NSE7 Practice Test 26 — 15 Questions

Question 1

An administrator wants to isolate tenant traffic in a single FortiGate by creating separate virtual firewalls with independent routing tables, administrators, and policies. Which feature should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Virtual Domains (VDOMs). VDOMs (Virtual Domains) are the correct feature because they partition a single FortiGate into multiple independent virtual firewalls, each with its own routing table, administrator access, and security policies. This allows complete tenant isolation within one physical appliance, meeting the administrator's requirement for separate virtual firewalls with independent routing, administration, and policy control.

Answer

Policy-based routing (PBR)

Answer

Virtual Router Redundancy Protocol (VRRP)

Answer

Virtual LANs (VLANs)

Question 2

A company has deployed FortiClient with advanced threat protection (ATP) features. Which TWO capabilities does FortiClient ATP provide beyond basic antivirus?

Accepted Answer

Exploit prevention and vulnerability scanning

Answer

Application control and inventory

Answer

VPN connectivity

Answer

Web filtering and URL rating

Question 3

Which of the following best describes the function of FortiDeceptor in an enterprise network?

Accepted Answer

It deploys decoys and lures to detect attackers inside the network.

Answer

It provides endpoint detection and response (EDR) capabilities on workstations.

Answer

It acts as a web application firewall for protecting web servers.

Answer

It provides sandboxing for advanced malware analysis.

Question 4

A network administrator is troubleshooting a split-brain scenario in an HA cluster. Which TWO conditions can cause split-brain? (Choose two.)

Accepted Answer

Loss of heartbeat link between HA members. Options A and D are correct. Loss of HA heartbeat communication (A) causes both units to think they are primary. Mismatched HA configuration (D) can also cause split-brain. Option B causes failover but not split-brain. Option C is irrelevant.

Answer

One unit has a higher priority

Answer

Firmware version mismatch

Answer

Session pickup is disabled

Question 5

An administrator is investigating an alert from FortiEDR indicating a suspicious process on an endpoint. The administrator wants to gather more context. Which TWO sources can provide threat intelligence to enrich the investigation?

Accepted Answer

FortiGuard Outbreak Prevention. Options C and D are correct. FortiGuard Outbreak Prevention and third-party threat feeds provide external threat intelligence about indicators of compromise.

Answer

Local antivirus signature database

Answer

FortiGate traffic logs

Answer

FortiClient local cache

Question 6

You are troubleshooting an SD-WAN rule where traffic is not matching the expected SLA. The FortiGate shows 'SLA mismatch' in logs. What is the MOST likely cause?

Accepted Answer

The measured SLA values exceed the configured thresholds. The 'SLA mismatch' log indicates that the measured SLA values (e.g., jitter, latency, packet loss) for the traffic have exceeded the configured thresholds in the SD-WAN rule. This causes the FortiGate to consider the link as not meeting the SLA, even though the interface is up and the probe server is reachable. The SD-WAN rule itself is enabled, but the traffic is steered away from the preferred member because the SLA is not satisfied.

Answer

The interface is down

Answer

The SLA probe server is unreachable

Answer

The SD-WAN rule is not enabled

Question 7

An administrator configures a firewall policy with an application control profile to block social media. The administrator observes that some social media traffic is still passing through. The traffic is HTTPS. What additional configuration is REQUIRED for application control to effectively block HTTPS-based social media?

Accepted Answer

Enable 'ssl-ssh-profile' with deep inspection on the policy. Application control requires visibility into the application layer to identify HTTPS-based traffic. Without SSL inspection, the firewall cannot decrypt the HTTPS payload to inspect the application signatures. Enabling an 'ssl-ssh-profile' with deep inspection on the policy allows the FortiGate to decrypt the traffic, apply the application control profile, and effectively block social media applications.

Answer

Set application control to proxy-based inspection

Answer

Enable 'allow-ssl-inspection' under system settings

Answer

Add a DNS filter to block social media domains

Question 8

An administrator needs to monitor FortiGate session count and CPU usage over time using FortiAnalyzer. Which log type should be configured for this?

Accepted Answer

Performance logs. Performance logs are specifically designed to capture system resource utilization metrics such as CPU usage, memory consumption, and session counts over time. FortiAnalyzer uses these logs to generate historical performance graphs and reports, enabling administrators to monitor trends and identify resource bottlenecks. Security logs, event logs, and traffic logs do not contain the periodic, time-series resource data required for this monitoring purpose.

Answer

Security logs

Answer

Event logs

Answer

Traffic logs

Question 9

An administrator receives an error when trying to create a ZTNA proxy rule: 'The ZTNA proxy rule requires a valid application mapping.' What does this indicate?

Accepted Answer

The application mapping object is not defined. A ZTNA proxy rule maps an external FQDN/port to an internal application. The error means the application mapping (which defines the internal server) is missing or misconfigured.

Answer

The FortiClient EMS is not reachable

Answer

The SSL certificate is missing

Answer

The firewall policy is not in place

Question 10

An enterprise uses multiple VDOMs on a FortiGate. The administrator needs to route traffic between VDOM-A and VDOM-B using a firewall policy. What is the correct configuration step?

Accepted Answer

Configure a VDOM link between the two VDOMs and create a policy allowing traffic. A VDOM link creates a direct Layer 2 or Layer 3 connection between two VDOMs, allowing traffic to be controlled by firewall policies. This is the only method that enables policy-based inter-VDOM routing without requiring external cables or complex routing configurations.

Answer

Place both VDOMs in the same virtual router and use regular policies

Answer

Create a static route in each VDOM pointing to the other VDOM's virtual interface

Answer

Enable inter-VDOM routing globally under system settings

Question 11

A FortiGate administrator sees the following kernel log: 'kernel: [pid 1234] received packet with unknown or unsupported protocol 0x0800 on interface port1, drop'. What does this log indicate?

Accepted Answer

The interface is not configured with an IP address or is in the wrong VDOM.. The kernel log indicates that the interface port1 received an Ethernet frame with EtherType 0x0800 (IPv4) but the FortiGate dropped it because the interface is either not configured with an IP address or is bound to the wrong VDOM. Without an IP address or proper VDOM assignment, the kernel cannot process the packet at Layer 3, so it logs the packet as having an 'unknown or unsupported protocol' even though 0x0800 is standard IPv4.

Answer

The packet is an ARP request that failed.

Answer

The packet has an invalid MAC address.

Answer

The packet has IP options set that are not supported.

Question 12

Which BGP attribute is used by FortiGate SD-WAN to influence outbound traffic path selection?

Accepted Answer

Local Preference

Answer

Next Hop

Answer

MED

Answer

AS Path

Question 13

A network administrator is troubleshooting an IPsec VPN tunnel between Site A (FortiGate) and Site B (third-party VPN peer). The tunnel fails to establish. On FortiGate, phase1 status shows 'up' but phase2 status remains 'down'. What is the MOST likely cause?

Accepted Answer

The phase2 proposal (encryption, authentication, etc.) does not match.. Phase1 being up indicates IKE SA is established. Phase2 down indicates IPsec SA negotiation failed, typically due to mismatched proposals (encryption, integrity, PFS) or traffic selector mismatch.

Answer

The firewall policies at Site B are blocking UDP port 500.

Answer

The pre-shared key does not match on both sides.

Answer

The DPD settings are incompatible between the peers.

Question 14

A company uses FortiClient EMS for endpoint compliance and ZTNA tag assignment. An administrator wants to enforce that only endpoints with a ZTNA tag 'Compliant' can access a specific internal application through ZTNA. Which configuration is required on the FortiGate?

Accepted Answer

Create a ZTNA access proxy and a ZTNA policy that references the 'Compliant' tag. ZTNA access proxy policies combine a firewall policy with ZTNA rules. The tag condition is defined in the ZTNA policy, which specifies the required ZTNA tags to allow access.

Answer

Add a firewall policy with source set to the tag object

Answer

Configure an SSL VPN portal and assign the tag as a group

Answer

Configure a security policy with FortiClient endpoint control

Question 15

During a routine audit, a FortiGate administrator discovers that all traffic from a specific user group is being denied by a firewall policy. The policy uses a ZTNA rule that requires the device tag 'Compliant'. The administrator checks the user's device in EMS and sees it is tagged as 'Compliant'. However, the traffic is still denied. What could be the problem?

Accepted Answer

The FortiGate's EMS connector is not syncing tag information in real-time. Even if the tag exists, the FortiGate may not have updated tag information from EMS or the session may have been established before the tag was applied. Option A is correct because the FortiGate must re-evaluate tags for new connections; if the EMS connector is not syncing or the session is cached with old tags, it may deny.

Answer

The user's IP address has changed and the tag is mapped to a different IP

Answer

The ZTNA rule is configured with the wrong application port

Answer

The device posture compliance check requires additional criteria not met