NSE7 Practice Test 15 — 15 Questions

Question 1

A FortiGate administrator wants to use FortiManager automation stitches to automatically block IP addresses that trigger multiple intrusion prevention events. Which two components are required to configure an automation stitch? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Trigger. An automation stitch in FortiManager requires a Trigger to define the event that initiates the stitch (e.g., an intrusion prevention event) and an Action to specify the response (e.g., blocking an IP address via a firewall address object). The Trigger monitors for specific log messages or system events, while the Action executes the configured remediation step. Without both, the stitch cannot be created or function.

Answer

Playbook

Answer

Destination

Answer

Schedule

Question 2

An administrator wants to enforce that only devices with antivirus software installed and running can access a sensitive application via ZTNA. Which ZTNA feature should be used to verify this requirement?

Accepted Answer

ZTNA tags with device posture checks. ZTNA tags with device posture checks allow the FortiGate to evaluate the security posture of the endpoint, including whether antivirus software is installed and running. These tags are then used in firewall policies to grant or deny access to sensitive applications based on compliance. This directly enforces the requirement.

Answer

ZTNA inline CASB

Answer

NAC with FortiNAC

Answer

IPsec VPN with DPD

Question 3

A FortiGate admin notices that sessions to a particular server are not being logged in FortiAnalyzer. The firewall policy has logging enabled. What is the MOST likely reason?

Accepted Answer

The FortiGate is not configured to send logs to FortiAnalyzer. The most likely reason is that the FortiGate is not configured to send logs to FortiAnalyzer. Even if the firewall policy has logging enabled, logs are only generated locally on the FortiGate; they must be explicitly forwarded to FortiAnalyzer via the 'config log fortianalyzer setting' CLI or GUI configuration. Without this configuration, no logs reach FortiAnalyzer regardless of policy settings.

Answer

The FortiAnalyzer's device registration is incorrect

Answer

The log queue on FortiGate is full

Answer

The FortiAnalyzer is out of disk space

Question 4

An administrator sees the following log entry:
'id=13593 msg="CDR: File attachment sanitized"'
Which feature generated this log?

Accepted Answer

Content Disarm and Reconstruction. The log entry 'CDR: File attachment sanitized' is generated by Content Disarm and Reconstruction (CDR). CDR works by removing active content (e.g., macros, scripts, embedded objects) from files and rebuilding them into a safe, sanitized version. This is distinct from sandboxing or machine learning, as CDR does not rely on detection but instead proactively neutralizes threats by reconstructing the file.

Answer

FortiSandbox

Answer

Machine Learning Engine

Answer

Outbreak Prevention

Question 5

An administrator wants to see the current sessions for a specific source IP address 192.168.1.10. Which CLI command should be used?

Accepted Answer

diagnose sys session filter src 192.168.1.10; diagnose sys session list. The `diagnose sys session filter src` command sets a filter for the source IP address, and `diagnose sys session list` then displays only the sessions matching that filter. This two-step process is the standard FortiGate CLI method for viewing active sessions for a specific source IP, as it leverages the session table directly without triggering debug overhead.

Answer

get system session list src 192.168.1.10

Answer

diagnose debug flow src-addr 192.168.1.10

Answer

execute session list source 192.168.1.10

Question 6

An administrator configures a custom IPS signature to detect traffic to a specific malicious domain. Which syntax is correct for a custom IPS signature in FortiGate?

Accepted Answer

F-SBID( --name "malicious_domain"; --pattern "example.com"; --service HTTP; ). FortiGate custom IPS signatures use the F-SBID (Fortinet Signature-Based IDentification) syntax, which requires the --name and --pattern keywords to define the signature name and the malicious pattern to match. This syntax is specific to FortiGate's IPS engine and is not based on Snort or Suricata rule syntax.

Answer

config ips custom signature edit "malicious_domain" set signature "alert tcp any any -> any any (msg:"malicious"; content:"example.com";)" end

Answer

config firewall policy edit 1 set ips-filter "malicious_domain" end

Answer

set ips-sensor custom-signature "malicious_domain" pattern "example.com"

Question 7

Which THREE actions can an administrator perform using FortiManager in a Security Fabric environment? (Choose three.)

Accepted Answer

Upgrade the firmware of multiple FortiGates at once. FortiManager supports centralized firmware management, allowing administrators to upgrade the firmware of multiple FortiGates simultaneously via the 'Firmware Upgrade' wizard in the Device Manager. This leverages the FortiManager's role as a central management point, which can stage and push firmware images to managed devices in a Security Fabric, reducing downtime and ensuring consistency across the fabric.

Answer

Terminate IPsec VPN tunnels on the FortiManager

Answer

Configure FortiGate to manage the FortiManager

Question 8

A network administrator is configuring SD-WAN on a FortiGate. The organization has two internet links: MPLS (primary) and broadband (backup). The administrator wants all traffic to use the MPLS link unless it fails, in which case traffic should fail over to the broadband link. Which SD-WAN configuration best achieves this requirement?

Accepted Answer

Set the MPLS link priority to 10 and the broadband link priority to 5, then configure an SD-WAN rule with the 'best quality' strategy.. Setting the MPLS link priority to 10 (higher) and broadband to 5 (lower) ensures the SD-WAN rule with 'best quality' strategy selects the MPLS link as the preferred path. The 'best quality' strategy evaluates link quality metrics and, when priorities differ, prefers the higher-priority link. If the MPLS link fails, the strategy automatically fails over to the broadband link, meeting the requirement.

Answer

Enable 'set role' on the MPLS link as 'primary' and on the broadband link as 'standby' with the 'redundant' strategy.

Answer

Configure both links in the SD-WAN zone with equal priority and use the 'lowest cost' strategy.

Answer

Create two static routes: one with higher distance for MPLS and one with lower distance for broadband.

Question 9

In a multi-VDOM deployment, an administrator needs to route traffic between VDOM-A and VDOM-B. The administrator creates a VDOM link between the two VDOMs. What additional configuration is required on each VDOM to enable inter-VDOM traffic?

Accepted Answer

Configure a static route on each VDOM pointing to the other VDOM's networks via the VDOM link, and create a firewall policy allowing traffic. Inter-VDOM traffic via a VDOM link requires both a static route on each VDOM pointing to the remote VDOM's networks through the VDOM link interface, and a firewall policy on each VDOM that permits the desired traffic. Without the static route, the VDOM does not know how to reach the other VDOM's subnets; without the firewall policy, traffic is blocked by the implicit deny rule. The VDOM link itself provides the Layer 2 or Layer 3 connectivity between the VDOMs, but routing and policy enforcement are mandatory for traffic to flow.

Answer

Only a firewall policy on VDOM-A allowing traffic to VDOM-B

Answer

Assign the VDOM link interfaces to the same VDOM

Answer

Enable 'inter-vdom-routing' under system settings only

Question 10

A company has two internet connections: a primary fiber link (port1, 100 Mbps) and a backup DSL link (port2, 20 Mbps). They are using SD-WAN to load balance traffic based on volume, with a rule that sends 70% of traffic to port1 and 30% to port2. Recently, users report that video conferencing applications are experiencing high latency and jitter. The network team finds that the SD-WAN performance SLA for the fiber link shows 80% packet loss and high latency. The SD-WAN rule action is set to 'best quality' with a latency threshold of 150 ms. The current latency on port1 is 200 ms, and on port2 is 40 ms. What should the administrator do to ensure that video conferencing traffic uses the DSL link while the fiber link is degraded?

Accepted Answer

No changes are needed; the SD-WAN rule with 'best quality' will automatically use port2 for new sessions because port1 does not meet the SLA.. The SD-WAN rule action is set to 'best quality', which means the FortiGate will automatically steer new sessions away from any interface that fails the performance SLA. Since port1 has 80% packet loss and 200 ms latency (exceeding the 150 ms threshold), it is considered degraded, and new video conferencing traffic will be directed to port2 (40 ms latency) without manual intervention.

Answer

Increase the SLA latency threshold to 250 ms so that the fiber link is considered acceptable.

Answer

Change the SD-WAN rule action to 'lowest cost' to favor the DSL link.

Answer

Adjust the volume ratio to send 100% of traffic to port2 until the fiber link recovers.

Question 11

An administrator runs 'diagnose debug application ipsmonitor -1' and sees repeated messages: 'IPS engine restarting'. What is the MOST likely cause of this behavior?

Accepted Answer

The IPS engine is running out of memory. The 'IPS engine restarting' message in the output of 'diagnose debug application ipsmonitor -1' indicates that the IPS engine process is crashing and being automatically restarted by the FortiGate's watchdog. The most common cause of IPS engine crashes is memory exhaustion, as the engine requires a dedicated memory heap to process signatures and sessions; when this heap is depleted, the engine terminates to prevent system instability.

Answer

The FortiGate is overloaded with too many concurrent sessions

Answer

The firewall policy is configured for flow-based inspection

Answer

The IPS signatures are outdated and need updating

Question 12

A FortiGate administrator needs to identify which process is consuming the most memory. Which command should be used?

Accepted Answer

diagnose sys top. The 'diagnose sys top' command displays a real-time list of running processes sorted by CPU and memory usage, allowing the administrator to identify which process is consuming the most memory. This is the standard FortiGate CLI command for process-level resource monitoring, similar to 'top' on Linux systems.

Answer

show system resource usage

Answer

diagnose hardware sysinfo memory

Answer

get system performance status

Question 13

A FortiGate admin configures a policy package with header and footer policies in FortiManager. What is the purpose of header policies?

Accepted Answer

They are evaluated before other policies in the same policy package. Header policies in FortiManager are evaluated before any other policies in the same policy package. This allows administrators to enforce mandatory rules—such as blocking specific traffic or applying global inspection—that must be processed first, ensuring they are not bypassed by more specific policies later in the sequence.

Answer

They are used for NAT policies only

Answer

They provide default logging for all traffic

Answer

They apply only to the root VDOM

Question 14

A FortiGate has two WAN interfaces configured as SD-WAN members. The administrator wants traffic to specific destination IP addresses to use a particular member. Which SD-WAN configuration object should be used to achieve this?

Accepted Answer

SD-WAN rule. SD-WAN rules are the correct configuration object because they allow you to define policy-based forwarding (PBF) criteria, such as source/destination IP addresses, to steer traffic to a specific SD-WAN member interface. Unlike static routes, SD-WAN rules evaluate traffic against match conditions and then apply an explicit action to use a designated member or strategy, making them the precise tool for this requirement.

Answer

Route map

Answer

Prefix list

Answer

Performance SLA

Question 15

An administrator configures a FortiGate in transparent mode for a VDOM. After switching to transparent mode, the administrator notices that the default route disappears and traffic fails. What must be configured to restore routing?

Accepted Answer

A management IP address and default gateway for the VDOM. In transparent mode, a FortiGate VDOM acts as a Layer 2 bridge and does not participate in Layer 3 routing. The default route disappears because the VDOM has no Layer 3 interface to host a routing table. To restore management connectivity and allow the FortiGate to reach remote networks (e.g., for firmware updates or logging), you must configure a management IP address and a default gateway for the VDOM. This management IP is used solely for outbound management traffic and does not affect the bridged data plane.

Answer

A static route on the upstream router

Answer

Enable NAT mode to allow routing

Answer

Assign an IP address to each interface