NSE7 Practice Test 4 — 25 Questions

Question 1

Which FortiManager feature allows administrators to view the exact configuration changes that would be applied to a managed FortiGate before committing them?

Accepted Answer

Install preview. Install preview is the correct answer because it allows administrators to see the exact CLI commands that will be pushed to a managed FortiGate during the next install operation, without actually applying them. This feature provides a diff-like view of the configuration changes, enabling validation before committing changes to production devices.

Answer

Revision history

Answer

Device manager

Answer

Policy checker

Question 2

A FortiGate is configured with SD-WAN using load balancing algorithm 'source-dest-ip'. What is the primary characteristic of this algorithm?

Accepted Answer

All traffic from the same source IP to the same destination IP uses the same SD-WAN member.. The 'source-dest-ip' load balancing algorithm in SD-WAN uses a hash of both the source IP and destination IP to deterministically select an SD-WAN member. This ensures that all packets belonging to the same flow (same source-destination pair) are consistently forwarded over the same member, preserving per-flow stickiness and avoiding out-of-order delivery.

Answer

Traffic is sent to the member with the highest bandwidth.

Answer

Traffic is sent to the member with the lowest cost metric.

Answer

Traffic is distributed evenly across all SD-WAN members regardless of source or destination.

Question 3

A network administrator runs 'get system ha status' on a FortiGate HA cluster and sees that only one unit shows as primary. The secondary unit shows as 'standalone' with no HA peer detected. What is the MOST likely cause of this issue?

Accepted Answer

The heartbeat interface is down or misconfigured. When a secondary unit shows as 'standalone' with no HA peer detected, it indicates that the heartbeat communication between the two FortiGate units has failed. The most common cause is that the heartbeat interface is down, misconfigured, or not physically connected, preventing the units from discovering each other as HA peers. Without a functioning heartbeat link, the secondary unit cannot join the cluster and remains in standalone mode.

Answer

The cluster serial numbers do not match

Answer

The HA group ID is different on each unit

Answer

The HA priority on the secondary unit is set to 0

Question 4

A network administrator wants to delegate management of a specific VDOM to a junior administrator. The junior should be able to modify firewall policies and objects within that VDOM but not change system settings or other VDOMs. Which administrative access configuration meets this requirement?

Accepted Answer

Create a local user with an admin profile that has permissions for that VDOM only. FortiGate allows you to create a local user with an admin profile that has permissions scoped to a specific VDOM. By assigning the junior administrator to that VDOM-only profile, they can modify firewall policies and objects within that VDOM but cannot change system settings or access other VDOMs. This is the standard method for delegating VDOM-specific administrative access without granting global or multi-VDOM privileges.

Answer

Place the VDOM in transparent mode to allow full access

Answer

Create a RADIUS user that is assigned to the VDOM group

Answer

Use the management VDOM feature to assign the junior admin to the VDOM

Question 5

What is the purpose of FortiAnalyzer in a Fortinet security fabric?

Accepted Answer

To collect and analyze logs, generate reports, and provide visibility into security events. FortiAnalyzer is the centralized logging and analytics platform within the Fortinet Security Fabric. It aggregates logs from FortiGate and other Fabric devices, correlates events, generates compliance reports, and provides a single-pane-of-glass view for security monitoring and forensic analysis. This directly supports visibility and reporting, not real-time threat prevention or configuration management.

Answer

To provide sandboxing and advanced threat protection

Answer

To act as a network firewall and IPS

Answer

To manage and deploy configurations to FortiGates

Question 6

An administrator configures a FortiGate with VDOMs and notices that the 'config vdom' command lists multiple VDOMs, but only one VDOM is shown in the 'show full-configuration' output. What is the most likely reason?

Accepted Answer

The administrator is in the context of a specific VDOM. The 'config vdom' command lists all VDOMs configured on the FortiGate because it operates in the global context. However, 'show full-configuration' only displays the configuration of the current VDOM context. If the administrator is inside a specific VDOM (e.g., after executing 'config vdom' and 'edit <vdom-name>'), the output is scoped to that VDOM, not the global configuration. This is a fundamental behavior of VDOM-based CLI navigation in FortiOS.

Answer

The VDOMs are not properly synchronized

Answer

The VDOMs are not assigned any interfaces

Answer

The FortiGate is in transparent mode

Question 7

Which technology uses DMARC reports to help administrators identify unauthorized use of their email domain?

Accepted Answer

DMARC. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the correct answer because it specifically uses aggregate and forensic reports (DMARC reports) to provide administrators with visibility into how their email domain is being used, including unauthorized or spoofed emails. These reports are generated by receiving mail servers and sent back to the domain owner, detailing authentication results from SPF and DKIM checks, which helps identify and mitigate domain abuse.

Answer

SPF

Answer

DKIM

Answer

FortiMail

Question 8

When troubleshooting an IPsec VPN phase 1 negotiation failure, which debug command should the administrator run to see detailed IKE negotiation messages?

Accepted Answer

diagnose debug application ike -1. The command 'diagnose debug application ike -1' enables detailed IKE (Internet Key Exchange) debug messages in FortiOS, which are essential for troubleshooting Phase 1 negotiation failures. This command captures the full IKE negotiation exchange, including proposals, authentication, and Diffie-Hellman group selection, allowing the administrator to identify where the failure occurs.

Answer

diagnose vpn ike log

Answer

get vpn ipsec tunnel details

Answer

diagnose debug application ipsec -1

Question 9

Which SD-WAN load balancing algorithm is best for ensuring that all traffic from a specific source-destination pair uses the same WAN link?

Accepted Answer

Source-dest IP. Source-dest IP (B) is the correct algorithm because it uses a hash of both the source and destination IP addresses to deterministically select a WAN link. This ensures that all packets belonging to the same flow (same source-destination pair) are consistently forwarded over the same link, preserving packet order and avoiding reordering issues.

Answer

Spillover

Answer

Volume

Answer

Lowest-cost

Question 10

An administrator is planning a multi-VDOM deployment with a management VDOM. Which TWO statements about management VDOMs are correct? (Choose two.)

Accepted Answer

The management VDOM can be used for FortiGuard updates. Option A is correct because in a multi-VDOM FortiGate deployment the management VDOM is specifically designed to carry out-of-band management functions, including FortiGuard update traffic (FortiGuard services such as AV/IPS signature and web-filter database downloads), which is why it is often given its own dedicated management interface and route. Option D is correct because the management VDOM is intended to host administrative access services such as HTTPS GUI and SSH, allowing administrators to log in and manage the device independently of the production VDOMs. The remaining options are incorrect: the management VDOM can still contain firewall policies (so B is false), it does not require a separate license since VDOMs are a built-in feature of the FortiGate platform (so C is false), and user traffic is not required to traverse the management VDOM—it is reserved for management-plane traffic, not data-plane forwarding (so E is false).

Answer

The management VDOM cannot have firewall policies

Answer

The management VDOM requires a separate license

Answer

All user traffic must pass through the management VDOM

Question 11

A FortiGate administrator is configuring a multi-VDOM deployment. The administrator wants to use a single physical interface for multiple VDOMs. Which TWO methods allow this?

Accepted Answer

Use NP6 virtual interfaces (e.g., virtual wire) on supported models. Option C is correct because a physical interface can be partitioned into VLAN subinterfaces (e.g., port1.10, port1.20), and each subinterface can be assigned to a different VDOM, allowing one physical port to serve multiple VDOMs. Option B is correct because on NP6-accelerated FortiGate models, NP6 virtual interfaces such as virtual wire pairs (and NP6 vlinks) can be created and mapped into different VDOMs, letting a single physical NP6 interface be shared across VDOMs. Option A is incorrect because a physical interface can belong to only one VDOM at a time; it cannot be directly assigned to multiple VDOMs. Option D is incorrect because a software switch is a single interface object that resides in one VDOM and cannot be assigned to multiple VDOMs simultaneously. Option E is incorrect because inter-VDOM routing is used to pass traffic between VDOMs and does not allow sharing the same physical interface or the same IP subnet across VDOMs.

Answer

Use the same physical interface in multiple VDOMs directly

Answer

Create a software switch interface and assign it to multiple VDOMs

Answer

Configure inter-VDOM routing to share the same IP subnet

Question 12

What is the purpose of using a prefix list in route redistribution?

Accepted Answer

To match routes based on IP prefix and prefix length. A prefix list is used in route redistribution to match routes based on their IP prefix and prefix length (e.g., 192.168.0.0/16). This allows granular control over which routes are redistributed from one routing protocol to another, such as from OSPF to BGP, by filtering based on the network address and subnet mask.

Answer

To define a list of allowed source IPs for management access

Answer

To specify the next-hop for a set of routes

Answer

To set BGP community values on matched prefixes

Question 13

Which FortiManager feature allows an administrator to roll back a policy package to a previous version?

Accepted Answer

Revision history. FortiManager's Revision History feature automatically creates a versioned snapshot of policy packages each time they are installed or modified. Administrators can browse prior revisions and revert to any previous version, restoring the exact policy state. This is the built-in rollback mechanism for policy packages.

Answer

Install preview

Answer

Device manager

Answer

Automation stitch

Question 14

Which Fortinet product is specifically designed to deploy decoys and lures to detect lateral movement and early-stage attacks inside the network?

Accepted Answer

FortiDeceptor. FortiDeceptor is specifically designed to deploy decoys and lures that mimic real assets (e.g., servers, endpoints, IoT devices) to attract and detect lateral movement and early-stage attacks inside the network. It uses deception technology to create a realistic attack surface, triggering alerts when an attacker interacts with a decoy, without relying on signatures or behavioral analysis.

Answer

FortiSandbox

Answer

FortiEDR

Answer

FortiClient

Question 15

A FortiGate in HA active-passive mode has two VDOMs. VDOM-1 is configured for management (management VDOM). The administrator connects to the management VDOM IP to manage the device. What is a characteristic of the management VDOM?

Accepted Answer

It provides administrative access and is separate from data VDOMs. In an HA active-passive setup with multiple VDOMs, a management VDOM is dedicated to administrative access (e.g., SSH, HTTPS, SNMP) and is logically separated from data VDOMs that handle production traffic. This separation ensures that management traffic does not interfere with data plane operations and that administrative access remains available even if data VDOMs experience issues. The management VDOM can be any VDOM, not necessarily the root, and its configuration is not automatically synchronized to other VDOMs.

Answer

It automatically synchronizes configuration to other VDOMs

Answer

It must be the root VDOM

Answer

It can only be accessed via the console port

Question 16

A FortiGate administrator is planning to deploy VDOMs to separate customer traffic. The administrator wants to use FortiManager for centralized management. Which TWO prerequisites must be met before the VDOMs can be managed from FortiManager?

Accepted Answer

The FortiGate must be assigned to an ADOM. FortiManager uses ADOMs (Administrative Domains) to logically group managed devices, and a FortiGate must be assigned to an ADOM before its VDOMs can be managed. Option D is correct because the FortiGate must be added to the FortiManager device list (via model or managed registration) to establish communication and allow policy/object provisioning to its VDOMs.

Answer

Inter-VDOM routing must be enabled

Answer

FortiAnalyzer must be registered with FortiManager

Answer

All VDOMs must be in the same ADOM

Question 17

An administrator is troubleshooting why a new firewall policy on a managed FortiGate is not taking effect. The policy was created in FortiManager and installed successfully. Which TWO steps should the administrator verify to identify the issue? (Select TWO.)

Accepted Answer

Check if the policy is disabled. Option C is correct because a policy that exists in FortiManager and installs successfully can still be administratively disabled on the managed FortiGate, in which case it will never match traffic; the administrator should confirm the policy's status is enabled. Option D is correct because firewall policies are evaluated top-down and the first matching policy wins, so if a broader or conflicting policy appears above the new policy in the policy list, the new policy will never be hit; verifying its position in the order is essential. Option A is not appropriate because rebooting the FortiGate does not resolve a policy configuration or ordering problem and would only cause unnecessary downtime. Option B is not the right focus because routing determines whether traffic reaches the FortiGate and which interface/next-hop is used, but the scenario states the policy itself is not taking effect, not that traffic is failing to route. Option E is not relevant because HA status affects failover and session synchronization, not whether a specific installed policy matches traffic.

Answer

Reboot the FortiGate

Answer

Review the FortiGate's routing table

Answer

Verify the FortiGate's HA status

Question 18

An admin creates a VDOM named 'CustomerA' with inter-VDOM link to the management VDOM. The admin wants CustomerA administrators to manage only their own VDOM. Which configuration step is required?

Accepted Answer

Create a new administrator and set the 'VDOM' field to 'CustomerA' and assign a profile with appropriate permissions. To restrict a VDOM administrator to manage only their own VDOM, you must create a new administrator account and explicitly set the 'VDOM' field to that VDOM (e.g., 'CustomerA') and assign a profile with the necessary permissions. This ensures the admin's scope is limited to that VDOM, preventing access to the management VDOM or other VDOMs.

Answer

Use the 'config system admin' command and set trusthost to the admin's IP

Answer

Place the management VDOM and CustomerA in different administrative domains (ADOMs) in FortiManager

Answer

Enable admin-role override in the VDOM settings

Question 19

An administrator wants to verify that a BGP route is being advertised to a neighbor. Which command displays the routes that FortiGate is advertising to a specific BGP neighbor?

Accepted Answer

get router info bgp neighbor advertised-routes. The command 'get router info bgp neighbor advertised-routes' is the specific FortiOS CLI command that displays the BGP routes that the FortiGate has advertised to a particular BGP neighbor. This command queries the BGP table for routes that have been sent to the neighbor and are in the Adj-RIB-Out, which is exactly what the administrator needs to verify outbound route advertisement.

Answer

get router info bgp network

Answer

diagnose ip router bgp routes

Answer

show ip bgp summary

Question 20

Which FortiClient ATP feature provides protection against zero-day malware by monitoring process behavior and blocking suspicious activities at the endpoint?

Accepted Answer

FortiClient Exploit Prevention. FortiClient Exploit Prevention is correct because it uses real-time behavioral monitoring of process activities—such as API calls, memory access patterns, and code injection attempts—to detect and block zero-day malware that has no known signature. Unlike signature-based detection, this feature identifies malicious behavior at runtime, making it effective against previously unseen threats.

Answer

FortiClient Web Filtering

Answer

FortiClient Cloud Sandbox

Answer

FortiClient Vulnerability Scan