAnalyzer feature allows the administrator to define such a custom report?

Accepted Answer

Report datasets and charts. FortiAnalyzer's reporting engine uses datasets and charts to define custom reports. Datasets are SQL-like queries that extract specific log data, and charts visualize that data. By creating a dataset that filters for 'critical' severity and specific attack types, and then adding it to a report, the administrator can generate the desired custom report. Other features like incident management, playbooks, and FortiView dashboards are for real-time monitoring and automated response, not custom report generation.

Answer

Incident management

Answer

Playbooks

Answer

FortiView dashboards

Question 7

What is the purpose of BFD (Bidirectional Forwarding Detection) in a FortiGate routing configuration?

Accepted Answer

To detect forwarding path failures quickly. BFD (Bidirectional Forwarding Detection) provides fast failure detection for forwarding paths between two adjacent routers, independent of any routing protocol. In FortiGate configurations, BFD is used to detect link or neighbor failures in sub-second intervals (e.g., 50-100 ms), enabling rapid convergence for dynamic routing protocols like OSPF or BGP. This is critical for SD-WAN and high-availability scenarios where traditional keepalive timers (e.g., OSPF Hello/Dead intervals of 10-40 seconds) are too slow.

Answer

To encrypt routing protocol traffic

Answer

To authenticate routing peers

Answer

To provide load balancing across multiple paths

Question 8

A FortiGate is configured with two WAN members in an SD-WAN zone. The performance SLA monitors latency to a probe server. The rule uses 'best quality' strategy. After some time, one member fails the SLA. Which action does the FortiGate take for existing sessions that were using that member?

Accepted Answer

Existing sessions continue on the failed member until they timeout. When a WAN member fails the performance SLA in an SD-WAN 'best quality' strategy, FortiGate does not disrupt existing sessions that were already using that member. Instead, those sessions continue on the failed member until they naturally timeout or are torn down, because the SD-WAN rule only influences the path selection for new sessions. This behavior is by design to avoid breaking active connections due to transient SLA fluctuations.

Answer

All sessions are dropped and the member is removed from the zone

Answer

Existing sessions are re-evaluated and may be moved based on policy

Answer

Existing sessions are immediately moved to another member

Question 9

A FortiGate administrator wants to use PKI certificates for IKEv2 authentication instead of pre-shared keys. Which phase1 configuration parameter must be changed to support certificate-based authentication?

Accepted Answer

Set the authentication method to 'signature'.. In FortiOS IPsec phase1 configuration, the 'authentication-method' parameter controls how the peers authenticate during IKEv2. Setting it to 'signature' instructs the FortiGate to use digital signatures (RSA or ECDSA) with X.509 certificates instead of pre-shared keys. This is the mandatory change to enable certificate-based authentication; other parameters like 'certificate' and 'remote-certificate' are then used to specify the actual certificates.

Answer

Set the proposal to include DH groups 14 or higher.

Answer

Configure 'local-gw' with the certificate's CN.

Answer

Enable 'peer-id-option' and set it to 'any'.

Question 10

A FortiGate administrator is integrating a FortiSwitch managed by the FortiGate. They want to configure a VLAN interface on the FortiSwitch for user traffic. Which configuration is required on the FortiGate?

Accepted Answer

Configure a VLAN on the FortiSwitch under the switch controller and assign it to a port. When integrating a FortiSwitch managed by a FortiGate, VLANs for user traffic must be created under the switch controller on the FortiGate. This allows the FortiGate to push the VLAN configuration to the FortiSwitch, including assigning the VLAN to a specific port or port group. Option B correctly describes this process, as the switch controller manages the FortiSwitch as an extension of the FortiGate, not as a standalone device.

Answer

Enable DHCP relay on the FortiSwitch VLAN

Answer

Use the config system interface to create a VLAN on the FortiGate and tag it on the trunk

Answer

Create a VLAN subinterface on the FortiGate's port that connects to the FortiSwitch

Question 11

A company is implementing a Security Fabric with multiple FortiGate devices. They want to use FortiAnalyzer for centralized logging and FortiManager for centralized management. Which of the following is a prerequisite for adding a FortiGate to the Security Fabric?

Accepted Answer

The FortiGate must have network connectivity to the FortiManager. For a FortiGate to join a Security Fabric, it must have network connectivity to the FortiManager that manages the fabric. FortiManager acts as the fabric root or controller, and the FortiGate registers with it using the FortiManager IP or FQDN. Without this connectivity, the FortiGate cannot be added to the Security Fabric topology.

Answer

The FortiGate must have FortiAnalyzer configured as a log device

Answer

The FortiGate's management IP must be configured via DHCP

Answer

The FortiGate must be operating in transparent mode

Question 12

An administrator needs to verify if a FortiGate is receiving BGP routes from a peer. Which command should the admin run to see the BGP routing table?

Accepted Answer

get router info bgp table. 'get router info bgp table' is the exact FortiOS CLI command to display the BGP routing table, showing all BGP-learned routes and their attributes. This command is specific to FortiGate's proprietary CLI syntax, which differs from Cisco IOS or generic Linux networking commands. The administrator needs this output to verify received BGP prefixes from a peer.

Answer

get router info routing-table bgp

Answer

show ip bgp

Answer

diagnose ip router bgp table

Question 13

A FortiGate administrator needs to integrate with FortiNAC to enforce network access control for wired and wireless devices. The administrator wants FortiNAC to dynamically assign VLANs based on the device's security posture. Which FortiNAC feature enables this?

Accepted Answer

NAC policies. NAC policies define rules for device classification and VLAN assignment based on posture assessment results.

Answer

DHCP fingerprinting

Answer

RADIUS accounting

Answer

SNMP traps

Question 14

A security engineer is troubleshooting a scenario where FortiGate is not blocking a known malicious URL categorized as 'Malware'. The web filtering profile is configured with 'monitor all' for the Malware category. What change should be made to block the URL?

Accepted Answer

Change the action for Malware category from 'monitor' to 'block' in the web filter profile. The web filtering profile currently has the Malware category set to 'monitor all', which logs but does not block traffic. To block the URL, the action must be changed from 'monitor' to 'block' within the same web filter profile. This directly enforces the blocking action for all URLs categorized as Malware, including the known malicious URL.

Answer

Configure traffic shaping to rate limit the URL

Answer

Add a static URL filter with the exact URL and action 'block'

Answer

Enable DNS filter with botnet C2 domain blocking

Question 15

A company uses FortiGate as a web application firewall (WAF) to protect a public web server. The security team wants to block SQL injection attacks. Which WAF signature category should the administrator enable?

Accepted Answer

SQL Injection. SQL injection attacks specifically target database queries by injecting malicious SQL statements through input fields. FortiGate's WAF signature category for SQL Injection is designed to detect and block these patterns, such as 'OR 1=1' or UNION-based injections, by matching against known attack signatures in the HTTP request payload.

Answer

Server-Side Request Forgery

Answer

Command Injection

Answer

Cross-Site Scripting