NSE7 Practice Test 25 — 15 Questions

Question 1

An administrator is troubleshooting a ZTNA connection issue where a user can access the ZTNA gateway but the connection to the internal application fails after a few seconds. The FortiGate logs show 'ZTNA session timeout' but the timeout value is set to 30 minutes. What could be the reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ZTNA proxy idle timeout is set to a lower value than the global timeout.. The ZTNA proxy has its own idle timeout setting that operates independently of the global timeout. Even though the global timeout is set to 30 minutes, if the per-proxy idle timeout is configured to a lower value (e.g., 30 seconds), the proxy will terminate the session after that idle period, logging 'ZTNA session timeout'. This explains why the connection fails after a few seconds despite the long global timeout.

Answer

The internal application is not responding to the proxy request.

Answer

The internal application has a 5-second timeout.

Answer

The client's FortiClient is not receiving the ZTNA tags.

Question 2

An administrator configures an automation stitch on FortiGate to automatically block an IP address when a specific IPS signature triggers. What must be configured as the trigger and action?

Accepted Answer

Trigger: 'Event Log' with filter for the IPS signature; Action: 'Add IP to Blocklist'. An automation stitch in FortiGate requires a trigger that defines the event that starts the automation, and an action that defines what happens when the trigger fires. For automatically blocking an IP when a specific IPS signature triggers, the trigger must be 'Event Log' with a filter for that IPS signature, and the action must be 'Add IP to Blocklist', which directly adds the source IP to the FortiGate's blocklist (banned IP list). This combination ensures that when the IPS signature is logged, the stitch extracts the source IP and applies a block.

Answer

Trigger: 'Incoming Webhook'; Action: 'CLI Script'

Answer

Trigger: 'FortiOS CLI'; Action: 'Alert Email'

Answer

Trigger: 'Schedule'; Action: 'Banned IP'

Question 3

Which FortiGate feature can automatically block traffic from an IP address that is detected as malicious by FortiSandbox?

Accepted Answer

Automation Stitch. Automation Stitch in FortiOS allows you to create a trigger-action pair that automatically blocks an IP address when FortiSandbox detects malicious activity. The trigger can be a FortiSandbox IOC (Indicator of Compromise) event, and the action can be an IP block via a local or external block list, enabling real-time, automated threat response without manual intervention.

Answer

Traffic Shaping

Answer

Intrusion Prevention System (IPS)

Answer

Application Control

Question 4

A network administrator wants to configure SD-WAN on a FortiGate with two internet connections (port1 and port2). The requirement is to use the link with the lowest cost as the primary path for all traffic, unless it exceeds a threshold. Which SD-WAN load balancing algorithm should the administrator choose?

Accepted Answer

Lowest-cost. The 'Lowest-cost' algorithm (option C) is correct because it allows the administrator to assign a cost metric to each SD-WAN link and designate the link with the lowest cost as the primary path. Traffic will use this primary link until its cost exceeds a defined threshold, at which point the FortiGate will spill over traffic to the next lowest-cost link. This directly matches the requirement of using the lowest-cost link as primary unless a threshold is exceeded.

Answer

Spillover

Answer

Sessions

Answer

Volume

Question 5

A FortiGate administrator wants to use FortiManager automation stitches to automatically block an IP address when a specific threat is detected. Which components must be configured within the automation stitch?

Accepted Answer

A trigger, at least one action, and optionally conditions. An automation stitch in FortiManager requires a trigger (e.g., an event or log match) to start the workflow, at least one action (e.g., a CLI script to block an IP via firewall address creation), and optionally conditions to filter when the trigger fires. This three-part structure is mandatory because the trigger defines the event, the action executes the response, and conditions provide granular control without which the stitch would fire on every trigger occurrence.

Answer

A trigger and a connector to an external threat feed

Answer

An action only, since the trigger is predefined

Answer

A schedule and a script

Question 6

A FortiGate administrator receives alerts about a device communicating with a known botnet C2 server. The traffic is encrypted with TLS. Which ATP feature is most effective to block this communication?

Accepted Answer

DNS Filter with botnet C2 domain blocking. DNS Filter with botnet C2 domain blocking is the most effective because it proactively prevents the initial DNS resolution of the botnet's command-and-control domain, stopping the TLS handshake before it even begins. Since the traffic is encrypted with TLS, other security mechanisms like application control or IPS would require decryption to inspect the payload, which may not be feasible or configured. DNS Filter operates at Layer 7 without needing to decrypt the traffic, directly blocking the domain lookup based on FortiGuard's real-time threat intelligence.

Answer

Application control to block the C2 application

Answer

Antivirus profile with SSL inspection

Answer

IPS signature for botnet activity

Question 7

An administrator wants to use FortiAnalyzer to generate weekly compliance reports for all managed FortiGates. Which FortiAnalyzer feature should be used?

Accepted Answer

Reports. FortiAnalyzer's Reports feature is specifically designed to generate scheduled, customizable compliance reports that aggregate data from multiple managed FortiGates. This allows administrators to produce weekly reports aligned with regulatory standards (e.g., PCI DSS, HIPAA) without manual effort, leveraging pre-defined or custom report templates.

Answer

Incidents

Answer

FortiView

Answer

Log Analytics

Question 8

An administrator configures an automation stitch on FortiManager to trigger a script when a specific log message is received. After saving, the stitch does not execute. What is a likely cause?

Accepted Answer

The automation stitch is not enabled. Automation stitches on FortiManager are disabled by default after creation. The administrator must explicitly enable the stitch before it will trigger on incoming log events. Without enabling, the stitch remains inactive regardless of other configurations.

Answer

The FortiGate is not in the same ADOM

Answer

The log message is not being sent to FortiManager

Answer

The script is not uploaded to the FortiGate

Question 9

A FortiGate administrator needs to configure a policy that allows traffic from VDOM A to VDOM B using inter-VDOM routing. Which configuration is required?

Accepted Answer

Policies in both VDOMs allowing traffic to and from the inter-VDOM link. Inter-VDOM routing requires explicit policy enforcement on both sides of the inter-VDOM link. A single policy in VDOM A cannot control return traffic from VDOM B, and FortiGate does not implicitly allow traffic between VDOMs. Therefore, policies must be configured in both VDOMs to permit traffic in both directions, ensuring stateful inspection and security controls are applied consistently.

Answer

A single policy in VDOM A with destination VDOM B

Answer

A static route in VDOM A pointing to VDOM B

Answer

Disable VDOM security features

Question 10

A network admin is deploying a FortiGate in transparent mode to inspect traffic between two Layer 2 switches. Which of the following statements about transparent mode is correct?

Accepted Answer

Transparent mode requires an IP address on each interface for management purposes. In transparent mode, FortiGate acts as a Layer 2 bridge and does not require IP addresses on its interfaces for forwarding traffic. However, to manage the device (e.g., via SSH, HTTPS, or SNMP), an IP address must be assigned to each interface or to a management VLAN. This allows administrative access while the firewall remains invisible to the Layer 2 network. Option B correctly identifies this requirement.

Answer

Transparent mode can only inspect traffic in one VLAN

Answer

Transparent mode supports NAT policies

Answer

Transparent mode requires VDOMs to be enabled

Question 11

What is the purpose of a header policy in a FortiManager policy package?

Accepted Answer

To define policies that are inserted at the beginning of the policy list. A header policy in a FortiManager policy package is used to define policies that are inserted at the beginning of the policy list, before any other policies. This ensures that certain traffic matching criteria (e.g., from specific sources or to specific destinations) is evaluated first, which is critical for enforcing high-priority rules like allowlisting or blocking specific traffic before more general policies are applied.

Answer

To apply policies to the management VDOM

Answer

To create policies that bypass security profiles

Answer

To specify the name of the policy package

Question 12

A network admin wants to use FortiClient's advanced threat protection features to detect ransomware behavior on endpoints. Which FortiClient feature should be enabled?

Accepted Answer

Advanced Threat Protection. FortiClient's Advanced Threat Protection (ATP) feature is specifically designed to detect and block ransomware behavior by using real-time behavioral analysis, machine learning, and exploit prevention. Unlike other features, ATP monitors process behavior for indicators of compromise (IoCs) such as mass file encryption or unauthorized file access patterns, making it the correct choice for ransomware detection.

Answer

Web Filtering

Answer

Application Firewall

Answer

Vulnerability Scan

Question 13

An administrator configures FortiAnalyzer to receive logs from multiple FortiGates. They want to create a report that shows only incidents involving 'critical' severity and specific attack types. Which FortiAnalyzer feature allows the administrator to define such a custom report?

Accepted Answer

Report datasets and charts. FortiAnalyzer reports use SQL-like queries and dataset definitions to filter and aggregate log data based on severity, attack type, etc.

Answer

Incident management

Answer

Playbooks

Answer

FortiView dashboards

Question 14

Which FortiGate feature allows the creation of multiple virtual routing tables within a single VDOM?

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) allows a single FortiGate VDOM to maintain multiple independent routing tables, each with its own forwarding decisions. This is achieved by creating separate VRF instances (identified by VRF IDs 1-255) within the same VDOM, enabling traffic isolation and overlapping IP address spaces without requiring separate VDOMs.

Answer

Policy-based routing

Answer

VDOM

Answer

ECMP

Question 15

An administrator is troubleshooting an HA cluster issue. The cluster consists of two FortiGate units in active-passive mode. The passive unit is showing a 'heartbeat lost' error in the logs. Which TWO configuration checks should the administrator perform to resolve this issue?

Accepted Answer

Ensure the heartbeat interface is physically connected and has a valid IP address in the same subnet. The heartbeat interface must be physically connected and have a valid IP address on the same subnet for the two FortiGates to exchange HA heartbeat packets (typically UDP port 703). If the interface is down or the IPs are not in the same subnet, the passive unit will log 'heartbeat lost' and fail to maintain cluster synchronization.

Answer

Check that the HA password is the same on both units

Answer

Verify that HA override is enabled on both units

Answer

Confirm that the management interface IP addresses are on the same subnet