NSE7 Practice Test 4 — 25 Questions

Question 1

A FortiGate administrator wants to ensure that only devices with an up-to-date antivirus and OS patch level can access a sensitive application published via ZTNA. Which ZTNA component should the administrator configure to enforce this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ZTNA tags with posture checks. ZTNA tags with posture checks allow the FortiGate to verify endpoint compliance (e.g., antivirus version, OS patch level) before granting access to a ZTNA-published application. The FortiGate collects posture data from the FortiClient endpoint and compares it against configured compliance rules; only devices that meet the requirements receive the appropriate ZTNA tag and are allowed through the ZTNA proxy.

Answer

ZTNA proxy configuration

Answer

SSL VPN portal settings

Answer

Firewall policy with application control

Question 2

A FortiGate VPN tunnel shows 'phase1 negotiation failed' in the logs. The remote gateway is a third-party device. The debug command 'diagnose vpn ike config' shows mismatched proposals. Which setting is MOST likely incorrect on the FortiGate?

Accepted Answer

The encryption algorithm (e.g., AES256 vs 3DES). The 'diagnose vpn ike config' command displays the IKE proposal parameters (encryption, authentication, DH group) that the FortiGate is configured to offer. When the log shows 'phase1 negotiation failed' and the debug output indicates 'mismatched proposals', it means the FortiGate's configured encryption algorithm (e.g., AES256) does not match any algorithm supported by the remote third-party device (e.g., 3DES). This is the most direct cause of proposal mismatch, as IKE phase 1 requires both sides to agree on a common transform set.

Answer

The pre-shared key

Answer

The local ID type

Answer

The DPD configuration

Question 3

A FortiGate is configured with ECMP routing to balance traffic across two default routes via two ISPs. The administrator wants to ensure that traffic from the same source-destination pair always uses the same ISP. Which ECMP load balancing method should be configured?

Accepted Answer

source-dest-ip. The source-dest-ip method hashes the source and destination IP addresses to compute a consistent path for all packets in a given flow. This ensures that traffic from the same source-destination pair always uses the same ISP, meeting the requirement for flow-based persistence without per-packet load balancing.

Answer

source-ip

Answer

per-packet

Answer

session

Question 4

A customer reports intermittent connectivity issues between two internal subnets separated by a FortiGate firewall. The traffic is allowed by the policy, but users experience timeouts during peak hours. Which troubleshooting step should you take first?

Accepted Answer

Check the session table for session limits and session congestion.. Intermittent connectivity during peak hours strongly suggests session table exhaustion or session congestion. The FortiGate's session table has a finite capacity, and when it fills up, new sessions are dropped, causing timeouts. Checking the session table for limits and congestion is the fastest, least intrusive first step to confirm whether the firewall is running out of session resources before performing more complex diagnostics.

Answer

Run a packet sniffer on the FortiGate to capture traffic between the subnets.

Answer

Disable hardware acceleration on the FortiGate.

Answer

Configure SNAT on the policy to translate the source IP.

Question 5

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal application. The application is accessed via HTTPS. Which component must be configured on the FortiGate to act as a reverse proxy for the application?

Accepted Answer

ZTNA proxy. ZTNA proxy is the FortiGate feature that acts as a reverse proxy, terminating the client connection and initiating a new connection to the internal application. It enforces access policies based on identity and device posture.

Answer

FortiClient EMS

Answer

SSL-VPN portal

Answer

ZTNA inline CASB

Question 6

A FortiGate admin is configuring a multi-peer IPsec VPN where the remote site has two ISPs for redundancy. The admin wants to ensure that if the primary ISP fails, the VPN automatically fails over to the secondary ISP without manual intervention. Which feature should be enabled?

Accepted Answer

Dead Peer Detection (DPD) with retry and failover. DPD (Dead Peer Detection) with auto-negotiation allows the FortiGate to detect peer unreachability and automatically re-establish the tunnel using an alternate path if configured.

Answer

IPsec interface mode with DHCP

Answer

IKEv2 with mobility extension

Answer

Auto-negotiate phase 1 settings

Question 7

Which TWO features are required to implement an always-on SSL VPN tunnel with FortiGate that automatically reconnects when the user's network changes?

Accepted Answer

Tunnel mode enabled. Tunnel mode is required for an always-on SSL VPN tunnel, as it encapsulates all traffic at the network layer (TUN) and maintains a persistent virtual interface on the client. This allows the VPN to stay active and automatically reconnect when the user's network changes, such as switching from Wi-Fi to cellular, without manual intervention.

Answer

DTLS enabled

Answer

Web mode portal

Answer

Split tunneling configured

Question 8

A FortiManager administrator wants to push a policy package that includes both global header/footer policies and VDOM-specific policies. Which statement about header/footer policies is correct?

Accepted Answer

Header policies are inserted before the VDOM's own policies; footer policies are appended after. In FortiManager, when a policy package includes both global header/footer policies and VDOM-specific policies, the header policies are inserted before the VDOM's own policies in the policy table, while footer policies are appended after them. This ensures that header policies are evaluated first for traffic matching, and footer policies serve as a catch-all or default set of rules at the end of the VDOM policy list.

Answer

Header/footer policies are only available when using per-device mapping

Answer

Header/footer policies can only be configured directly on the FortiGate, not via FortiManager

Answer

Header/footer policies are automatically generated and cannot be manually edited

Question 9

An administrator wants to load-balance traffic across two WAN links using ECMP. The routes have equal distances and metrics. However, traffic is only using one of the links. What could be the cause?

Accepted Answer

The routes are learned via different routing protocols with different administrative distances.. ECMP (Equal-Cost Multi-Path) requires routes to have identical administrative distances (AD) to be considered equal-cost. If routes are learned via different routing protocols (e.g., OSPF with AD 110 and static with AD 1), the FortiGate will prefer the route with the lower AD, even if metrics are equal. This causes traffic to use only the preferred link, as the other route is not installed in the routing table for ECMP selection.

Answer

ECMP is not enabled globally under config system settings.

Answer

The firewall policy is configured to use a specific egress interface.

Answer

The traffic is session-based and ECMP uses per-packet load balancing.

Question 10

An administrator wants to add custom fields to device objects in FortiManager to track location and contact info. Which feature should be used?

Accepted Answer

Meta fields. Meta fields in FortiManager allow administrators to define custom attributes (e.g., location, contact info) that can be attached to device objects. These fields are stored in the FortiManager database and can be used for filtering, reporting, and policy mapping, providing a flexible way to enrich device metadata without modifying the device configuration itself.

Answer

System templates

Answer

Custom reports

Answer

Dynamic mapping

Question 11

During a ZTNA deployment, an administrator notices that traffic from a specific internal application is being routed through the ZTNA gateway but is not reaching the destination server. The FortiGate policy allows the traffic, and the client has a valid ZTNA connection. What is the most likely cause of the issue?

Accepted Answer

The ZTNA proxy rule on the FortiGate is misconfigured, pointing to the wrong destination IP or port.. In a ZTNA deployment, the FortiGate acts as a reverse proxy for internal applications. If the ZTNA proxy rule is misconfigured with an incorrect destination IP or port, the FortiGate will forward the traffic to the wrong backend server or service, causing the connection to fail even though the client has a valid ZTNA connection and the firewall policy permits the traffic.

Answer

The client's FortiClient agent is not connected to the EMS server.

Answer

The destination server does not have internet connectivity.

Answer

The FortiGate policy is set to deny traffic from the client's subnet.

Question 12

An administrator configured a firewall policy to inspect SMTP traffic using an antivirus profile. However, email attachments are not being scanned. The FortiGate is operating in proxy-based inspection mode. What is the most likely cause?

Accepted Answer

The SMTP session helper is not enabled. In proxy-based inspection mode, the FortiGate must reassemble the SMTP session to scan attachments. The SMTP session helper is required to parse the SMTP commands and data stream so the antivirus engine can access the attachments. Without the helper enabled, the FortiGate treats the traffic as raw TCP and cannot extract MIME parts for scanning.

Answer

The policy is set to 'accept' instead of 'deny'

Answer

The email is sent over TLS encryption

Answer

The antivirus profile is set to flow-based inspection

Question 13

A network administrator is troubleshooting a BGP session between a FortiGate and an ISP router. The administrator runs 'get router info bgp summary' and sees that the BGP state is 'Active'. What does this state indicate?

Accepted Answer

The BGP speaker is trying to establish a TCP connection with the peer. The 'Active' state in BGP indicates that the router is actively trying to initiate a TCP connection to the configured peer. This means the BGP process has moved past the 'Connect' state (where it passively waits) and is now actively sending TCP SYN packets to the peer's port 179, but the three-way handshake has not yet completed. This state is normal during initial session establishment but becomes problematic if it persists, as it typically points to a Layer 3 reachability issue or a firewall blocking TCP/179.

Answer

The BGP session is administratively down due to a configuration error

Answer

The BGP speaker is waiting for a routing update from the peer

Answer

The BGP session is fully established and exchanging routes

Question 14

A FortiGate running FortiOS 7.2 has multiple WAN interfaces. The administrator is configuring SD-WAN load balancing with the 'volume' algorithm. The requirement is that each interface carries a percentage of total traffic based on its bandwidth capacity. The administrator sets the 'weight' of each interface accordingly. However, traffic distribution is not as expected. Which TWO factors could cause this discrepancy?

Accepted Answer

The interface bandwidth settings (speed) do not reflect actual link capacity. The 'volume' algorithm in FortiOS SD-WAN distributes traffic proportionally based on the configured interface weights, but these weights are derived from the interface bandwidth settings (speed). If the configured bandwidth does not match the actual link capacity, the weight ratios will be incorrect, leading to unexpected traffic distribution. The administrator must ensure that the 'speed' setting under each interface accurately reflects the real bandwidth to achieve the desired load balancing.

Answer

The weight values are not in the range 1-100

Answer

The load balancing algorithm is set to 'per-packet' instead of 'volume'

Answer

The performance SLA is set to 'disable' on some interfaces, causing them to be excluded

Question 15

An administrator configures BFD on a FortiGate to improve convergence time for OSPF. What is the primary purpose of BFD in this context?

Accepted Answer

To detect link failures faster than OSPF hello timers. BFD (Bidirectional Forwarding Detection) provides sub-second link failure detection, typically in the range of 50-300 milliseconds, which is significantly faster than OSPF's default hello/dead intervals (e.g., 10/40 seconds for broadcast networks). By integrating BFD with OSPF, the FortiGate can trigger OSPF neighbor state changes and route convergence almost immediately upon a link failure, without waiting for OSPF's own hello timer expiration.

Answer

To reduce the number of OSPF neighbors

Answer

To encrypt OSPF packets

Answer

To load balance OSPF traffic across multiple links

Question 16

A FortiGate administrator notices that traffic from a specific subnet is not being inspected by the Intrusion Prevention System (IPS) profile applied to the firewall policy. The policy is configured with the correct profile, and the IPS engine is enabled. What is the most likely cause?

Accepted Answer

The protocol in the IPS profile is not enabled for the application being used. The most likely cause is that the protocol in the IPS profile is not enabled for the application being used. Even when an IPS profile is applied to a firewall policy and the IPS engine is running, the profile must have the specific protocol (e.g., HTTP, SMTP, FTP) enabled for inspection. If the protocol is disabled or not selected, the IPS engine will bypass traffic of that type, resulting in no intrusion detection or prevention for that traffic.

Answer

The traffic is encrypted and SSL inspection is not enabled

Answer

The IPS profile is configured for signature-based detection only

Answer

The firewall policy is set to accept mode instead of explicit proxy

Question 17

An administrator notices that SD-WAN rule-based traffic is not failing over as expected when the primary link goes down. The SLA targets are configured correctly, and the interface health check is showing 'dead' for the primary link. What is the MOST likely reason for the failover not occurring?

Accepted Answer

The SD-WAN rule's 'set strategy' is 'manual' and the preferred member is still set to the primary interface. When an SD-WAN rule's strategy is set to 'manual', the rule uses a static preferred member list and will not automatically fail over to another member, even if the primary link's SLA health check status is 'dead'. The SLA targets are correctly configured and the health check is detecting the failure, but the manual strategy overrides dynamic path selection, so traffic continues to be sent to the dead primary interface. To enable failover, the strategy must be set to 'optimal' or 'maximize-bandwidth' (or similar dynamic strategy), or the preferred member must be manually updated.

Answer

The SD-WAN rule's 'set status' is set to 'disable'

Answer

The secondary interface has a higher cost than the primary interface

Answer

The 'set update-static-route' is not enabled on the SD-WAN

Question 18

A FortiGate is configured with two WAN members in an SD-WAN zone. The performance SLA monitors latency to a probe server. The rule uses 'best quality' strategy. After some time, one member fails the SLA. Which action does the FortiGate take for existing sessions that were using that member?

Accepted Answer

Existing sessions continue on the failed member until they timeout. When a WAN member fails the performance SLA in an SD-WAN 'best quality' strategy, FortiGate does not disrupt existing sessions that were already using that member. Instead, those sessions continue on the failed member until they naturally timeout or are torn down, because the SD-WAN rule only influences the path selection for new sessions. This behavior is by design to avoid breaking active connections due to transient SLA fluctuations.

Answer

All sessions are dropped and the member is removed from the zone

Answer

Existing sessions are re-evaluated and may be moved based on policy

Answer

Existing sessions are immediately moved to another member

Question 19

An admin creates a VDOM named 'CustomerA' with inter-VDOM link to the management VDOM. The admin wants CustomerA administrators to manage only their own VDOM. Which configuration step is required?

Accepted Answer

Create a new administrator and set the 'VDOM' field to 'CustomerA' and assign a profile with appropriate permissions. To restrict a VDOM administrator to manage only their own VDOM, you must create a new administrator account and explicitly set the 'VDOM' field to that VDOM (e.g., 'CustomerA') and assign a profile with the necessary permissions. This ensures the admin's scope is limited to that VDOM, preventing access to the management VDOM or other VDOMs.

Answer

Use the 'config system admin' command and set trusthost to the admin's IP

Answer

Place the management VDOM and CustomerA in different administrative domains (ADOMs) in FortiManager

Answer

Enable admin-role override in the VDOM settings

Question 20

Which FortiManager feature allows an administrator to view the exact CLI commands that will be pushed to a managed FortiGate before installation?

Accepted Answer

Install Preview. Install Preview is the correct answer because it allows an administrator to review the exact CLI commands that FortiManager will push to a managed FortiGate during the next installation. This feature provides a pre-installation view of the configuration changes, enabling verification before committing changes to the device.

Answer

Policy Check

Answer

Revision History

Answer

Device Manager Dashboard