NSE7 Practice Test 22 — 15 Questions

Question 1

An administrator configures a multi-VDOM FortiGate in transparent mode. The admin notices that the management IP is reachable from both interfaces, but traffic passing through the device is not being inspected. What is the likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VDOM is in transparent mode, but no firewall policy is applied to the traffic. In transparent mode, a FortiGate acts as a Layer 2 bridge, and traffic passing through the device is controlled by firewall policies, not by routing. Even though the management IP is reachable (because it is a separate IP on the bridge interface), no traffic inspection occurs unless an explicit firewall policy is configured to allow and inspect the traffic between the bridge interfaces. Option B correctly identifies that the missing firewall policy is the root cause.

Answer

Inter-VDOM routing is misconfigured

Answer

The FortiGate needs a default route

Answer

The management IP is assigned to the wrong VDOM

Question 2

A FortiGate administrator is investigating a slow network performance issue. The administrator suspects that session table limits are being reached. Which TWO metrics should be monitored to confirm this? (Choose two.)

Accepted Answer

Session fail rate. The session fail rate (B) directly indicates when the FortiGate is unable to establish new sessions because the session table is full, which is a clear symptom of hitting session table limits. The current session count (C) shows how many sessions are active; when this approaches the maximum session limit (e.g., 2 million on a FortiGate-600E), it confirms the table is near capacity. Monitoring both metrics together provides definitive evidence of session table exhaustion.

Answer

Interface bandwidth utilization

Answer

CPU usage

Answer

Memory usage

Question 3

A network administrator configures an SD-WAN zone with two members (port1 and port2) and sets the load balancing algorithm to 'spillover'. The spillover threshold is set to 100 Mbps on port1. If traffic reaches 120 Mbps on port1, what happens to new sessions?

Accepted Answer

New sessions are sent to port2 until port1 drops below the threshold. When the spillover algorithm is configured with a threshold of 100 Mbps on port1 and traffic reaches 120 Mbps, port1 is considered saturated. The SD-WAN zone then directs all new sessions to port2 until the traffic on port1 drops below the threshold. This is the defined behavior of spillover load balancing in Fortinet SD-WAN, where traffic is shifted away from an overloaded member to maintain performance.

Answer

All traffic is dropped because the threshold exceeded

Answer

Port1 continues to receive all new sessions but packets are queued

Answer

New sessions are distributed equally between port1 and port2

Question 4

An administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is up, but traffic is not passing. The administrator runs 'diagnose vpn tunnel list' and sees that both phase 1 and phase 2 are up. The policy allows traffic from both sides. What should the administrator check next?

Accepted Answer

Check the routing table for routes to the remote subnet. If both IPsec phases are up and policies allow traffic, the next most likely issue is missing or incorrect routing. Without a route to the remote subnet pointing to the IPsec tunnel interface, the FortiGate will not send traffic into the tunnel, even though the tunnel is established. Checking the routing table is the logical next step.

Answer

Increase the phase 2 keylife

Answer

Check the FortiGate's NTP status

Answer

Disable DPD

Question 5

A FortiGate administrator is planning a multi-VDOM deployment for a service provider. Which TWO statements are true about VDOM limitations and best practices?

Accepted Answer

It is recommended to use a dedicated management VDOM. Option C is correct because Fortinet best practice for multi-VDOM deployments is to create a dedicated management VDOM so that administrative access, management interfaces, and management traffic are isolated from production VDOMs, improving security and operational clarity. Option D is correct because each VDOM maintains its own independent configuration, including its own administrator accounts, authentication, and access profiles, allowing delegated administration per VDOM. Option A is incorrect because FortiGate models have platform-specific maximum VDOM limits (for example, entry-level units support fewer VDOMs than high-end chassis), so VDOMs are not unlimited. Option B is incorrect because each VDOM has its own independent routing table and can run its own routing protocols. Option E is incorrect because VDOMs can operate in NAT/route mode or transparent mode, so transparent mode is supported per VDOM.

Answer

There is no limit to the number of VDOMs supported

Answer

All VDOMs must share the same routing table

Answer

VDOMs cannot operate in transparent mode

Question 6

What is the function of a route map in FortiGate routing?

Accepted Answer

To filter and modify routing information during redistribution.. A route map in FortiGate routing is primarily used to filter and modify routing information during route redistribution between different routing protocols (e.g., OSPF, BGP, RIP). It allows granular control over which routes are accepted, advertised, or tagged with attributes like metric or community values, ensuring policy-based routing decisions.

Answer

To configure load balancing between multiple WAN links.

Answer

To enable BFD on a specific interface.

Answer

To create a static route for a specific destination.

Question 7

What does FortiGuard Outbreak Prevention use to protect against newly discovered malware outbreaks before traditional signatures are available?

Accepted Answer

Outbreak signatures and hash-based blocking. FortiGuard Outbreak Prevention uses outbreak signatures and hash-based blocking to provide rapid protection against newly discovered malware outbreaks before traditional signatures are available. Outbreak signatures are lightweight, pattern-based detections that can be deployed quickly, while hash-based blocking allows immediate blocking of known malicious file hashes, even when full signature analysis is not yet complete.

Answer

IP reputation and URL filtering

Answer

Heuristic analysis and emulation

Answer

Artificial intelligence and behavior analysis

Question 8

An administrator configures a hub-and-spoke ADVPN with FortiGate at the hub and multiple remote sites. After setup, spokes establish shortcuts directly. However, traffic between two spokes consistently goes through the hub even though shortcuts should exist. Running 'diagnose npu np6 ipsec peercache' shows no shortcut entries. What is the MOST likely reason?

Accepted Answer

The spokes are not running BGP over the ADVPN tunnels.. In a hub-and-spoke ADVPN, BGP is required to propagate the spoke's private IP addresses (used as tunnel endpoints) across the overlay network. Without BGP, spokes do not learn each other's tunnel IPs, so they cannot initiate shortcut tunnels. The 'diagnose npu np6 ipsec peercache' command shows no shortcut entries because the shortcut negotiation never starts.

Answer

The firewall policies on the spokes do not allow shortcut traffic.

Answer

Shortcut tunnels are disabled on the hub phase1 configuration.

Answer

The network processor (NP6) is not enabled for IPsec acceleration.

Question 9

A FortiGate is configured with an antivirus profile that has the machine learning engine enabled. An administrator notices that some files are being detected by the ML engine but the verdict is 'probably clean'. What does this verdict indicate?

Accepted Answer

The ML engine has low confidence that the file is malicious; it may be a false positive.. The ML engine in FortiGate's antivirus profile assigns a verdict of 'probably clean' when its confidence level is low that the file is malicious. This indicates a potential false positive, meaning the file is likely benign but the engine cannot be certain. The correct action is to allow the file to pass while logging the event for further analysis, not to block it outright.

Answer

The file is clean and safe to pass.

Answer

The file is definitely malicious and should be blocked.

Answer

The ML engine has detected an outbreak but needs FortiGuard to confirm.

Question 10

A FortiGate administrator notices that traffic classified as 'unknown' by the antivirus is being allowed. The administrator wants to ensure that such files are submitted to FortiSandbox for analysis and blocked until a verdict is received. Which configuration is required?

Accepted Answer

Enable FortiSandbox in the antivirus profile and set 'Action for unknown files' to 'Block'. When FortiSandbox is enabled in the antivirus profile and 'Action for unknown files' is set to 'Block', the FortiGate will submit files that cannot be identified by the local antivirus engine to FortiSandbox for analysis. While the file is being analyzed, it is blocked from reaching the client, ensuring that no potentially malicious content is delivered until a verdict (clean or malicious) is received. This directly addresses the administrator's requirement to block unknown files pending sandbox analysis.

Answer

Create a custom IPS signature for unknown files

Answer

Enable outbreak prevention in the antivirus profile

Answer

Enable FortiSandbox in the antivirus profile and set 'Action for known files' to 'Block'

Question 11

An admin is troubleshooting an IPsec VPN tunnel that is failing phase 2. The IKE debug shows 'no matching proposal'. Which TWO settings should the admin verify on both sides? (Choose two.)

Accepted Answer

Encryption algorithm (e.g., AES128, AES256). In IPsec phase 2, the IKE debug message 'no matching proposal' indicates a mismatch in the security association (SA) parameters used to establish the IPsec SA. The encryption algorithm (option B) is a core component of the IPsec proposal that must match exactly on both peers. Perfect Forward Secrecy (PFS) using a Diffie-Hellman group (option C) is also negotiated during phase 2; if one side requires PFS and the other does not, or if the DH groups differ, phase 2 will fail with this error.

Answer

Dead Peer Detection interval

Answer

Pre-shared key

Answer

Local and remote gateway IP addresses

Question 12

Which FortiAnalyzer feature allows administrators to create automated response actions triggered by specific log events, such as blocking an IP address when an intrusion is detected?

Accepted Answer

Playbooks. Playbooks in FortiAnalyzer allow administrators to define automated response actions triggered by specific log events, such as blocking an IP address when an intrusion is detected. This feature uses a visual workflow editor to chain conditions and actions (e.g., executing CLI commands via FortiGate API or sending alerts) based on real-time log analysis, enabling automated threat mitigation without manual intervention.

Answer

FortiView

Answer

Reports

Answer

Incidents

Question 13

A FortiGate VPN tunnel shows 'phase1 negotiation failed' in the logs. The remote gateway is a third-party device. The debug command 'diagnose vpn ike config' shows mismatched proposals. Which setting is MOST likely incorrect on the FortiGate?

Accepted Answer

The encryption algorithm (e.g., AES256 vs 3DES). The 'diagnose vpn ike config' command displays the IKE proposal parameters (encryption, authentication, DH group) that the FortiGate is configured to offer. When the log shows 'phase1 negotiation failed' and the debug output indicates 'mismatched proposals', it means the FortiGate's configured encryption algorithm (e.g., AES256) does not match any algorithm supported by the remote third-party device (e.g., 3DES). This is the most direct cause of proposal mismatch, as IKE phase 1 requires both sides to agree on a common transform set.

Answer

The pre-shared key

Answer

The local ID type

Answer

The DPD configuration

Question 14

An organization wants to prevent users from downloading malicious files from the internet. Which FortiGate security profile should be applied to the outbound firewall policy to block files based on their hash if they have been identified as malicious by FortiSandbox?

Accepted Answer

Antivirus profile. The Antivirus profile is the correct choice because it integrates with FortiSandbox to block files based on their hash when identified as malicious. FortiGate's antivirus engine can submit files to FortiSandbox for analysis, and if the file's hash matches a known malicious signature, the antivirus profile will block the download. This is specifically designed for file-based threat detection at the application layer, unlike other profiles that focus on different security functions.

Answer

Application Control profile

Answer

IPS profile

Answer

Web Filter profile

Question 15

An organization uses FortiManager to manage multiple FortiGates. A junior admin accidentally deleted a critical firewall policy on one device and the change was auto-installed. How can the senior admin revert the device to the previous configuration?

Accepted Answer

Go to Device Manager -> Revision History and restore the previous revision. FortiManager automatically stores configuration revisions for managed FortiGates. By navigating to Device Manager -> Revision History, the admin can select the previous revision and restore it, which reverts the device to its state before the accidental deletion. This process ensures the change is undone without manual intervention or affecting other devices.

Answer

Delete the ADOM and recreate it

Answer

Use the 'restore' command on FortiManager

Answer

Manually recreate the policy on the FortiGate