NSE7 Practice Test 5 — 25 Questions

Question 1

An administrator receives an error when trying to create a ZTNA proxy rule: 'The ZTNA proxy rule requires a valid application mapping.' What does this indicate?

Accepted Answer

The application mapping object is not defined. A ZTNA proxy rule maps an external FQDN/port to an internal application. The error means the application mapping (which defines the internal server) is missing or misconfigured.

Answer

The FortiClient EMS is not reachable

Answer

The SSL certificate is missing

Answer

The firewall policy is not in place

Question 2

An administrator wants to ensure that FortiGate validates the identity of the remote VPN peer using a certificate during IKEv2 phase 1. Which authentication method should the administrator select in the IPsec phase 1 configuration?

Accepted Answer

Signature (RSA). Selecting Signature (RSA) in the IPsec phase 1 configuration enables the FortiGate to use digital certificates for authentication, where the remote peer's identity is validated using its certificate. This meets the requirement of validating the identity of the remote VPN peer using a certificate during IKEv2 phase 1.

Answer

Aggressive mode

Answer

Pre-shared key

Answer

EAP

Question 3

In FortiAnalyzer, which tool provides real-time traffic monitoring and allows drilling down into details such as top talkers, applications, and threats?

Accepted Answer

FortiView. FortiView in FortiAnalyzer provides real-time traffic monitoring with drill-down capabilities into top talkers, applications, and threats. It aggregates data from FortiGate logs and presents it in an interactive dashboard, allowing administrators to identify and investigate network anomalies instantly without generating reports.

Answer

Reports

Answer

Incidents

Answer

Log Viewer

Question 4

A network administrator needs to configure SD-WAN on a FortiGate to distribute traffic across two WAN links based on session count. Which load balancing algorithm should be selected in the SD-WAN rule?

Accepted Answer

Sessions. The 'Sessions' load balancing algorithm distributes new sessions across SD-WAN members based on the current session count, ensuring an even distribution of sessions. This directly matches the requirement to distribute traffic based on session count, as it selects the member with the fewest active sessions for each new session.

Answer

Volume

Answer

Lowest-cost

Answer

Spillover

Question 5

An HA cluster of two FortiGates is experiencing split-brain. After investigation, you find that the heartbeat link is down on the primary unit. Which action will resolve the split-brain condition?

Accepted Answer

Restore the heartbeat link by checking cables, interfaces, and VLAN configuration. Split-brain occurs when HA peers lose heartbeat communication and both assume the primary role. Since the root cause is a failed heartbeat link on the primary unit, restoring that link (checking cables, interfaces, VLAN configuration) re-establishes the control channel, allowing the cluster to negotiate roles and resolve the split-brain condition without disrupting services or requiring a full HA reset.

Answer

Disable HA on both units and re-enable

Answer

Increase the HA priority on the primary unit

Answer

Reboot the secondary unit

Question 6

A FortiGate is configured as a SAML service provider (SP) for ZTNA. Users authenticate via an external IdP. After authentication, users are not able to access applications even though the ZTNA proxy rule lists them. What should the administrator check FIRST?

Accepted Answer

The ZTNA proxy rule's allowed group does not include the user's group. In FortiGate ZTNA with SAML SSO, after the IdP authenticates the user, FortiGate maps the SAML assertion's group attribute to a local or remote group and then evaluates the ZTNA proxy rule. If the user's group is not listed in the rule's allowed groups, access is denied even though authentication succeeded. Therefore, the first thing to check is whether the ZTNA proxy rule's allowed group includes the group the user was mapped to.

Answer

The FortiClient EMS license is invalid

Answer

The application server is unreachable from FortiGate

Answer

The SAML IdP certificate is expired

Question 7

An administrator is troubleshooting an IPsec VPN Phase 2 negotiation failure. The debug shows 'no matching phase 2 proposal' from the remote peer. Which TWO of the following are likely causes? (Choose two.)

Accepted Answer

The local and remote proxy IDs (subnets) are not matching. IPsec Phase 2 negotiation requires the proxy IDs (local and remote subnets) to match exactly between peers. The 'no matching phase 2 proposal' debug message indicates the remote peer received a proposal with a subnet or traffic selector that does not match its configured proxy ID. This is a common misconfiguration when defining which traffic should be encrypted over the VPN tunnel.

Answer

The pre-shared key is incorrect

Answer

The firewall policy does not allow UDP port 500

Answer

The IKE version (IKEv1 vs IKEv2) is different

Question 8

A FortiGate administrator wants to implement ZTNA to control access to an internal application server. Users will access the application via FortiClient. Which configuration step is REQUIRED to allow FortiClient to forward traffic to the ZTNA gateway?

Accepted Answer

Configure a ZTNA gateway on the FortiGate with an access proxy rule for the application. To allow FortiClient to forward traffic to the ZTNA gateway, the FortiGate must be configured as a ZTNA gateway with an access proxy rule that maps the application to a specific hostname and port. FortiClient then connects to the ZTNA gateway's proxy address, which forwards traffic to the internal application server. Option A is incorrect because a CA-signed certificate is not required for FortiClient; FortiGate can use a self-signed certificate for ZTNA. Option B is incorrect because a firewall policy from WAN to the application server would bypass ZTNA and expose the server directly. Option D is incorrect because the application server does not need to trust FortiClient's IP range; ZTNA uses identity-based access, not IP-based.

Answer

Install a CA-signed certificate on FortiClient

Answer

Create a firewall policy from the WAN interface to the application server

Answer

Configure the application server to accept connections from FortiClient's IP range

Question 9

A network admin is deploying a FortiGate in transparent mode to inspect traffic between two Layer 2 switches. Which of the following statements about transparent mode is correct?

Accepted Answer

Transparent mode requires an IP address on each interface for management purposes. In transparent mode, FortiGate acts as a Layer 2 bridge and does not require IP addresses on its interfaces for forwarding traffic. However, to manage the device (e.g., via SSH, HTTPS, or SNMP), an IP address must be assigned to each interface or to a management VLAN. This allows administrative access while the firewall remains invisible to the Layer 2 network. Option B correctly identifies this requirement.

Answer

Transparent mode can only inspect traffic in one VLAN

Answer

Transparent mode supports NAT policies

Answer

Transparent mode requires VDOMs to be enabled

Question 10

A FortiGate is configured with two SD-WAN members (port1 and port2). The administrator sets an SD-WAN rule with 'set load-balance-mode source-dst-ip' for all internal traffic. The source IP is 10.0.0.1 and destination IP is 172.16.0.1. Which factor determines the outgoing interface for this traffic?

Accepted Answer

The combination of source IP and destination IP hashed to select an interface. With 'set load-balance-mode source-dst-ip', the FortiGate performs a hash of both the source IP and destination IP to deterministically select an outgoing SD-WAN member. This ensures that all packets belonging to the same source-destination pair are consistently forwarded over the same interface, preserving flow symmetry without relying on per-packet metrics.

Answer

The destination IP only

Answer

The source IP only

Answer

The interface with the lowest current utilization

Question 11

A network administrator is troubleshooting a split-brain scenario in an HA cluster. Which TWO conditions can cause split-brain? (Choose two.)

Accepted Answer

Loss of heartbeat link between HA members. Options A and D are correct. Loss of HA heartbeat communication (A) causes both units to think they are primary. Mismatched HA configuration (D) can also cause split-brain. Option B causes failover but not split-brain. Option C is irrelevant.

Answer

One unit has a higher priority

Answer

Firmware version mismatch

Answer

Session pickup is disabled

Question 12

An administrator runs 'get router info bgp summary' and sees that the BGP session to a neighbor is in the 'Idle' state. The neighbor IP is reachable via ping. The BGP configuration uses loopback interfaces with 'update-source loopback1'. What is the MOST likely reason for the Idle state?

Accepted Answer

There is no route on the neighbor back to the FortiGate's loopback IP. The 'Idle' state in BGP indicates that the session cannot start, often due to a missing route to the neighbor's update-source IP. Since the neighbor IP is reachable via ping but the session uses loopback interfaces with 'update-source loopback1', the FortiGate's BGP packets will source from its loopback1 IP. If the neighbor does not have a route back to that loopback IP, it cannot respond to the TCP handshake, leaving the session stuck in Idle. This is a classic BGP loopback peering issue where reachability of the source IP is required, not just the physical interface IP.

Answer

The loopback interface is down or has no IP address assigned

Answer

The BGP neighbor's remote-as is misconfigured

Answer

The BGP timer values (keepalive/hold) are mismatched

Question 13

A FortiGate has multiple IPsec VPNs to different branch offices. The administrator notices that one VPN tunnel is flapping (going up and down repeatedly). From the CLI, 'diagnose vpn ike gateway list' shows the gateway state as 'up' but then quickly goes to 'down'. What is the MOST likely cause?

Accepted Answer

Dead Peer Detection (DPD) retry interval is too short. A flapping IPsec tunnel where the IKE gateway shows 'up' then quickly 'down' is most commonly caused by Dead Peer Detection (DPD) being too aggressive — if the DPD retry interval or retry count is too short, transient packet loss or latency causes the FortiGate to declare the peer dead and tear down the tunnel, which then renegotiates and flaps.

Answer

The remote gateway's certificate is expired

Answer

The phase2 proposal is mismatched

Answer

The pre-shared key is incorrect

Question 14

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration uses certificates for authentication. The admin sees the following log message: 'Certificate validation failed: unable to get local issuer certificate.' What is the most likely cause?

Accepted Answer

The CA certificate that signed the peer's certificate is not imported on the FortiGate. The error 'unable to get local issuer certificate' indicates that the FortiGate cannot find the CA certificate that signed the peer's certificate in its local store. Without the CA certificate, the FortiGate cannot validate the peer's certificate chain. Importing the correct CA certificate resolves the issue.

Answer

The peer's certificate has expired

Answer

The certificate revocation list (CRL) is not configured

Answer

The local certificate does not match the peer's expected CN

Question 15

An administrator wants to enforce that only devices with up-to-date antivirus software can access corporate resources via ZTNA. Which FortiClient feature should be used to enforce this requirement?

Accepted Answer

ZTNA tags. ZTNA tags in FortiClient are dynamic posture attributes (such as antivirus status, OS patch level, and domain membership) that FortiGate/FortiClient EMS uses to make zero-trust access decisions. By tagging endpoints based on their antivirus being up-to-date, the administrator can enforce a policy that only tagged devices are allowed to reach corporate resources. This is the core mechanism Fortinet uses for ZTNA posture-based access control.

Answer

VPN tunnel

Answer

Web filter

Answer

Application firewall

Question 16

A security analyst wants to use automation stitches on FortiGate to automatically block IP addresses that trigger an IPS signature for 'SSH Brute Force'. Which two components are required to create this automation stitch? (Choose two.)

Accepted Answer

Action: 'Add to Block List'. Option A ('Add to Block List') is correct because the automation stitch must contain an action that actually enforces the block; the 'Add to Block List' action inserts the offending source IP into the FortiGate's local block list so subsequent traffic from that address is dropped. Option D ('IPS Event') is correct because the stitch needs a trigger that fires when the IPS signature for 'SSH Brute Force' is detected, and the IPS Event trigger is the mechanism that initiates the automation stitch upon an IPS log event. Together, the IPS Event trigger and the Add to Block List action form the required trigger-plus-action pair for this scenario. Option B (FortiAnalyzer log query) is not required because automation stitches on FortiGate are triggered by local event/log conditions, not by querying FortiAnalyzer. Option C (Email Notification) is an action that would only notify someone rather than block the IP, so it does not fulfill the blocking requirement. Option E (FortiGuard category) relates to web filtering categorization and is unrelated to blocking an IP that triggered an IPS signature.

Answer

FortiAnalyzer log query

Answer

Action: 'Email Notification'

Answer

FortiGuard category

Question 17

A FortiGate administrator enables Dead Peer Detection (DPD) on an IPsec VPN tunnel. What is the primary purpose of DPD?

Accepted Answer

To detect when the remote peer is no longer reachable. DPD is used to monitor the liveness of the remote peer. If the peer becomes unreachable, DPD detects it and can trigger a failover or tunnel teardown, ensuring traffic does not blackhole.

Answer

To dynamically adjust the tunnel MTU

Answer

To encrypt the IKE negotiation traffic

Answer

To automatically renegotiate the IKE SA before it expires

Question 18

In a hub-and-spoke VPN, spokes cannot communicate with each other directly. The administrator wants to allow direct spoke-to-spoke traffic without routing through the hub. Which technology should be configured?

Accepted Answer

ADVPN with IKEv2. ADVPN (Auto-Discovery VPN) with IKEv2 is Fortinet's proprietary shortcut mechanism that allows spokes to dynamically establish direct tunnels to one another without permanent spoke-to-spoke configuration. The hub acts as a registration point and uses IKEv2 to negotiate shortcut tunnels between spokes on demand, so traffic no longer has to hairpin through the hub. This is the only option that provides dynamic, on-demand direct spoke-to-spoke connectivity.

Answer

Static routes on spokes

Answer

IKEv1 with mode-config

Answer

GRE over IPsec

Question 19

An organization wants to implement multiple layers of defense against advanced persistent threats. Which three Fortinet solutions would be most effective in an ATP strategy? (Choose three.)

Accepted Answer

FortiSandbox. FortiSandbox is correct because it provides dynamic analysis of suspicious files and URLs in a controlled, isolated environment, detecting zero-day and advanced malware that signature-based solutions miss. It integrates with other Fortinet security products to share threat intelligence and automate blocking, forming a critical layer in an ATP strategy by catching threats that evade initial defenses.

Answer

FortiMail

Answer

FortiWeb

Question 20

During a ZTNA deployment, an administrator notices that traffic from a specific internal application is being routed through the ZTNA gateway but is not reaching the destination server. The FortiGate policy allows the traffic, and the client has a valid ZTNA connection. What is the most likely cause of the issue?

Accepted Answer

The ZTNA proxy rule on the FortiGate is misconfigured, pointing to the wrong destination IP or port.. In a ZTNA deployment, the FortiGate acts as a reverse proxy for internal applications. If the ZTNA proxy rule is misconfigured with an incorrect destination IP or port, the FortiGate will forward the traffic to the wrong backend server or service, causing the connection to fail even though the client has a valid ZTNA connection and the firewall policy permits the traffic.

Answer

The client's FortiClient agent is not connected to the EMS server.

Answer

The destination server does not have internet connectivity.

Answer

The FortiGate policy is set to deny traffic from the client's subnet.