NSE7 Practice Test 21 — 15 Questions

Question 1

A security administrator is configuring FortiSandbox integration to automatically block malicious files detected in email attachments. Which TWO actions are required to achieve this integration?

Accepted Answer

Configure FortiGate to submit files to FortiSandbox for analysis. FortiGate must be configured to submit files to FortiSandbox for analysis, which is the foundational step to enable detection of malicious content in email attachments. This submission is typically done via the FortiGate antivirus profile, where the 'FortiSandbox' inline scanning option is enabled, allowing files to be sent to FortiSandbox for verdict-based blocking.

Answer

Deploy FortiClient endpoints with full disk encryption

Answer

Configure FortiSandbox to send SNMP traps when a file is malicious

Answer

Enable FortiGate's machine learning engine on the antivirus profile

Question 2

A FortiGate administrator needs to use FortiManager to deploy a new security policy to all firewalls in a specific ADOM. Which two steps are part of the installation process? (Choose two.)

Accepted Answer

Run the install preview to see the changes that will be applied. Option B is correct because running the install preview in FortiManager lets the administrator review exactly which policy package changes will be pushed to the managed FortiGates before committing, helping avoid unintended configuration changes. Option C is correct because the actual deployment step in FortiManager's Install Wizard requires selecting the target devices (or all devices in the ADOM) and clicking 'Install' to push the policy package to those firewalls. Option A is not part of the installation process itself; revision history is a logging/versioning feature that records changes, not a required install step. Option D is unnecessary because the scenario already specifies an existing ADOM containing the firewalls, so creating a new ADOM is not required. Option E is incorrect because automation stitches are used to trigger automated actions based on events, not to install a policy package to devices.

Answer

Configure revision history to track changes

Answer

Create a new ADOM for the policy package

Answer

Enable automation stitches to push the policy

Question 3

A FortiGate admin configures an automation stitch to send an email alert when a high-severity IPS event occurs. The trigger is 'IPS Event' and the action is 'Email'. After testing, no email is sent despite events being logged. What is the most likely cause?

Accepted Answer

No SMTP server is configured in the FortiGate. The automation stitch requires a functional SMTP server configuration to send emails. Without an SMTP server defined under System > Settings > Email Service, the FortiGate cannot relay the alert email, even if the trigger and action are correctly configured and events are logged. This is the most common reason for email delivery failure in automation stitches.

Answer

The IPS event severity threshold is set too low

Answer

The automation stitch is disabled

Answer

The IPS engine is in monitor mode

Question 4

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session in established state that has been active for 1 hour and will expire in about 1 hour.. The output shows 'proto=6', which is the protocol number for TCP, and 'proto_state=01', which indicates the TCP session is in an established state (TCP_ESTABLISHED). The 'duration=3600' means the session has been active for 3600 seconds (1 hour), and 'expire=3599' means the session will expire in 3599 seconds (approximately 1 hour), consistent with the default TCP session timeout of 3600 seconds in FortiGate.

Answer

The session is a UDP session with a short timeout.

Answer

The session is a UDP session that has been active for 1 hour.

Answer

The session is a TCP session that has timed out and is being removed.

Question 5

What is the primary purpose of an administrative VDOM on a FortiGate?

Accepted Answer

To provide independent management and administrative access for different tenants or departments. An administrative VDOM on a FortiGate provides independent management and administrative access for different tenants or departments. Each administrative VDOM has its own administrator accounts, authentication settings, and management interfaces (HTTPS, SSH, SNMP), allowing multi-tenant isolation without requiring separate physical firewalls. This is distinct from traffic-forwarding VDOMs, which handle data plane operations.

Answer

To enable transparent mode operation

Answer

To increase the maximum number of firewall policies

Answer

To route traffic between different VDOMs

Question 6

An enterprise FortiGate has multiple VDOMs. The administrator wants to allow traffic from VDOM A to reach servers in VDOM B without traversing an external router. Which configuration is required?

Accepted Answer

Create an inter-VDOM link using the 'config system interface' command with type 'vdom-link'. Inter-VDOM links are the native FortiGate mechanism for routing traffic between VDOMs without external hardware. Created via 'config system interface' with type 'vdom-link', they act as a direct Layer 3 connection between VDOMs, allowing traffic to flow internally through the FortiGate's backplane. This avoids the need for an external router or physical cabling.

Answer

Place both VDOMs in the same VDOM group

Answer

Configure a static route in each VDOM pointing to the other VDOM's management IP

Answer

Enable VDOM forwarding in global settings

Question 7

A network administrator wants to block known malicious IP addresses using threat intelligence feeds on FortiGate. Which feature should they use?

Accepted Answer

External Threat Intelligence. FortiGate's External Threat Intelligence feature allows administrators to import and consume threat intelligence feeds (e.g., STIX/TAXII, CSV, or custom URLs) to block known malicious IP addresses. This is the correct feature because it is specifically designed to ingest external threat data and apply it to firewall policies for dynamic blocking, unlike the other options which serve different purposes.

Answer

FortiGuard Web Filtering

Answer

Application Control

Answer

IP Reputation

Question 8

An administrator runs 'diagnose vpn ike gateway list' and sees that the IKE SA state is 'UP' but the IPsec SA state is 'DOWN'. The remote peer is a FortiGate. What is the most likely cause of this issue?

Accepted Answer

The Phase2 parameters (encryption, authentication, proxy IDs) do not match between the peers. When the IKE SA is UP but the IPsec SA is DOWN, Phase 1 (IKE) has succeeded but Phase 2 (IPsec) negotiation has failed. The most common cause is a mismatch in Phase 2 parameters — encryption/authentication algorithms, PFS settings, or proxy IDs (quick mode selectors) — between the two FortiGates. Since Phase 1 is up, the pre-shared key and basic reachability are already proven correct.

Answer

The pre-shared key is incorrect

Answer

The tunnel interface is down

Answer

The firewall policy on the remote FortiGate is blocking UDP 500

Question 9

When troubleshooting an IPsec VPN phase 1 failure, you run 'diagnose vpn ike config' and see that the remote gateway IP address is incorrect. Which command is used to correct the peer IP configuration?

Accepted Answer

config vpn ipsec phase1-interface edit set remote-gw . The 'config vpn ipsec phase1-interface' command allows you to edit the phase1 configuration, and the 'set remote-gw ' command directly corrects the peer IP address. This is the standard FortiGate CLI method to update the remote gateway IP for an IPsec VPN phase1 interface, which is essential for establishing the IKE session.

Answer

set psksecret <secret>

Answer

execute vpn tunnel down <tunnel>

Answer

set certificate <name>

Question 10

A FortiGate administrator is troubleshooting a VPN tunnel that connects to a remote site. The tunnel is up, but traffic is not passing. The administrator checks the Phase 2 settings and sees that the local and remote subnets are correctly defined. What is the next step to diagnose the issue?

Accepted Answer

Check the firewall policies that reference the VPN interface. When the VPN tunnel is up (Phase 1 and Phase 2 are established) but traffic is not passing, the most common cause is that a firewall policy referencing the VPN interface is either missing or misconfigured. Even with correct Phase 2 selectors and routing, the FortiGate will drop traffic if no policy explicitly permits it from the source to the destination over the VPN interface. Therefore, checking the firewall policies is the logical next step.

Answer

Check the routing table for the remote subnet

Answer

Run 'diagnose vpn ike log' to check for Phase 1 errors

Answer

Restart the VPN tunnel

Question 11

Which TWO features are required to implement an always-on SSL VPN tunnel with FortiGate that automatically reconnects when the user's network changes?

Accepted Answer

Tunnel mode enabled. Option A (Tunnel mode enabled) is correct because an always-on SSL VPN requires a full tunnel-mode connection, which routes all traffic through the FortiGate and supports the persistent, automatically reconnecting VPN interface; web-mode portals are session-based and cannot provide an always-on tunnel. Option C (Auto-connect setting in FortiClient) is correct because FortiClient's auto-connect feature establishes the SSL VPN tunnel at startup and automatically re-establishes it when the underlying network changes, which is exactly the always-on behavior described. Option B (DTLS enabled) is not required, since DTLS only optimizes transport performance and the tunnel can reconnect over TLS. Option D (Web mode portal) is not required because web mode is a clientless, browser-based access method that cannot deliver an always-on tunnel. Option E (Split tunneling configured) is not required because split tunneling only controls which traffic is routed through the tunnel and does not enable automatic reconnection.

Answer

DTLS enabled

Answer

Web mode portal

Answer

Split tunneling configured

Question 12

An administrator configures automation stitches on FortiManager to trigger a script when a specific event log is received. The script should block the source IP on the firewall. However, the script does not run when the event occurs. What is a likely cause?

Accepted Answer

The event handler filter does not match the log. Automation stitches on FortiManager rely on event handler filters to match specific log IDs or patterns. If the filter does not match the incoming event log (e.g., wrong log ID, incorrect field value, or mismatched severity), the trigger condition is never met, and the script will not execute. This is the most common misconfiguration when setting up event-driven automation.

Answer

The FortiGate is in transparent mode

Answer

The script is not compiled

Answer

The script is set to run on all managed devices

Question 13

A network administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The remote gateway logs show a proposal mismatch. On FortiGate, the administrator runs 'diagnose vpn ike config' and sees 'proposal: aes128-sha1, aes256-sha256'. The remote side expects 'aes256-sha1'. What is the most likely cause?

Accepted Answer

The Phase 1 proposal list does not include the algorithm combination the remote gateway requires. The 'diagnose vpn ike config' output shows the FortiGate's Phase 1 proposal list includes 'aes128-sha1' and 'aes256-sha256', but the remote gateway expects 'aes256-sha1'. Since neither of the local proposals matches the remote's required combination, the IKE negotiation fails with a 'proposal mismatch' error. The administrator must add 'aes256-sha1' to the Phase 1 proposal list on the FortiGate to align with the remote gateway's expectation.

Answer

The pre-shared key is incorrect

Answer

The Phase 2 selectors are misconfigured

Answer

The IKE version is set to 1 but remote uses 2

Question 14

An administrator wants to monitor the session count on a FortiGate in real time. Which CLI command provides this information?

Accepted Answer

diagnose sys session stat. 'diagnose sys session stat' is the specific FortiGate CLI command that displays real-time session statistics, including the total number of sessions currently tracked by the firewall. This command provides a live count of active sessions, which is exactly what the administrator needs for real-time monitoring.

Answer

diagnose sys top

Answer

get system performance status

Answer

diagnose debug enable

Question 15

A FortiGate HA cluster is configured with two units in active-passive mode. The administrator needs to perform a firmware upgrade on the cluster with minimal downtime. The current firmware version is 7.2.5 and the target is 7.2.7. The cluster uses FGCP with session synchronization enabled. Which procedure should the administrator follow?

Accepted Answer

Upgrade the passive unit first, perform a graceful failover, then upgrade the new passive unit. It follows the recommended upgrade procedure for an active-passive FGCP cluster with session synchronization. By upgrading the passive unit first, then performing a graceful failover (which preserves existing sessions via FGCP session sync), and finally upgrading the new passive unit, the administrator ensures that the cluster remains operational throughout the process with minimal traffic disruption. This method avoids a full cluster outage and maintains session continuity.

Answer

Upgrade only the primary unit and let the secondary synchronize automatically

Answer

Disable HA, upgrade both units, then re-enable HA

Answer

Upgrade both units at the same time by connecting to each via console