NSE7 Practice Test 23 — 15 Questions

Question 1

An administrator is troubleshooting a ZTNA issue where users are able to authenticate but the application access is still blocked. The ZTNA status on FortiClient shows 'Connected' but the application does not load. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user's FortiClient does not have the required ZTNA tags assigned. When users can authenticate and the ZTNA status shows 'Connected' on FortiClient, but the application still fails to load, the most likely cause is that the client lacks the required ZTNA tags. ZTNA tags are used by the FortiGate to enforce access policies; without the correct tags, the FortiGate will block the application traffic even though the tunnel is established. This scenario indicates a tag assignment or synchronization issue between FortiClient and EMS.

Answer

The ZTNA application is not configured with HTTPS

Answer

The FortiClient EMS server is not reachable from the FortiGate

Answer

The FortiGate is not configured with the correct ZTNA application gateway

Question 2

An administrator wants to load balance traffic across two WAN links by session count. Which SD-WAN load balancing algorithm should they use?

Accepted Answer

Sessions. The Sessions algorithm distributes new sessions across WAN links based on the current session count, ensuring each link handles a roughly equal number of active sessions. This directly matches the administrator's requirement to load balance by session count, as it uses the session counter as the metric for link selection.

Answer

Spillover

Answer

Lowest-cost

Answer

Volume

Question 3

A FortiGate has multiple VRFs configured. An administrator wants to allow traffic from VRF 1 to reach a server in VRF 2. What configuration is required?

Accepted Answer

Configure a VRF leak policy using route maps or policy routes.. VRF leaking is the standard method to allow traffic between different VRFs on a FortiGate. This is achieved by configuring route maps or policy routes to selectively import/export routes between VRFs, enabling inter-VRF communication without merging the VRFs or using VDOMs.

Answer

Use a single VDOM and enable inter-VDOM links.

Answer

Place both interfaces in the same VRF.

Answer

Create a static route from one VRF to another.

Question 4

A FortiGate is configured with multiple VRFs. An administrator notices that routes from VRF A are not being advertised to VRF B via BGP, even though the BGP configuration is correct. Which TWO actions could resolve this issue?

Accepted Answer

Configure a route leak from VRF A to VRF B under config router vrf. Configuring a route leak from VRF A to VRF B under 'config router vrf' explicitly allows routes to be imported/exported between VRFs using route targets, which is required for cross-VRF BGP route advertisement. Option E is correct because 'set next-hop-self' on the BGP neighbor in each VRF ensures that the next hop is reachable from the receiving VRF, preventing next-hop unreachability issues that can block route advertisement.

Answer

Enable 'route-flap damping' on the BGP session between VRFs

Answer

Disable 'bgp enforce-first-as' to allow cross-VRF advertisements

Answer

Configure 'set import-route' under the BGP VRF configuration

Question 5

A FortiGate administrator wants to use BFD to quickly detect link failures in an SD-WAN deployment. Which statement about BFD configuration on FortiGate is correct?

Accepted Answer

BFD can be configured under the interface or routing protocol to detect forwarding path failures. BFD (Bidirectional Forwarding Detection) on FortiGate can be configured either directly on an interface or under a dynamic routing protocol (such as OSPF or BGP). When configured under the interface, BFD monitors the forwarding path to that specific neighbor; when configured under the routing protocol, it provides sub-second failure detection for routes learned via that protocol. This flexibility allows the administrator to tailor BFD to the SD-WAN deployment's needs, ensuring rapid link failure detection without relying on routing protocol timers.

Answer

BFD is enabled by default on all FortiGate interfaces

Answer

BFD sessions are established automatically when OSPF neighbors form

Answer

BFD uses performance SLA probes to determine link health

Question 6

A FortiGate is connected to a FortiExtender via USB. The administrator wants to use LTE as a backup WAN link in an SD-WAN setup. After configuring the FortiExtender, the LTE interface is not showing up as an SD-WAN member. What is the most likely reason?

Accepted Answer

The FortiGate does not have a valid FortiExtender license. When a FortiGate connects to a FortiExtender via USB, the LTE interface will not appear as an SD-WAN member unless the FortiExtender is in managed mode and the FortiGate has a valid FortiExtender license. Without the license, the FortiGate cannot manage the FortiExtender or expose its LTE interface for SD-WAN membership, even if the physical connection and SIM are functional.

Answer

The FortiExtender is not in managed mode

Answer

The LTE SIM card is not activated

Answer

The LTE interface must be configured as a WAN link in the FortiExtender first

Question 7

A network administrator configured a hub-and-spoke ADVPN with IKEv2. Spoke sites can establish tunnels to the hub, but shortcut tunnels are not being created between spokes. What is the MOST likely cause?

Accepted Answer

Auto-discovery is disabled on the hub FortiGate. In a hub-and-spoke ADVPN with IKEv2, shortcut tunnels between spokes require auto-discovery to be enabled on the hub FortiGate. Auto-discovery allows the hub to exchange IKE information (including NAT-T and IP addresses) between spokes, enabling them to establish direct tunnels. When auto-discovery is disabled on the hub, the hub will not forward the necessary IKE messages (such as the IKE_AUTH exchange with the auto-discovery payload) to other spokes, preventing shortcut tunnel creation.

Answer

Dead Peer Detection is disabled on the hub

Answer

The spokes are using different IKE versions

Answer

The IKEv2 authentication method is not set to pre-shared key

Question 8

An administrator is configuring SD-WAN on a FortiGate. They want traffic from the internal network to a specific SaaS application to use the MPLS link unless the latency exceeds 50 ms, in which case traffic should failover to the broadband link. Which configuration elements are required?

Accepted Answer

Create an SD-WAN member for each link, configure a performance SLA with latency threshold 50 ms, and add an SD-WAN rule matching the SaaS traffic with the MPLS member as preferred and enable 'set failover enable'.. It uses SD-WAN members for each link, a performance SLA with a latency threshold of 50 ms to monitor link quality, and an SD-WAN rule that matches SaaS traffic with the MPLS member as preferred and failover enabled. This configuration ensures that traffic uses the MPLS link as long as latency stays below 50 ms, and automatically fails over to the broadband link when the SLA is violated.

Answer

Configure policy-based routing to direct SaaS traffic to the MPLS link and rely on default routing for failover.

Answer

Add a static route for the SaaS IP with the MPLS interface as the gateway and a higher distance than the default route via broadband.

Answer

Create an SD-WAN member for each link, configure a performance SLA with jitter threshold 50 ms, and add an SD-WAN rule matching the SaaS traffic using the 'best-quality' strategy with the MPLS member.

Question 9

You run the following command on a FortiGate:
`diagnose sys session filter dport 443`
Output:
`proto=6 proto_state=01 duration=3600 expire=3599`
What does this output indicate?

Accepted Answer

The session is for TCP port 443, is in state SYN_SENT, and has been active for 3600 seconds.. The output shows `proto=6`, which is the protocol number for TCP, and `dport 443` filters for destination port 443. The `proto_state=01` indicates the TCP state is SYN_SENT (state 1 in the FortiGate session table). The `duration=3600` means the session has been active for 3600 seconds, and `expire=3599` shows the remaining time in seconds before the session times out. Thus, Option B correctly interprets these fields.

Answer

The session is for UDP port 443, is in state ESTABLISHED, and has 3599 bytes remaining.

Answer

The session is for TCP port 443, is in state TIME_WAIT, and will expire in 3600 seconds.

Answer

The session is for TCP port 443, is in state FIN_WAIT, and will expire in 3599 seconds.

Question 10

An administrator configured an SD-WAN rule to steer traffic to a specific member interface using the 'lowest-cost' strategy. After applying, the traffic is not being load-balanced as expected. Which configuration element is MOST likely missing?

Accepted Answer

A performance SLA has not been assigned to the SD-WAN member interfaces.. The 'lowest-cost' strategy in Fortinet SD-WAN selects the member interface with the lowest cost value. However, without a performance SLA assigned to the SD-WAN member interfaces, the SD-WAN rule cannot dynamically measure link quality or update interface costs based on real-time conditions. As a result, the rule defaults to static cost values or may not load-balance traffic at all, because the SLA is required to trigger cost-based path selection and failover. Assigning an SLA enables the FortiGate to monitor link performance and adjust the effective cost, allowing proper load balancing across multiple members.

Answer

The 'best-quality' strategy was inadvertently selected instead.

Answer

The SD-WAN member interfaces are not in the same zone.

Answer

The 'update-static-route' option is disabled on the SD-WAN member.

Question 11

An administrator configures a route map on a FortiGate to redistribute connected routes into OSPF. The route map sets a metric of 100. After applying, the redistributed routes appear with metric 20. What is the most likely reason?

Accepted Answer

The route map is not applied to the redistribution configuration. The most likely reason the redistributed routes appear with metric 20 instead of the configured 100 is that the route map was not applied to the redistribution configuration. In FortiGate OSPF redistribution, a route map must be explicitly referenced under the 'redistribute connected' command; otherwise, the route map is ignored, and OSPF uses its default metric of 20 for redistributed connected routes.

Answer

The route map is applied to the wrong direction

Answer

OSPF does not allow metric setting via route maps

Answer

The metric type is set to type 1

Question 12

A FortiGate administrator is investigating a security incident and needs to identify which user initiated a specific outbound connection to a malicious IP address. The company uses FSSO for authentication. Which THREE pieces of information from FortiAnalyzer logs would be MOST useful? (Choose three.)

Accepted Answer

Username from the FortiGate authentication log. FSSO (Fortinet Single Sign-On) maps network sessions to Active Directory usernames via the FortiGate authentication log. When investigating which user initiated an outbound connection to a malicious IP, the username from this log directly ties the session to a specific identity, enabling attribution beyond just IP addresses.

Answer

Destination IP address

Answer

Event type (e.g., traffic, event, attack)

Question 13

A FortiGate with multiple VDOMs is experiencing high CPU usage. The administrator suspects that one VDOM is consuming excessive resources. Which THREE methods can be used to limit resource usage per VDOM?

Accepted Answer

Apply per-VDOM traffic shaping policies. Per-VDOM traffic shaping policies allow the administrator to apply bandwidth limits and QoS policies specifically to traffic within a particular VDOM, preventing that VDOM from monopolizing the FortiGate's CPU resources. This is achieved by configuring shaping policies under the VDOM's firewall policy that match traffic and apply a traffic shaper, which can limit bandwidth and prioritize traffic, thereby reducing CPU load from that VDOM.

Answer

Enable HA resource reservation

Answer

Enable VDOM logging

Question 14

A company uses FortiWeb as a reverse proxy for their web application. They want to protect against SQL injection attacks. Which FortiWeb feature should be configured?

Accepted Answer

Enable 'SQL Injection Prevention' in the Web Protection Profile. FortiWeb's Web Protection Profile includes a dedicated 'SQL Injection Prevention' module that uses signature-based and behavioral analysis to detect and block SQL injection attempts at the application layer. This is the correct feature because FortiWeb is a web application firewall (WAF) designed specifically for HTTP/HTTPS traffic, and SQL injection protection is a core WAF function, not a general IPS or network-layer feature.

Answer

Enable 'IPS Sensor' with SQL injection signatures

Answer

Use the FortiGate WAF profile instead

Answer

Configure a custom HTTP header validation rule

Question 15

An administrator configures a route-map to match prefix-list 'PREFIX' and set metric 20. Which OSPF route redistribution uses this route-map correctly?

Accepted Answer

config router ospf
  config redistribute "connected"
    set route-map "RM"
  end. In FortiOS, the route-map is applied to a specific redistribution rule under 'config router ospf' using the 'set route-map' command within the 'config redistribute' block. This correctly associates the route-map 'RM' with the redistribution of connected routes into OSPF, matching the prefix-list 'PREFIX' and setting the metric to 20.

Answer

config router policy
  config route-map
    edit "RM"
      config rule
        set match-ip-address "PREFIX"
        set set-metric 20
      end
    end

Answer

config router ospf
  set route-map "RM"

Answer

config router prefix-list
  edit "PREFIX"
    set rule permit 10.0.0.0/8
  end