NSE7 Practice Exam 3 — 20 Questions

Question 1

Which SD-WAN load balancing algorithm distributes traffic based on the number of active sessions per interface?

Accepted Answer

Sessions. The Sessions algorithm in Fortinet SD-WAN distributes new sessions by selecting the interface with the fewest currently active sessions. This ensures balanced session distribution across WAN links, preventing any single interface from becoming overloaded with connections while others remain underutilized.

Answer

Volume

Answer

Source-destination IP

Answer

Spillover

Question 2

A FortiManager administrator wants to deploy a policy package that contains shared header and footer policies across multiple devices. How should these policies be configured in FortiManager?

Accepted Answer

Configure the policies as header/footer policies within the policy package. In FortiManager, header and footer policies are specifically designed to be shared across multiple devices within a policy package. By configuring them as header/footer policies, the administrator ensures that these common rules are applied consistently at the top and bottom of the device-specific policy tables, while the middle policies can vary per device. This is the correct method for deploying shared policies without duplicating them in each device's policy set.

Answer

Define the policies in the ADOM's default policy package

Answer

Create a global policy package and assign it to all devices

Answer

Use the 'install preview' feature to merge policies

Question 3

An administrator needs to configure VRF to separate traffic for two departments. Which TWO components must be configured for each VRF?

Accepted Answer

A VRF instance. A VRF instance (option A) is the foundational component that must be created for each VRF, as it establishes the separate routing table that isolates the department's traffic. Interface binding to the VRF (option B) is also required because interfaces must be assigned to the VRF so that traffic entering and leaving those interfaces uses the correct VRF routing table. A dedicated VDOM (option C) is incorrect because VDOMs are a Fortinet-specific virtualization concept separate from VRF, and VRF can be configured without VDOMs. Route leaking configuration (option D) is not mandatory for each VRF; it is only needed when you want to selectively share routes between VRFs, which is optional. A separate firewall policy for each VRF (option E) is not a required VRF component, as firewall policies are managed independently of VRF configuration and depend on the platform's security policy model.

Answer

A dedicated VDOM

Answer

Route leaking configuration

Answer

A separate firewall policy for each VRF

Question 4

Which FortiMail advanced feature allows the administrator to rewrite URLs in email bodies to redirect users to a safe scanning service when they click on a link?

Accepted Answer

URL Rewriting. URL Rewriting is the correct answer because it is a FortiMail advanced feature specifically designed to replace URLs in email bodies with rewritten links that redirect users through FortiMail's scanning service. When a user clicks the rewritten URL, FortiMail inspects the destination in real time for malicious content, such as phishing or malware sites, before allowing the redirect. This provides proactive protection against zero-hour threats by leveraging FortiGuard's web filtering and threat intelligence.

Answer

Attachment Filtering

Answer

Bounce Verification

Answer

Anti-Spam

Question 5

During a ZTNA implementation, the administrator configures a ZTNA rule for an internal application but users cannot connect. The FortiGate policy is correct and the application is reachable from the FortiGate. What is the most likely misconfiguration?

Accepted Answer

The ZTNA rule's proxy destination IP or port is wrong.. The ZTNA rule defines the mapping between the external proxy address and the internal application's actual IP and port. If the proxy destination IP or port is misconfigured, the FortiGate's ZTNA proxy cannot forward traffic to the correct internal server, even though the firewall policy and network connectivity are otherwise valid. This is a common misconfiguration when the internal application's IP or service port differs from what is specified in the ZTNA rule.

Answer

The firewall policy is set to deny traffic from the ZTNA gateway.

Answer

The client does not have a route to the internal application.

Answer

The client's FortiClient agent is not authenticated.

Question 6

In a Zero Trust Network Access architecture, which component acts as the policy enforcement point for access decisions?

Accepted Answer

FortiGate ZTNA gateway. In a Zero Trust Network Access (ZTNA) architecture, the FortiGate ZTNA gateway acts as the policy enforcement point (PEP). It terminates encrypted ZTNA tunnels from FortiClient agents, inspects traffic against configured access policies, and enforces decisions based on identity, device posture, and context. This is distinct from the control plane (FortiClient EMS) or logging (FortiAnalyzer).

Answer

FortiClient agent

Answer

FortiAnalyzer

Answer

FortiClient EMS

Question 7

A company is deploying FortiClient ATP to protect endpoints. They want to block ransomware behavior in real time. Which FortiClient feature should be enabled?

Accepted Answer

Real-Time Protection. Real-Time Protection is the FortiClient feature that uses behavioral analysis and machine learning to detect and block ransomware-like activities, such as mass file encryption or unauthorized file modifications, as they occur. This feature monitors process behavior in real time, leveraging FortiSandbox threat intelligence and local heuristics to stop ransomware before it can cause damage.

Answer

Vulnerability Scan

Answer

Web Filtering

Answer

Application Firewall

Question 8

During a failover test in an HA cluster, the primary FortiGate fails over to the secondary. After failover, some existing TCP sessions are dropped. What is the MOST likely reason?

Accepted Answer

Session pickup is not enabled on the HA cluster. In an HA cluster, session pickup (also known as session synchronization) is responsible for replicating session tables from the primary FortiGate to the secondary. When failover occurs, if session pickup is not enabled, the secondary FortiGate has no knowledge of existing TCP sessions, causing them to be dropped. This is the most likely reason because the secondary device cannot forward traffic for sessions it does not recognize, even if the network topology remains unchanged.

Answer

The failover caused a routing change

Answer

The session TTL expired during failover

Answer

The HA mode is active-passive

Question 9

An administrator needs to configure advanced email security on FortiMail to protect against phishing and spoofing. Which THREE features should be enabled to achieve comprehensive email authentication?

Accepted Answer

DKIM signing and verification. DKIM (DomainKeys Identified Mail) signing and verification is correct because it allows the sending domain to cryptographically sign outgoing emails, and the receiving server to verify that the signature matches the domain’s public DNS record. This ensures the email was not tampered with and originates from an authorized server, directly addressing phishing and spoofing by validating message integrity and sender authenticity.

Answer

Anti-spam Bayesian filtering

Answer

TLS encryption for inbound/outbound

Question 10

An organization wants to implement a solution that can detect and automatically respond to threats across multiple Fortinet security products. Which product should they use?

Accepted Answer

FortiSOAR. FortiSOAR is the correct choice because it is a security orchestration, automation, and response (SOAR) platform designed to ingest alerts from multiple Fortinet products (e.g., FortiGate, FortiSIEM, FortiMail) and execute automated playbooks for threat detection and response. Unlike management or analytics tools, FortiSOAR provides the cross-product incident response and automation capabilities required to detect and automatically respond to threats across the Fortinet security fabric.

Answer

FortiManager

Answer

FortiSIEM

Answer

FortiAnalyzer

Question 11

A FortiGate in an HA cluster is experiencing intermittent session synchronization failures. The administrator runs 'diagnose sys ha dump sync-status' and sees that sessions are not being synchronized properly. Which TWO potential causes should the administrator investigate?

Accepted Answer

Excessive number of sessions exceeding the session sync limit. FortiGate HA has a configurable session sync limit (default 500,000 sessions). When the number of concurrent sessions exceeds this limit, the FortiGate stops synchronizing new sessions to the backup unit, leading to intermittent synchronization failures. This can be verified by checking the 'ses_sync_limit' value in the HA configuration and comparing it to the current session count. Option D is correct because high packet loss or latency on the heartbeat interface can cause session synchronization failures. The heartbeat interface carries synchronization traffic, and any degradation in its performance can lead to missed or delayed sync packets, resulting in intermittent sync failures. This can be diagnosed by checking heartbeat interface statistics such as packet loss and latency.

Answer

Mismatched HA group IDs

Answer

Incorrect BGP route advertisements

Answer

Mismatched HA passwords

Question 12

You run the following command on a FortiGate: 'diagnose vpn ike gateway list' and see that the DPD status for a VPN peer is 'dead'. What does this indicate?

Accepted Answer

The VPN peer has been detected as unreachable and the tunnel is considered down. When 'diagnose vpn ike gateway list' shows DPD status as 'dead', it means the FortiGate has not received DPD (Dead Peer Detection) responses from the peer within the configured retry period, so it considers the peer unreachable and tears down the tunnel. The IKE SA and IPsec SAs are removed, and the tunnel is considered down. This is the correct interpretation of the 'dead' status.

Answer

The remote peer has been manually disconnected from the network

Answer

The VPN tunnel is still up but the peer is not responding to DPD messages

Answer

The IKE SA is still active but the IPsec SA has expired

Question 13

An administrator has configured FortiSandbox integration with FortiGate. Files are being submitted, but the firewall is not blocking subsequent downloads of files that FortiSandbox later identifies as malicious. The administrator verifies that the FortiSandbox license is valid and the connection is up. Which configuration is most likely missing?

Accepted Answer

The 'Retrieve and block' option is not enabled in the antivirus profile.. The 'Retrieve and block' option in the antivirus profile is responsible for pulling verdicts from FortiSandbox and blocking files that are later found malicious. Without it, FortiGate only submits files and does not act on subsequent verdicts. The other options address different aspects of integration or inspection and are not the cause of the described behavior.

Answer

The SSL inspection profile is not set to deep inspection.

Answer

FortiSandbox is not configured as a fabric connector in Security Fabric.

Answer

The FortiSandbox appliance is not in the 'block' mode.

Question 14

An administrator wants to group firewall objects by department (e.g., Sales, Engineering) and easily filter them in FortiManager policy packages. Which feature should be used?

Accepted Answer

Meta fields. Meta fields in FortiManager allow administrators to define custom attributes (e.g., Department) for firewall objects. These fields can then be used to group and filter objects within policy packages, enabling efficient management by department without requiring separate ADOMs or VDOMs.

Answer

Tags in FortiGate

Answer

ADOM overrides

Answer

Policy package folders

Question 15

In a FortiManager deployment with global ADOM enabled, an administrator creates a firewall policy in the global ADOM. What is the effect of this policy on the per-ADOM devices?

Accepted Answer

The policy is installed as a header policy on all managed FortiGates. In FortiManager, when global ADOM is enabled, policies created in the global ADOM are automatically installed as header policies on all managed FortiGates across all ADOMs. Header policies are evaluated before per-ADOM policies, allowing global enforcement of rules. This ensures consistent security posture across the entire managed estate.

Answer

The policy is used only if no per-ADOM policy exists with the same name

Answer

The policy is applied only to devices in the same ADOM as the global ADOM

Answer

The policy is ignored unless explicitly assigned to each ADOM

Question 16

A company wants to protect its internal users from malicious files attached to emails. Which FortiGate feature should be configured to inspect SMTP traffic for malware?

Accepted Answer

Antivirus. FortiGate's Antivirus feature is designed to scan SMTP traffic for malware by inspecting email attachments and body content against virus signatures. When configured in a security policy, it intercepts SMTP sessions, buffers the email data, and performs real-time scanning to block or quarantine malicious files before delivery to internal users.

Answer

Email Filter

Answer

Web Filter

Answer

IPS

Question 17

Which of the following is a required step when enabling VDOMs on a FortiGate for the first time?

Accepted Answer

Reboot the FortiGate after enabling VDOMs. When enabling VDOMs on a FortiGate for the first time, the device must be rebooted to restructure the internal data plane and control plane to support multiple virtual domains. This reboot is mandatory because the firmware transitions from a single-VDOM mode to a multi-VDOM mode, which requires reinitializing kernel structures and memory allocation for VDOM-specific resources.

Answer

Create at least two VDOMs before enabling the VDOM feature

Answer

Disable all firewall policies

Answer

Configure inter-VDOM routing

Question 18

An administrator wants to verify which SD-WAN member is currently being used for a specific traffic flow. Which command should they use on the FortiGate?

Accepted Answer

diagnose sys sdwan session. The command 'diagnose sys sdwan session' shows active sessions that are being processed by SD-WAN rules, including the chosen member. It is the most direct way to verify which SD-WAN member is used for a specific flow.

Answer

diagnose sys sdwan health-check

Answer

diagnose sys session list

Answer

diagnose sys sdwan member

Question 19

A network administrator wants to ensure that files downloaded from the internet are analyzed by FortiSandbox before being delivered to the client. The FortiGate is configured with a FortiSandbox connection and an antivirus profile. Which setting must be enabled in the antivirus profile to submit files to FortiSandbox?

Accepted Answer

Submit files to FortiSandbox. The 'Submit files to FortiSandbox' setting in the antivirus profile is the specific toggle that instructs FortiGate to forward files to the configured FortiSandbox for analysis. Without this setting enabled, the FortiGate will not send any files to FortiSandbox, even if the FortiSandbox connection is configured and the antivirus profile is applied.

Answer

FortiSandbox inline scanning

Answer

Enable Content Disarm and Reconstruction (CDR)

Answer

Enable Outbreak Prevention

Question 20

A network admin needs to apply a common set of firewall rules at the beginning of every policy package for all VDOMs managed by FortiManager. The rules should be automatically inserted and not editable within each VDOM. What should be configured?

Accepted Answer

Policy package header policies. Policy package header policies in FortiManager allow administrators to define a set of firewall policies that are automatically inserted at the top of every policy package for all VDOMs, and they are not editable within each VDOM. This enforces a common baseline of rules across managed devices.

Answer

VDOM policy templates

Answer

Global policy objects

Answer

Central management policies