NSE7 Practice Test 2 — 25 Questions

Question 1

A network administrator notices that FortiGate is not blocking a known malicious file that was submitted to FortiSandbox and received a 'malicious' verdict. The firewall policy includes a FortiSandbox inline scan profile. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The FortiSandbox is not configured as an inline scanner in the antivirus profile. The FortiGate uses an antivirus profile to define how files are scanned, including whether to send files to FortiSandbox for inline analysis. Even if the firewall policy references a FortiSandbox inline scan profile, the antivirus profile must have the 'FortiSandbox inline scan' option enabled to actually forward files to the FortiSandbox appliance. Without this setting, the FortiGate will not submit files for sandboxing, so a malicious verdict from FortiSandbox is never applied to the traffic.

Answer

The antivirus signature database is outdated

Answer

The FortiSandbox license has expired

Answer

The file is larger than the maximum file size allowed for scanning

Question 2

Which FortiManager feature allows an administrator to view the exact CLI commands that will be pushed to a managed FortiGate before installation?

Accepted Answer

Install Preview. Install Preview is the correct answer because it allows an administrator to review the exact CLI commands that FortiManager will push to a managed FortiGate during the next installation. This feature provides a pre-installation view of the configuration changes, enabling verification before committing changes to the device.

Answer

Policy Check

Answer

Revision History

Answer

Device Manager Dashboard

Question 3

Which FortiGate feature allows the creation of multiple virtual routing tables within a single VDOM?

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) allows a single FortiGate VDOM to maintain multiple independent routing tables, each with its own forwarding decisions. This is achieved by creating separate VRF instances (identified by VRF IDs 1-255) within the same VDOM, enabling traffic isolation and overlapping IP address spaces without requiring separate VDOMs.

Answer

Policy-based routing

Answer

VDOM

Answer

ECMP

Question 4

In FortiManager, what is the purpose of an automation stitch?

Accepted Answer

To trigger automated actions based on predefined events. An automation stitch in FortiManager is a sequence of automated actions triggered by a predefined event, such as a log message, SNMP trap, or schedule. It allows administrators to define a set of actions (e.g., run a script, send an alert, or change a policy) that execute in response to specific conditions, streamlining incident response and network management without manual intervention.

Answer

To combine multiple ADOMs into a single management domain

Answer

To automatically deploy configuration changes to devices

Answer

To stitch together multiple policy packages into one

Question 5

An enterprise uses multiple VDOMs on a FortiGate. The administrator needs to route traffic between VDOM-A and VDOM-B using a firewall policy. What is the correct configuration step?

Accepted Answer

Configure a VDOM link between the two VDOMs and create a policy allowing traffic. A VDOM link creates a direct Layer 2 or Layer 3 connection between two VDOMs, allowing traffic to be controlled by firewall policies. This is the only method that enables policy-based inter-VDOM routing without requiring external cables or complex routing configurations.

Answer

Place both VDOMs in the same virtual router and use regular policies

Answer

Create a static route in each VDOM pointing to the other VDOM's virtual interface

Answer

Enable inter-VDOM routing globally under system settings

Question 6

Which of the following is the primary purpose of BFD (Bidirectional Forwarding Detection) on a FortiGate?

Accepted Answer

To provide fast detection of link failures. BFD (Bidirectional Forwarding Detection) is a lightweight protocol designed to provide sub-second failure detection between two forwarding engines, such as FortiGate peers. Unlike routing protocol hellos (e.g., OSPF Hello at 10-second intervals), BFD can detect link or neighbor failures in as little as 50–100 ms, enabling faster convergence. This makes it the primary mechanism for rapid link failure detection in high-availability and SD-WAN deployments.

Answer

To synchronize routing tables between peers

Answer

To load balance traffic across multiple paths

Answer

To encrypt routing updates between peers

Question 7

What is the primary function of Content Disarm and Reconstruction (CDR) in FortiGate's antivirus profile?

Accepted Answer

To remove active content and rebuild files to eliminate hidden threats. Content Disarm and Reconstruction (CDR) works by stripping active content (e.g., macros, scripts, OLE objects) from incoming files and rebuilding them into a safe, sanitized version. This eliminates hidden threats such as embedded exploits or malicious code that signature-based detection might miss, providing protection against zero-day and unknown attacks. Option D correctly identifies this core function of removing active content and rebuilding files to neutralize threats.

Answer

To detect and block zero-day malware using machine learning

Answer

To reconstruct files that were corrupted during transmission

Answer

To compress files for faster scanning

Question 8

An administrator needs to check the current CPU and memory usage of a FortiGate to determine if resource exhaustion is causing network delays. Which CLI command provides a real-time, top-like view of processes and their resource consumption?

Accepted Answer

diagnose sys top. The correct command is 'diagnose sys top', which offers a dynamic, top-like view of processes and their CPU/memory usage. It is the primary tool for real-time resource monitoring on FortiGate, allowing administrators to quickly identify resource-heavy processes.

Answer

diagnose sys session stat

Answer

diagnose hardware sysinfo memory

Answer

get system performance status

Question 9

A FortiGate administrator is configuring an IPsec VPN with IKEv2 and wants to ensure that the tunnel uses perfect forward secrecy (PFS). Which phase2 configuration is required?

Accepted Answer

Set 'pfs enable' in phase2 proposal.. Perfect forward secrecy in IPsec is enabled in the phase2 proposal by setting 'pfs enable'. This forces a new Diffie-Hellman exchange for each phase2 rekey, ensuring that compromised keys do not compromise past or future sessions. The phase1 dh-group setting is separate and does not enable PFS for phase2.

Answer

Set 'pfs enable' in phase1 proposal.

Answer

Set 'pfs disable' in phase2 proposal.

Answer

Set 'dh-group 14' in phase1 proposal.

Question 10

A FortiGate administrator is configuring an ADVPN with a hub-and-spoke topology. The administrator wants to ensure that spoke-to-spoke traffic can be dynamically established without traversing the hub for every packet. The administrator also wants to ensure that the shortcut tunnels are only established when necessary and are torn down when no longer used. Which two statements about ADVPN shortcut tunnels on FortiGate are correct? (Choose two.)

Accepted Answer

Shortcut tunnels are established when a spoke receives a shortcut offer from the hub and the spoke has a route to the destination spoke's public IP.. ADVPN shortcut tunnels are established on demand when the hub sends a shortcut offer and the originating spoke can reach the destination spoke's public IP. They are torn down after an idle timeout when no traffic matches, reverting traffic to the hub path. This dynamic creation and teardown optimizes spoke-to-spoke communication while preserving the hub as a fallback and control point.

Answer

Shortcut tunnels are always established between all spokes at initial VPN bring-up, regardless of traffic patterns.

Answer

Shortcut tunnels can only be established between spokes that are in the same IP subnet.

Answer

Shortcut tunnels require the hub to be removed from the routing path permanently once established.

Question 11

An administrator wants to detect lateral movement and early stages of an attack using decoy systems that mimic production assets. Which Fortinet product should they deploy?

Accepted Answer

FortiDeceptor. FortiDeceptor is specifically designed to detect lateral movement and early-stage attacks by deploying decoy systems (honeypots) that mimic production assets. It uses deception technology to lure attackers away from real targets and trigger alerts when decoys are probed or compromised, enabling early threat detection without impacting production systems.

Answer

FortiSIEM

Answer

FortiEDR

Answer

FortiNDR

Question 12

Which two commands display the current session count on a FortiGate?

Accepted Answer

get system performance status. Both 'get system performance status' and 'diagnose sys session stat' display the current session count on a FortiGate. 'get system performance status' provides a real-time snapshot including active sessions, while 'diagnose sys session stat' shows session table statistics such as total and used sessions. Therefore, both commands are valid answers to the question.

Answer

show system session

Answer

diagnose hardware sysinfo session

Question 13

An administrator is investigating a security incident where a workstation is communicating with a known command and control (C2) server. The FortiGate has IPS enabled but did not block the traffic. Which TWO configuration issues could explain why the IPS did not detect the C2 communication? (Choose two.)

Accepted Answer

The firewall policy does not have SSL deep inspection enabled. Without SSL deep inspection, the FortiGate cannot decrypt HTTPS traffic to inspect the payload for C2 signatures. IPS operates on decrypted content; if the C2 communication uses TLS, the IPS engine only sees encrypted packets and cannot match application-layer signatures. Enabling SSL deep inspection with a valid CA certificate is required to decrypt and inspect the traffic.

Answer

The IPS sensor is configured in 'Inline' mode

Answer

The IPS sensor has 'Logging' disabled

Answer

The FortiGate is operating in 'Transparent' mode

Question 14

A FortiGate with SD-WAN configured has a Performance SLA monitoring Google DNS (8.8.8.8). The SLA is configured with latency threshold 100 ms and jitter threshold 20 ms. The link is currently meeting both thresholds. The administrator wants to ensure that if the SLA fails, traffic moves to another link. Which SD-WAN rule strategy should be used?

Accepted Answer

Failover (SLA). The Failover (SLA) strategy is correct because it ensures that traffic is moved to another link only when the Performance SLA fails, while the primary link is used as long as it meets the configured latency (100 ms) and jitter (20 ms) thresholds. This strategy provides deterministic failover behavior, matching the administrator's requirement to switch traffic only upon SLA failure.

Answer

Best quality

Answer

Manual selection

Answer

Maximize bandwidth (SLA)

Question 15

An administrator configures an SD-WAN rule to steer traffic from a specific subnet to an SD-WAN member with the lowest cost. Which load balancing algorithm should be selected in the SD-WAN rule to achieve this behavior?

Accepted Answer

Lowest-cost. The 'Lowest-cost' algorithm is correct because it directs traffic to the SD-WAN member with the lowest configured cost metric, which directly matches the administrator's requirement to steer traffic from a specific subnet to the member with the lowest cost. In Fortinet SD-WAN, the cost is a static metric assigned per SD-WAN member interface, and the Lowest-cost algorithm selects the member with the smallest cost value for each new session, ensuring traffic follows the least-cost path.

Answer

Volume

Answer

Sessions

Answer

Source-dest-IP

Question 16

Which SD-WAN load balancing algorithm distributes traffic based on the number of active sessions per interface?

Accepted Answer

Sessions. The Sessions algorithm in Fortinet SD-WAN distributes new sessions by selecting the interface with the fewest currently active sessions. This ensures balanced session distribution across WAN links, preventing any single interface from becoming overloaded with connections while others remain underutilized.

Answer

Volume

Answer

Source-destination IP

Answer

Spillover

Question 17

A FortiManager administrator wants to deploy a policy package that contains shared header and footer policies across multiple devices. How should these policies be configured in FortiManager?

Accepted Answer

Configure the policies as header/footer policies within the policy package. In FortiManager, header and footer policies are specifically designed to be shared across multiple devices within a policy package. By configuring them as header/footer policies, the administrator ensures that these common rules are applied consistently at the top and bottom of the device-specific policy tables, while the middle policies can vary per device. This is the correct method for deploying shared policies without duplicating them in each device's policy set.

Answer

Define the policies in the ADOM's default policy package

Answer

Create a global policy package and assign it to all devices

Answer

Use the 'install preview' feature to merge policies

Question 18

An administrator needs to configure VRF to separate traffic for two departments. Which TWO components must be configured for each VRF?

Accepted Answer

A VRF instance. A VRF instance (option A) is the foundational component that must be created for each VRF, as it establishes the separate routing table that isolates the department's traffic. Interface binding to the VRF (option B) is also required because interfaces must be assigned to the VRF so that traffic entering and leaving those interfaces uses the correct VRF routing table. A dedicated VDOM (option C) is incorrect because VDOMs are a Fortinet-specific virtualization concept separate from VRF, and VRF can be configured without VDOMs. Route leaking configuration (option D) is not mandatory for each VRF; it is only needed when you want to selectively share routes between VRFs, which is optional. A separate firewall policy for each VRF (option E) is not a required VRF component, as firewall policies are managed independently of VRF configuration and depend on the platform's security policy model.

Answer

A dedicated VDOM

Answer

Route leaking configuration

Answer

A separate firewall policy for each VRF

Question 19

Which FortiMail advanced feature allows the administrator to rewrite URLs in email bodies to redirect users to a safe scanning service when they click on a link?

Accepted Answer

URL Rewriting. URL Rewriting is the correct answer because it is a FortiMail advanced feature specifically designed to replace URLs in email bodies with rewritten links that redirect users through FortiMail's scanning service. When a user clicks the rewritten URL, FortiMail inspects the destination in real time for malicious content, such as phishing or malware sites, before allowing the redirect. This provides proactive protection against zero-hour threats by leveraging FortiGuard's web filtering and threat intelligence.

Answer

Attachment Filtering

Answer

Bounce Verification

Answer

Anti-Spam

Question 20

During a ZTNA implementation, the administrator configures a ZTNA rule for an internal application but users cannot connect. The FortiGate policy is correct and the application is reachable from the FortiGate. What is the most likely misconfiguration?

Accepted Answer

The ZTNA rule's proxy destination IP or port is wrong.. The ZTNA rule defines the mapping between the external proxy address and the internal application's actual IP and port. If the proxy destination IP or port is misconfigured, the FortiGate's ZTNA proxy cannot forward traffic to the correct internal server, even though the firewall policy and network connectivity are otherwise valid. This is a common misconfiguration when the internal application's IP or service port differs from what is specified in the ZTNA rule.

Answer

The firewall policy is set to deny traffic from the ZTNA gateway.

Answer

The client does not have a route to the internal application.

Answer

The client's FortiClient agent is not authenticated.