NSE7 Practice Test 18 — 15 Questions

Question 1

Drag and drop the steps to configure OSPF on a FortiGate firewall into the correct order.

Accepted Answer

Step 1: Create virtual router, Step 2: Define areas and networks, Step 3: Set router ID, Step 4: Enable on interfaces, Step 5: Verify. Create virtual router, define areas and networks, set router ID, enable on interfaces, then verify.

Answer

Step 1: Set router ID, Step 2: Create virtual router, Step 3: Define areas and networks, Step 4: Enable on interfaces, Step 5: Verify

Answer

Step 1: Create virtual router, Step 2: Set router ID, Step 3: Enable on interfaces, Step 4: Define areas and networks, Step 5: Verify

Answer

Step 1: Define areas and networks, Step 2: Create virtual router, Step 3: Set router ID, Step 4: Enable on interfaces, Step 5: Verify

Question 2

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is an established TCP session with about one hour remaining before timeout. The output shows a TCP session (proto=6) with state 01, which in Fortinet's session table indicates an established TCP connection. The duration of 3600 seconds and expire value of 3599 seconds mean the session has been active for about one hour and has approximately one hour remaining before the idle timeout expires. This matches option B.

Answer

The session is in SYN_SENT state and cannot be established

Answer

The session is a UDP session using port 443

Answer

The session has a duration of 3600 seconds and will expire immediately

Question 3

An administrator connects a FortiExtender to the FortiGate's USB port. The FortiGate detects the FortiExtender and creates a virtual interface 'wwan1'. However, the link status shows 'down'. The SIM card is inserted and the cellular plan is active. What should the administrator check?

Accepted Answer

The APN settings are not configured under the FortiExtender interface. The link status of the wwan1 interface remains 'down' because the FortiExtender requires the Access Point Name (APN) to be configured to establish a cellular data connection. Without the correct APN, the modem cannot attach to the mobile network, even with an active SIM card and power. The APN is configured under the FortiExtender interface settings on the FortiGate, not on the FortiExtender itself.

Answer

The FortiGate needs a security policy allowing traffic from wwan1

Answer

The FortiExtender firmware is not compatible with the FortiGate

Answer

The FortiExtender is not powered on

Question 4

An organization wants to prevent zero-day attacks by using Content Disarm and Reconstruction (CDR) on email attachments. Which Fortinet product provides this capability?

Accepted Answer

FortiMail. FortiMail is the correct answer because it natively integrates Content Disarm and Reconstruction (CDR) to sanitize email attachments by removing active content (e.g., macros, scripts, embedded objects) and rebuilding the file in a safe format. This prevents zero-day exploits that bypass signature-based detection, as CDR does not rely on threat intelligence but instead strips potentially malicious elements before delivery.

Answer

FortiWeb

Answer

FortiGate

Answer

FortiSandbox

Question 5

An administrator wants to troubleshoot why specific traffic is not matching a configured firewall policy. Which debug command should be used?

Accepted Answer

diagnose debug flow. The 'diagnose debug flow' command is the correct tool for tracing traffic through the firewall policy engine in FortiOS. It captures the packet flow in real time, showing which policy is evaluated, why a match or no-match occurs, and any drop reasons. This directly addresses the administrator's need to troubleshoot why specific traffic is not matching a configured firewall policy.

Answer

diagnose sys session list

Answer

get firewall policy <id>

Answer

diagnose netlink interface list

Question 6

A company has two internet connections: a primary fiber link (port1, 100 Mbps) and a backup DSL link (port2, 20 Mbps). They are using SD-WAN to load balance traffic based on volume, with a rule that sends 70% of traffic to port1 and 30% to port2. Recently, users report that video conferencing applications are experiencing high latency and jitter. The network team finds that the SD-WAN performance SLA for the fiber link shows 80% packet loss and high latency. The SD-WAN rule action is set to 'best quality' with a latency threshold of 150 ms. The current latency on port1 is 200 ms, and on port2 is 40 ms. What should the administrator do to ensure that video conferencing traffic uses the DSL link while the fiber link is degraded?

Accepted Answer

No changes are needed; the SD-WAN rule with 'best quality' will automatically use port2 for new sessions because port1 does not meet the SLA.. The SD-WAN rule action is set to 'best quality', which means the FortiGate will automatically steer new sessions away from any interface that fails the performance SLA. Since port1 has 80% packet loss and 200 ms latency (exceeding the 150 ms threshold), it is considered degraded, and new video conferencing traffic will be directed to port2 (40 ms latency) without manual intervention.

Answer

Increase the SLA latency threshold to 250 ms so that the fiber link is considered acceptable.

Answer

Change the SD-WAN rule action to 'lowest cost' to favor the DSL link.

Answer

Adjust the volume ratio to send 100% of traffic to port2 until the fiber link recovers.

Question 7

Which routing technique allows a FortiGate to forward packets based on source IP address, destination IP address, or other criteria, in addition to the destination IP alone?

Accepted Answer

Policy-Based Routing (PBR). Policy-Based Routing (PBR) allows a FortiGate to forward packets based on criteria beyond the destination IP address, such as source IP, destination port, protocol, or application. This is achieved by configuring policy routes that override the default routing table lookup, enabling granular traffic steering for advanced networking scenarios like SD-WAN.

Answer

RIP

Answer

OSPF route redistribution

Answer

ECMP

Question 8

A multinational company uses FortiGate devices as VPN gateways to connect its headquarters (HQ) and branch offices via IPsec VPN tunnels. The company is migrating its remote access solution from IPsec VPN to SSL VPN using FortiClient. Currently, 500 remote users connect via IPsec VPN with pre-shared keys and XAuth authentication. The migration must be seamless with minimal downtime, and users must continue to authenticate using their existing Active Directory credentials. The SSL VPN portal must provide access to internal web applications and some legacy TCP-based applications that do not support HTTP. The security team requires that all traffic between remote users and the internal network be encrypted and that the SSL VPN use a certificate from a public CA to avoid certificate warnings on client devices. The IT team wants to use FortiToken for two-factor authentication (2FA) for all VPN users. Which of the following is the most appropriate course of action to meet all requirements?

Accepted Answer

Deploy SSL VPN with a public CA certificate, configure LDAP authentication against Active Directory, enable FortiToken for 2FA, and create a split-tunneling policy that uses both SSL VPN web mode and tunnel mode via FortiClient.. It meets all requirements: a public CA certificate avoids client certificate warnings, LDAP authentication against Active Directory allows seamless credential reuse, FortiToken provides the required 2FA, and combining SSL VPN web mode (for web apps) with tunnel mode via FortiClient (for legacy TCP applications) ensures full coverage. This approach minimizes downtime by migrating users gradually without changing their authentication backend.

Answer

Configure SSL VPN with a self-signed certificate and use the local password database for authentication. Enable FortiToken and configure the portal to provide both web and TCP forwarding applications.

Answer

Set up SSL VPN with a public CA certificate, use LDAP for authentication, but do not enable FortiToken because it would require a separate token per user.

Answer

Create a new IPsec VPN configuration using certificate-based authentication and FortiToken, and gradually move users to the new IPsec VPN.

Question 9

A network admin runs 'diagnose sys top' on a FortiGate and sees that the process 'httpsd' is consistently using 95% CPU. Which of the following actions is MOST appropriate to troubleshoot this issue?

Accepted Answer

Check the number of active admin sessions and consider stopping the web GUI service temporarily. The httpsd process handles the FortiGate web GUI (HTTPS) and API requests. High CPU usage by httpsd typically indicates excessive admin sessions or web GUI activity. Option D is correct because checking active admin sessions and temporarily stopping the web GUI service (e.g., via 'config system global set admin-https-redirect disable' or stopping the service) directly addresses the likely cause without disrupting firewall processing or requiring policy changes.

Answer

Restart the FortiGate firewall engine with 'diagnose test application fgwbd 255'

Answer

Disable the antivirus profile on all policies to reduce processing load

Answer

Increase the log rate to capture more details about the httpsd process

Question 10

A network administrator is troubleshooting a scenario where FortiView in FortiAnalyzer shows no traffic data for a specific FortiGate, but logs are being received. Which two possible causes should the administrator investigate? (Choose two.)

Accepted Answer

The FortiGate is not sending traffic logs; only event logs are being forwarded. FortiView relies on traffic logs (e.g., traffic, firewall, or application control logs) to generate its visualizations. If the FortiGate is only forwarding event logs (e.g., admin, system, or VPN logs) but not traffic logs, FortiView will show no traffic data even though logs are being received. This is a common misconfiguration in log forwarding policies on the FortiGate.

Answer

The FortiGate's clock is not synchronized with FortiAnalyzer

Answer

The FortiAnalyzer ADOM is configured as a global ADOM

Answer

The FortiAnalyzer disk is full and not indexing new logs

Question 11

An administrator notices that after making changes to a policy package in FortiManager, the 'Install Preview' shows that the changes will modify policies on a FortiGate. However, the admin wants to verify what the exact changes will be before installing. What should the admin do?

Accepted Answer

Use the 'Revision History' to compare the current configuration with the previous version. The Revision History feature in FortiManager allows an administrator to compare the current configuration of a policy package with a previous version, showing a detailed diff of exactly which policies will be added, removed, or modified. This provides a precise verification of changes before installation, unlike the Install Preview which only indicates that changes exist without showing the specific modifications.

Answer

Check the 'Audit Log' for recent changes

Answer

Run 'diagnose dvm device list' on FortiManager

Answer

Use the 'Install Preview' and then click 'View Details' on each device

Question 12

A network administrator is configuring VDOMs on a FortiGate and wants to separate management traffic from production data traffic. What is the best practice when using a management VDOM?

Accepted Answer

Create a dedicated management VDOM and assign only management interfaces to it. Creating a dedicated management VDOM and assigning only management interfaces to it is the best practice because it isolates management traffic from production data traffic, reducing the attack surface and preventing management access from being exposed to untrusted networks. This aligns with Fortinet's security best practices for VDOM administration, ensuring that management functions are logically separated from data-plane operations.

Answer

Disable management access on all VDOMs except the root VDOM

Answer

Use inter-VDOM routing to route management traffic to the root VDOM

Answer

Assign all interfaces to the management VDOM

Question 13

A network admin needs to apply a common set of firewall rules at the beginning of every policy package for all VDOMs managed by FortiManager. The rules should be automatically inserted and not editable within each VDOM. What should be configured?

Accepted Answer

Policy package header policies. Header policies in policy packages allow global policies that apply before VDOM-specific policies. They are defined at the ADOM level and cannot be modified within individual VDOMs.

Answer

VDOM policy templates

Answer

Global policy objects

Answer

Central management policies

Question 14

An administrator has configured a FortiGate HA cluster with two units. The cluster uses a virtual cluster for load balancing in active-active mode. The administrator notices that traffic from one VDOM is not being load-balanced and is only handled by one unit. What is the most likely cause?

Accepted Answer

The VDOM is not assigned to any virtual cluster. In an active-active HA cluster with virtual clusters, each VDOM must be explicitly assigned to a virtual cluster to participate in load balancing. If a VDOM is not assigned to any virtual cluster, it defaults to being handled only by the primary unit, regardless of the cluster mode. This explains why traffic from that VDOM is not load-balanced.

Answer

Session pickup is disabled

Answer

The HA priority is set to 0 on the secondary unit

Answer

The management interface is not configured on the VDOM

Question 15

A FortiGate with two WAN interfaces configured in an SD-WAN setup uses the 'lowest-cost' load balancing algorithm. The performance SLA monitors latency and jitter. If wan1 has a cost of 10 and wan2 has a cost of 20, but wan1 is experiencing 50% packet loss, what will happen to traffic?

Accepted Answer

Traffic is sent to wan2 because wan1 is considered dead. When an SD-WAN member interface fails the performance SLA (e.g., 50% packet loss), FortiGate marks it as 'dead' and removes it from the active member set. The 'lowest-cost' algorithm then selects the next lowest-cost member that is alive, which is wan2 (cost 20). Traffic is not load-balanced equally because wan1 is dead, and it is not dropped because wan2 is available.

Answer

Traffic is distributed equally between both links

Answer

Traffic is dropped until wan1 recovers

Answer

Traffic continues using wan1 because cost is lower