NSE7 Practice Test 24 — 15 Questions

Question 1

An administrator wants to create a separate virtual firewall instance on a FortiGate to isolate a DMZ environment. The DMZ must have its own routing table, firewall policies, and administrators. Which FortiGate feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Virtual Domains (VDOMs). Virtual Domains (VDOMs) are the FortiGate feature that allows the creation of multiple independent virtual firewalls within a single physical appliance. Each VDOM operates with its own separate routing table, firewall policies, and administrative domains, making it the correct choice for isolating a DMZ environment with dedicated administrators and routing.

Answer

Virtual Router Redundancy Protocol (VRRP)

Answer

Virtual LANs (VLANs)

Answer

Security Fabric

Question 2

A network administrator is troubleshooting a scenario where FortiView in FortiAnalyzer shows no traffic data for a specific FortiGate, but logs are being received. Which two possible causes should the administrator investigate? (Choose two.)

Accepted Answer

The FortiGate is not sending traffic logs; only event logs are being forwarded. Option C is correct because FortiView visualizations are built from traffic (forward) logs, so if the FortiGate only forwards event logs and no traffic logs, FortiAnalyzer will show received logs but no traffic data in FortiView. Option D is correct because if the FortiView log database (the SQL/traffic log database used for FortiView aggregation) is corrupted or requires a rebuild, FortiAnalyzer can still receive logs while FortiView fails to display traffic data until the database is repaired or rebuilt. Option A is not the cause because clock skew typically affects log timestamps and correlation, not the complete absence of FortiView traffic data when logs are arriving. Option B is not the cause because a global ADOM affects ADOM scope and policy/object visibility, not whether FortiView renders traffic logs for a FortiGate. Option E is not the cause because a full disk would generally prevent or impair log reception/indexing broadly, whereas the scenario states logs are being received.

Answer

The FortiGate's clock is not synchronized with FortiAnalyzer

Answer

The FortiAnalyzer ADOM is configured as a global ADOM

Answer

The FortiAnalyzer disk is full and not indexing new logs

Question 3

An administrator is troubleshooting a scenario where traffic from VLAN 100 to a server at 10.1.2.100 is being blocked. The FortiGate has an active security policy allowing the traffic and the routing table shows a correct route. Which TWO diagnostic commands should the administrator run to identify the cause of the blockage?

Accepted Answer

diagnose sniffer packet any 'host 10.1.2.100' 4. 'diagnose sniffer packet any host 10.1.2.100 4' captures packets to/from the server at the interface level, allowing the administrator to see if traffic from VLAN 100 is actually arriving at the FortiGate and whether it is being dropped or forwarded. This command helps identify if the issue is at Layer 2 (e.g., VLAN misconfiguration) or Layer 3 (e.g., routing or firewall drops).

Answer

get system performance status

Answer

diagnose ip arp list

Answer

diagnose sys session list

Question 4

An administrator is investigating a security incident and needs to determine which firewall policy allowed a specific malicious traffic flow. The traffic is no longer active. Which FortiAnalyzer log type should the admin query?

Accepted Answer

Traffic logs. Traffic logs record every session that passes through the FortiGate, including the source/destination IPs, ports, policy ID, and action taken. Since the traffic is no longer active, the administrator must query historical traffic logs in FortiAnalyzer to identify which firewall policy permitted the malicious flow. Event logs, security logs, and audit logs do not contain the per-session policy mapping needed for this forensic analysis.

Answer

Event logs

Answer

Security logs

Answer

Audit logs

Question 5

An administrator is reviewing the HA configuration shown in the exhibit. The primary unit has failed, and the secondary unit (with priority 100) has taken over. However, the administrator notices that the secondary unit has an IP address of 10.10.10.2 on port3, but cannot ping the management gateway 10.10.10.1. What is the most likely cause?

Accepted Answer

The HA management interface IP is not active on the secondary. When the secondary unit takes over in an HA cluster, the HA management interface IP (configured under config system ha) is only active on the primary unit by default. Even after failover, the secondary unit does not automatically activate this IP unless the 'management-interface-ip' is explicitly configured to be active on the secondary. Since the secondary unit has IP 10.10.10.2 on port3 but cannot ping the management gateway 10.10.10.1, the most likely cause is that the HA management interface IP is not active on the secondary, meaning the secondary unit is using its own port3 IP (10.10.10.2) but the gateway expects the management IP to be reachable from that subnet, which it is not.

Answer

The hbdev configuration is incorrect

Answer

The override setting is preventing the secondary from taking over management

Answer

session-pickup is not enabled

Question 6

You run 'diagnose sys session filter dport 179' on a FortiGate and see many sessions with proto=6 and proto_state=01. What does this indicate about the BGP sessions?

Accepted Answer

BGP sessions are in the process of being established, but not yet fully up.. Proto=6 indicates TCP, and proto_state=01 corresponds to TCP SYN_SENT (state 1 in the Linux TCP state model used by FortiGate). This means the BGP session has sent a SYN but has not yet received a SYN-ACK, so the three-way handshake is incomplete and the session is not established. BGP uses TCP port 179, so seeing many sessions in this state indicates ongoing connection attempts that have not yet completed.

Answer

BGP sessions are fully established and exchanging routes.

Answer

BGP sessions are being actively torn down.

Answer

BGP sessions are using TCP port 179 but are idle.

Question 7

An administrator deploys a FortiGate in transparent mode within a Layer 2 network. They apply a firewall policy with an antivirus profile to inspect traffic between two VLANs. What is a key characteristic of transparent mode that affects policy application?

Accepted Answer

Traffic is forwarded based on MAC addresses, and policies are applied transparently without changing the IP path. In transparent mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. This allows firewall policies, including antivirus inspection, to be applied to traffic between VLANs without modifying the IP path or requiring NAT, ensuring seamless integration into existing Layer 2 networks.

Answer

NAT is automatically applied to all traffic to preserve private IP addresses

Answer

Firewall policies are applied only to traffic entering the management interface

Answer

Each VDOM in transparent mode requires a unique IP address for management

Question 8

A network administrator is configuring SD-WAN on a FortiGate and wants to ensure that VoIP traffic uses the link with the lowest latency while bulk download traffic uses the link with the highest bandwidth. Which TWO configuration steps are required?

Accepted Answer

Create an SD-WAN rule for VoIP traffic with 'best quality' strategy. Option B is correct because an SD-WAN rule with the 'best quality' strategy selects the member link that best satisfies the configured performance SLA (lowest latency, jitter, and packet loss), which is exactly what VoIP traffic requires. Option E is correct because the 'best quality' strategy depends on a performance SLA that defines the latency threshold and probes (e.g., ping, HTTP, or twamp) used to measure each member's link quality; without a latency SLA, the SD-WAN rule cannot evaluate link quality. Option A is incorrect because a static route for the VoIP subnet does not perform dynamic link selection based on latency and would bypass SD-WAN path selection. Option C is incorrect because BFD is a failure-detection mechanism for fast link-down detection, not a latency-based path selection method. Option D is incorrect because route maps are used for route filtering and attribute manipulation in routing protocols, not for SD-WAN quality-based steering.

Answer

Assign a static route for the VoIP subnet

Answer

Enable BFD on all WAN interfaces

Answer

Configure a route map for VoIP traffic

Question 9

You are troubleshooting a VPN phase 2 negotiation failure. The logs show 'no proposal chosen'. What is the MOST likely cause?

Accepted Answer

The phase 2 proposal settings differ between the peers. The 'no proposal chosen' error in VPN phase 2 indicates that the IPsec peers could not agree on a common set of phase 2 parameters (such as encryption algorithm, authentication algorithm, or PFS group). Since phase 2 negotiation occurs after IKE phase 1 has successfully completed, the issue is specifically with the IPsec SA proposal settings, not with pre-shared keys or IKE version. Therefore, differing phase 2 proposals between the peers are the most likely cause.

Answer

The remote gateway IP is incorrect

Answer

The pre-shared key mismatch

Answer

The IKE version mismatch

Question 10

A FortiGate is configured with ECMP load balancing. What is the default behavior when multiple routes have equal cost?

Accepted Answer

Traffic is load balanced across the routes using a hash algorithm. When ECMP load balancing is configured on a FortiGate, the default behavior is to distribute traffic across multiple equal-cost routes using a hash algorithm. This hash algorithm considers fields such as source/destination IP, protocol, and ports to ensure session consistency, meaning all packets belonging to the same session follow the same path. This is the standard ECMP behavior in FortiOS, as documented in the FortiGate Administration Guide.

Answer

The route with the lowest metric is always preferred

Answer

The administrator must enable per-packet load balancing

Answer

All traffic is sent over the first route until it fails

Question 11

A company wants to receive threat intelligence feeds from external sources to enhance their FortiGate's protection. Which method should be used to integrate external threat feeds into FortiGate?

Accepted Answer

Configure an external threat feed connector in FortiGate, such as using a URL to a STIX/TAXII feed.. FortiGate supports integration with external threat intelligence feeds via the External Threat Feed connector, which can consume STIX/TAXII feeds from a URL. This allows the FortiGate to dynamically update its threat database with indicators from third-party sources, enhancing its protection without relying solely on FortiGuard services.

Answer

Use FortiGuard Threat Intelligence Service which automatically pulls feeds.

Answer

Manually add IP addresses to local address objects.

Answer

Use FortiAnalyzer to push feeds to FortiGate.

Question 12

A multi-area OSPF network includes a FortiGate as an ABR. The administrator needs to redistribute a static route into OSPF. Which command is required on the FortiGate to achieve this?

Accepted Answer

config router ospf
config redistribute
edit 'static'
set status enable
end. To redistribute a static route into OSPF on a FortiGate, you must enter the OSPF configuration context, navigate to the 'redistribute' subcommand, select the 'static' route type, and set its status to 'enable'. This is the standard method for enabling route redistribution from one routing protocol (or static routes) into OSPF, as defined in the FortiGate CLI reference.

Answer

config router prefix-list
edit 'static'
set action permit
end

Answer

config router policy
set src 0.0.0.0/0
set dst 0.0.0.0/0
end

Answer

config router static
set redistribute ospf enable
end

Question 13

An administrator wants to integrate a FortiExtender with a FortiGate to provide cellular WAN connectivity. Which configuration step is required on the FortiGate to use the FortiExtender as an SD-WAN member?

Accepted Answer

Add the FortiExtender's interface to the SD-WAN zone. To use a FortiExtender as an SD-WAN member, the FortiExtender's physical or logical interface must be added to the SD-WAN zone on the FortiGate. This allows the FortiGate to apply SD-WAN rules, load balancing, and SLA-based path selection to traffic traversing the cellular WAN link. Without this step, the interface remains a standard WAN interface and cannot participate in SD-WAN policies.

Answer

Enable BGP on the FortiExtender interface

Answer

Create a firewall policy allowing traffic from the FortiExtender

Answer

Configure a static route pointing to the FortiExtender

Question 14

A company uses SSL VPN with FortiGate for remote access. Users report that after connecting, they can access internal web servers but cannot ping them. Which configuration is most likely missing?

Accepted Answer

Firewall policy allowing ICMP. SSL VPN tunnels typically allow TCP-based traffic like HTTP/HTTPS to internal web servers, but ICMP (ping) is a separate protocol that requires explicit permission in the firewall policy. Without a firewall policy rule permitting ICMP from the SSL VPN interface to the internal network, the FortiGate will drop the ping requests, even though the tunnel is established and other traffic flows.

Answer

Split tunneling settings

Answer

SSL VPN web portal settings

Answer

DNS server configuration

Question 15

Which load balancing algorithm in SD-WAN distributes new sessions based on the source and destination IP addresses, ensuring that all sessions from a given source-destination pair go to the same member?

Accepted Answer

Source-dest IP. The Source-dest IP algorithm in Fortinet SD-WAN uses a hash of the source and destination IP addresses to determine the outbound member for each new session. This ensures that all sessions between the same source-destination pair are consistently forwarded to the same WAN member, preserving flow affinity without requiring session-based state tracking.

Answer

Lowest cost

Answer

Volume

Answer

Sessions