NSE7 Practice Test 19 — 15 Questions

Question 1

Which routing technique allows a FortiGate to forward packets based on source IP address, destination IP address, or other criteria, in addition to the destination IP alone?

Accepted Answer

Policy-Based Routing (PBR). Policy-Based Routing (PBR) allows a FortiGate to forward packets based on criteria beyond the destination IP address, such as source IP, destination port, protocol, or application. This is achieved by configuring policy routes that override the default routing table lookup, enabling granular traffic steering for advanced networking scenarios like SD-WAN.

Answer

RIP

Answer

OSPF route redistribution

Answer

ECMP

Question 2

A FortiGate administrator configures a custom IPS signature with the pattern 'attack' in the HTTP request URI. After applying the signature, no alerts are generated even though the traffic matches. What is the MOST likely cause?

Accepted Answer

The signature's protocol decoder is not set to 'HTTP'. The custom IPS signature pattern 'attack' will only be inspected against the HTTP request URI if the signature's protocol decoder is explicitly set to 'HTTP'. Without this decoder assignment, the IPS engine does not know which protocol layer to parse, and the pattern is never matched against the URI, resulting in no alerts despite matching traffic.

Answer

The signature's protocol decoder is set to 'HTTP'

Answer

The signature action is set to 'pass'

Answer

The signature severity is too low

Question 3

A FortiGate is configured with an SD-WAN rule using 'spillover' algorithm. The primary member has a spillover threshold of 100 Mbps. Traffic of 80 Mbps is currently flowing through the primary member. A new session requiring 30 Mbps arrives. What will happen?

Accepted Answer

The new session is sent to the secondary member because the primary threshold would be exceeded.. The SD-WAN 'spillover' algorithm forwards traffic to the primary member until its load reaches the configured threshold (100 Mbps). With 80 Mbps already flowing, adding a new 30 Mbps session would push the total to 110 Mbps, exceeding the threshold. Therefore, the new session is sent to the secondary member to avoid oversubscription, as per the spillover logic.

Answer

The new session is sent to the primary member because the current load is below the threshold.

Answer

The new session is dropped because no member can handle it.

Answer

The primary member's threshold is dynamically increased.

Question 4

A FortiGate has multiple VDOMs. The administrator notices that traffic from VDOM-1 to VDOM-2 is allowed by inter-VDOM policies but is not being inspected by the security profiles. What is the most likely cause?

Accepted Answer

The security profiles are applied only on the egress VDOM. When inter-VDOM traffic flows through a VDOM link, security profiles are applied only on the egress VDOM by default. This is because the VDOM link acts as a logical wire, and inspection occurs at the point where traffic exits the link. If the administrator has applied security profiles only on the ingress VDOM (VDOM-1), they will not be enforced on traffic leaving VDOM-1 toward VDOM-2, resulting in no inspection.

Answer

The traffic is using a bypass path due to asymmetric routing

Answer

The VDOMs are in different virtual routers

Answer

The VDOM link is configured as a signal interface

Question 5

A FortiGate is configured with OSPF and BGP. The administrator wants to redistribute OSPF routes into BGP. Which TWO steps are required?

Accepted Answer

Use the 'redistribute ospf' command under the BGP configuration. The 'redistribute ospf' command under BGP configuration is the explicit method to inject OSPF-learned routes into the BGP table. This command triggers the redistribution process, allowing OSPF routes to be advertised to BGP peers.

Answer

Configure a route map to filter the routes being redistributed

Answer

Set the BGP table version to 2

Answer

Disable OSPF on the interface

Question 6

An administrator wants to enforce that only devices with the latest antivirus signatures and a corporate disk encryption solution can access a sensitive application via ZTNA. Which two FortiClient EMS components must be configured? (Choose two.)

Accepted Answer

Device posture checks. Option A (Device posture checks) is correct because posture checks in FortiClient EMS evaluate endpoint compliance conditions such as antivirus signature currency and disk encryption status, which are exactly the requirements the administrator wants to enforce. Option D (ZTNA tags) is correct because FortiClient EMS dynamically assigns ZTNA tags to endpoints based on posture results, and these tags are then used in ZTNA firewall policies to allow or deny access to the sensitive application. Together, posture checks generate the compliance data and ZTNA tags translate that data into enforceable access control. Option B (VPN tunnels) is not needed because ZTNA provides application-level access without requiring a traditional VPN tunnel. Option C (SAML SSO) is an identity authentication mechanism and does not by itself verify antivirus signatures or disk encryption compliance.

Answer

VPN tunnels

Answer

SAML SSO

Question 7

Match each FortiGate routing concept to its description.

Accepted Answer

Policy-based routing: Routes packets based on criteria other than destination IP, such as source IP or protocol. Correct matches: PBR, Route redistribution, Administrative distance, and Static route are correctly paired. ECMP and Metric are swapped; ECMP distributes traffic across equal-cost paths, while Metric compares routes within a protocol.

Answer

ECMP: A numeric value used to compare routes within the same routing protocol

Answer

Metric: Distributes traffic across multiple equal-cost paths to the same destination

Question 8

An administrator wants to use FortiGate to automatically block traffic if FortiEDR detects a threat on an endpoint. Which feature should the administrator configure?

Accepted Answer

Create an automation stitch with a trigger from FortiEDR and an action to block the source IP. FortiGate integrates with FortiEDR via automation stitches, which allow events from FortiEDR (such as a detected threat) to trigger automated actions on FortiGate, such as blocking the source IP of the compromised endpoint. This provides real-time, policy-driven threat response without manual intervention, leveraging the Fortinet Security Fabric. Option A is incorrect because a VPN tunnel is not required; FortiEDR and FortiGate communicate via APIs. Option B is incorrect because FortiGuard Outbreak Prevention is a separate service that provides threat intelligence, not direct endpoint detection integration. Option C is incorrect because a static route is unnecessary for the API-based communication.

Answer

Configure a VPN tunnel between FortiGate and FortiEDR

Answer

Enable FortiGuard Outbreak Prevention on the antivirus profile

Answer

Configure a static route to the FortiEDR management IP

Question 9

An administrator is deploying ZTNA with FortiClient EMS to secure access to a corporate web application. Which THREE components are required for a successful ZTNA deployment? (Choose three.)

Accepted Answer

FortiClient EMS server. FortiClient EMS server (B) is required because it acts as the central management and policy authority for ZTNA, handling endpoint registration, tagging, and synchronization of ZTNA configuration to FortiGates and FortiClients. FortiClient installed on endpoint devices (C) is required because it provides the endpoint identity, posture information, and ZTNA client functionality needed to establish secure tunnels to the access proxy. A FortiGate configured as ZTNA access proxy (D) is required because it enforces ZTNA policies and brokers access between endpoints and the protected corporate web application. FortiSandbox (A) is not required for ZTNA deployment; it provides sandboxing/threat analysis and is not a core ZTNA component. FortiAnalyzer (E) is also not required; it provides logging, reporting, and analytics but ZTNA can function without it.

Answer

FortiSandbox for threat analysis

Answer

FortiAnalyzer for logging

Question 10

A FortiGate administrator is troubleshooting a ZTNA problem where users are unable to connect to an internal application via FortiClient. FortiClient reports 'Connection refused'. The FortiGate ZTNA gateway is configured correctly. Which THREE steps should the administrator take to diagnose the issue?

Accepted Answer

Verify that FortiClient can reach the ZTNA gateway's IP and port. Option B is correct because a 'Connection refused' error from FortiClient typically indicates a TCP-level reachability problem to the ZTNA gateway, so verifying that the client can reach the gateway's IP and port (for example, with telnet or Test-NetConnection on the configured access proxy port) confirms whether the failure is at the network path or at the gateway itself. Option C is correct because the ZTNA access proxy rule defines the application mapping (external FQDN/port to the real internal server and port), and an incorrect mapping would cause the gateway to reject or misroute the connection even when the gateway is otherwise configured correctly. Option E is correct because the FortiGate must be able to reach the backend application server; if the server is down, the port is closed, or a firewall/routing issue blocks the FortiGate-to-server path, the access proxy cannot complete the connection and the client sees a refused or failed connection. Option A is not relevant because antivirus update status does not affect ZTNA access proxy connectivity or TCP reachability. Option D is not a diagnostic step; rebooting the FortiClient computer does not isolate the cause and may only mask a transient issue.

Answer

Check the FortiGate's antivirus update status

Answer

Reboot the FortiClient computer

Question 11

An administrator is configuring FortiGate automation stitches to respond to a detected ransomware outbreak. The trigger is a high severity event from FortiSandbox. Which TWO actions can be used in an automation stitch to contain the threat?

Accepted Answer

Execute a CLI script to block the infected host's IP address. Executing a CLI script to block the infected host's IP address directly on the FortiGate allows immediate containment by applying a firewall policy or address-based block, which is a standard action in automation stitches for threat response. Option E is correct because quarantining the endpoint via FortiClient EMS integration leverages the FortiClient endpoint agent to isolate the infected device from the network, which is a supported action in automation stitches for ransomware containment.

Answer

Create a new FortiGate administrator account

Answer

Send an SNMP trap to a monitoring system

Answer

Change the SSID of a wireless network

Question 12

Which of the following is a valid command to check the status of all BGP neighbors on a FortiGate?

Accepted Answer

get router info bgp summary. 'get router info bgp summary' is the standard FortiGate CLI command to display the status of all BGP neighbors, including their state, uptime, and prefixes received. This command retrieves the BGP routing table summary from the FortiGate's routing daemon, which is essential for verifying neighbor relationships and troubleshooting BGP peering issues.

Answer

diagnose router bgp summary

Answer

show bgp neighbors

Answer

diagnose ip router bgp all

Question 13

A company has a FortiGate with multiple VDOMs. The security team wants to use FortiManager to manage policies centrally. Which three steps are necessary to set up VDOM management via FortiManager? (Choose three.)

Accepted Answer

Enable VDOMs on the FortiGate and configure them for FortiManager management. VDOMs must be enabled on the FortiGate and each VDOM must be configured to allow FortiManager management. This is done by setting the 'set vdom mgmt' parameter within each VDOM or globally, which permits FortiManager to push policy and object changes to the specific VDOM context. Without this step, FortiManager cannot authenticate or communicate with the VDOMs, even if the device is added to the ADOM.

Answer

Configure a static route on FortiManager to reach the FortiGate's management IP

Answer

Disable VDOM configuration locking on FortiManager

Question 14

What is the purpose of FortiDeceptor in an enterprise security architecture?

Accepted Answer

To simulate real assets and detect attackers attempting to interact with decoys. FortiDeceptor is a deception-based threat detection solution that deploys decoys (simulated real assets like servers, databases, or IoT devices) across the network. When an attacker probes or interacts with these decoys, FortiDeceptor generates high-fidelity alerts, enabling early detection of lateral movement or reconnaissance without relying on signatures. This aligns with the Advanced Threat Protection domain by shifting from reactive blocking to proactive deception.

Answer

To provide VPN access for remote users

Answer

To encrypt all data at rest on endpoints

Answer

To block all inbound traffic from suspicious IP addresses

Question 15

A FortiGate administrator wants to ensure that files in email attachments are disarmed before delivery. Which security feature should be configured in the antivirus profile?

Accepted Answer

Content Disarm and Reconstruction (CDR). Content Disarm and Reconstruction (CDR) is the correct answer because it is specifically designed to remove active content (e.g., macros, scripts, embedded objects) from email attachments and rebuild them into safe, sanitized versions before delivery. Unlike detection-based methods, CDR proactively disarms threats by stripping potentially malicious elements while preserving the file's usability, making it the ideal choice for disarming attachments in an antivirus profile.

Answer

FortiSandbox inline scanning

Answer

Machine Learning Engine

Answer

Outbreak Prevention