NSE7 Practice Test 20 — 15 Questions

Question 1

An administrator configures a performance SLA for SD-WAN health checks. The SLA uses a ping probe to 8.8.8.8 every 2 seconds with a latency threshold of 150 ms and jitter threshold of 20 ms. After some time, the SD-WAN rule still shows the member as 'dead'. Which command should the administrator use to verify the probe results?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

diagnose sys sdwan health-check. The 'diagnose sys sdwan health-check' command is the correct tool because it provides real-time, detailed probe results for each SD-WAN health-check member, including latency, jitter, packet loss, and SLA status. This allows the administrator to see exactly why the member is marked as 'dead', such as exceeding the 150 ms latency or 20 ms jitter thresholds. The 'show system sdwan health-check' command only displays configured parameters, not live probe data.

Answer

show system sdwan health-check

Answer

diagnose sys session list

Answer

execute ping-options source 8.8.8.8

Question 2

An organization wants to implement email authentication to prevent spoofing and phishing attacks. They use FortiMail as their email security gateway. Which THREE mechanisms should they configure to achieve comprehensive email authentication?

Accepted Answer

Sender Policy Framework (SPF). Sender Policy Framework (SPF) is correct because it allows the domain owner to publish a DNS TXT record listing authorized sending IP addresses, enabling receiving mail servers (like FortiMail) to verify that the email originated from an approved source. This directly prevents spoofing by rejecting messages from unauthorized IPs claiming to be from the domain.

Answer

Transport Layer Security (TLS) for SMTP

Answer

FortiGuard Antispam

Question 3

A FortiGate is configured with multiple BGP peers. One of the peers is not receiving the expected routes. The administrator runs 'get router info bgp neighbors <IP>' and sees that the 'State/PfxRcd' field is 'Active'. What does this indicate?

Accepted Answer

The BGP session is in the Active state, meaning the FortiGate is trying to establish a TCP connection to the peer. The 'Active' state in BGP indicates that the FortiGate has sent an OPEN message and is waiting for a TCP connection from the peer, or is actively retrying the TCP connection. This means the session has not yet reached the Established state, so no routes are being exchanged. Option C correctly identifies that the FortiGate is attempting to establish a TCP connection to the peer.

Answer

The BGP peer has reached the maximum prefix limit

Answer

The BGP peer has been administratively shut down

Answer

The BGP session has been established and routes are being exchanged

Question 4

A company is deploying ZTNA to protect an internal application. They want to ensure that only users with devices that have disk encryption enabled and the latest OS patches can access the application. Which THREE components must be configured to achieve this?

Accepted Answer

FortiClient on the endpoint device. Option C is correct because FortiClient is the endpoint agent that performs the on-device posture checks (disk encryption status and OS patch level) and reports that information to FortiClient EMS. Option E is correct because FortiClient EMS is where the compliance/ZTNA tagging policies are defined and where tags (such as 'disk-encrypted' and 'patched') are assigned to endpoints based on those posture results. Option D is correct because the FortiGate ZTNA access proxy enforces tag-based rules, only allowing access to the internal application when the endpoint presents the required compliance tags. Option A is not needed since FortiNAC provides network admission control (NAC) for LAN/port-level access, not ZTNA application access control. Option B is not required because ZTNA uses TLS-based access proxy tunnels rather than an IPsec VPN to reach the protected application.

Answer

FortiNAC for network admission control

Answer

IPsec VPN to encrypt traffic between client and FortiGate

Question 5

In a multi-VDOM deployment, inter-VDOM routing is configured using VDOM links. After configuring the VDOM links and adding static routes, traffic between VDOMs is not working. The administrator verifies that the VDOM link interfaces are up and have correct IP addresses. What is the most likely missing configuration?

Accepted Answer

Firewall policies are missing or not allowing the traffic. In a FortiGate multi-VDOM deployment, VDOM links create a direct Layer 3 connection between VDOMs, but traffic is still subject to firewall policies. Even with correct IP addresses and static routes, inter-VDOM traffic will be dropped unless explicit firewall policies are configured on both VDOMs to permit the traffic. This is because FortiGate enforces stateful inspection at every VDOM boundary, including VDOM links.

Answer

The inter-VDOM routing mode is set to 'nat' instead of 'route'

Answer

The VDOM links are not assigned to the correct VDOM

Answer

The VDOMs are in different administrative domains

Question 6

An administrator configures a VDOM on a FortiGate and assigns two interfaces (port1, port2) to it. The administrator wants to route traffic between two different subnets within the same VDOM. Which configuration is required?

Accepted Answer

Configure static or dynamic routing. Routing between two subnets within the same VDOM is standard intra-VDOM routing. Since both interfaces (port1, port2) belong to the same VDOM, no inter-VDOM constructs are needed; the FortiGate simply requires a route (static or dynamic) to forward packets between the subnets. A firewall policy allowing the traffic is also necessary, but the question specifically asks for the routing configuration.

Answer

Configure a VDOM link

Answer

Create a policy with inter-VDOM link

Answer

Enable inter-VDOM routing

Question 7

A FortiGate administrator notices that after installing a new policy package from FortiManager, the firewall policies on the managed FortiGate do not match what was configured in FortiManager. What feature should the administrator use to review the exact changes before committing?

Accepted Answer

Install preview. Install preview, is correct because it allows the administrator to review the exact configuration changes that FortiManager will push to the managed FortiGate before the changes are committed. This feature compares the current running configuration on the FortiGate with the intended policy package in FortiManager and displays a detailed diff of additions, deletions, and modifications. It is specifically designed to prevent unexpected policy mismatches by providing a pre-commit review step.

Answer

Revision history

Answer

Device manager log

Answer

Policy consistency check

Question 8

An IPS administrator wants to detect a new custom attack that sends malformed HTTP headers. The attack pattern is a specific sequence of bytes that is not covered by existing signatures. What is the BEST way to detect this attack on FortiGate?

Accepted Answer

Create a custom IPS signature. Custom IPS signatures allow you to define a specific byte sequence or pattern (e.g., via a regular expression or hex pattern) that matches the malformed HTTP header. FortiGate's IPS engine can then inspect HTTP traffic at the application layer and trigger an alert or block when the custom pattern is found, even if no existing signature covers it.

Answer

Use an automation stitch to block traffic with unusual headers

Answer

Enable protocol anomaly detection in the IPS sensor

Answer

Deploy FortiWeb as a reverse proxy

Question 9

A FortiGate has two equal-cost paths to a destination network. ECMP is enabled. The administrator notices that all traffic uses the first path. What is the most likely cause?

Accepted Answer

ECMP is configured to use 'source-dest-ip' hash and all sessions are from same source to same destination. When ECMP is configured with the 'source-dest-ip' hash algorithm, traffic is load-balanced based on a hash of both source and destination IP addresses. If all sessions originate from the same source IP and go to the same destination IP, the hash value is identical for every session, causing all traffic to be forwarded over the same path. This is the most likely cause because the administrator sees all traffic using the first path despite ECMP being enabled.

Answer

ECMP is configured with 'spillover' mode

Answer

The second path is administratively down

Answer

The route metric is not equal

Question 10

Drag and drop the steps to configure a FortiGate as a DHCP server into the correct order.

Accepted Answer

Select interface, then enable DHCP, then set scope, then configure options, then apply.. The correct sequence to configure a FortiGate as a DHCP server is: first select the interface that will serve DHCP, then enable DHCP on that interface, set the IP address scope (range), configure additional options such as default gateway and DNS servers, and finally apply the configuration. This order ensures dependencies are met and the configuration is valid.

Answer

Enable DHCP, then select interface, then set scope, then configure options, then apply.

Answer

Set scope, then configure options, then enable DHCP, then select interface, then apply.

Answer

Configure options, then apply, then select interface, then enable DHCP, then set scope.

Question 11

A FortiGate with SD-WAN enabled uses two members: MPLS (10 ms latency) and Internet (40 ms latency). The SD-WAN rule uses 'Best Quality' strategy with latency as the metric. Traffic to a critical application (10.1.1.0/24) is currently using the MPLS link. The MPLS link's latency increases to 60 ms due to a routing issue. How will FortiGate handle new sessions to 10.1.1.0/24?

Accepted Answer

New sessions will use the Internet link; existing sessions continue on MPLS.. The 'Best Quality' strategy with latency metric selects the link with the lowest latency for new sessions. When MPLS latency rises to 60 ms, it exceeds the Internet link's 40 ms, so new sessions will be steered to the Internet. However, SD-WAN does not preemptively rehash existing sessions; they remain on the original link (MPLS) until they expire or are torn down.

Answer

FortiGate will wait for the MPLS link to recover before sending new traffic.

Answer

All sessions immediately switch to the Internet link.

Answer

Existing sessions continue on MPLS; new sessions will use MPLS until the next SLA probe.

Question 12

A network admin is troubleshooting why FortiGate's antivirus is not detecting a known malware sample. The sample is detected by other scanners. Which two checks should the admin perform? (Choose two.)

Accepted Answer

Verify that the FortiGuard Antivirus subscription is active. FortiGate's antivirus engine relies on a valid FortiGuard Antivirus subscription to download and update the virus signature database. If the subscription has expired, the engine cannot receive new signatures, causing it to miss recently discovered malware samples that other scanners with active subscriptions detect.

Answer

Check that the file is not excluded by a file filter

Answer

Ensure the firewall policy is configured for proxy-based inspection

Answer

Confirm that the antivirus profile has 'Scan on Delivery' enabled

Question 13

A network administrator is configuring inter-VDOM routing between two VDOMs: VDOM-A and VDOM-B. The administrator creates a inter-VDOM link and adds routes pointing to the link. However, traffic from VDOM-A to VDOM-B fails. What is the most likely missing configuration?

Accepted Answer

A firewall policy must be created in each VDOM to permit traffic across the inter-VDOM link. In FortiGate, inter-VDOM routing requires firewall policies in each VDOM to explicitly permit traffic across the inter-VDOM link. Without these policies, the FortiGate drops the traffic even if routes are correctly configured, because the inter-VDOM link behaves like a virtual interface that requires policy-based access control.

Answer

Both VDOMs must be in transparent mode

Answer

The inter-VDOM link must be in the same VDOM

Answer

The management VDOM must be enabled

Question 14

An administrator runs 'diagnose debug application sslvpn -1' and sees repeated 'SSL_ERROR_SSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate'. The SSL-VPN is configured to require client certificates. What is the cause?

Accepted Answer

The client is not sending a client certificate. The error 'SSL_ERROR_SSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate' occurs during the TLS handshake when the server requests a client certificate and the client fails to provide one. Since the SSL-VPN is configured to require client certificates, the FortiGate expects the client to present a valid certificate; if none is sent, the handshake fails with this specific OpenSSL error. This directly indicates that the client is not sending a client certificate, making option A correct.

Answer

The SSL-VPN server certificate is expired

Answer

The SSL-VPN tunnel mode is misconfigured

Answer

The CA certificate is not imported on FortiGate

Question 15

A FortiGate is configured with an IPsec VPN that uses certificate-based authentication. The VPN fails to establish. The administrator checks the phase1 debug and sees the message: 'no suitable certificate found'. What is the most likely cause?

Accepted Answer

The local certificate is not imported or does not match the certificate name. The 'no suitable certificate found' error in IPsec phase1 debug indicates that the FortiGate cannot locate a local certificate that matches the peer's expected certificate name (often the peer's ID or the configured local certificate name). This typically occurs when the local certificate is not imported or the certificate's Common Name (CN) or Subject Alternative Name (SAN) does not match the configured local ID or peer's expected identifier. Without a matching local certificate, the IKE exchange cannot proceed to authenticate the FortiGate to the remote peer.

Answer

The peer's certificate is not trusted

Answer

The certificate revocation list (CRL) is outdated

Answer

The CA certificate is missing