NSE7 Practice Test 23 — 15 Questions

Question 1

An administrator is configuring a FortiGate to inspect SMTP traffic for spam and viruses. The traffic must be decrypted to inspect the content. Which THREE elements are required for this configuration? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A spam filter profile applied to the firewall policy. A spam filter profile is required to inspect SMTP traffic for spam. FortiGate uses this profile to apply anti-spam techniques such as DNSBL, SURBL, and heuristic analysis on the email content after decryption. Without it, spam detection cannot occur.

Answer

A web filter profile applied to the firewall policy

Answer

An application control profile applied to the firewall policy

Question 2

An administrator is troubleshooting BGP with SD-WAN. They have configured BGP on the FortiGate and the SD-WAN rule uses 'best quality' strategy. However, failover does not happen when a WAN link goes down. The BGP session is still up. What is the most likely reason?

Accepted Answer

The performance SLA is not configured to track the BGP next hop.. The 'best quality' SD-WAN strategy selects the best path based on performance SLA metrics. Without a performance SLA monitoring the BGP next hop, the FortiGate cannot detect that the link has failed from a BGP perspective, so it will not trigger a failover even if the physical interface goes down. The BGP session remains up because it is still receiving keepalives, but the SD-WAN rule does not consider the link unusable without SLA tracking.

Answer

The SD-WAN rule is configured with 'set update-static-route disable'.

Answer

The BGP session is using eBGP multihop.

Answer

The load balancing algorithm is set to 'volume'.

Question 3

An administrator is troubleshooting an HA cluster where both units show as primary after a link failure. What is the most likely cause of this split-brain scenario?

Accepted Answer

The HA heartbeat interface is down or misconfigured. In a Fortinet HA cluster, the heartbeat interface is responsible for exchanging health and synchronization information between units. If this interface goes down or is misconfigured, the units lose communication and each assumes the other is dead, causing both to transition to the primary state (split-brain). This is the most common cause of split-brain scenarios in FortiGate HA clusters.

Answer

The priority values are set identically

Answer

The HA uptime is mismatched between the two units

Answer

The session pickup feature is disabled

Question 4

What is the primary difference between using a Web Application Firewall (WAF) on FortiGate versus using FortiWeb?

Accepted Answer

FortiWeb provides dedicated, advanced WAF features and higher performance for web traffic, while FortiGate WAF is a basic protection feature.. FortiWeb is a dedicated web application firewall appliance that provides advanced, specialized WAF features such as machine learning-based bot detection, API discovery, and granular signature tuning, along with higher throughput for web traffic. In contrast, the WAF feature on FortiGate is a basic, integrated protection module that offers essential HTTP/HTTPS inspection and signature-based filtering, but lacks the depth and performance optimization of FortiWeb.

Answer

There is no difference; they are the same.

Answer

FortiGate WAF is cloud-based, while FortiWeb is on-premises.

Answer

FortiGate WAF can protect multiple web servers simultaneously, while FortiWeb protects only one.

Question 5

An administrator wants to create an automation stitch that responds to a high-severity IPS event by blocking the attacker IP. Which THREE components are required to build this automation stitch?

Accepted Answer

Trigger (e.g., IPS Event). An automation stitch in FortiOS requires a trigger to initiate the workflow. In this scenario, the IPS event trigger is specifically designed to fire when a high-severity IPS signature match occurs, providing the necessary event data (e.g., attacker IP) to pass to subsequent actions. Without a trigger, the stitch would have no starting point.

Answer

Schedule (e.g., run every hour)

Answer

Condition (e.g., severity threshold)

Question 6

Which FortiGate command is used to view the current CPU usage of individual processes in real time?

Accepted Answer

diagnose sys top. The 'diagnose sys top' command on FortiGate provides a real-time, top-like display of CPU and memory usage for individual processes, allowing administrators to identify which specific daemons or tasks are consuming resources. This command is essential for troubleshooting performance issues at the process level, unlike other commands that show aggregate or different diagnostic data.

Answer

diagnose sys session stat

Answer

get system performance status

Answer

diagnose hardware sysinfo memory

Question 7

A network engineer needs to collect logs from multiple FortiGates and generate compliance reports. Which TWO FortiAnalyzer features should be used?

Accepted Answer

Log analytics. Log analytics (option B) is correct because it provides the ability to search, filter, and visualize logs from multiple FortiGates, enabling the identification of trends and anomalies necessary for compliance reporting. Reports (option C) is correct because FortiAnalyzer includes a dedicated reporting engine that can generate scheduled or on-demand compliance reports based on collected logs, with pre-defined templates for standards like PCI DSS, HIPAA, and SOX.

Answer

ADOM configuration

Answer

Automation stitches

Answer

Policy packages

Question 8

A FortiGate has two equal-cost paths to a destination network through two different ISPs. The administrator wants to load balance traffic across both links using ECMP, but notices that all traffic uses only one link. What should the administrator check first?

Accepted Answer

Check that both routes have the same administrative distance and priority. ECMP requires that all candidate routes have identical administrative distance and priority values. If either differs, FortiGate will select only the route with the lower distance/priority, breaking load balancing. The administrator should verify these parameters first because they directly control route selection before ECMP is applied.

Answer

Configure 'set v4-ecmp-mode' to 'source-ip-based'

Answer

Verify that 'set load-balance-eligible' is enabled on both WAN interfaces

Answer

Disable 'anti-replay' on the security policy

Question 9

Which TWO of the following are required components for a Fortinet ZTNA solution? (Select two.)

Accepted Answer

FortiGate. FortiGate is the enforcement point in a ZTNA solution, acting as the ZTNA gateway that verifies device posture and user identity before granting access to protected applications. It terminates ZTNA tunnels from FortiClient and applies identity-based policies, making it a required component for traffic inspection and access control.

Answer

FortiAuthenticator

Answer

FortiWeb

Answer

FortiAnalyzer

Question 10

During a BGP troubleshooting session, an administrator sees that the BGP neighbor state is 'Active'. Which three conditions could cause this state? (Choose THREE.)

Accepted Answer

The remote AS number is misconfigured. A misconfigured remote AS number causes the BGP neighbor to remain in the 'Active' state. BGP uses the remote AS number to validate the OPEN message; if the AS number in the OPEN message does not match the configured remote AS, the session is rejected, and the neighbor stays in Active, repeatedly attempting to establish a TCP connection.

Answer

The BGP update timer is too short

Answer

The maximum-prefix limit has been exceeded

Question 11

An admin runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is established and has been active for 1 hour. The output shows `proto=6` (TCP), `proto_state=01` (ESTABLISHED in Fortinet's session table), `duration=3600` seconds (1 hour), and `expire=3599` seconds (remaining lifetime). This combination indicates a fully established TCP session that has been active for one hour and is still valid, not blocked or in a transitional state.

Answer

The session is being blocked by a firewall policy

Answer

The session is in SYN_SENT state, waiting for a reply

Answer

The session is in TIME_WAIT state after a FIN

Question 12

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal application. The application is accessed via HTTPS. Which component must be configured on the FortiGate to act as a reverse proxy for the application?

Accepted Answer

ZTNA proxy. The ZTNA proxy is the FortiGate component that acts as a reverse proxy for HTTPS applications in a ZTNA deployment. It terminates the client's TLS connection, authenticates the user via FortiClient EMS tags or certificates, and then proxies the request to the internal application, enforcing zero trust access policies. This is distinct from SSL-VPN, which provides network-level access rather than application-level reverse proxy.

Answer

FortiClient EMS

Answer

SSL-VPN portal

Answer

ZTNA inline CASB

Question 13

A BGP peering between two FortiGates is not establishing. The administrator runs 'get router info bgp neighbor' and sees that the neighbor state is 'Idle' and the BGP configuration appears correct. What should the administrator check next?

Accepted Answer

Verify that the BGP neighbor IP is reachable via the routing table. When a BGP neighbor is stuck in the 'Idle' state, it typically indicates that BGP cannot initiate the TCP connection to the neighbor. The most common cause is that the neighbor IP address is not reachable via the routing table. Even if the BGP configuration (AS number, neighbor IP) is correct, BGP will remain Idle until it can successfully open a TCP session on port 179. Therefore, verifying IP reachability (e.g., with 'ping' or checking the routing table) is the logical next step.

Answer

Run 'diagnose ip router bgp all enable' to enable debug

Answer

Check the BGP AS number configuration

Answer

Increase the BGP timers

Question 14

A multi-tenant FortiGate uses VDOMs. The administrator notices that logins via SSH to the management VDOM succeed, but attempts to SSH to a traffic VDOM's management IP fail. The traffic VDOM has an administrative user configured. What is the most likely cause?

Accepted Answer

SSH access is not enabled on the traffic VDOM's management interface. SSH access to a VDOM's management IP requires that the management interface explicitly permits SSH administrative access. In a multi-tenant FortiGate with VDOMs, each VDOM's management interface has its own independent administrative access settings. Even if the admin user exists and the VDOM is licensed, SSH will be rejected if the management interface does not have SSH access enabled under config system interface or via the GUI. The fact that SSH to the management VDOM succeeds but fails to the traffic VDOM's management IP points directly to this per-interface access control.

Answer

The traffic VDOM does not have a license

Answer

The traffic VDOM is in transparent mode

Answer

The admin user is not in the correct trust group

Question 15

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is up but traffic is not passing. The administrator runs 'diagnose vpn ike gateway list' and sees that the IKE SA has been established. However, 'diagnose vpn tunnel list' shows no IPsec SA entries. What is the most likely cause?

Accepted Answer

The phase 2 proposal (encryption, authentication, etc.) does not match between peers. If the IKE SA is established but no IPsec SA entries appear in 'diagnose vpn tunnel list', the most likely cause is a Phase 2 proposal mismatch. Phase 1 (IKE SA) negotiates the secure channel, while Phase 2 (IPsec SA) negotiates the actual tunnel parameters. If the encryption, authentication, or other Phase 2 settings do not match, the IPsec SA will fail to establish, even though Phase 1 is up.

Answer

The firewall policies are not configured to allow traffic through the tunnel

Answer

The pre-shared key on both sides does not match

Answer

The interface MTU is set too low