NSE7 Practice Test 5 — 25 Questions

Question 1

An administrator wants to create a separate virtual firewall instance on a FortiGate to isolate a DMZ environment. The DMZ must have its own routing table, firewall policies, and administrators. Which FortiGate feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Virtual Domains (VDOMs). Virtual Domains (VDOMs) are the FortiGate feature that allows the creation of multiple independent virtual firewalls within a single physical appliance. Each VDOM operates with its own separate routing table, firewall policies, and administrative domains, making it the correct choice for isolating a DMZ environment with dedicated administrators and routing.

Answer

Virtual Router Redundancy Protocol (VRRP)

Answer

Virtual LANs (VLANs)

Answer

Security Fabric

Question 2

What is the primary function of FortiAnalyzer's FortiView feature?

Accepted Answer

Real-time traffic monitoring and visualization. FortiView on FortiAnalyzer provides real-time traffic monitoring and visualization by aggregating logs from FortiGate devices and displaying them in graphical dashboards. It allows administrators to instantly view top talkers, applications, threats, and other network activity without needing to run manual queries, making it the primary function for live traffic analysis.

Answer

Centralized device configuration management

Answer

Scheduling and generating compliance reports

Answer

Automated remediation of security incidents

Question 3

An administrator wants to use FortiAnalyzer to generate reports for compliance. Which two data sources can be included in a FortiAnalyzer report? (Choose two.)

Accepted Answer

Log data from FortiGate. FortiAnalyzer reports are built from log data collected from FortiGate devices, which includes traffic logs, event logs, and security logs. This log data is the primary source for compliance reporting because it provides detailed records of network activity. FortiView traffic statistics are also a valid data source, as they aggregate real-time and historical traffic data from FortiGate logs, allowing reports to include graphical summaries and top-talker information.

Answer

Routing table information from routers

Answer

Configuration backups from FortiManager

Answer

User authentication logs from LDAP servers

Question 4

A FortiGate administrator needs to manage multiple FortiGate devices centrally. They want to deploy policy packages from FortiManager to specific VDOMs on each device. Which FortiManager object must be configured first?

Accepted Answer

Administrative Domain (ADOM). The Administrative Domain (ADOM) is the top-level container in FortiManager that defines the management boundary for a set of FortiGate devices and their VDOMs. Before you can create or assign policy packages to specific VDOMs on managed devices, you must first configure the ADOM to enable multi-tenancy and VDOM-level management. Without an ADOM, FortiManager cannot isolate or target individual VDOMs for policy deployment.

Answer

Device Group

Answer

Install Preview

Answer

Policy Package

Question 5

An administrator wants to see the current number of active sessions on a FortiGate. Which command should the admin use?

Accepted Answer

diagnose sys session stat. The command 'diagnose sys session stat' displays a summary of session statistics, including the total number of active sessions currently tracked by the FortiGate's session table. This is the correct way to quickly see the current active session count without listing every individual session, which would be overwhelming and resource-intensive.

Answer

diagnose sys session list

Answer

get system performance status

Answer

get system ha status

Question 6

An administrator needs to back up the configuration of a FortiGate managed by FortiManager before making major changes. Which feature in FortiManager should the administrator use?

Accepted Answer

Revision history. Revision History in FortiManager allows administrators to create, view, and restore previous configuration versions of managed FortiGate devices. This is the correct feature for backing up a configuration before making major changes, as it provides a point-in-time snapshot that can be rolled back if needed.

Answer

Policy package import/export

Answer

Automation stitch

Answer

Install preview

Question 7

An administrator runs 'diagnose sys session list' and sees sessions with 'proto=6 proto_state=02' and a long duration. The administrator is troubleshooting why sessions are not being terminated after a policy change that should block the traffic. What does 'proto_state=02' indicate?

Accepted Answer

The session is in established state (TCP connection active). In Fortinet's 'diagnose sys session list' output, 'proto=6' indicates TCP, and 'proto_state=02' maps to the TCP established state (ESTABLISHED). This means the session has completed the three-way handshake and is actively passing data. A long duration in this state explains why the session persists even after a policy change that should block new traffic—the existing session remains in the kernel session table until it times out or is explicitly cleared, because FortiGate's stateful inspection does not retroactively terminate established sessions upon policy modification.

Answer

The session is in TIME_WAIT state

Answer

The session is in SYN_SENT state, waiting for a SYN-ACK

Answer

The session is in FIN_WAIT state, closing the connection

Question 8

A FortiGate is configured with multiple VDOMs. The administrator needs to allow traffic from a VDOM named 'CustomerA' to reach a server in VDOM 'SharedServices'. Both VDOMs are on the same FortiGate. Which configuration is necessary?

Accepted Answer

Enable inter-VDOM routing and create policies allowing traffic between the VDOMs. Inter-VDOM routing is required to route traffic between VDOMs on the same FortiGate. This is enabled globally via the CLI command 'config system global' and 'set inter-vdom-routing enable'. Once enabled, you must create firewall policies between the VDOMs (using the VDOM link or directly referencing the VDOMs in policies) to permit the traffic. Without inter-VDOM routing, VDOMs are isolated Layer 3 domains and cannot communicate.

Answer

Place both VDOMs in the same ADOM in FortiManager

Answer

Create a VDOM link between the two VDOMs

Answer

Configure the FortiGate in transparent mode

Question 9

Which TWO statements correctly describe the behavior of SD-WAN rules when using the 'maximize-bandwidth' strategy?

Accepted Answer

The administrator can assign different weights to members to influence the proportion of traffic each handles.. The 'maximize-bandwidth' strategy in SD-WAN rules uses weighted load balancing, where the administrator assigns weights to each member link. The proportion of traffic each member handles is directly proportional to its assigned weight, allowing fine-grained control over bandwidth utilization across multiple WAN links.

Answer

The strategy ensures that all traffic uses the member with the highest bandwidth.

Answer

Traffic from a single session can be split across multiple members for better performance.

Answer

Traffic is distributed based on session count to keep each link equally utilized.

Question 10

What is the purpose of a management VDOM in a multi-VDOM FortiGate deployment?

Accepted Answer

To host the management interfaces and administrative services (GUI, SSH) while other VDOMs carry user traffic. A management VDOM is dedicated to hosting all administrative interfaces (GUI, SSH, SNMP, syslog) and management services, isolating them from user traffic VDOMs. This separation ensures that management access remains available even if a data VDOM is overloaded or compromised, and it centralizes administrative control without mixing management and data plane functions.

Answer

To route traffic between different VDOMs

Answer

To aggregate logs from all other VDOMs

Answer

To enforce inter-VDOM traffic policies centrally

Question 11

In a multi-VDOM deployment, an administrator needs to route traffic between VDOM-A and VDOM-B. The administrator creates a VDOM link between the two VDOMs. What additional configuration is required on each VDOM to enable inter-VDOM traffic?

Accepted Answer

Configure a static route on each VDOM pointing to the other VDOM's networks via the VDOM link, and create a firewall policy allowing traffic. Inter-VDOM traffic via a VDOM link requires both a static route on each VDOM pointing to the remote VDOM's networks through the VDOM link interface, and a firewall policy on each VDOM that permits the desired traffic. Without the static route, the VDOM does not know how to reach the other VDOM's subnets; without the firewall policy, traffic is blocked by the implicit deny rule. The VDOM link itself provides the Layer 2 or Layer 3 connectivity between the VDOMs, but routing and policy enforcement are mandatory for traffic to flow.

Answer

Only a firewall policy on VDOM-A allowing traffic to VDOM-B

Answer

Assign the VDOM link interfaces to the same VDOM

Answer

Enable 'inter-vdom-routing' under system settings only

Question 12

An administrator runs the command 'diagnose sys session filter dport 443' on a FortiGate and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in SYN_SENT state, meaning the three-way handshake is incomplete. The output shows `proto=6` (TCP), `proto_state=01`, `duration=3600`, and `expire=3599`. In FortiGate's session table, `proto_state=01` represents the TCP state `SYN_SENT`, which means the session has sent a SYN but has not yet received a SYN-ACK, so the three-way handshake is incomplete. The `expire=3599` indicates the session will time out in 3599 seconds if the handshake does not complete, but the session is not yet established.

Answer

The session is fully established and will expire in about 3599 seconds

Answer

The traffic is being blocked by the firewall policy

Answer

The session is using HTTPS and has been inspected

Question 13

A FortiGate administrator is integrating a FortiSwitch managed by the FortiGate. They want to configure a VLAN interface on the FortiSwitch for user traffic. Which configuration is required on the FortiGate?

Accepted Answer

Configure a VLAN on the FortiSwitch under the switch controller and assign it to a port. When integrating a FortiSwitch managed by a FortiGate, VLANs for user traffic must be created under the switch controller on the FortiGate. This allows the FortiGate to push the VLAN configuration to the FortiSwitch, including assigning the VLAN to a specific port or port group. Option B correctly describes this process, as the switch controller manages the FortiSwitch as an extension of the FortiGate, not as a standalone device.

Answer

Enable DHCP relay on the FortiSwitch VLAN

Answer

Use the config system interface to create a VLAN on the FortiGate and tag it on the trunk

Answer

Create a VLAN subinterface on the FortiGate's port that connects to the FortiSwitch

Question 14

A FortiGate running FortiOS 7.2 has multiple VDOMs. The administrator notices that inter-VDOM routing between two VDOMs is not working. Configuration shows a firewall policy allowing the traffic, and the route table shows routes to the destination VDOM. What additional configuration is required?

Accepted Answer

Create a VDOM link interface pair and assign them to the respective VDOMs. Inter-VDOM routing requires a VDOM link, which is a pair of logical interfaces (one in each VDOM) that are directly connected. Without this link, the VDOMs cannot exchange traffic even if firewall policies and routes exist, because they operate as separate virtual firewalls with isolated forwarding tables.

Answer

Configure a static route with a gateway IP in the destination VDOM

Answer

Assign an IP address to the VLAN interface on the source VDOM

Answer

Enable 'inter-vdom' under config system global

Question 15

An administrator configures a multi-VDOM FortiGate in transparent mode. The admin notices that the management IP is reachable from both interfaces, but traffic passing through the device is not being inspected. What is the likely issue?

Accepted Answer

The VDOM is in transparent mode, but no firewall policy is applied to the traffic. In transparent mode, a FortiGate acts as a Layer 2 bridge, and traffic passing through the device is controlled by firewall policies, not by routing. Even though the management IP is reachable (because it is a separate IP on the bridge interface), no traffic inspection occurs unless an explicit firewall policy is configured to allow and inspect the traffic between the bridge interfaces. Option B correctly identifies that the missing firewall policy is the root cause.

Answer

Inter-VDOM routing is misconfigured

Answer

The FortiGate needs a default route

Answer

The management IP is assigned to the wrong VDOM

Question 16

A network engineer needs to collect logs from multiple FortiGates and generate compliance reports. Which TWO FortiAnalyzer features should be used?

Accepted Answer

Log analytics. Log analytics (option B) is correct because it provides the ability to search, filter, and visualize logs from multiple FortiGates, enabling the identification of trends and anomalies necessary for compliance reporting. Reports (option C) is correct because FortiAnalyzer includes a dedicated reporting engine that can generate scheduled or on-demand compliance reports based on collected logs, with pre-defined templates for standards like PCI DSS, HIPAA, and SOX.

Answer

ADOM configuration

Answer

Automation stitches

Answer

Policy packages

Question 17

A FortiManager administrator wants to push policy package changes to a managed FortiGate, but wants to see what changes will be applied before committing. Which FortiManager feature should the administrator use?

Accepted Answer

Install preview. Install preview is the correct feature because it allows the administrator to simulate the installation of policy package changes on a managed FortiGate without actually applying them. This provides a detailed diff of what will be added, modified, or removed, enabling verification before committing the changes. It is specifically designed for pre-commit validation in FortiManager's centralized management workflow.

Answer

Meta fields

Answer

Automation stitch

Answer

Revision history

Question 18

A network administrator configures SD-WAN on a FortiGate with two WAN members (port1, port2). They set up a performance SLA to measure latency to 8.8.8.8. The SLA shows both members are 'alive'. However, traffic matching an SD-WAN rule with 'best quality' strategy is not using the lowest-latency link. What is the MOST likely cause?

Accepted Answer

The performance SLA does not have 'latency' as the first metric in the priority order. The 'best quality' strategy selects the link with the highest priority based on the performance SLA's metric order. If latency is not the first metric in the priority list (e.g., jitter or packet loss is first), the algorithm will prefer the link that best satisfies the first metric, not necessarily the lowest latency. Thus, even though both links are alive, the link with lower latency may be deprioritized if it performs worse on the first metric.

Answer

Both WAN members have the same cost in the SD-WAN configuration

Answer

The SD-WAN rule is configured with 'manual' strategy

Answer

The SD-WAN rule has 'set-match' enabled for source IP

Question 19

What is the purpose of a global ADOM in FortiManager?

Accepted Answer

To provide a common object repository that can be referenced by other ADOMs. A global ADOM in FortiManager serves as a shared object repository (e.g., addresses, services, schedules) that can be referenced by other ADOMs, enabling centralized management of common objects across multiple administrative domains. This avoids duplication and ensures consistency, as changes in the global ADOM propagate to all ADOMs that reference those objects. It does not directly create or push firewall policies; instead, it provides the building blocks for policies within individual ADOMs.

Answer

To create global firewall policies applicable to all devices

Answer

To manage all devices in a single ADOM regardless of location

Answer

To store global logs from all FortiGates

Question 20

A FortiGate administrator is planning a multi-VDOM deployment for a service provider. Which TWO statements are true about VDOM limitations and best practices?

Accepted Answer

It is recommended to use a dedicated management VDOM. Using a dedicated management VDOM is a best practice in multi-VDOM deployments. It isolates administrative traffic (e.g., HTTPS, SSH, SNMP) from data-plane VDOMs, ensuring that management access remains available even if a data VDOM fails or is misconfigured. This also simplifies auditing and RBAC by centralizing admin access without exposing production traffic.

Answer

There is no limit to the number of VDOMs supported

Answer

All VDOMs must share the same routing table

Answer

VDOMs cannot operate in transparent mode