NSE7 Practice Test 19 — 15 Questions

Question 1

Match each FortiGate interface type to its usage.

Accepted Answer

Physical interface: A hardware port that provides direct network connectivity. The correct matches: Physical Interface → hardware port; VLAN Interface → logical interface for 802.1Q tagging; Loopback Interface → always-up virtual interface; Aggregate Interface → combines multiple physical interfaces. Common confusions include mixing the definitions of loopback and VLAN, or confusing physical interfaces with aggregate interfaces.

Answer

Physical interface: A logical interface that combines multiple physical interfaces

Answer

VLAN interface: A virtual interface that is always up

Question 2

An organization is deploying FortiEDR to enhance endpoint protection. Which THREE capabilities does FortiEDR provide? (Choose three.)

Accepted Answer

Forensic investigation and root cause analysis. FortiEDR provides forensic investigation and root cause analysis by recording detailed endpoint telemetry, including process creation, network connections, and file system changes. This allows security teams to reconstruct the full attack chain after an incident, identifying the initial infection vector and all subsequent malicious activities. The platform correlates these events across multiple endpoints to provide a comprehensive timeline for investigation.

Answer

Decoy deployment to lure attackers

Answer

Email security filtering

Question 3

A company uses FortiMail to protect email. They set up DMARC with a policy of 'quarantine' for emails failing SPF and DKIM checks. However, legitimate emails from a third-party service are being quarantined. What should the admin do?

Accepted Answer

Update the SPF record to include the third-party mail server IP. The root cause is that the third-party mail server's IP is not authorized in the sender domain's SPF record. DMARC uses SPF alignment: if the message fails SPF (because the sending IP is not listed) and also fails DKIM, DMARC enforces the 'quarantine' policy. Adding the third-party IP to the SPF record allows SPF to pass, achieving alignment and preventing quarantine.

Answer

Add the sender domain to a whitelist in FortiMail

Answer

Change the DMARC policy to 'none'

Answer

Disable DMARC checking for that specific sender

Question 4

A network admin configures inter-VDOM routing between two VDOMs on a FortiGate. The admin creates a firewall policy in VDOM A allowing traffic to VDOM B, but traffic is still not passing. What additional step is required?

Accepted Answer

Create a firewall policy in VDOM B to permit the traffic from VDOM A. Inter-VDOM routing on a FortiGate requires firewall policies in both VDOMs to permit traffic in both directions. Even if VDOM A has a policy allowing traffic to VDOM B, VDOM B must have a corresponding policy to allow the return traffic or the initial traffic from VDOM A to be processed. Without this, the FortiGate drops the packets due to asymmetric policy enforcement.

Answer

Configure a static route in VDOM B pointing back to VDOM A

Answer

Enable inter-VDOM routing under config system global

Answer

Assign the inter-VDOM link to both VDOMs

Question 5

A FortiGate administrator wants to check if the device is experiencing high CPU usage due to a specific process. Which command should they use to display real-time process CPU usage?

Accepted Answer

diagnose sys top. The 'diagnose sys top' command provides a real-time, top-like view of FortiGate processes, showing CPU and memory usage per process. This allows the administrator to identify which specific process is consuming high CPU, making it the correct choice for this diagnostic task.

Answer

show system resource

Answer

get system performance status

Answer

diagnose debug application crashlog read

Question 6

A security analyst wants to use automation stitches on FortiGate to automatically block an IP address when a critical severity event is logged. Which TWO components are essential to create this automation stitch? (Choose two.)

Accepted Answer

An action that adds the source IP to a firewall address group. An automation stitch in FortiGate requires an action to execute a specific task, such as adding a source IP to a firewall address group, which effectively blocks the IP. This action is essential for enforcing the security response triggered by the stitch.

Answer

A FortiGuard subscription

Answer

A FortiAnalyzer to store logs

Answer

A static route to the internet

Question 7

An administrator is configuring a hub-and-spoke ADVPN with IBGP as the overlay routing protocol. The hub is configured as a route reflector. Which two conditions must be met for a shortcut tunnel to be established between two spokes? (Choose TWO)

Accepted Answer

The hub must have a route to the spoke's subnet via the IPsec tunnel. For shortcut tunnels to establish, the hub must send a shortcut offer to the spokes. This requires that the hub learns the route from one spoke via IBGP and reflects it to the other spoke. The spoke must also have auto-discovery-shortcut-mode enabled to accept the shortcut. Additionally, the spokes must be able to communicate directly (no NAT between them).

Answer

The spokes must use overlapping IPsec proposal sets

Answer

The hub must have 'set auto-discovery-shortcut-mode both'

Answer

The spokes must be in the same VDOM

Question 8

A network engineer is configuring a FortiGate HA cluster with two FortiGate 100F units in active-passive mode. The engineer wants to use VDOMs to separate guest and corporate traffic. After initial setup, the engineer configures two VDOMs: 'guest' and 'corp'. Both VDOMs have interfaces assigned. The HA status shows 'synchronized'. However, the engineer notices that traffic from the corporate network is not being forwarded correctly. Pings from the corporate LAN to the internet fail. The guest network works fine. The engineer checks the routing table on the active unit and sees that the default route is present in the 'corp' VDOM. What is the most likely cause of the issue?

Accepted Answer

The default route in the corp VDOM has an incorrect gateway IP address.. The most likely cause is an incorrect gateway IP address in the default route for the 'corp' VDOM. Since the guest VDOM works correctly, the HA cluster and VDOM configuration are functional, and the issue is isolated to the corporate VDOM's routing. A misconfigured next-hop IP would prevent traffic from reaching the internet, even though the route itself is present in the routing table.

Answer

The interface assigned to the corp VDOM is administratively down.

Answer

The HA cluster must be in active-active mode for VDOMs to work.

Answer

The VDOM link between the root VDOM and corp VDOM is not configured.

Question 9

A FortiGate has an SD-WAN configuration with two members (wan1, wan2). The performance SLA monitors latency to 8.8.8.8. The admin notices that even when the SLA is satisfied on both members, all traffic uses wan1. The SD-WAN rule is configured with 'strategy = best quality'. What is the most likely cause?

Accepted Answer

The best quality strategy selects the member with the best SLA metric, which is wan1 by default when both meet SLA. When the SD-WAN rule uses 'best quality' strategy and both members meet the performance SLA, FortiGate selects the member with the best (lowest) latency metric. By default, if both members have equal SLA satisfaction, the first member in the SD-WAN configuration (wan1) is chosen as the tie-breaker. This explains why all traffic uses wan1 even though both links are healthy.

Answer

A firewall policy is overriding the SD-WAN rule

Answer

The performance SLA is incorrectly configured, causing wan2 to be ignored

Answer

The SD-WAN rule has 'set match-vip disable' which forces all traffic to wan1

Question 10

A FortiGate with VDOMs enabled has a management VDOM (mgmt-vdom) and a traffic VDOM (traffic-vdom). The admin wants to manage the FortiGate via HTTPS from a network in traffic-vdom. What configuration is needed?

Accepted Answer

Add the interface from traffic-vdom to the management VDOM using 'set vdom mgmt-vdom' in the interface configuration. When VDOMs are enabled, the management VDOM owns the management IP addresses for the entire FortiGate. To allow HTTPS management from an interface in a non-management VDOM (traffic-vdom), that interface must be reassigned to the management VDOM using the 'set vdom mgmt-vdom' command. This makes the interface part of the management VDOM while still passing traffic for the original VDOM, enabling administrative access from that network.

Answer

Configure a static route in the management VDOM to reach traffic-vdom subnets

Answer

Enable 'admin-sport' in the global system settings

Answer

Create a firewall policy in traffic-vdom allowing HTTPS to the FortiGate's IP

Question 11

A FortiGate administrator wants to use FortiManager to manage multiple FortiGates in different geographic regions. To isolate configuration changes, the administrator creates separate ADOMs for each region. Which type of ADOM should be used to allow some common objects (like address groups) to be shared across all regions?

Accepted Answer

Global ADOM. The Global ADOM is designed to store and share common objects, such as address groups, policies, and schedules, across all ADOMs in a FortiManager deployment. When an administrator creates separate ADOMs for each region, the Global ADOM acts as a central repository for objects that need to be consistent everywhere, allowing per-region ADOMs to reference these shared objects without duplicating them. This ensures configuration isolation for region-specific settings while maintaining a single source of truth for global resources.

Answer

Per-Device ADOM

Answer

Regular ADOM

Answer

Meta ADOM

Question 12

During an SD-WAN health check, an administrator observes that a performance SLA for wan1 shows 'Status: dead' even though the interface is up and can ping the SLA server. The SLA configuration uses a TCP echo probe to 8.8.8.8 port 443. What is the most likely cause?

Accepted Answer

The probe protocol is TCP echo, but the server at 8.8.8.8 does not support TCP echo on port 443.. The TCP echo probe sends a TCP SYN to the specified port and expects a SYN-ACK to confirm connectivity. 8.8.8.8 (Google DNS) does not run a TCP echo service on port 443; it serves HTTPS. The server will respond with a TCP RST or simply ignore the probe, causing the SLA to fail and show 'dead' even though the interface is up and ICMP ping works.

Answer

The SLA server is blocking ICMP echo requests.

Answer

The performance SLA is configured with the wrong threshold.

Answer

The firewall policy allowing the probe traffic is missing.

Question 13

A FortiGate administrator is configuring a multi-peer IPsec VPN where two remote sites (Site A and Site B) connect to a central hub. The administrator wants to ensure that if the primary peer for a site goes down, traffic automatically fails over to the backup peer. Which TWO settings must be configured on the hub's phase1?

Accepted Answer

Set 'peer-options' to include both peers with 'priority'. Multi-peer VPN requires configuring 'peer-options' with multiple peer IPs and priorities, and enabling 'failover' on the phase1 interface to allow automatic switching to the backup peer if the primary goes down.

Answer

Set 'auto-negotiate' to 'enable'

Answer

Set 'dpd' to 'on-demand'

Answer

Set 'aggregate-ipsec' to 'round-robin'

Question 14

An administrator wants to monitor real-time CPU usage per process on a FortiGate. Which command should be used?

Accepted Answer

diagnose sys top. The 'diagnose sys top' command on FortiGate displays real-time CPU usage per process, similar to the Linux 'top' command. This is the standard diagnostic tool for monitoring per-process CPU and memory consumption in real time, which directly meets the administrator's requirement.

Answer

diagnose hardware sysinfo cpu

Answer

get system performance status

Answer

show system performance monitor

Question 15

An administrator runs 'diagnose debug vd case <vdom_name>' and receives the error 'VDOM not found'. The VDOM exists and is configured. What is the most likely cause?

Accepted Answer

The VDOM name is misspelled or has incorrect case. The 'diagnose debug vd case' command is case-sensitive and expects the exact VDOM name as configured. Even if the VDOM exists, a mismatch in letter case (e.g., typing 'VDOM1' instead of 'vdom1') will cause the 'VDOM not found' error because the command performs a literal string comparison without case normalization.

Answer

The VDOM is a traffic VDOM and requires a different command

Answer

The VDOM is administratively disabled

Answer

The administrator is in the wrong VDOM context