NSE7 Practice Test 24 — 15 Questions

Question 1

An administrator needs to create a custom IPS signature to detect a specific exploit that sends a unique string 'EXPLOIT_2024' in the HTTP User-Agent header. Which IPS signature syntax should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

F-SBID(--name "Custom_Exploit"; --protocol tcp; --pattern "User-Agent: EXPLOIT_2024"; --service HTTP;). It uses the `--pattern` to match the exact string 'User-Agent: EXPLOIT_2024' within the HTTP header context, and `--service HTTP` ensures the signature only inspects HTTP traffic. This syntax precisely detects the exploit string in the User-Agent header as required.

Answer

F-SBID(--name "Custom_Exploit"; --protocol tcp; --pattern "EXPLOIT_2024"; --context http-header;)

Answer

F-SBID(--name "Custom_Exploit"; --protocol tcp; --pattern "User-Agent: EXPLOIT"; --service HTTP;)

Answer

F-SBID(--name "Custom_Exploit"; --protocol tcp; --pattern "EXPLOIT_2024"; --service HTTP;)

Question 2

A FortiGate is configured with VRF. Which statement about VRF is true?

Accepted Answer

VRF allows multiple routing tables to coexist on the same FortiGate.. VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, each with its own set of interfaces, routes, and forwarding decisions. This enables network segmentation and traffic isolation without requiring separate physical devices, making option B correct.

Answer

Interfaces can belong to multiple VRFs simultaneously.

Answer

Routes from different VRFs can be automatically redistributed without configuration.

Answer

VRF can only be used when OSPF is enabled.

Question 3

A company has a FortiGate with multiple VDOMs. The security team wants to use FortiManager to manage policies centrally. Which three steps are necessary to set up VDOM management via FortiManager? (Choose three.)

Accepted Answer

Enable VDOMs on the FortiGate and configure them for FortiManager management. VDOMs must be enabled on the FortiGate and each VDOM must be configured to allow FortiManager management. This is done by setting the 'set vdom mgmt' parameter within each VDOM or globally, which permits FortiManager to push policy and object changes to the specific VDOM context. Without this step, FortiManager cannot authenticate or communicate with the VDOMs, even if the device is added to the ADOM.

Answer

Configure a static route on FortiManager to reach the FortiGate's management IP

Answer

Disable VDOM configuration locking on FortiManager

Question 4

An administrator is troubleshooting a ZTNA access issue. Remote users can connect to the FortiGate's ZTNA proxy, but when they try to access the internal application, they receive a 403 Forbidden error. The administrator has verified that the user is authenticated and the ZTNA rule is configured correctly. What is the most likely cause?

Accepted Answer

The user's device does not have the required ZTNA tags from EMS. A 403 Forbidden error in ZTNA typically indicates that the access control rule denied the request. This can happen if the device does not meet the required posture checks (ZTNA tags). Option B is correct because the ZTNA rule likely requires a specific tag that the device does not have, resulting in denial.

Answer

The FortiGate firewall policy allowing ZTNA traffic is missing

Answer

The application server does not have a valid certificate

Answer

The ZTNA proxy is configured with the wrong port for the application

Question 5

A company uses FortiManager to manage multiple FortiGate firewalls. After making changes to a policy package, the administrator runs an install preview and sees a warning: 'Policy ID 10 will be deleted on device XYZ'. What is the most likely reason for this warning?

Accepted Answer

Policy ID 10 was manually added on the device but is not present in the policy package. The warning 'Policy ID 10 will be deleted on device XYZ' indicates that the policy package on FortiManager does not contain Policy ID 10, but the device currently has it. During an install, FortiManager synchronizes the device's policy set with the policy package, so any policy present on the device but absent from the package is flagged for deletion. This is a standard consistency check to prevent unintended policy loss.

Answer

The policy package has been corrupted and needs to be re-imported

Answer

The device is in a different ADOM and cannot use the same policy ID

Answer

A revision history conflict exists that prevents the install

Question 6

You are troubleshooting BFD on a FortiGate SD-WAN deployment. BFD is configured on two WAN interfaces (wan1, wan2) with a minimum transmit interval of 100 ms and a multiplier of 3. The network experiences occasional jitter causing packet loss. After a brief outage, the BFD session does not recover. Which setting should be adjusted to improve BFD resilience without significantly increasing failover time?

Accepted Answer

Increase the BFD multiplier to 4 or higher.. Increasing the BFD multiplier (from 3 to 4 or higher) allows the session to tolerate more lost BFD control packets before declaring a failure. This directly addresses the jitter-induced packet loss without changing the detection timing for sustained outages, as the multiplier only affects the number of missed packets required to trigger a failure. The minimum transmit interval remains at 100 ms, so the base detection time (multiplier × interval) increases only slightly, preserving fast failover for true link failures.

Answer

Disable BFD and rely on route timers.

Answer

Enable BFD on the management interface.

Answer

Increase the BFD minimum transmit interval on both interfaces.

Question 7

Which of the following is a required step when enabling VDOMs on a FortiGate for the first time?

Accepted Answer

Reboot the FortiGate after enabling VDOMs. When enabling VDOMs on a FortiGate for the first time, the device must be rebooted to restructure the internal data plane and control plane to support multiple virtual domains. This reboot is mandatory because the firmware transitions from a single-VDOM mode to a multi-VDOM mode, which requires reinitializing kernel structures and memory allocation for VDOM-specific resources.

Answer

Create at least two VDOMs before enabling the VDOM feature

Answer

Disable all firewall policies

Answer

Configure inter-VDOM routing

Question 8

An administrator configures SD-WAN with two members (port1 and port2). A performance SLA monitors latency to 8.8.8.8. The SD-WAN rule uses 'Best Quality' strategy based on latency. When the link on port1 becomes slow, the FortiGate continues using port1 even though port2 has lower latency. What is the most likely cause?

Accepted Answer

The performance SLA is not associated with the SD-WAN members. The performance SLA must be explicitly associated with the SD-WAN members (port1 and port2) for the 'Best Quality' strategy to use latency measurements. Without this association, the FortiGate cannot compare the SLA results per interface and defaults to using the current active member, even if its latency is higher. The SLA monitors 8.8.8.8, but the SD-WAN rule has no link to those measurements, so port1 continues to be used.

Answer

The FortiGate is not receiving ICMP replies from 8.8.8.8

Answer

The SD-WAN rule is configured with 'Manual' strategy

Answer

The load balancing algorithm is set to 'volume' instead of 'lowest-latency'

Question 9

An administrator is configuring SD-WAN with two members: MPLS and Broadband. The requirement is that voice traffic (UDP ports 16384-32768) should use MPLS primarily, and if MPLS fails SLA, then use Broadband. Which two configurations are needed? (Choose TWO.)

Accepted Answer

Configure a performance SLA for the MPLS member. A performance SLA must be configured on the MPLS member to monitor its link quality (e.g., latency, jitter, packet loss). If the SLA fails, the SD-WAN rule can then trigger a failover to the Broadband member. Option C is correct because an SD-WAN rule matching voice traffic with the 'best quality' strategy ensures that the traffic uses the highest-quality link (MPLS) as long as its SLA is met, automatically switching to Broadband when MPLS fails SLA.

Answer

Disable the Broadband member from the SD-WAN zone

Answer

Configure policy-based routing for voice traffic

Answer

Set the load balancing algorithm to 'sessions'

Question 10

An administrator wants to use BFD to detect failures in an OSPF neighbor relationship faster than OSPF hello timers. They configure 'config router ospf' and 'set bfd enable'. However, BFD sessions are not coming up. What is a possible reason?

Accepted Answer

The interface has 'set bfd enable' missing under config system interface. On FortiGate, enabling BFD under the OSPF process alone does not activate BFD on the interface. The interface itself must also have 'set bfd enable' under 'config system interface' to allow BFD session establishment. Option C is incorrect because while BFD generally requires both ends to enable it, the question specifically asks for a reason on the local FortiGate's configuration; the neighbor's configuration is outside the administrator's control for this scenario, and the most common oversight is the interface-level setting.

Answer

OSPF is configured with 'network point-to-multipoint'

Answer

The neighbor does not have BFD enabled on its OSPF configuration

Answer

The FortiGate's BFD transmit interval is set too high

Question 11

A FortiGate is configured with OSPF in multiple areas and redistributes connected routes into OSPF. The administrator notices that routes from area 1 are not appearing in area 0. The area 0 routers show the routes as 'O E2' but with an invalid metric. What is the most likely cause?

Accepted Answer

Redistribution is configured without a route map. When a route is redistributed into OSPF without a route map, it is advertised as a Type 5 LSA (external) with a default metric of 20. However, if the redistribution is not properly filtered or the metric is not explicitly set, the route may appear with an invalid metric (e.g., 0 or unexpected value) on the ABR. The ABR will flood this LSA into area 0, but the metric inconsistency causes the routes to be seen as 'O E2' with an invalid metric, preventing proper route installation.

Answer

OSPF network type is broadcast on one side and point-to-point on the other

Answer

The interface costs are misconfigured

Answer

The ABR has 'area 0 stub' configured

Question 12

Drag and drop the steps to troubleshoot a FortiGate SSL VPN connection failure into the correct order.

Accepted Answer

Basic configuration, then user authentication, then policies, then debug, then routing. Start with basic configuration, then user authentication, then policies, then debug, then routing.

Answer

User authentication, then basic configuration, then policies, then debug, then routing

Answer

Basic configuration, then policies, then user authentication, then debug, then routing

Answer

Basic configuration, then user authentication, then debug, then policies, then routing

Question 13

An administrator notices that after upgrading FortiOS, the ADVPN shortcut tunnels are no longer being established. The hub and spokes have the same ADVPN configuration as before. What is the most likely cause?

Accepted Answer

The spokes do not have routes to each other's networks via the hub. ADVPN shortcut tunnel initiation may require proper routing. If dynamic routing (e.g., BGP or OSPF) is not advertising the spoke networks to each other, spokes won't have routes to trigger shortcuts.

Answer

The IKE version changed to IKEv1

Answer

Dead Peer Detection (DPD) is disabled on the tunnel

Answer

The hub's ADVPN configuration was reset during upgrade

Question 14

A FortiGate administrator is troubleshooting a scenario where traffic between two VDOMs is not working. The admin has configured inter-VDOM routing. Which TWO steps should the administrator verify? (Choose two.)

Accepted Answer

Check that there is a firewall policy in the destination VDOM allowing the return traffic. Inter-VDOM routing requires firewall policies in both the source and destination VDOMs to permit traffic. The destination VDOM must have a policy allowing the return traffic (from the destination to the source) for the session to be established. Without this, the FortiGate will drop the return packets, breaking the bidirectional flow.

Answer

Check that NAT is enabled on the policies

Answer

Check that the inter-VDOM link is configured as a physical interface

Answer

Check that both VDOMs are in the same administrative VDOM

Question 15

A security analyst is investigating a phishing email that bypassed email security. The email's headers show SPF=pass, DKIM=pass, but DMARC=quarantine. The email was delivered to the inbox. What is the most likely reason DMARC did not block or quarantine the email?

Accepted Answer

The SPF and DKIM alignment checks passed, so DMARC treated the email as authentic. DMARC uses SPF and DKIM alignment to determine authenticity. When both SPF and DKIM pass and are aligned (i.e., the domain in the From header matches the domain used in SPF/DKIM), DMARC considers the email authentic and applies the policy accordingly. In this case, the DMARC policy was set to 'quarantine', but because alignment checks passed, DMARC treated the email as legitimate and allowed delivery to the inbox, rather than quarantining it.

Answer

The email was sent from a subdomain not covered by DMARC

Answer

The DMARC record had a pct (percentage) of less than 100

Answer

The DMARC policy was set to 'none'