NSE7 Practice Test 20 — 15 Questions

Question 1

An administrator applies the above policy but users from 10.0.1.0/24 cannot access web servers at 10.0.2.0/24. However, they can ping the servers. What is the most likely cause?

Accepted Answer

The service 'HTTP' does not include port 443 or the web application is using HTTPS.. The policy allows HTTP traffic (port 80), but the web servers are likely using HTTPS (port 443). Since the service object 'HTTP' in FortiGate typically only includes TCP/80, HTTPS traffic is denied by default. The administrator can ping the servers because ICMP is permitted by an implicit or explicit policy, confirming that routing and connectivity are functional.

Answer

The destination address is incorrect.

Answer

The schedule 'always' is not correctly configured.

Answer

The source interface is incorrect.

Question 2

An administrator configures an automation stitch in FortiManager to execute a CLI script on a FortiGate when a specific event is triggered. The automation stitch is enabled but does not run when the event occurs. What is the most likely cause?

Accepted Answer

The automation stitch has not been installed to the FortiGate. In FortiManager, automation stitches are created and stored in the central management database but must be explicitly installed to the managed FortiGate via the 'Install Wizard' or a direct policy/object install. Until the stitch is installed, the FortiGate does not have the configuration locally, so even if the stitch is enabled in FortiManager and the event occurs, the FortiGate will not execute the CLI script. This is a common oversight where administrators assume enabling the stitch in FortiManager automatically pushes it to the device.

Answer

The event trigger is set to high severity only

Answer

The FortiGate does not support automation stitches

Answer

The CLI script contains an invalid command

Question 3

What is the difference between a global ADOM and a regular ADOM in FortiManager?

Accepted Answer

Global ADOM allows sharing policy packages and objects across multiple ADOMs. In FortiManager, a Global ADOM is a special administrative domain that allows you to centrally manage and share policy packages, objects, and templates across multiple regular ADOMs. This enables consistent security policies and objects (like addresses, services, and schedules) to be pushed to all managed FortiGates, regardless of which ADOM they belong to. Regular ADOMs are isolated and cannot share objects or policies with other ADOMs, making the Global ADOM essential for large-scale, multi-tenant deployments.

Answer

Global ADOM manages only FortiGates in transparent mode

Answer

Regular ADOM cannot use meta fields

Answer

Global ADOM has unlimited device capacity

Question 4

When troubleshooting an IPsec VPN phase 1 negotiation failure, which debug command should the administrator run to see detailed IKE negotiation messages?

Accepted Answer

diagnose debug application ike -1. The command 'diagnose debug application ike -1' enables detailed IKE (Internet Key Exchange) debug messages in FortiOS, which are essential for troubleshooting Phase 1 negotiation failures. This command captures the full IKE negotiation exchange, including proposals, authentication, and Diffie-Hellman group selection, allowing the administrator to identify where the failure occurs.

Answer

diagnose vpn ike log

Answer

get vpn ipsec tunnel details

Answer

diagnose debug application ipsec -1

Question 5

An administrator configures a WAF profile on FortiGate to protect a web application. They notice that SQL injection attacks are not being blocked. What is the MOST likely reason?

Accepted Answer

The FortiGuard Web Filtering subscription is inactive. The FortiGuard Web Filtering subscription provides the signature database required to detect and block SQL injection attacks within a WAF profile. Without an active subscription, the WAF profile cannot update or use the latest attack signatures, rendering it unable to identify SQL injection patterns even if the profile is enabled and applied correctly.

Answer

The web application uses HTTPS without SSL inspection

Answer

The WAF profile is set to monitor mode

Answer

The WAF profile is applied to the wrong firewall policy

Question 6

Which FortiAnalyzer feature allows administrators to create automated response actions triggered by specific log events, such as blocking an IP address when an intrusion is detected?

Accepted Answer

Playbooks. Playbooks in FortiAnalyzer allow administrators to define automated response actions triggered by specific log events, such as blocking an IP address when an intrusion is detected. This feature uses a visual workflow editor to chain conditions and actions (e.g., executing CLI commands via FortiGate API or sending alerts) based on real-time log analysis, enabling automated threat mitigation without manual intervention.

Answer

FortiView

Answer

Reports

Answer

Incidents

Question 7

An administrator is configuring a firewall policy for web traffic to a critical web application. They want to protect against SQL injection and cross-site scripting. Which security profile should they apply?

Accepted Answer

Web Application Firewall (WAF) profile. The Web Application Firewall (WAF) profile is specifically designed to inspect HTTP/HTTPS traffic at the application layer and block common web-based attacks such as SQL injection and cross-site scripting (XSS). It uses signature-based detection and behavioral analysis to identify malicious payloads in request parameters, headers, and body content, making it the correct choice for protecting a critical web application.

Answer

Antivirus profile with CDR

Answer

Application control profile

Answer

IPS sensor with pre-defined signatures

Question 8

A FortiGate administrator runs 'diagnose ips anomaly list' and sees many entries with 'protocol anomaly - tcp_port_scan'. The administrator wants to reduce false positives. Which action should be taken in the IPS sensor configuration?

Accepted Answer

Increase the threshold for the port scan detection in the IPS sensor.. Increasing the threshold for port scan detection in the IPS sensor reduces false positives by requiring a higher number of scan attempts within the detection window before an alert is triggered. The 'diagnose ips anomaly list' output shows 'protocol anomaly - tcp_port_scan' entries, which are generated by the IPS engine's anomaly-based detection; raising the threshold makes the sensor less sensitive to benign network scanning activity, such as legitimate port sweeps by monitoring tools.

Answer

Add the trusted server IPs to an exemption list in the IPS sensor.

Answer

Disable the TCP port scan filter entirely.

Answer

Change the action from 'block' to 'monitor' for all IPS filters.

Question 9

A company uses FortiWeb to protect its web application. They want to block SQL injection attempts. Which FortiWeb feature should be configured to inspect HTTP requests for malicious SQL patterns?

Accepted Answer

Web Application Firewall (WAF) Signatures. FortiWeb's WAF Signatures (option B) are specifically designed to inspect HTTP request payloads for known attack patterns, including SQL injection signatures. This feature uses a regularly updated signature database to match malicious SQL syntax (e.g., UNION, OR 1=1) within GET/POST parameters, cookies, or headers, making it the correct choice for blocking SQL injection attempts.

Answer

URL Access Rule

Answer

HTTP Protocol Constraint

Answer

IP List

Question 10

What does FortiGuard Outbreak Prevention use to protect against newly discovered malware outbreaks before traditional signatures are available?

Accepted Answer

Outbreak signatures and hash-based blocking. FortiGuard Outbreak Prevention uses outbreak signatures and hash-based blocking to provide rapid protection against newly discovered malware outbreaks before traditional signatures are available. Outbreak signatures are lightweight, pattern-based detections that can be deployed quickly, while hash-based blocking allows immediate blocking of known malicious file hashes, even when full signature analysis is not yet complete.

Answer

IP reputation and URL filtering

Answer

Heuristic analysis and emulation

Answer

Artificial intelligence and behavior analysis

Question 11

Based on the exhibit, what can be concluded about the session?

Accepted Answer

The session is offloaded to the NPU for hardware acceleration.. The session state 'npu' indicates that the session has been offloaded to the Network Processor Unit (NPU) for hardware acceleration. This is a normal and expected state for traffic that matches hardware-offloadable profiles, allowing the NPU to process packets at wire speed without CPU intervention.

Answer

The session is a one-way session with only outbound traffic.

Answer

The session is not being logged.

Answer

The session is in the 'npu' state, meaning it is being processed by the CPU.

Question 12

A company wants to use FortiMail to implement email authentication to prevent spoofing. Which THREE mechanisms should be configured in FortiMail's Authentication Profile?

Accepted Answer

DMARC. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is correct because it builds on SPF and DKIM to provide a policy framework that tells receiving mail servers how to handle messages that fail authentication checks. In FortiMail's Authentication Profile, DMARC enables the enforcement of policies like quarantine or reject, which directly prevents spoofing by ensuring only authenticated emails are delivered.

Answer

S/MIME

Answer

TLS

Question 13

An administrator configures a custom IPS signature to detect traffic to a specific malicious domain. Which syntax is correct for a custom IPS signature in FortiGate?

Accepted Answer

F-SBID( --name "malicious_domain"; --pattern "example.com"; --service HTTP; ). FortiGate custom IPS signatures use the F-SBID (Fortinet Signature-Based IDentification) syntax, which requires the --name and --pattern keywords to define the signature name and the malicious pattern to match. This syntax is specific to FortiGate's IPS engine and is not based on Snort or Suricata rule syntax.

Answer

config ips custom signature edit "malicious_domain" set signature "alert tcp any any -> any any (msg:"malicious"; content:"example.com";)" end

Answer

config firewall policy edit 1 set ips-filter "malicious_domain" end

Answer

set ips-sensor custom-signature "malicious_domain" pattern "example.com"

Question 14

An admin wants to ensure that office documents (e.g., Word, Excel) downloaded from the internet are safe before users open them. Which feature should be used to remove potentially malicious macros and active content?

Accepted Answer

Content Disarm and Reconstruction (CDR). Content Disarm and Reconstruction (CDR) is the correct feature because it proactively removes potentially malicious macros, scripts, and active content from office documents by stripping the original file's active elements and rebuilding a safe, sanitized version. Unlike detection-based methods, CDR eliminates threats before the file reaches the user, ensuring that even unknown or zero-day macro-based attacks are neutralized.

Answer

Machine learning engine

Answer

Antivirus pattern matching

Answer

FortiSandbox file submission

Question 15

A network admin notices that files submitted to FortiSandbox are not being analyzed. The FortiGate is configured to send files to FortiSandbox. What is the MOST likely cause?

Accepted Answer

FortiSandbox license is expired. The most likely cause is an expired FortiSandbox license. When the license expires, FortiSandbox stops analyzing submitted files and may reject new submissions, even though the FortiGate is configured to send them. The FortiGate will still attempt to forward files, but FortiSandbox will not process them, resulting in no analysis results being returned.

Answer

FortiGate firewall policy is blocking the connection to FortiSandbox on port 443

Answer

FortiSandbox is in quarantine mode

Answer

File size exceeds the maximum submission size limit on FortiGate