NSE7 Practice Test 17 — 15 Questions

Question 1

A company uses SSL VPN with FortiGate for remote access. Users report that after connecting, they can access internal web servers but cannot ping them. Which configuration is most likely missing?

Accepted Answer

Firewall policy allowing ICMP. SSL VPN tunnels typically allow TCP-based traffic like HTTP/HTTPS to internal web servers, but ICMP (ping) is a separate protocol that requires explicit permission in the firewall policy. Without a firewall policy rule permitting ICMP from the SSL VPN interface to the internal network, the FortiGate will drop the ping requests, even though the tunnel is established and other traffic flows.

Answer

Split tunneling settings

Answer

SSL VPN web portal settings

Answer

DNS server configuration

Question 2

A FortiGate is configured with two VPN tunnels to different remote sites. The administrator notices that traffic is not load-balanced across the tunnels; all traffic uses the first tunnel. The administrator wants to use ECMP (Equal Cost Multi-Path) routing. Which two actions are required? (Choose two.)

Accepted Answer

Set the same distance and priority for both static routes. ECMP requires that routes have the same distance and priority. Also, the administrator must enable ECMP in the routing settings. Option A and D are correct: set the same distance and priority for the static routes, and enable ECMP. Note: ECMP is enabled by default in policy-based routing? Actually, for static routes, ECMP is automatically used when multiple routes have the same distance and priority. Option D is correct: enable ECMP in the routing settings (if not already). But the question asks for two actions. So A and D.

Answer

Configure both tunnels to use the same IKE version

Answer

Set the same phase2 lifetime for both tunnels

Question 3

Refer to the exhibit. Users report that they cannot log in to the SSL VPN portal. The stats show 15 login failures with reason 'auth_fail'. What is the most likely cause?

Accepted Answer

The SSL VPN settings do not reference the user group. The 'auth_fail' reason indicates that the authentication request was processed but rejected, typically because the SSL VPN portal is not configured to reference the user group that 'user1' belongs to. Without a group filter or group mapping in the SSL VPN settings, the FortiGate cannot match the user to any allowed group, causing the authentication to fail even if the user credentials are valid.

Answer

The user 'user1' does not exist

Answer

The login-attempt-limit is too low

Answer

The encryption algorithm is set to low

Question 4

An administrator runs 'diagnose sys session filter dport 443' and sees 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate?

Accepted Answer

The session is in TCP SYN_SENT state. The output shows proto=6 (TCP) and proto_state=01 (SYN_SENT). However, a session with a duration of 3600 seconds cannot remain in SYN_SENT state; it would have timed out or transitioned to ESTABLISHED. Therefore, the output is contradictory and none of the provided options correctly describe the session. Option A is wrong because proto=6 is TCP, not UDP. Option B is wrong because a session alive for an hour cannot be in SYN_SENT. Option C is wrong because 'expire' is in seconds, not milliseconds. Option D is wrong because 'duration' is the total session time, not idle time.

Answer

The session is a UDP flow

Answer

The session will expire in 3599 milliseconds

Answer

The session has been idle for 3600 seconds

Question 5

Match each IPsec VPN term to its definition.

Accepted Answer

IKE: Protocol used to establish security associations and authenticate peers.. Correct matches: IKE establishes SAs and authenticates peers; SPI is an index to identify SAs; ESP provides confidentiality, authentication, and integrity. Common confusions include swapping IKE and SA definitions.

Answer

IKE: A set of parameters defining how IPsec processes traffic between peers.

Answer

IPsec SA: Protocol used to establish security associations and authenticate peers.

Question 6

An administrator is configuring FortiGate automation stitches to respond to a detected brute-force attack against an internal web server. The trigger is set to 'Event' with a condition matching repeated failed login attempts. Which TWO actions are appropriate to mitigate the attack? (Choose two.)

Accepted Answer

Add the source IP to a local address group that is used in a block policy. Adding the source IP to a local address group that is referenced in a block policy dynamically updates the firewall rule set to drop all traffic from that IP. This is a common automation stitch action in FortiGate that leverages the local address object and policy to enforce immediate blocking without manual intervention.

Answer

Enable quarantine on the web server

Answer

Shut down the web server interface

Answer

Run a CLI script to disable the user account

Question 7

An administrator configures VDOMs on a FortiGate and assigns port1 to VDOM-A and port2 to VDOM-B. The administrator then creates a firewall policy in VDOM-A to allow traffic from port1 to the VDOM link. Traffic from VDOM-A to VDOM-B is still failing. What is the most likely missing configuration?

Accepted Answer

A VDOM link connecting VDOM-A and VDOM-B. The most likely missing configuration is a VDOM link, which is the logical interconnecting interface required to route traffic between VDOMs. Without a VDOM link, VDOM-A and VDOM-B are isolated from each other, and no firewall policy or route can forward traffic between them. The administrator must create a VDOM link (e.g., using the 'config system vdom-link' command) to establish the Layer 3 adjacency needed for inter-VDOM communication.

Answer

An inter-VDOM routing policy under system settings

Answer

A policy in VDOM-B allowing traffic from the VDOM link to port2

Answer

A static route in VDOM-A pointing to VDOM-B's subnet

Question 8

An administrator wants to create an automation stitch that sends a webhook notification when an IPS attack is detected. Which trigger and action should be used?

Accepted Answer

Trigger: 'IPS Event'; Action: 'Webhook'. An automation stitch requires a trigger that matches the event type and an action that performs the desired response. 'IPS Event' is the correct trigger for detecting an IPS attack, and 'Webhook' is the action that sends an HTTP POST request to a configured endpoint, which is the standard method for webhook notifications in FortiOS.

Answer

Trigger: 'FortiGuard'; Action: 'Quarantine'

Answer

Trigger: 'System Event'; Action: 'Email'

Answer

Trigger: 'Incoming Webhook'; Action: 'IPS Event'

Question 9

An administrator notices that when a BGP session goes down, failover to the backup path takes about 30 seconds. The admin wants to reduce the failover time to less than 1 second. Which technology should the administrator implement?

Accepted Answer

Enable BFD on the BGP neighbor and the associated interface. BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for BGP sessions by sending rapid hello packets independently of the BGP keepalive mechanism. By enabling BFD on both the BGP neighbor and the associated interface, the router can detect a link or neighbor failure in milliseconds (e.g., 50-300 ms), allowing BGP to converge and switch to the backup path in under 1 second, far faster than the default 30-second hold timer.

Answer

Configure BGP fast external failover

Answer

Increase the BGP keepalive timer to 1 second

Answer

Use policy-based routing with SLA monitoring

Question 10

An organization uses FortiManager to manage multiple FortiGates. A junior admin accidentally deleted a critical firewall policy on one device and the change was auto-installed. How can the senior admin revert the device to the previous configuration?

Accepted Answer

Go to Device Manager -> Revision History and restore the previous revision. FortiManager automatically stores configuration revisions for managed FortiGates. By navigating to Device Manager -> Revision History, the admin can select the previous revision and restore it, which reverts the device to its state before the accidental deletion. This process ensures the change is undone without manual intervention or affecting other devices.

Answer

Delete the ADOM and recreate it

Answer

Use the 'restore' command on FortiManager

Answer

Manually recreate the policy on the FortiGate

Question 11

An administrator configures inter-VDOM routing between VDOM-A and VDOM-B using a VDOM link. After configuration, traffic from VDOM-A cannot reach VDOM-B. Which configuration step is MOST likely missing?

Accepted Answer

Create a firewall policy on VDOM-A and VDOM-B allowing traffic over the VDOM link interface. VDOM links are special inter-VDOM interfaces that require firewall policies on both VDOMs to permit traffic. Without a policy on VDOM-A and VDOM-B that allows traffic over the VDOM link interface, packets will be dropped by the implicit deny rule. This is the most common missing step when inter-VDOM routing fails.

Answer

Enable 'inter-vdom-routing' under system settings

Answer

Configure a static route on VDOM-A pointing to VDOM-B's subnet via the VDOM link

Answer

Assign both VDOM link interfaces to the same VDOM

Question 12

An administrator wants to ensure that traffic between two VDOMs on the same FortiGate is properly inspected. Which THREE configurations must be in place?

Accepted Answer

Inspection profiles applied to the policies. Inspection profiles (such as antivirus, web filtering, and IPS) must be explicitly applied to the firewall policies that govern traffic traversing the inter-VDOM link. Without these profiles, the FortiGate will forward traffic between VDOMs based solely on the policy action (accept/deny) without performing any deep packet inspection, leaving the traffic unexamined for threats. This is a fundamental requirement for UTM inspection in a multi-VDOM architecture.

Answer

Enable SSL inspection on the inter-VDOM link interface

Answer

Static routes on both VDOMs pointing to the inter-VDOM link

Question 13

A FortiGate has VDOMs enabled. An administrator runs 'get system status' and sees only one VDOM listed. However, the administrator configured two VDOMs earlier. What is the most likely cause?

Accepted Answer

The command only shows the management VDOM; use 'config vdom' to see all. When VDOMs are enabled, the 'get system status' command displays only the management VDOM (the VDOM from which the administrator is currently logged in). To see all configured VDOMs, the administrator must use the 'config vdom' command followed by 'show' or 'get system status' within the global context. Option D correctly identifies this behavior, as the second VDOM is not deleted or hidden by a bug; it simply is not shown by that command.

Answer

The second VDOM was deleted by another administrator

Answer

VDOM mode is not enabled globally

Answer

The second VDOM has a different name and is hidden due to a bug

Question 14

A site-to-site IPsec VPN tunnel is failing. The administrator runs 'diagnose vpn ike config' and sees that phase 1 parameters are correct. However, phase 2 negotiation fails with 'no proposal chosen'. What is the MOST likely cause?

Accepted Answer

The phase 2 encryption/authentication algorithms do not match between peers. The 'no proposal chosen' error in phase 2 indicates that the IPsec security association (SA) parameters—specifically the encryption algorithm, authentication algorithm, or Diffie-Hellman group—do not match between the two peers. Since the administrator confirmed phase 1 is correct via 'diagnose vpn ike config', the issue is isolated to phase 2 proposal mismatch, making option B the most likely cause.

Answer

The pre-shared key is incorrect

Answer

The firewall policy allowing IKE traffic is missing

Answer

The remote gateway IP address is wrong

Question 15

An administrator is troubleshooting a VPN tunnel that fails to establish. The administrator has verified that pre-shared keys match and phase 1 parameters are correct. Which TWO additional items should be checked?

Accepted Answer

NAT traversal configuration. NAT traversal (NAT-T) is required when a VPN tunnel passes through a device performing Network Address Translation (NAT). NAT-T encapsulates ESP packets inside UDP 4500 to avoid issues with NAT modifying IP headers. Even if phase 1 parameters match, without NAT-T enabled on both peers, the tunnel may fail to establish if a NAT device is detected between them.

Answer

The phase 2 proposal

Answer

The NTP server configuration

Answer

The FortiGate's hostname