NSE7 Practice Test 14 — 15 Questions

Question 1

What is the primary purpose of Dead Peer Detection (DPD) in an IPsec VPN configuration?

Accepted Answer

To detect if a VPN peer is alive by sending periodic probes and bringing down the tunnel if no response is received.. DPD sends keepalive messages to detect peer reachability. If the peer does not respond, the tunnel is marked down, allowing failover. Key renegotiation is handled by IKE lifetime settings, not DPD.

Answer

To establish a backup tunnel in case the primary tunnel fails.

Answer

To automatically renegotiate IKE phase1 keys before they expire.

Answer

To verify the integrity of encrypted packets using HMAC authentication.

Question 2

An administrator configures a ZTNA rule with an inline CASB profile to protect access to a SaaS application. The rule uses a ZTNA tag that requires 'OS Type = Windows' and 'Antivirus = running'. A user with a Windows 10 device and Symantec antivirus running is denied access. What is the MOST likely cause?

Accepted Answer

The Symantec antivirus is not listed in the FortiGate's supported antivirus list.. The ZTNA tag requires 'Antivirus = running', which means the FortiGate must receive a compliance report from the FortiClient EMS indicating that a supported antivirus is active. Symantec is not in FortiGate's supported antivirus list, so the EMS reports the antivirus status as 'not compliant', causing the ZTNA rule to deny access even though the user has antivirus running.

Answer

The user's device is not connected to the corporate network.

Answer

The inline CASB profile is blocking all traffic from the ZTNA rule.

Answer

The ZTNA tag requires the FortiClient EMS to be installed on the device.

Question 3

An administrator wants to detect lateral movement and early stages of an attack using decoy systems that mimic production assets. Which Fortinet product should they deploy?

Accepted Answer

FortiDeceptor. FortiDeceptor is specifically designed to detect lateral movement and early-stage attacks by deploying decoy systems (honeypots) that mimic production assets. It uses deception technology to lure attackers away from real targets and trigger alerts when decoys are probed or compromised, enabling early threat detection without impacting production systems.

Answer

FortiSIEM

Answer

FortiEDR

Answer

FortiNDR

Question 4

An enterprise deploys a FortiGate in transparent mode to bridge two broadcast domains. The administrator needs to apply a web filter to HTTP traffic between these domains. Which configuration is required?

Accepted Answer

Configure a security policy with source and destination interfaces as the bridge, action ACCEPT, and a web filter profile. In transparent mode, FortiGate bridges traffic at Layer 2, so security policies must use the bridge interface as both source and destination. Option B correctly configures a security policy with source and destination interfaces set to the bridge, action ACCEPT, and a web filter profile applied. This allows the FortiGate to inspect HTTP traffic between the two broadcast domains and apply the web filter.

Answer

Apply the web filter profile directly to the bridge interface

Answer

Enable web filtering globally under Config -> Features

Answer

Create a policy with action SET_PERMIT and enable web filtering

Question 5

An administrator notices that an application-based SD-WAN rule is not steering traffic as expected. The SLA targets are configured correctly. Which TWO debug commands should the administrator use to diagnose the issue? (Choose two.)

Accepted Answer

diagnose sys sdwan info. 'diagnose sys sdwan info' displays the current SD-WAN configuration and status, including SLA targets, interface metrics, and rule assignments, which helps verify if the SD-WAN rule is correctly applied. Option E is correct because filtering session entries by destination port 443 (HTTPS) and listing them shows active traffic flows, allowing the administrator to confirm whether the application traffic is being steered according to the SD-WAN rule or taking an unexpected path.

Answer

diagnose debug application sslvpn -1

Answer

get system performance status

Answer

diagnose sys sdwan rule list

Question 6

An administrator is investigating a security incident where a workstation is communicating with a known command and control (C2) server. The FortiGate has IPS enabled but did not block the traffic. Which TWO configuration issues could explain why the IPS did not detect the C2 communication? (Choose two.)

Accepted Answer

The firewall policy does not have SSL deep inspection enabled. Without SSL deep inspection, the FortiGate cannot decrypt HTTPS traffic to inspect the payload for C2 signatures. IPS operates on decrypted content; if the C2 communication uses TLS, the IPS engine only sees encrypted packets and cannot match application-layer signatures. Enabling SSL deep inspection with a valid CA certificate is required to decrypt and inspect the traffic.

Answer

The IPS sensor is configured in 'Inline' mode

Answer

The IPS sensor has 'Logging' disabled

Answer

The FortiGate is operating in 'Transparent' mode

Question 7

Which SD-WAN load balancing algorithm distributes traffic based on the number of active sessions per interface?

Accepted Answer

Sessions. The Sessions algorithm in Fortinet SD-WAN distributes new sessions by selecting the interface with the fewest currently active sessions. This ensures balanced session distribution across WAN links, preventing any single interface from becoming overloaded with connections while others remain underutilized.

Answer

Volume

Answer

Source-destination IP

Answer

Spillover

Question 8

A FortiManager administrator wants to deploy a policy package that contains shared header and footer policies across multiple devices. How should these policies be configured in FortiManager?

Accepted Answer

Configure the policies as header/footer policies within the policy package. In FortiManager, header and footer policies are specifically designed to be shared across multiple devices within a policy package. By configuring them as header/footer policies, the administrator ensures that these common rules are applied consistently at the top and bottom of the device-specific policy tables, while the middle policies can vary per device. This is the correct method for deploying shared policies without duplicating them in each device's policy set.

Answer

Define the policies in the ADOM's default policy package

Answer

Create a global policy package and assign it to all devices

Answer

Use the 'install preview' feature to merge policies

Question 9

A network admin is troubleshooting an SD-WAN rule that should steer VoIP traffic to a low-latency link. The rule matches traffic from the VoIP subnet to any destination and uses the 'best-quality' strategy with SLA monitoring. However, traffic is still using the other link. Which TWO checks should the admin perform? (Choose two.)

Accepted Answer

Check that the SD-WAN rule has a higher priority than other rules that might match the traffic.

Answer

Ensure that the FortiGate has a default route via each SD-WAN member.

Answer

Disable the other SD-WAN members temporarily to force traffic to the desired link.

Answer

Confirm that the VoIP subnet is included in the SD-WAN zone.

Question 10

An administrator is troubleshooting an IPsec VPN tunnel that connects a branch office to the main office. The tunnel is down. The administrator runs 'diagnose vpn ike gateway list' and sees the following output:
IKE gateway: branch
  state: down
  DPD: enabled
  DPD retrycount: 3
  DPD retryinterval: 10
What does the DPD configuration indicate?

Accepted Answer

The tunnel will be brought down after 3 unanswered DPD probes, each 10 seconds apart. DPD (Dead Peer Detection) is configured with a retry count of 3 and a retry interval of 10 seconds. This means the FortiGate will send DPD probes every 10 seconds and after 3 consecutive failures (30 seconds total without response), it will consider the peer dead. The tunnel is currently down, likely because DPD detected the peer as unreachable.

Answer

The tunnel will be brought down immediately after the first DPD timeout

Answer

The tunnel will stay up indefinitely because DPD is disabled

Answer

DPD will send probes every 30 seconds

Question 11

A FortiGate is configured as a SAML service provider (SP) for SSO. Users authenticate via an external IdP. After successful authentication, the FortiGate should enforce a firewall policy based on the user's group membership. Which FortiGate setting must be enabled to receive group information from the IdP?

Accepted Answer

Configure the 'user-group' attribute in the SAML SP settings. To receive group membership information from the IdP, the FortiGate SAML SP must be configured with the correct SAML attribute that carries the user group data. This is done by setting the 'user-group' attribute (or equivalent) in the SAML SP configuration. When the IdP sends a SAML assertion containing that attribute, FortiGate maps it to the user's group membership, enabling group-based firewall policies. Option D is correct because it explicitly references configuring the 'user-group' attribute in the SAML SP settings.

Answer

Enable 'Require IdP Certificate Validation'

Answer

Create a separate firewall policy for each user

Answer

Enable 'Auto-Provision Users' on FortiGate

Question 12

An HA cluster of two FortiGates is experiencing split-brain. After investigation, you find that the heartbeat link is down on the primary unit. Which action will resolve the split-brain condition?

Accepted Answer

Restore the heartbeat link by checking cables, interfaces, and VLAN configuration. Split-brain occurs when HA peers lose heartbeat communication and both assume the primary role. Since the root cause is a failed heartbeat link on the primary unit, restoring that link (checking cables, interfaces, VLAN configuration) re-establishes the control channel, allowing the cluster to negotiate roles and resolve the split-brain condition without disrupting services or requiring a full HA reset.

Answer

Disable HA on both units and re-enable

Answer

Increase the HA priority on the primary unit

Answer

Reboot the secondary unit

Question 13

During a failover test in an active-passive HA cluster, the administrator notices that the secondary unit does not take over the primary role after a link failure on the primary. The 'get system ha status' shows both units in 'standalone' mode. What is the MOST likely cause?

Accepted Answer

The HA heartbeat interface is down or misconfigured on one unit. When both units show 'standalone' mode in 'get system ha status', it indicates that the HA cluster has lost communication between the primary and secondary units, causing them to operate independently. The most common cause is a failure or misconfiguration of the HA heartbeat interface, which is the dedicated link used for cluster synchronization and health monitoring. Without a functional heartbeat, the secondary cannot detect the primary's link failure and will not initiate a failover.

Answer

The session pickup feature is disabled

Answer

The cluster is running in active-active mode

Answer

The HA override feature is disabled

Question 14

An administrator is troubleshooting an IPsec VPN where phase 1 is up but phase 2 fails. Which two debug commands would be MOST helpful in diagnosing the phase 2 issue? (Choose TWO.)

Accepted Answer

diagnose vpn ipsec phase2-config. 'diagnose vpn ipsec phase2-config' displays the phase 2 configuration parameters (e.g., proxy IDs, encryption/authentication algorithms, and SA lifetimes) that must match between peers. Option E is correct because 'diagnose debug application ike -1' enables real-time IKEv1/IKEv2 debugging, which shows the exact phase 2 negotiation messages (e.g., Quick Mode exchanges) and any error codes or mismatches. Together, they allow you to identify configuration mismatches or negotiation failures that prevent phase 2 from establishing.

Answer

diagnose sys session list

Answer

diagnose debug application ipsec -1

Answer

get vpn ipsec tunnel details

Question 15

An administrator configures a session helper for FTP on FortiGate. After enabling the helper, FTP clients can establish control connections but data transfers fail. What is the most likely cause?

Accepted Answer

The session helper is not applied to the correct firewall policy or the traffic is not matching the helper. The session helper for FTP must be explicitly applied to the firewall policy that handles the FTP traffic. If the helper is enabled globally but not associated with the correct policy, or if the traffic does not match the policy (e.g., due to incorrect source/destination or service), the FortiGate will not inspect the control channel to dynamically open data ports. This results in successful control connections (TCP port 21) but failure of data transfers (active or passive), as the helper is not present to create the necessary pinholes for data sessions.

Answer

The firewall policy is configured to deny all FTP traffic

Answer

The FTP server's certificate is invalid

Answer

The FTP server is using active mode, which is not supported by the session helper