NSE7 Practice Test 16 — 15 Questions

Question 1

In FortiGate's ZTNA, what is the purpose of a 'ZTNA tag'?

Accepted Answer

To identify a device's compliance status and attributes for policy enforcement.. ZTNA tags are dynamic attributes (e.g., OS type, antivirus status) assigned to devices based on posture checks. They are used in firewall policies to grant access based on device compliance, not for routing or QoS.

Answer

To mark packets for quality of service (QoS) prioritization.

Answer

To label network interfaces for traffic steering.

Answer

To assign a security level to application traffic.

Question 2

An administrator configures FortiGate as a SAML identity provider (IdP) for a cloud application. The application (SP) initiates the login. Users are redirected to the FortiGate login page and authenticate successfully, but then receive an error from the SP. What is a common cause?

Accepted Answer

The SP's ACS (Assertion Consumer Service) URL is misconfigured on the FortiGate. When FortiGate is the IdP, it must be configured with the SP's ACS URL and entity ID. If these are incorrect, the SAML assertion is not accepted by the SP.

Answer

The FortiGate's certificate is not trusted by the user's browser

Answer

The user's account is locked

Answer

The SAML attribute mapping is incorrect

Question 3

Which FortiManager feature allows administrators to view the exact configuration changes that would be applied to a managed FortiGate before committing them?

Accepted Answer

Install preview. Install preview is the correct answer because it allows administrators to see the exact CLI commands that will be pushed to a managed FortiGate during the next install operation, without actually applying them. This feature provides a diff-like view of the configuration changes, enabling validation before committing changes to production devices.

Answer

Revision history

Answer

Device manager

Answer

Policy checker

Question 4

A FortiGate is configured with two SD-WAN members (port1 and port2). The administrator sets an SD-WAN rule with 'set load-balance-mode source-dst-ip' for all internal traffic. The source IP is 10.0.0.1 and destination IP is 172.16.0.1. Which factor determines the outgoing interface for this traffic?

Accepted Answer

The combination of source IP and destination IP hashed to select an interface. With 'set load-balance-mode source-dst-ip', the FortiGate performs a hash of both the source IP and destination IP to deterministically select an outgoing SD-WAN member. This ensures that all packets belonging to the same source-destination pair are consistently forwarded over the same interface, preserving flow symmetry without relying on per-packet metrics.

Answer

The destination IP only

Answer

The source IP only

Answer

The interface with the lowest current utilization

Question 5

A FortiGate administrator needs to configure a hub-and-spoke ADVPN with OSPF as the routing protocol over the VPN tunnels. Which TWO steps are required on the hub FortiGate to enable shortcut tunnels?

Accepted Answer

Enable 'shortcut' option under the phase2 configuration.. Enabling the 'shortcut' option under the phase2 configuration on the hub FortiGate allows the hub to advertise shortcut tunnel capabilities to spoke devices. This is essential for establishing direct spoke-to-spoke tunnels in an ADVPN setup, as it triggers the dynamic negotiation of shortcut paths when traffic patterns warrant them.

Answer

Set 'add-route' to 'disable' on the phase2 configuration.

Answer

Enable 'auto-discovery-receiver' on the hub's phase1 configuration.

Answer

Configure OSPF network type as 'broadcast' on the hub's tunnel interface.

Question 6

An administrator runs the following CLI command on a FortiGate and sees the output below:
diagnose vpn ike gateway list
vd: root/0 name: REMOTE_GW vrf: 0 version: 2
state: UP IKE SA: created 1s ago 1.2.3.4:500->5.6.7.8:500
What is the most likely explanation for the IKE SA being created only 1 second ago?

Accepted Answer

The VPN tunnel was just configured or a configuration change was applied. The IKE SA was recently created, suggesting a previous SA was deleted and a new one established. This often happens after configuration changes or a restart of IKE negotiation.

Answer

The remote peer changed its IP address

Answer

DPD detected a dead peer and renegotiated

Answer

The phase 2 SA expired and triggered phase 1 rekey

Question 7

An organization is deploying multiple FortiGate devices across different geographic locations. The central IT team manages all devices from a single FortiManager. The remote FortiGates connect to FortiManager over a WAN link. Which feature should be enabled on FortiManager to ensure that configuration changes are applied consistently and without interruption to the remote FortiGates?

Accepted Answer

Use the 'Install on Next Reboot' option in the install wizard. The 'Install on Next Reboot' option ensures that configuration changes are staged on the remote FortiGate and applied atomically when the device reboots. This prevents partial or inconsistent application over an unreliable WAN link, as the FortiManager pushes the full configuration revision to the device, which then applies it during the boot process without requiring a persistent management session.

Answer

Enable auto-link configuration on the FortiManager

Answer

Use 'Install Wizard' with 'Immediate Install' option

Answer

Enable 'Configuration Override' on the managed FortiGates

Question 8

An administrator configures SD-WAN with multiple members. The SD-WAN rule uses the 'latency' strategy. The administrator notices that traffic is not switching to the best-performing member even when latency exceeds the threshold. What could be the issue?

Accepted Answer

The SLA target is not configured or not applied to the SD-WAN rule. The latency-based SD-WAN rule requires an SLA target to define acceptable performance thresholds. Without an SLA target configured and applied to the rule, the FortiGate has no baseline to compare against, so it will never trigger a member switch even if latency exceeds the threshold. The SLA target must be linked to the SD-WAN rule via the 'set sla' command in the rule configuration.

Answer

The load balancing algorithm is set to 'source-ip-based'

Answer

The threshold is set too low

Answer

The SD-WAN members are in different VDOMs

Question 9

An administrator runs 'diagnose debug application fnbam 3' and sees many entries with state 'sctp'. The FortiGate has flow-based inspection enabled. What is being indicated?

Accepted Answer

Traffic is being fast-forwarded without security profile inspection. The 'diagnose debug application fnbam 3' command shows the FortiGate's flow-based Network Processor (NPU) session offload status. When entries show state 'sctp', it indicates that the traffic is being handled by the SCTP (Session Control Traffic Path) fast-path, meaning the session is offloaded to the NPU for hardware acceleration and bypasses security profile inspection. This is normal for flow-based inspection when traffic matches fast-path criteria, not an indication of SCTP protocol inspection or attacks.

Answer

The FortiGate is performing SCTP deep inspection

Answer

The FortiGate is using proxy-based inspection

Answer

There is an SCTP-based attack in progress

Question 10

Match each SD-WAN component to its role.

Accepted Answer

SD-WAN Rule: Determines traffic steering based on criteria like source, destination, application.. Correct matches: SD-WAN Rule → traffic steering; Performance SLA → link quality monitoring; Virtual-WAN-Link → interface grouping. Common confusions mix these roles.

Answer

SD-WAN Rule: Monitors link quality metrics (latency, jitter, packet loss) against thresholds.

Answer

Performance SLA: Groups WAN interfaces into a logical bundle for load balancing.

Answer

Virtual-WAN-Link: Determines traffic steering based on criteria like source, destination, application.

Question 11

An administrator configured a new policy package in FortiManager and assigned it to a FortiGate. After installing the policy package, the FortiGate shows the new policies, but traffic is not matching them. What could be the reason?

Accepted Answer

The policy package is installed to the root VDOM instead of the target VDOM. When a policy package is installed to a FortiGate via FortiManager, the installation target must match the VDOM context of the FortiGate. If the administrator assigns the policy package to the root VDOM (or a different VDOM) instead of the specific VDOM where traffic is being processed, the policies will appear in the FortiGate's configuration but will not be applied to the correct VDOM's traffic. FortiManager installs policies per VDOM, and mismatched VDOM assignment causes the policies to be ignored by the traffic path.

Answer

The policy package has not been committed

Answer

The FortiGate has not been added to the ADOM

Answer

The FortiGate is in transparent mode

Question 12

What is the function of a VRF (Virtual Routing and Forwarding) on a FortiGate?

Accepted Answer

To create multiple independent routing tables. VRF (Virtual Routing and Forwarding) on a FortiGate allows the creation of multiple independent routing tables within a single physical device. This enables network segmentation and traffic isolation at Layer 3, where each VRF maintains its own routing table, forwarding decisions, and interface associations, preventing routes from leaking between VRFs unless explicitly configured with route leaking.

Answer

To provide redundancy for routing protocols

Answer

To aggregate multiple physical interfaces into one logical interface

Answer

To encrypt traffic between different virtual domains

Question 13

A FortiGate HA cluster is configured in active-passive mode with VDOMs. The administrator wants to ensure that a specific VDOM (VDOM1) always runs on the primary unit unless that unit fails. Additionally, the administrator wants to minimize disruption during a failover. Which THREE configuration steps should be taken?

Accepted Answer

Set the HA priority of the primary unit to a higher value (e.g., 200) than the secondary unit. In an active-passive HA cluster, setting a higher HA priority (e.g., 200) on the primary unit ensures it is elected as the active unit. This guarantees that VDOM1, which is not load-balanced, will run on the primary unit under normal conditions, as the higher priority value makes the primary unit preferred during the election process.

Answer

Disable session pickup to speed up failover

Answer

Enable active-active HA mode

Question 14

An administrator configures two FortiGate units in an active-passive HA cluster. During a failover test, the administrator notices that the secondary unit becomes primary but the session table is empty, causing all existing connections to drop. Which configuration change should be made to preserve session information during failover?

Accepted Answer

Enable session pickup and configure HA session synchronization. Session pickup and HA session synchronization are specifically designed to replicate the session table from the primary FortiGate to the secondary unit in an active-passive cluster. Without this feature, the secondary unit becomes primary but has no knowledge of existing sessions, causing all active connections to drop. Enabling session synchronization ensures that session state information is continuously mirrored to the standby unit, allowing seamless failover without disrupting established flows.

Answer

Enable FGCP configuration synchronization

Answer

Configure dead gateway detection on the FortiGate units

Answer

Enable link-failover on the monitored interfaces

Question 15

A FortiGate administrator wants to see the current number of active sessions. Which command provides this information?

Accepted Answer

diagnose sys session stat. The 'diagnose sys session stat' command displays a summary of the current session table, including the total number of active sessions, which is exactly what the administrator needs. This command is part of FortiGate's diagnostic tools and provides a quick statistical overview without listing individual session details.

Answer

show system session-info

Answer

diagnose sys session list

Answer

get system performance status