NSE7 Practice Test 21 — 15 Questions

Question 1

An administrator configures BGP route advertisement but the routes are not being sent to the neighbor. The BGP session is established. What is the MOST likely cause?

Accepted Answer

The 'network' statement is missing for the desired prefix. The BGP session is established, so Layer 3 connectivity and TCP port 179 are working. The most common reason for routes not being advertised to a neighbor is that the 'network' statement is missing for the desired prefix. In BGP, the 'network' command does not advertise the prefix unless it matches an exact route in the IP routing table; without it, BGP has no prefix to send, even if the session is up.

Answer

The BGP administrative distance is set too high

Answer

The BGP neighbor has the wrong update-source interface

Answer

The route is filtered by a route-map

Question 2

You are troubleshooting a VPN phase 2 negotiation failure. The logs show 'no proposal chosen'. What is the MOST likely cause?

Accepted Answer

The phase 2 proposal settings differ between the peers. The 'no proposal chosen' error in VPN phase 2 indicates that the IPsec peers could not agree on a common set of phase 2 parameters (such as encryption algorithm, authentication algorithm, or PFS group). Since phase 2 negotiation occurs after IKE phase 1 has successfully completed, the issue is specifically with the IPsec SA proposal settings, not with pre-shared keys or IKE version. Therefore, differing phase 2 proposals between the peers are the most likely cause.

Answer

The remote gateway IP is incorrect

Answer

The pre-shared key mismatch

Answer

The IKE version mismatch

Question 3

A security engineer wants to implement advanced threat protection for email using FortiMail. Which THREE features should be enabled to provide comprehensive protection against sophisticated email threats? (Choose three.)

Accepted Answer

URL rewriting and click-time protection. URL rewriting and click-time protection (A) is correct because it proactively neutralizes malicious URLs in emails by rewriting them to route through FortiMail's proxy, enabling real-time inspection at the time of click. This defends against phishing and credential-harvesting attacks that use URLs to deliver payloads or steal credentials, even if the URL was benign at delivery time.

Answer

Anti-Spam filter

Answer

Attachment size limits

Question 4

An administrator needs to troubleshoot an HA synchronization issue. Which TWO commands provide information about the HA synchronization status?

Accepted Answer

diagnose ha dump. The 'diagnose ha dump' command (C) provides detailed internal HA state information, including synchronization status, heartbeat details, and failover counters, which is essential for deep troubleshooting. The 'get system ha status' command (D) displays the current HA operational status, including synchronization state (e.g., 'synchronized' or 'out of sync'), making it a direct tool for checking sync health.

Answer

diagnose hardware sysinfo

Answer

show system ha

Answer

diagnose sys session stat

Question 5

An administrator configured FortiGate to forward suspected malicious files to FortiSandbox. They set the action to 'block' for malicious verdicts. Some files are being blocked, but others with a 'clean' verdict are allowed. However, they notice that some files that should have been sent to FortiSandbox are not being forwarded. Which reason is MOST likely?

Accepted Answer

The file size exceeds the maximum size configured for FortiSandbox scanning. The most likely reason is that the file size exceeds the maximum size configured for FortiSandbox scanning. FortiGate has a configurable limit (default 10 MB) for files sent to FortiSandbox; files larger than this threshold are not forwarded, even if the antivirus engine would otherwise trigger a submission. This explains why some files are blocked or allowed based on verdicts, while others are never submitted.

Answer

The FortiGate antivirus engine is set to proxy-based mode

Answer

The FortiGate has insufficient disk space for temporary files

Answer

The FortiSandbox device is overloaded and rejecting submissions

Question 6

Which of the following is the primary purpose of BFD (Bidirectional Forwarding Detection) on a FortiGate?

Accepted Answer

To provide fast detection of link failures. BFD (Bidirectional Forwarding Detection) is a lightweight protocol designed to provide sub-second failure detection between two forwarding engines, such as FortiGate peers. Unlike routing protocol hellos (e.g., OSPF Hello at 10-second intervals), BFD can detect link or neighbor failures in as little as 50–100 ms, enabling faster convergence. This makes it the primary mechanism for rapid link failure detection in high-availability and SD-WAN deployments.

Answer

To synchronize routing tables between peers

Answer

To load balance traffic across multiple paths

Answer

To encrypt routing updates between peers

Question 7

Which of the following is a valid command to check the status of all BGP neighbors on a FortiGate?

Accepted Answer

get router info bgp summary. 'get router info bgp summary' is the standard FortiGate CLI command to display the status of all BGP neighbors, including their state, uptime, and prefixes received. This command retrieves the BGP routing table summary from the FortiGate's routing daemon, which is essential for verifying neighbor relationships and troubleshooting BGP peering issues.

Answer

diagnose router bgp summary

Answer

show bgp neighbors

Answer

diagnose ip router bgp all

Question 8

During a failover test in an HA cluster, the primary FortiGate fails over to the secondary. After failover, some existing TCP sessions are dropped. What is the MOST likely reason?

Accepted Answer

Session pickup is not enabled on the HA cluster. In an HA cluster, session pickup (also known as session synchronization) is responsible for replicating session tables from the primary FortiGate to the secondary. When failover occurs, if session pickup is not enabled, the secondary FortiGate has no knowledge of existing TCP sessions, causing them to be dropped. This is the most likely reason because the secondary device cannot forward traffic for sessions it does not recognize, even if the network topology remains unchanged.

Answer

The failover caused a routing change

Answer

The session TTL expired during failover

Answer

The HA mode is active-passive

Question 9

A FortiGate admin notices that sessions to a particular server are not being logged in FortiAnalyzer. The firewall policy has logging enabled. What is the MOST likely reason?

Accepted Answer

The FortiGate is not configured to send logs to FortiAnalyzer. The most likely reason is that the FortiGate is not configured to send logs to FortiAnalyzer. Even if the firewall policy has logging enabled, logs are only generated locally on the FortiGate; they must be explicitly forwarded to FortiAnalyzer via the 'config log fortianalyzer setting' CLI or GUI configuration. Without this configuration, no logs reach FortiAnalyzer regardless of policy settings.

Answer

The FortiAnalyzer's device registration is incorrect

Answer

The log queue on FortiGate is full

Answer

The FortiAnalyzer is out of disk space

Question 10

An administrator runs 'diagnose debug application fnbam -1' and sees messages like 'LB_SELECT: selected server 10.0.0.2:80' but the client connection fails. The FortiGate is configured with server load balancing. What could be the issue?

Accepted Answer

The real server is not reachable or is down. The 'LB_SELECT: selected server 10.0.0.2:80' message indicates that the FortiGate's load-balancing process has chosen a real server for the connection. However, the client connection fails, which points to a problem with the selected server itself. The most common cause is that the real server is unreachable or down, preventing the TCP handshake or HTTP response from completing, even though the load-balancing decision was made successfully.

Answer

The load balancing algorithm is set to least-connection

Answer

The persistence setting is misconfigured

Answer

The virtual server IP is overlapping with a physical interface

Question 11

An administrator is troubleshooting an HA cluster where both units show as primary after a link failure. What is the most likely cause of this split-brain scenario?

Accepted Answer

The HA heartbeat interface is down or misconfigured. In a Fortinet HA cluster, the heartbeat interface is responsible for exchanging health and synchronization information between units. If this interface goes down or is misconfigured, the units lose communication and each assumes the other is dead, causing both to transition to the primary state (split-brain). This is the most common cause of split-brain scenarios in FortiGate HA clusters.

Answer

The priority values are set identically

Answer

The HA uptime is mismatched between the two units

Answer

The session pickup feature is disabled

Question 12

An administrator sees the following output from 'get router info routing-table':
S       0.0.0.0/0 [10/0] via 192.168.1.1, port1
S       0.0.0.0/0 [10/0] via 192.168.2.1, port2
They have configured ECMP load balancing. However, traffic to a specific destination IP is always using port1. What is the likely reason?

Accepted Answer

The destination IP hash results in the same link for all sessions due to the load balancing algorithm. D is correct because FortiGate ECMP load balancing uses a hash-based algorithm (source-destination IP, port, or protocol) by default, not per-packet. When the hash of the destination IP consistently maps to the same link (port1), all sessions to that specific IP will use that interface, even though multiple routes exist with equal administrative distance and cost.

Answer

The firewall policy only allows traffic on port1

Answer

ECMP uses per-packet load balancing by default and the traffic is a single flow

Answer

One of the static routes has a lower administrative distance

Question 13

A FortiGate administrator is planning to deploy VDOMs to separate customer traffic. The administrator wants to use FortiManager for centralized management. Which TWO prerequisites must be met before the VDOMs can be managed from FortiManager?

Accepted Answer

The FortiGate must be assigned to an ADOM. FortiManager uses ADOMs (Administrative Domains) to logically group managed devices, and a FortiGate must be assigned to an ADOM before its VDOMs can be managed. Option D is correct because the FortiGate must be added to the FortiManager device list (via model or managed registration) to establish communication and allow policy/object provisioning to its VDOMs.

Answer

Inter-VDOM routing must be enabled

Answer

FortiAnalyzer must be registered with FortiManager

Answer

All VDOMs must be in the same ADOM

Question 14

Two FortiGate units in an HA cluster are experiencing synchronization issues. The administrator runs 'diagnose sys ha checksum cluster' and sees different checksum values for the 'system' and 'router' objects. What is the FIRST step to resolve the mismatch?

Accepted Answer

Execute 'execute ha synchronize start' from the primary unit. The 'diagnose sys ha checksum cluster' command reveals checksum mismatches for 'system' and 'router' objects, indicating that the HA cluster's configuration synchronization is incomplete or out of sync. The first step is to initiate a manual synchronization using 'execute ha synchronize start' from the primary unit, which forces the primary to push its full configuration database to the secondary unit, resolving the mismatch without disrupting services. This command is designed to trigger a full sync of all configuration objects, including system and router settings, without requiring a reboot or HA restart.

Answer

Upgrade the firmware on both units to the same version

Answer

Reboot both units to force a full sync

Answer

Disable and re-enable HA on both units

Question 15

A FortiGate administrator wants to quickly identify which process is consuming the most CPU on the device. Which CLI command should be used?

Accepted Answer

diagnose sys top. 'diagnose sys top' displays a real-time list of running processes sorted by CPU usage, allowing the administrator to quickly identify the most CPU-intensive process. This command is the standard FortiGate CLI tool for live process-level CPU monitoring, similar to the Linux 'top' command.

Answer

diagnose hardware sysinfo memory

Answer

diagnose debug application crashlog read

Answer

get system performance status