NSE7 Practice Test 15 — 15 Questions

Question 1

A FortiGate is managed by FortiManager. The administrator creates a new policy package for VDOM 'Sales' and installs it. Later, they find that the previous configuration has been overwritten. What should the administrator do to avoid this in the future?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the install preview before applying the changes. Using the install preview allows the administrator to review the exact changes that will be applied to the FortiGate before committing them. This prevents accidental overwrites by showing a diff of the configuration, enabling the administrator to verify that the new policy package will not replace existing settings unintentionally.

Answer

Set the FortiGate to backup mode

Answer

Enable auto-lock on the policy package

Answer

Enable revision history

Question 2

An administrator is configuring a FortiGate HA cluster in active-passive mode. The company has two ISPs, and the primary FortiGate is connected to ISP1 and ISP2. The secondary FortiGate is connected only to ISP2. The administrator wants to ensure that failover occurs only if both ISP1 and ISP2 connections are lost on the primary device. Which configuration approach should be used?

Accepted Answer

Set the HA priority of the primary to 1 and the secondary to 0, and enable link-fail-signal on both ISP interfaces on the primary, then set 'set ha-priority 1' on the primary and 'set ha-priority 0' on the secondary.. It uses link-fail-signal on both ISP interfaces of the primary FortiGate to detect physical link loss, and sets HA priorities (primary=1, secondary=0) so that failover occurs only when both ISP links are down. Link-fail-signal triggers an HA failover only when the monitored interface loses carrier, and since both ISP1 and ISP2 interfaces are monitored, the primary will only relinquish control when both links fail, meeting the requirement.

Answer

Use gateway monitoring with virtual router failover, and set the failure threshold to 2.

Answer

Configure gateway monitoring on the primary for ISP1 only, and set the HA failover threshold to 1.

Answer

Set the HA priority of the primary to 1 and the secondary to 0, and enable link-fail-signal on both ISP interfaces on the primary.

Question 3

In FortiManager, what is an automation stitch?

Accepted Answer

A sequence of automated actions triggered by a specific event. An automation stitch in FortiManager is a sequence of automated actions (such as running scripts, sending alerts, or executing CLI commands) that are triggered by a specific event (e.g., a log message, a SNMP trap, or a schedule). This allows administrators to automate incident response and policy changes without manual intervention, directly within the FortiManager fabric.

Answer

A feature to stitch multiple ADOMs together

Answer

A set of scripts that run on a schedule

Answer

A method to combine multiple policy packages

Question 4

A FortiGate is configured with OSPF and BGP. The administrator wants to redistribute OSPF routes into BGP. Which TWO steps are required?

Accepted Answer

Use the 'redistribute ospf' command under the BGP configuration. The 'redistribute ospf' command under BGP configuration is the explicit method to inject OSPF-learned routes into the BGP table. This command triggers the redistribution process, allowing OSPF routes to be advertised to BGP peers.

Answer

Configure a route map to filter the routes being redistributed

Answer

Set the BGP table version to 2

Answer

Disable OSPF on the interface

Question 5

An organization wants to deploy a web application firewall (WAF) to protect a public-facing web application. They are evaluating FortiGate versus FortiWeb. Which of the following is a key advantage of using FortiWeb over FortiGate for WAF functionality?

Accepted Answer

FortiWeb offers advanced bot detection and positive security model. FortiWeb is a dedicated web application firewall that provides advanced bot detection and a positive security model, which allows only explicitly allowed traffic based on a whitelist of known good patterns. This is a key advantage over FortiGate, which primarily uses a negative security model (signature-based) and lacks the same depth of bot mitigation and positive enforcement for web-specific threats.

Answer

FortiGate can perform SSL deep inspection without performance impact

Answer

FortiGate supports a larger number of web servers behind a single policy

Answer

FortiGate can automatically patch web application vulnerabilities

Question 6

An organization uses FortiMail and wants to validate that incoming emails are from legitimate senders by checking the sender's domain against a published policy. Which two email authentication mechanisms can FortiMail use? (Choose two.)

Accepted Answer

SPF and DKIM. FortiMail can use SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to validate that incoming emails originate from legitimate senders by checking the sender's domain against a published policy. SPF verifies that the sending IP address is authorized by the domain's DNS TXT record, while DKIM uses a digital signature in the email header that can be validated against a public key published in the sender's DNS. Both mechanisms allow FortiMail to authenticate the sender's domain before accepting the message.

Answer

DKIM and DMARC

Answer

STARTTLS and SPF

Answer

DMARC and SPF

Question 7

A FortiGate is running OSPF with multiple areas. The administrator notices that routes from area 1 are not being redistributed into area 0. The ABR has the following configuration: 'config router ospf
 config area
  edit 0.0.0.0
  set type nssa
 end
 config area
  edit 0.0.0.1
  set type standard
 end
 end'. What is the issue?

Accepted Answer

Area 0 is configured as NSSA, which does not accept type 3 LSAs from other areas.. Area 0 is configured as an NSSA (Not-So-Stubby Area), which by default does not accept Type 3 summary LSAs from other areas. Since routes from area 1 (a standard area) are injected into the ABR as Type 3 LSAs, they are blocked by the NSSA area 0 boundary. This prevents inter-area route redistribution into area 0.

Answer

The ABR must have 'set type standard' for area 0.

Answer

The ABR is missing a 'redistribute connected' command.

Answer

Area 1 is not configured as NSSA, so routes cannot be redistributed.

Question 8

An SD-WAN rule is configured to steer traffic based on SLA metrics. The administrator notices that traffic is not using the expected member interface even though the SLA is meeting thresholds. What should the administrator check FIRST?

Accepted Answer

Run 'diagnose sys sdwan info' to verify the rule and member status. 'diagnose sys sdwan info' provides a real-time view of SD-WAN rule status, member interface health, and SLA compliance. This command directly shows whether the rule is matching traffic and if the expected member is active or has been deprioritized due to implicit factors like session stickiness or load-balancing algorithm, which are not visible in the SLA thresholds alone.

Answer

Check the firewall policy to ensure SD-WAN is enabled

Answer

Verify the BGP configuration to ensure routes are being advertised

Answer

Restart the FortiGate to clear any stale sessions

Question 9

An administrator is configuring a FortiGate HA cluster and wants to ensure that the cluster can tolerate a failure of one unit without administrative intervention. The cluster must also support upgrading firmware with minimal downtime. Which HA mode should the administrator select?

Accepted Answer

Active-passive HA. Active-passive HA (option C) is correct because it provides automatic failover without administrative intervention when a unit fails, and it supports hitless firmware upgrades by upgrading the standby unit first, then performing a failover to make it active, followed by upgrading the original active unit. This mode uses a single management IP and synchronizes configuration and session state between the primary and backup units, ensuring minimal downtime during both failure and upgrade scenarios.

Answer

Standalone mode

Answer

Active-active HA

Answer

FGCP mode

Question 10

An administrator wants to automatically block a file that FortiSandbox has determined to be malicious. The FortiGate is configured with an antivirus profile that includes FortiSandbox submission. Which verdict action should be set to 'block' in the antivirus profile to achieve this?

Accepted Answer

Malicious. The 'Malicious' verdict action in the antivirus profile is specifically designed to block files that FortiSandbox has determined to be malicious. When FortiSandbox submits a file and returns a 'malicious' verdict, the FortiGate uses this action to enforce blocking, ensuring the file is not delivered to the end user.

Answer

Exempted

Answer

Unknown

Answer

Clean

Question 11

An administrator is deploying a hub-and-spoke ADVPN with three spoke sites. The spokes have dynamic IP addresses. The hub has a static IP. The administrator wants the spokes to establish direct shortcut tunnels when they communicate with each other. Which THREE conditions must be met for shortcut tunnels to be established? (Choose three.)

Accepted Answer

The spoke tunnel interfaces must be in the same IP subnet. For ADVPN shortcuts to be established, three conditions must be met: (A) The spoke tunnel interfaces must be in the same IP subnet to allow direct routing. (D) Auto-discovery must be enabled in the phase1 settings on all spokes to exchange shortcut information. (E) The hub must have routes to all spoke local subnets so it can forward shortcut initiation packets. Option B is incorrect because spokes can have dynamic IP addresses with ADVPN. Option C is incorrect because 'set shortcuthub enable' is not required; the hub functions as a shortcut hub by default.

Answer

The spokes must have static public IP addresses

Answer

The hub must be configured with 'set shortcuthub enable' to act as a shortcut hub

Question 12

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal web application. The current network uses FortiGate as the firewall. Which component is required to enforce ZTNA policies on the FortiGate?

Accepted Answer

FortiGate ZTNA proxy configuration. ZTNA on FortiGate requires the FortiGate to be configured as a ZTNA proxy (gateway) that intercepts traffic to internal applications and enforces access policies. Option C is correct because the FortiGate must have the ZTNA proxy configuration to act as the enforcement point. Options A, B, and D are not directly responsible for enforcing ZTNA policies; FortiSandbox is for sandboxing, FortiAnalyzer for logging, and FortiAuthenticator for authentication services, but the enforcement itself is done by the FortiGate ZTNA proxy.

Answer

FortiSandbox for content inspection

Answer

FortiAnalyzer for log analysis

Answer

FortiAuthenticator for RADIUS authentication

Question 13

A FortiGate is configured with a ZTNA access proxy rule for a web application. The administrator wants to enforce that only devices with a specific FortiClient tag (e.g., 'Compliant') can access the application. Where is this tag-based access control configured?

Accepted Answer

In the ZTNA access proxy rule under the ZTNA gateway configuration. In FortiGate ZTNA, device posture tags from FortiClient are evaluated in the ZTNA access proxy rule under the ZTNA gateway configuration. The administrator configures the tag match condition directly in the access proxy rule, not in a firewall policy, SSL profile, or EMS policy. Therefore, option D is correct.

Answer

In the FortiClient EMS policy

Answer

In the firewall policy that permits traffic from the ZTNA gateway to the application

Answer

In the SSL inspection profile

Question 14

An admin configures a FortiManager ADOM for a customer with multiple FortiGates. The admin wants to use meta fields to group firewalls by location. After defining a meta field 'Location' and assigning values to devices, where can the admin use the meta field for policy targeting?

Accepted Answer

In the installation target of a policy package, the admin can filter devices by meta field values. In FortiManager, meta fields are used within ADOM-level policy packages to filter devices during installation targeting. This allows the admin to select only FortiGates with a specific 'Location' meta field value, enabling policy targeting based on location without manual device grouping.

Answer

Meta fields are automatically synced to FortiGate and used in firewall policies

Answer

In the ADOM level policy package, meta fields are used as variables in policy names

Answer

Meta fields are only used for generating reports in FortiAnalyzer

Question 15

A FortiGate is configured with multiple VRFs to segregate traffic from different departments. The administrator needs to allow the Finance VRF to access a shared printer in the default VRF. Which TWO steps are required to enable inter-VRF communication?

Accepted Answer

Configure a leak route from the Finance VRF to the default VRF for the printer's subnet. Route leaking is required to make the printer's subnet reachable from the Finance VRF. Without a leak route, the Finance VRF has no route to the printer in the default VRF, so traffic cannot be forwarded even if a firewall policy permits it.

Answer

Configure OSPF to redistribute routes between VRFs

Answer

Place both the Finance and default VRF interfaces into the same zone

Answer

Assign the printer's IP address to an interface in the Finance VRF