NSE7 Practice Test 18 — 15 Questions

Question 1

A network administrator wants to logically separate two departments on a single FortiGate. Each department must have its own firewall policies, routing table, and administrators. Which feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Virtual Domains (VDOMs). Virtual Domains (VDOMs) allow a single FortiGate to be partitioned into multiple independent virtual firewalls, each with its own firewall policies, routing table, and administrative access. This meets the requirement for logical separation of departments with isolated policy and routing domains.

Answer

Policy Packages

Answer

Administrative Domains (ADOMs)

Answer

VLANs

Question 2

An administrator wants to ensure that traffic between two VDOMs on the same FortiGate is properly inspected. Which THREE configurations must be in place?

Accepted Answer

Inspection profiles applied to the policies. Option D is correct because an inter-VDOM link is the virtual interface pair that provides the actual data path between two VDOMs on the same FortiGate; without it, no traffic can pass between the VDOMs. Option C is correct because each VDOM requires its own firewall policy that permits traffic to traverse the inter-VDOM link, since policies are evaluated per-VDOM and a policy in one VDOM does not automatically apply to the other. Option A is correct because inspection profiles (such as antivirus, IPS, web filter, or application control) must be attached to those inter-VDOM policies for the traffic to actually be inspected rather than merely permitted. Option B is not required because SSL inspection is a profile-level setting applied through a firewall policy, not a property enabled on the inter-VDOM link interface itself. Option E is not required because the inter-VDOM link is directly connected and its subnets are known to each VDOM, so static routes pointing to the link are unnecessary for basic inter-VDOM traffic.

Answer

Enable SSL inspection on the inter-VDOM link interface

Answer

Static routes on both VDOMs pointing to the inter-VDOM link

Question 3

An administrator configures BGP route advertisement but the routes are not being sent to the neighbor. The BGP session is established. What is the MOST likely cause?

Accepted Answer

The 'network' statement is missing for the desired prefix. The BGP session is established, so Layer 3 connectivity and TCP port 179 are working. The most common reason for routes not being advertised to a neighbor is that the 'network' statement is missing for the desired prefix. In BGP, the 'network' command does not advertise the prefix unless it matches an exact route in the IP routing table; without it, BGP has no prefix to send, even if the session is up.

Answer

The BGP administrative distance is set too high

Answer

The BGP neighbor has the wrong update-source interface

Answer

The route is filtered by a route-map

Question 4

What is the purpose of header and footer policies in a FortiManager policy package?

Accepted Answer

They define policies that are placed at the top (header) and bottom (footer) of the policy list when applied to a FortiGate. Header and footer policies in FortiManager policy packages allow administrators to define policies that are automatically placed at the very top (header) and very bottom (footer) of the policy list when the package is installed on a FortiGate. This ensures that critical policies, such as default deny rules or inter-VDOM links, remain in a fixed position regardless of other policy changes. This mechanism is essential for maintaining a consistent security posture across managed FortiGates.

Answer

They are used for VDOM-specific policies that cannot be modified

Answer

They provide a way to group policies for reporting purposes

Answer

They allow policy packages to be installed in a specific sequence

Question 5

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGate devices. The tunnel is established, but traffic is not passing. Which configuration should the administrator check first?

Accepted Answer

Firewall policies. When an IPsec VPN tunnel is established but traffic does not pass, the most common cause is missing or misconfigured firewall policies. Even with correct Phase 1 and Phase 2 settings, the FortiGate will not forward traffic between the tunnel interface and the destination network unless an explicit firewall policy permits it. This is because FortiGate uses a stateful inspection model where all traffic must be allowed by a policy, regardless of the VPN being up.

Answer

NAT traversal configuration

Answer

Static routes

Answer

Phase1 parameters

Question 6

A FortiGate has two VDOMs: 'root' and 'customer'. The admin wants to route traffic from 'customer' to the internet via 'root', which has a BGP connection to an ISP. What is the required configuration?

Accepted Answer

Create an inter-VDOM link between 'customer' and 'root', and configure policies to allow traffic. Inter-VDOM links are the only supported method for routing traffic between VDOMs on the same FortiGate. An inter-VDOM link creates a virtual point-to-point connection between two VDOMs, allowing traffic to flow through firewall policies. Without this link, VDOMs are isolated and cannot exchange traffic, even if static routes or BGP are configured.

Answer

Enable VDOM forwarding on the WAN interface in 'root'

Answer

Configure a static route in 'customer' pointing to the 'root' VDOM's management IP

Answer

Place both VDOMs in the same VDOM group and enable route leak

Question 7

A company is deploying FortiGate with Advanced Threat Protection (ATP) and wants to block advanced malware that uses encrypted C2 communications. Which security profile should be configured to perform SSL inspection and detect malicious traffic?

Accepted Answer

Antivirus profile with SSL inspection. An Antivirus profile with SSL inspection enabled is required to decrypt encrypted C2 (command-and-control) traffic so that FortiGate can inspect the payload for malware signatures, heuristics, and behavioral patterns. Without SSL inspection, the ATP engine cannot see inside the encrypted tunnel, rendering the antivirus and other security profiles ineffective against encrypted C2 communications.

Answer

Data Leak Prevention profile

Answer

Web Filtering profile

Answer

Intrusion Prevention profile

Question 8

What is the purpose of BFD on a FortiGate?

Accepted Answer

To provide fast detection of link failures.. BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for routing protocols like OSPF and BGP, independent of the routing protocol's own hello timers. On a FortiGate, BFD is used to rapidly detect link or neighbor failures, enabling faster convergence in SD-WAN and dynamic routing scenarios.

Answer

To load balance traffic across multiple paths.

Answer

To authenticate OSPF neighbors.

Answer

To encrypt traffic between two FortiGates.

Question 9

During a security incident, the SOC team receives an alert from FortiSIEM about a user accessing a known malicious IP. The team wants to automatically block the IP on the FortiGate. Which FortiGate feature can be used to create an automated response based on a threat intelligence feed?

Accepted Answer

Automation Stitch. Automation Stitch in FortiOS allows you to create automated responses triggered by events such as threat intelligence feeds. By configuring an Automation Stitch with a trigger from FortiSIEM (e.g., via a webhook or syslog) and an action to add a block entry to the FortiGate's local address group or dynamic block list, the SOC team can automatically block the malicious IP without manual intervention.

Answer

Local-in Policy

Answer

FortiGuard Outbreak Prevention

Answer

FortiGate VPN

Question 10

A FortiGate running FortiOS 7.4.1 has two VDOMs: CustomerA and CustomerB. The administrator wants CustomerA to access an HTTP server in CustomerB. Both VDOMs have appropriate policies. What additional configuration is required?

Accepted Answer

Configure a VDOM link between CustomerA and CustomerB. A VDOM link is required to enable Layer-2 or Layer-3 connectivity between two VDOMs on the same FortiGate. Without a VDOM link, the VDOMs are isolated from each other, even if policies exist. The VDOM link acts as a virtual interface pair that forwards traffic between CustomerA and CustomerB, allowing the HTTP server access.

Answer

Create a policy allowing traffic from CustomerA to CustomerB

Answer

Enable inter-VDOM routing under system settings

Answer

Assign both VDOMs to the same administrative domain in FortiManager

Question 11

A FortiGate admin sees the following log: 'Action=blocked, Service=HTTP, Application=Outbreak, File=invoice.doc, ThreatScore=95'. What is the MOST likely explanation for this block?

Accepted Answer

The file was blocked by FortiGuard outbreak prevention. The log entry shows 'Application=Outbreak' and 'ThreatScore=95', which are specific indicators of FortiGuard outbreak prevention. FortiGuard outbreak prevention uses real-time threat intelligence to block files associated with widespread malware campaigns before traditional signatures are updated. The 'Outbreak' application tag and high threat score directly correspond to this feature, not to machine learning, sandbox verdicts, or custom IPS signatures.

Answer

The file was blocked by the machine learning engine

Answer

The file was blocked by FortiSandbox verdict

Answer

The file was blocked by a custom IPS signature

Question 12

An administrator is troubleshooting a BGP session that is not establishing between two FortiGates. The administrator has verified that the neighbor IP is reachable. Which TWO commands should be used to further diagnose the issue? (Choose two.)

Accepted Answer

get router info bgp neighbor . 'get router info bgp neighbor ' displays detailed BGP session state information, including the current state (e.g., Idle, Connect, Active, OpenSent, OpenConfirm, Established), hold timer, keepalive interval, and any error codes or notifications. This command directly reveals why the session is not establishing, such as a mismatch in BGP capabilities, AS numbers, or authentication.

Answer

diagnose debug flow filter daddr <IP>

Answer

get router info routing-table bgp

Answer

diagnose sys session filter dport 179

Question 13

An organization has multiple ADOMs in FortiManager. The admin wants to share a set of firewall objects across all ADOMs. What is the best approach?

Accepted Answer

Use the Global ADOM to create global objects. The Global ADOM in FortiManager is specifically designed to create and manage global objects (such as address objects, services, and schedules) that can be shared across all regular ADOMs. When an object is created in the Global ADOM, it is automatically available in all ADOMs that are linked to it, eliminating the need for duplication. This is the only native, supported method for sharing objects across multiple ADOMs in FortiManager.

Answer

Create a meta field and assign objects

Answer

Manually recreate the objects in each ADOM

Answer

Enable object sharing in the system settings

Question 14

An enterprise FortiGate has multiple VDOMs. The security policy requires that all traffic between VDOMs must be inspected by a next-generation firewall profile. Which three steps are necessary to achieve this? (Choose three.)

Accepted Answer

Ensure routing is properly configured to forward traffic through the inter-VDOM link. For traffic to traverse between VDOMs via an inter-VDOM link, proper routing must be configured in each VDOM to forward traffic through the inter-VDOM link interface. Without correct routing entries (static or dynamic), packets will not be directed to the inter-VDOM link, and the next-generation firewall profile cannot be applied.

Answer

Place both VDOMs in the same ADOM in FortiManager

Answer

Enable VDOM inspection mode in global settings

Question 15

Drag and drop the steps to perform a firmware upgrade on a FortiGate device into the correct order.

Accepted Answer

Backup configuration, then Upload firmware image, then Confirm upgrade, then Verify upgrade. The correct sequence for a FortiGate firmware upgrade is to first back up the configuration, then upload the new firmware image, confirm the upgrade to start the process, and finally verify the upgrade after the device reboots. This ensures configuration safety and successful upgrade completion.

Answer

Upload firmware image, then Backup configuration, then Confirm upgrade, then Verify upgrade

Answer

Backup configuration, then Confirm upgrade, then Upload firmware image, then Verify upgrade

Answer

Backup configuration, then Upload firmware image, then Verify upgrade, then Confirm upgrade