NSE7 Practice Exam 2 — 20 Questions

Question 1

Which FortiGate security feature removes potentially malicious active content from files (e.g., macros, scripts) before delivering them to end users?

Accepted Answer

Content Disarm and Reconstruction. Content Disarm and Reconstruction (CDR) is the correct answer because it specifically removes potentially malicious active content—such as macros, scripts, and embedded objects—from files (e.g., Office documents, PDFs) by stripping the active elements and reconstructing a safe, sanitized version before delivery. Unlike traditional scanning, CDR does not rely on signatures or heuristics; it assumes the file could be malicious and proactively neutralizes threats by rebuilding the file with only safe, static content.

Answer

Antivirus

Answer

Data Leak Prevention

Answer

File Filter

Question 2

An administrator configures an automation stitch to respond to a high severity event. The trigger is 'event' and the action is 'CLI script'. What must be defined for the action to execute properly?

Accepted Answer

A valid CLI script that contains commands to be executed on the FortiGate. For an automation stitch action of type 'CLI script' to execute properly on a FortiGate, the action must reference a valid CLI script that contains the actual FortiGate CLI commands to be run. The script is defined locally on the FortiGate and does not require external authentication, a FortiManager, or an email server for execution.

Answer

An API token for authentication

Answer

A FortiManager to execute the script

Answer

An email server to send the script output

Question 3

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route for 192.168.100.0/24 into OSPF. After configuring 'config router ospf' with 'redistribute static' enabled, the route appears in the OSPF database but is not being advertised to other areas. What is the most likely cause?

Accepted Answer

The router is an ABR and the static route is being redistributed as a type 5 LSA, which is not flooded into stub areas.. An ABR does not flood Type 5 LSAs (which are generated by redistribution) into stub areas or NSSAs. Since the route appears in the OSPF database on the ABR but is not advertised to other areas, the most likely cause is that the receiving area is a stub area, which by design blocks Type 5 LSAs. The redistribution of a static route into OSPF creates a Type 5 LSA, which is only flooded throughout the AS except into stub areas and NSSAs.

Answer

The 'redistribute static' command needs a route map to filter the route correctly.

Answer

The static route's administrative distance is too high for OSPF.

Answer

OSPF must be configured with 'default-information originate' to allow redistribution.

Question 4

An administrator runs 'diagnose ips anomaly http' and sees many entries with 'type=SQLi' and 'score=0'. What does a score of 0 indicate?

Accepted Answer

The traffic showed suspicious patterns but did not meet the threshold. In Fortinet's IPS anomaly detection, a score of 0 indicates that the traffic exhibited suspicious patterns (e.g., SQLi signatures) but did not accumulate enough anomaly points to meet the configured threshold for triggering an action. This means the traffic was flagged as potentially malicious but was not deemed severe enough to warrant logging or blocking, so it remains in a 'monitoring' state without enforcement.

Answer

The anomaly detection is disabled

Answer

The IPS sensor is not applied to any policy

Answer

The traffic is definitely an SQL injection attack

Question 5

A FortiManager administrator wants to push a policy package that includes both global header/footer policies and VDOM-specific policies. Which statement about header/footer policies is correct?

Accepted Answer

Header policies are inserted before the VDOM's own policies; footer policies are appended after. In FortiManager, when a policy package includes both global header/footer policies and VDOM-specific policies, the header policies are inserted before the VDOM's own policies in the policy table, while footer policies are appended after them. This ensures that header policies are evaluated first for traffic matching, and footer policies serve as a catch-all or default set of rules at the end of the VDOM policy list.

Answer

Header/footer policies are only available when using per-device mapping

Answer

Header/footer policies can only be configured directly on the FortiGate, not via FortiManager

Answer

Header/footer policies are automatically generated and cannot be manually edited

Question 6

A network administrator notices that FortiGate is not blocking a known malicious file that was submitted to FortiSandbox and received a 'malicious' verdict. The firewall policy includes a FortiSandbox inline scan profile. What is the MOST likely cause?

Accepted Answer

The FortiSandbox is not configured as an inline scanner in the antivirus profile. The FortiGate uses an antivirus profile to define how files are scanned, including whether to send files to FortiSandbox for inline analysis. Even if the firewall policy references a FortiSandbox inline scan profile, the antivirus profile must have the 'FortiSandbox inline scan' option enabled to actually forward files to the FortiSandbox appliance. Without this setting, the FortiGate will not submit files for sandboxing, so a malicious verdict from FortiSandbox is never applied to the traffic.

Answer

The antivirus signature database is outdated

Answer

The FortiSandbox license has expired

Answer

The file is larger than the maximum file size allowed for scanning

Question 7

Which FortiManager feature allows an administrator to view the exact CLI commands that will be pushed to a managed FortiGate before installation?

Accepted Answer

Install Preview. Install Preview is the correct answer because it allows an administrator to review the exact CLI commands that FortiManager will push to a managed FortiGate during the next installation. This feature provides a pre-installation view of the configuration changes, enabling verification before committing changes to the device.

Answer

Policy Check

Answer

Revision History

Answer

Device Manager Dashboard

Question 8

Which FortiGate feature allows the creation of multiple virtual routing tables within a single VDOM?

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) allows a single FortiGate VDOM to maintain multiple independent routing tables, each with its own forwarding decisions. This is achieved by creating separate VRF instances (identified by VRF IDs 1-255) within the same VDOM, enabling traffic isolation and overlapping IP address spaces without requiring separate VDOMs.

Answer

Policy-based routing

Answer

VDOM

Answer

ECMP

Question 9

In FortiManager, what is the purpose of an automation stitch?

Accepted Answer

To trigger automated actions based on predefined events. An automation stitch in FortiManager is a sequence of automated actions triggered by a predefined event, such as a log message, SNMP trap, or schedule. It allows administrators to define a set of actions (e.g., run a script, send an alert, or change a policy) that execute in response to specific conditions, streamlining incident response and network management without manual intervention.

Answer

To combine multiple ADOMs into a single management domain

Answer

To automatically deploy configuration changes to devices

Answer

To stitch together multiple policy packages into one

Question 10

An enterprise uses multiple VDOMs on a FortiGate. The administrator needs to route traffic between VDOM-A and VDOM-B using a firewall policy. What is the correct configuration step?

Accepted Answer

Configure a VDOM link between the two VDOMs and create a policy allowing traffic. A VDOM link creates a direct Layer 2 or Layer 3 connection between two VDOMs, allowing traffic to be controlled by firewall policies. This is the only method that enables policy-based inter-VDOM routing without requiring external cables or complex routing configurations.

Answer

Place both VDOMs in the same virtual router and use regular policies

Answer

Create a static route in each VDOM pointing to the other VDOM's virtual interface

Answer

Enable inter-VDOM routing globally under system settings

Question 11

Which of the following is the primary purpose of BFD (Bidirectional Forwarding Detection) on a FortiGate?

Accepted Answer

To provide fast detection of link failures. BFD (Bidirectional Forwarding Detection) is a lightweight protocol designed to provide sub-second failure detection between two forwarding engines, such as FortiGate peers. Unlike routing protocol hellos (e.g., OSPF Hello at 10-second intervals), BFD can detect link or neighbor failures in as little as 50–100 ms, enabling faster convergence. This makes it the primary mechanism for rapid link failure detection in high-availability and SD-WAN deployments.

Answer

To synchronize routing tables between peers

Answer

To load balance traffic across multiple paths

Answer

To encrypt routing updates between peers

Question 12

What is the primary function of Content Disarm and Reconstruction (CDR) in FortiGate's antivirus profile?

Accepted Answer

To remove active content and rebuild files to eliminate hidden threats. Content Disarm and Reconstruction (CDR) works by stripping active content (e.g., macros, scripts, OLE objects) from incoming files and rebuilding them into a safe, sanitized version. This eliminates hidden threats such as embedded exploits or malicious code that signature-based detection might miss, providing protection against zero-day and unknown attacks. Option D correctly identifies this core function of removing active content and rebuilding files to neutralize threats.

Answer

To detect and block zero-day malware using machine learning

Answer

To reconstruct files that were corrupted during transmission

Answer

To compress files for faster scanning

Question 13

An administrator needs to check the current CPU and memory usage of a FortiGate to determine if resource exhaustion is causing network delays. Which CLI command provides a real-time, top-like view of processes and their resource consumption?

Accepted Answer

diagnose sys top. The correct command is 'diagnose sys top', which offers a dynamic, top-like view of processes and their CPU/memory usage. It is the primary tool for real-time resource monitoring on FortiGate, allowing administrators to quickly identify resource-heavy processes.

Answer

diagnose sys session stat

Answer

diagnose hardware sysinfo memory

Answer

get system performance status

Question 14

A FortiGate administrator is configuring an IPsec VPN with IKEv2 and wants to ensure that the tunnel uses perfect forward secrecy (PFS). Which phase2 configuration is required?

Accepted Answer

Set 'pfs enable' in phase2 proposal.. Perfect forward secrecy in IPsec is enabled in the phase2 proposal by setting 'pfs enable'. This forces a new Diffie-Hellman exchange for each phase2 rekey, ensuring that compromised keys do not compromise past or future sessions. The phase1 dh-group setting is separate and does not enable PFS for phase2.

Answer

Set 'pfs enable' in phase1 proposal.

Answer

Set 'pfs disable' in phase2 proposal.

Answer

Set 'dh-group 14' in phase1 proposal.

Question 15

A FortiGate administrator is configuring an ADVPN with a hub-and-spoke topology. The administrator wants to ensure that spoke-to-spoke traffic can be dynamically established without traversing the hub for every packet. The administrator also wants to ensure that the shortcut tunnels are only established when necessary and are torn down when no longer used. Which two statements about ADVPN shortcut tunnels on FortiGate are correct? (Choose two.)

Accepted Answer

Shortcut tunnels are established when a spoke receives a shortcut offer from the hub and the spoke has a route to the destination spoke's public IP.. ADVPN shortcut tunnels are established on demand when the hub sends a shortcut offer and the originating spoke can reach the destination spoke's public IP. They are torn down after an idle timeout when no traffic matches, reverting traffic to the hub path. This dynamic creation and teardown optimizes spoke-to-spoke communication while preserving the hub as a fallback and control point.

Answer

Shortcut tunnels are always established between all spokes at initial VPN bring-up, regardless of traffic patterns.

Answer

Shortcut tunnels can only be established between spokes that are in the same IP subnet.

Answer

Shortcut tunnels require the hub to be removed from the routing path permanently once established.

Question 16

An administrator wants to detect lateral movement and early stages of an attack using decoy systems that mimic production assets. Which Fortinet product should they deploy?

Accepted Answer

FortiDeceptor. FortiDeceptor is specifically designed to detect lateral movement and early-stage attacks by deploying decoy systems (honeypots) that mimic production assets. It uses deception technology to lure attackers away from real targets and trigger alerts when decoys are probed or compromised, enabling early threat detection without impacting production systems.

Answer

FortiSIEM

Answer

FortiEDR

Answer

FortiNDR

Question 17

Which two commands display the current session count on a FortiGate?

Accepted Answer

get system performance status. Both 'get system performance status' and 'diagnose sys session stat' display the current session count on a FortiGate. 'get system performance status' provides a real-time snapshot including active sessions, while 'diagnose sys session stat' shows session table statistics such as total and used sessions. Therefore, both commands are valid answers to the question.

Answer

show system session

Answer

diagnose hardware sysinfo session

Question 18

An administrator is investigating a security incident where a workstation is communicating with a known command and control (C2) server. The FortiGate has IPS enabled but did not block the traffic. Which TWO configuration issues could explain why the IPS did not detect the C2 communication? (Choose two.)

Accepted Answer

The firewall policy does not have SSL deep inspection enabled. Without SSL deep inspection, the FortiGate cannot decrypt HTTPS traffic to inspect the payload for C2 signatures. IPS operates on decrypted content; if the C2 communication uses TLS, the IPS engine only sees encrypted packets and cannot match application-layer signatures. Enabling SSL deep inspection with a valid CA certificate is required to decrypt and inspect the traffic.

Answer

The IPS sensor is configured in 'Inline' mode

Answer

The IPS sensor has 'Logging' disabled

Answer

The FortiGate is operating in 'Transparent' mode

Question 19

A FortiGate with SD-WAN configured has a Performance SLA monitoring Google DNS (8.8.8.8). The SLA is configured with latency threshold 100 ms and jitter threshold 20 ms. The link is currently meeting both thresholds. The administrator wants to ensure that if the SLA fails, traffic moves to another link. Which SD-WAN rule strategy should be used?

Accepted Answer

Failover (SLA). The Failover (SLA) strategy is correct because it ensures that traffic is moved to another link only when the Performance SLA fails, while the primary link is used as long as it meets the configured latency (100 ms) and jitter (20 ms) thresholds. This strategy provides deterministic failover behavior, matching the administrator's requirement to switch traffic only upon SLA failure.

Answer

Best quality

Answer

Manual selection

Answer

Maximize bandwidth (SLA)

Question 20

An administrator configures an SD-WAN rule to steer traffic from a specific subnet to an SD-WAN member with the lowest cost. Which load balancing algorithm should be selected in the SD-WAN rule to achieve this behavior?

Accepted Answer

Lowest-cost. The 'Lowest-cost' algorithm is correct because it directs traffic to the SD-WAN member with the lowest configured cost metric, which directly matches the administrator's requirement to steer traffic from a specific subnet to the member with the lowest cost. In Fortinet SD-WAN, the cost is a static metric assigned per SD-WAN member interface, and the Lowest-cost algorithm selects the member with the smallest cost value for each new session, ensuring traffic follows the least-cost path.

Answer

Volume

Answer

Sessions

Answer

Source-dest-IP