NSE7 Practice Test 26 — 15 Questions

Question 1

A network administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The remote gateway logs show a proposal mismatch. On FortiGate, the administrator runs 'diagnose vpn ike config' and sees 'proposal: aes128-sha1, aes256-sha256'. The remote side expects 'aes256-sha1'. What is the most likely cause?

Accepted Answer

The Phase 1 proposal list does not include the algorithm combination the remote gateway requires. The proposal mismatch occurs because the FortiGate's IKE proposal includes aes256-sha256 but not aes256-sha1, and the remote gateway expects aes256-sha1. The correct action is to add aes256-sha1 to the proposal list.

Answer

The pre-shared key is incorrect

Answer

The Phase 2 selectors are misconfigured

Answer

The IKE version is set to 1 but remote uses 2

Question 2

A FortiGate is receiving BGP routes from a neighbor but not advertising them to other peers. The administrator runs 'get router info bgp network' and sees the routes are in the BGP table but not advertised. What is the most likely cause?

Accepted Answer

An outbound route map is applied that filters these routes. BGP routes are not advertised unless they pass outbound filtering (prefix lists, route maps) or are not the best path. Additionally, if synchronization is enabled, routes must be in the IGP routing table. The most common cause is a missing or restrictive outbound route map.

Answer

BGP synchronization is enabled and the routes are not in the IGP

Answer

The next hop is unreachable

Answer

The router-id is the same as the peer

Question 3

An administrator is troubleshooting an SD-WAN scenario where traffic from a branch office to a critical SaaS application is experiencing high latency. The SD-WAN rule uses the best quality SLA strategy. The administrator runs 'diagnose sys sdwan neighbor' and sees that both WAN links have SLA compliance above 90%. However, traffic still uses the slower link. The administrator then runs 'diagnose sys sdwan health-check list' and notices that the health-check server IP is different from the SaaS application's server IP. What is the MOST likely reason the traffic is not using the best-performing link?

Accepted Answer

The health-check server's IP does not match the application's destination IP, so SLA measurements are not representative. SD-WAN SLA health checks measure performance to a specific server (e.g., a public DNS or internet IP). If the actual application traffic goes to a different server, the measured SLA may not reflect the real path performance to that destination. The route selection logic uses SLA results only for the configured health-check server.

Answer

The SD-WAN rule is configured with 'set load-balance-mode' instead of 'best-quality'

Answer

The health-check server is not reachable from the faster link

Answer

The SD-WAN rule has a manual routing override configured

Question 4

An administrator is testing failover in an HA cluster. They unplug the primary FortiGate's port1 (the heartbeat interface) but the secondary does not take over. The heartbeat is configured on port1. What is the MOST likely cause?

Accepted Answer

The primary unit still has a heartbeat path through other interfaces. Option C is correct. In HA, failover is triggered by loss of heartbeat plus loss of monitored ports or a dead gateway. Simply unplugging the heartbeat interface may cause split-brain, not failover, because the primary is still operational and the secondary still sees the primary's heartbeat? Actually, unplugging the heartbeat interface on the primary means the secondary loses heartbeat. But if the primary still has other monitored ports up, it will remain primary. However, the secondary should detect loss of heartbeat and become primary after a timeout. But if the primary still has heartbeat on another path? The question says heartbeat is configured on port1 and that port was unplugged. The likely cause is that the primary still has another heartbeat interface or the failover threshold is not met. Option C is the most plausible.

Answer

The HA uptime is less than the failover hold time

Answer

The secondary unit's priority is higher than the primary's

Answer

The secondary unit has a faulty power supply

Question 5

An SD-WAN rule is configured to steer traffic based on SLA metrics. The administrator notices that traffic is not using the expected member interface even though the SLA is meeting thresholds. What should the administrator check FIRST?

Accepted Answer

Run 'diagnose sys sdwan info' to verify the rule and member status. Option A is correct. The 'diagnose sys sdwan info' command provides real-time information about SD-WAN rules, member status, SLA performance, and route selection. It is the first step to troubleshoot why traffic is not following the expected path.

Answer

Check the firewall policy to ensure SD-WAN is enabled

Answer

Verify the BGP configuration to ensure routes are being advertised

Answer

Restart the FortiGate to clear any stale sessions

Question 6

A FortiGate administrator wants to check if the device is experiencing high CPU usage due to a specific process. Which command should they use to display real-time process CPU usage?

Accepted Answer

diagnose sys top. Option A is correct. 'diagnose sys top' shows real-time CPU and memory usage per process, similar to the Linux 'top' command. It helps identify which process is consuming CPU.

Answer

show system resource

Answer

get system performance status

Answer

diagnose debug application crashlog read

Question 7

A BGP peering between two FortiGates is not establishing. The administrator runs 'get router info bgp neighbor' and sees that the neighbor state is 'Idle' and the BGP configuration appears correct. What should the administrator check next?

Accepted Answer

Verify that the BGP neighbor IP is reachable via the routing table. Option D is correct. A neighbor state of 'Idle' often indicates that BGP is administratively disabled or there is a problem with the underlying connectivity. The most common cause is that the BGP neighbor is not reachable via a valid route or the interface is down. Checking the routing table and connectivity is the next step.

Answer

Run 'diagnose ip router bgp all enable' to enable debug

Answer

Check the BGP AS number configuration

Answer

Increase the BGP timers

Question 8

A FortiGate HA cluster is experiencing persistent split-brain even after both units are rebooted. Which THREE actions should the administrator take to resolve this issue? (Choose three.)

Accepted Answer

Verify that the heartbeat interfaces are properly connected and configured. Options A, B, and E are correct. Changing the HA mode to active-passive ensures no concurrent primaries. Increasing the failover threshold (hold time) can prevent flapping. Verifying heartbeat interface connectivity ensures proper communication. Option C (disabling HA) is not a resolution; option D (reducing priority) does not fix split-brain root cause.

Answer

Reduce the priority on the secondary unit

Answer

Disable HA on both units and re-enable

Question 9

An administrator needs to monitor FortiGate session count and CPU usage over time using FortiAnalyzer. Which log type should be configured for this?

Accepted Answer

Performance logs. Performance monitoring logs contain periodic samples of system resource usage, including session count and CPU. The administrator should enable performance logging on FortiGate and send it to FortiAnalyzer.

Answer

Security logs

Answer

Event logs

Answer

Traffic logs

Question 10

An administrator wants to verify that a BGP route is being advertised to a neighbor. Which command displays the routes that FortiGate is advertising to a specific BGP neighbor?

Accepted Answer

get router info bgp neighbor advertised-routes. Option A is correct. 'get router info bgp neighbor advertised-routes' shows all routes that the FortiGate is advertising to that specific BGP neighbor. This is the standard command for verifying outbound route advertisement.

Answer

get router info bgp network

Answer

diagnose ip router bgp routes

Answer

show ip bgp summary

Question 11

A FortiGate is configured with SD-WAN and multiple members. The administrator notices that traffic to a critical application is consistently routed over a low-quality link, even though a better link is available. The SD-WAN rule uses the 'Best Quality' strategy with a performance SLA. What is the most likely reason?

Accepted Answer

The better link is failing its SLA probes. The 'Best Quality' strategy selects the best link based on measured performance. If the better link is not meeting the SLA, it will not be selected. The administrator should check the SLA thresholds and ensure the link is passing.

Answer

The better link is in 'standby' mode

Answer

The SD-WAN rule is using source-based routing

Answer

The application traffic is not matching the SD-WAN rule

Question 12

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. Phase 1 seems to complete, but Phase 2 fails with 'no proposal chosen'. The administrator checks the Phase 2 configuration and sees the following settings: 'Local address: 10.0.0.0/24, Remote address: 192.168.0.0/24, Proposal: aes256-sha1, Enable Perfect Forward Secrecy (PFS): Disabled'. Which TWO changes would most likely resolve the issue? (Choose two.)

Accepted Answer

Enable PFS on FortiGate. Phase 2 failure with 'no proposal chosen' indicates a mismatch in proposal or selectors. Common causes: PFS mismatch (if remote requires PFS) or selector mismatch (subnets).

Answer

Change the local address to 10.0.0.0/8

Answer

Add aes256-sha256 to the Phase 2 proposal

Answer

Increase the Phase 2 lifetime

Question 13

An administrator is troubleshooting a VPN tunnel between two FortiGates. The phase 1 fails to come up. The administrator runs 'diagnose vpn ike log' and sees the error 'no proposal chosen'. Which THREE configuration mismatches could cause this error?

Accepted Answer

Different Diffie-Hellman groups (e.g., DH5 vs DH14). The 'no proposal chosen' error in IKE phase 1 indicates that the two peers cannot agree on the IKE SA parameters. Common mismatches include encryption algorithm, authentication method, and Diffie-Hellman group.

Answer

Mismatched local and remote gateway IPs

Answer

Mismatched pre-shared keys

Question 14

An administrator is configuring SD-WAN and wants to ensure that traffic matching a specific SLA rule uses the best-performing member. Which TWO commands can be used to verify the SLA performance and route selection? (Choose two.)

Accepted Answer

diagnose sys sdwan health-check. Options B and D are correct. 'diagnose sys sdwan info' shows detailed SD-WAN information including SLA performance and routing decisions. 'diagnose sys sdwan health-check' shows the health-check results for each member, which is essential for SLA verification.

Answer

diagnose sys session list

Answer

get router info routing-table

Answer

show system sdwan

Question 15

An administrator configured a firewall policy to inspect SMTP traffic using an antivirus profile. However, email attachments are not being scanned. The FortiGate is operating in proxy-based inspection mode. What is the most likely cause?

Accepted Answer

The SMTP session helper is not enabled. SMTP traffic requires a specific session helper to be enabled for FortiGate to properly parse and scan email traffic. If the SMTP session helper is disabled, the antivirus profile may not scan the attachments correctly.

Answer

The policy is set to 'accept' instead of 'deny'

Answer

The email is sent over TLS encryption

Answer

The antivirus profile is set to flow-based inspection