NSE7 Practice Test 3 — 25 Questions

Question 1

A FortiGate in an HA cluster is experiencing intermittent session synchronization failures. The administrator runs 'diagnose sys ha dump sync-status' and sees that sessions are not being synchronized properly. Which TWO potential causes should the administrator investigate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Excessive number of sessions exceeding the session sync limit. FortiGate HA has a configurable session sync limit (default 500,000 sessions). When the number of concurrent sessions exceeds this limit, the FortiGate stops synchronizing new sessions to the backup unit, leading to intermittent synchronization failures. This can be verified by checking the 'ses_sync_limit' value in the HA configuration and comparing it to the current session count. Option D is correct because high packet loss or latency on the heartbeat interface can cause session synchronization failures. The heartbeat interface carries synchronization traffic, and any degradation in its performance can lead to missed or delayed sync packets, resulting in intermittent sync failures. This can be diagnosed by checking heartbeat interface statistics such as packet loss and latency.

Answer

Mismatched HA group IDs

Answer

Incorrect BGP route advertisements

Answer

Mismatched HA passwords

Question 2

You run the following command on a FortiGate: 'diagnose vpn ike gateway list' and see that the DPD status for a VPN peer is 'dead'. What does this indicate?

Accepted Answer

The VPN peer has been detected as unreachable and the tunnel is considered down. When 'diagnose vpn ike gateway list' shows DPD status as 'dead', it means the FortiGate has not received DPD (Dead Peer Detection) responses from the peer within the configured retry period, so it considers the peer unreachable and tears down the tunnel. The IKE SA and IPsec SAs are removed, and the tunnel is considered down. This is the correct interpretation of the 'dead' status.

Answer

The remote peer has been manually disconnected from the network

Answer

The VPN tunnel is still up but the peer is not responding to DPD messages

Answer

The IKE SA is still active but the IPsec SA has expired

Question 3

An administrator has configured FortiSandbox integration with FortiGate. Files are being submitted, but the firewall is not blocking subsequent downloads of files that FortiSandbox later identifies as malicious. The administrator verifies that the FortiSandbox license is valid and the connection is up. Which configuration is most likely missing?

Accepted Answer

The 'Retrieve and block' option is not enabled in the antivirus profile.. The 'Retrieve and block' option in the antivirus profile is responsible for pulling verdicts from FortiSandbox and blocking files that are later found malicious. Without it, FortiGate only submits files and does not act on subsequent verdicts. The other options address different aspects of integration or inspection and are not the cause of the described behavior.

Answer

The SSL inspection profile is not set to deep inspection.

Answer

FortiSandbox is not configured as a fabric connector in Security Fabric.

Answer

The FortiSandbox appliance is not in the 'block' mode.

Question 4

An administrator wants to group firewall objects by department (e.g., Sales, Engineering) and easily filter them in FortiManager policy packages. Which feature should be used?

Accepted Answer

Meta fields. Meta fields in FortiManager allow administrators to define custom attributes (e.g., Department) for firewall objects. These fields can then be used to group and filter objects within policy packages, enabling efficient management by department without requiring separate ADOMs or VDOMs.

Answer

Tags in FortiGate

Answer

ADOM overrides

Answer

Policy package folders

Question 5

In a FortiManager deployment with global ADOM enabled, an administrator creates a firewall policy in the global ADOM. What is the effect of this policy on the per-ADOM devices?

Accepted Answer

The policy is installed as a header policy on all managed FortiGates. In FortiManager, when global ADOM is enabled, policies created in the global ADOM are automatically installed as header policies on all managed FortiGates across all ADOMs. Header policies are evaluated before per-ADOM policies, allowing global enforcement of rules. This ensures consistent security posture across the entire managed estate.

Answer

The policy is used only if no per-ADOM policy exists with the same name

Answer

The policy is applied only to devices in the same ADOM as the global ADOM

Answer

The policy is ignored unless explicitly assigned to each ADOM

Question 6

A company wants to protect its internal users from malicious files attached to emails. Which FortiGate feature should be configured to inspect SMTP traffic for malware?

Accepted Answer

Antivirus. FortiGate's Antivirus feature is designed to scan SMTP traffic for malware by inspecting email attachments and body content against virus signatures. When configured in a security policy, it intercepts SMTP sessions, buffers the email data, and performs real-time scanning to block or quarantine malicious files before delivery to internal users.

Answer

Email Filter

Answer

Web Filter

Answer

IPS

Question 7

Which of the following is a required step when enabling VDOMs on a FortiGate for the first time?

Accepted Answer

Reboot the FortiGate after enabling VDOMs. When enabling VDOMs on a FortiGate for the first time, the device must be rebooted to restructure the internal data plane and control plane to support multiple virtual domains. This reboot is mandatory because the firmware transitions from a single-VDOM mode to a multi-VDOM mode, which requires reinitializing kernel structures and memory allocation for VDOM-specific resources.

Answer

Create at least two VDOMs before enabling the VDOM feature

Answer

Disable all firewall policies

Answer

Configure inter-VDOM routing

Question 8

An administrator wants to verify which SD-WAN member is currently being used for a specific traffic flow. Which command should they use on the FortiGate?

Accepted Answer

diagnose sys sdwan session. The command 'diagnose sys sdwan session' shows active sessions that are being processed by SD-WAN rules, including the chosen member. It is the most direct way to verify which SD-WAN member is used for a specific flow.

Answer

diagnose sys sdwan health-check

Answer

diagnose sys session list

Answer

diagnose sys sdwan member

Question 9

A network administrator wants to ensure that files downloaded from the internet are analyzed by FortiSandbox before being delivered to the client. The FortiGate is configured with a FortiSandbox connection and an antivirus profile. Which setting must be enabled in the antivirus profile to submit files to FortiSandbox?

Accepted Answer

Submit files to FortiSandbox. The 'Submit files to FortiSandbox' setting in the antivirus profile is the specific toggle that instructs FortiGate to forward files to the configured FortiSandbox for analysis. Without this setting enabled, the FortiGate will not send any files to FortiSandbox, even if the FortiSandbox connection is configured and the antivirus profile is applied.

Answer

FortiSandbox inline scanning

Answer

Enable Content Disarm and Reconstruction (CDR)

Answer

Enable Outbreak Prevention

Question 10

A network admin needs to apply a common set of firewall rules at the beginning of every policy package for all VDOMs managed by FortiManager. The rules should be automatically inserted and not editable within each VDOM. What should be configured?

Accepted Answer

Policy package header policies. Policy package header policies in FortiManager allow administrators to define a set of firewall policies that are automatically inserted at the top of every policy package for all VDOMs, and they are not editable within each VDOM. This enforces a common baseline of rules across managed devices.

Answer

VDOM policy templates

Answer

Global policy objects

Answer

Central management policies

Question 11

An administrator wants to enforce that only devices with antivirus software installed and up-to-date can access the corporate network. Which FortiGate feature should be used?

Accepted Answer

ZTNA tags and posture checks. FortiGate uses ZTNA device posture checks via FortiClient EMS to enforce endpoint compliance, such as antivirus status.

Answer

Application control profile

Answer

IPsec VPN with pre-shared key

Answer

Web filtering profile

Question 12

An administrator configures a WAF profile on FortiGate to protect a web application. However, the administrator notices that SQL injection attacks are not being blocked. What should the administrator check first?

Accepted Answer

The SQL injection signatures are enabled in the WAF profile. SQL injection attacks are blocked by specific signatures within the WAF profile. If these signatures are not enabled, the WAF will not inspect HTTP requests for SQL injection patterns, allowing attacks to pass through. The administrator must verify that the SQL injection signatures are toggled on under the WAF profile's signature configuration.

Answer

The WAF profile is attached to the correct firewall policy

Answer

The FortiGate has a valid Advanced Web Protection subscription

Answer

The web application is using HTTPS and SSL inspection is configured

Question 13

Which FortiAnalyzer feature allows an administrator to create a sequence of automated response actions triggered by a specific log event?

Accepted Answer

Playbooks. Playbooks in FortiAnalyzer allow administrators to define a sequence of automated response actions that are triggered by specific log events. This feature enables event-driven automation, such as executing CLI scripts, sending alerts, or integrating with external systems via webhooks, directly from the FortiAnalyzer interface.

Answer

Reports

Answer

Incidents

Answer

FortiView

Question 14

What is the primary function of FortiAnalyzer's FortiView feature?

Accepted Answer

Real-time traffic monitoring and visualization. FortiView on FortiAnalyzer provides real-time traffic monitoring and visualization by aggregating logs from FortiGate devices and displaying them in graphical dashboards. It allows administrators to instantly view top talkers, applications, threats, and other network activity without needing to run manual queries, making it the primary function for live traffic analysis.

Answer

Centralized device configuration management

Answer

Scheduling and generating compliance reports

Answer

Automated remediation of security incidents

Question 15

An organization uses FortiAnalyzer for centralized logging. The security team wants to use playbooks to automate responses to detected incidents. Which THREE components are essential for a playbook to function?

Accepted Answer

Trigger. In FortiAnalyzer playbooks, the essential building blocks are the trigger, conditions, and actions. Option A (Trigger) is correct because a playbook must have an event source that initiates execution, such as a new log, incident, or event detected by FortiAnalyzer. Option C (Conditions) is correct because conditions define the matching logic or filters that determine whether the playbook should run and which path it follows. Option E (Actions) is correct because actions specify the automated response steps the playbook performs, such as sending notifications, running CLI scripts, or creating incidents. Option B (A report schedule) is not required, since reports are separate scheduled outputs and do not drive playbook execution. Option D (A dashboard visualization) is not required, because dashboards are for display and monitoring, not for the functional logic of a playbook.

Answer

A report schedule

Answer

A dashboard visualization

Question 16

An administrator needs to back up the configuration of a FortiGate managed by FortiManager before making major changes. Which feature in FortiManager should the administrator use?

Accepted Answer

Revision history. Revision History in FortiManager allows administrators to create, view, and restore previous configuration versions of managed FortiGate devices. This is the correct feature for backing up a configuration before making major changes, as it provides a point-in-time snapshot that can be rolled back if needed.

Answer

Policy package import/export

Answer

Automation stitch

Answer

Install preview

Question 17

A FortiGate admin configures a firewall policy with an antivirus profile in flow-based inspection mode. The admin notices that some large files are being scanned but others are allowed without scanning. What is the most likely cause?

Accepted Answer

The FortiGate's antivirus buffer size is exceeded, causing some files to bypass scanning. In flow-based inspection, FortiGate uses a buffer to reassemble files before scanning. When a file exceeds the configured antivirus buffer size (default 1 MB for flow-based), the FortiGate cannot buffer the entire file for scanning and allows it to pass without inspection. This explains why some large files bypass scanning while smaller ones are scanned.

Answer

The antivirus signatures are outdated

Answer

The antivirus profile has an exemption for certain file types

Answer

Flow-based inspection cannot scan files larger than 10 MB

Question 18

A company uses an advanced antivirus profile with machine learning engine enabled. After a recent outbreak, several files that were previously undetected are now flagged. How does the outbreak prevention feature help in this situation?

Accepted Answer

It downloads the latest ML models from FortiGuard to detect new threats. The outbreak prevention feature in FortiGate's advanced antivirus profile automatically downloads the latest machine learning (ML) models from FortiGuard when a new outbreak is detected. This allows the ML engine to identify and flag previously undetected files without requiring a traditional signature update, enabling proactive detection of zero-day threats.

Answer

It sends all files to FortiSandbox for analysis

Answer

It quarantines all files for 24 hours until a signature is released

Answer

It blocks all executable files from being downloaded

Question 19

Which feature allows a FortiGate to participate in multiple routing tables simultaneously, enabling network segmentation and overlapping IP address spaces?

Accepted Answer

VRF. C is correct because VRF (Virtual Routing and Forwarding) allows a FortiGate to maintain multiple separate routing tables (RIB) on the same physical device. Each VRF instance operates as an independent routing domain, enabling network segmentation and the use of overlapping IP address spaces without conflict, which is essential for MPLS L3VPN and multi-tenant environments.

Answer

VDOM

Answer

Policy-based routing

Answer

Route redistribution

Question 20

An administrator needs to view real-time traffic logs and top applications for a specific VDOM on FortiAnalyzer. Which tool should be used?

Accepted Answer

FortiView. FortiView is the correct tool because it provides real-time traffic logs and top applications per VDOM on FortiAnalyzer. It uses live data streams from FortiGate logs to display current network activity, allowing administrators to filter by VDOM and view metrics like top applications, sources, and destinations without running a report or script.

Answer

Playbooks

Answer

Incident Management

Answer

Reports