NSE7 Practice Test 26 — 15 Questions

Question 1

An administrator is troubleshooting an SD-WAN scenario where traffic from a branch office to a critical SaaS application is experiencing high latency. The SD-WAN rule uses the best quality SLA strategy. The administrator runs 'diagnose sys sdwan neighbor' and sees that both WAN links have SLA compliance above 90%. However, traffic still uses the slower link. The administrator then runs 'diagnose sys sdwan health-check list' and notices that the health-check server IP is different from the SaaS application's server IP. What is the MOST likely reason the traffic is not using the best-performing link?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The health-check server's IP does not match the application's destination IP, so SLA measurements are not representative. The SD-WAN rule uses the best quality SLA strategy, which selects the link with the best SLA metrics (latency, jitter, packet loss) for the traffic. However, if the health-check server IP does not match the SaaS application's destination IP, the SLA measurements are not representative of the actual path to the application. The SD-WAN device measures performance to the health-check server, not the application server, so the link that appears best for the health-check may be worse for the actual application traffic, causing the slower link to be selected.

Answer

The SD-WAN rule is configured with 'set load-balance-mode' instead of 'best-quality'

Answer

The health-check server is not reachable from the faster link

Answer

The SD-WAN rule has a manual routing override configured

Question 2

You want to use policy-based routing (PBR) to send traffic from a specific subnet to a different next-hop than the default route. Which configuration is required?

Accepted Answer

Configure a route map under 'config router policy'. Policy-based routing (PBR) on FortiGate is configured under 'config router policy' using route maps. This allows you to match traffic based on criteria such as source subnet and set a specific next-hop, overriding the default route. Option A correctly identifies the required configuration path for PBR.

Answer

Create a firewall policy with 'set policy-based-route enable'

Answer

Enable 'set pbr-enforce-symmetric' on the interface

Answer

Configure a prefix list and apply to the static route

Question 3

An admin wants to block malicious files detected by FortiSandbox at the FortiGate level. Which configuration is required on the FortiGate to automatically block files based on FortiSandbox verdict?

Accepted Answer

Enable 'FortiSandbox inline prevention' in the antivirus profile. Enabling 'FortiSandbox inline prevention' in the antivirus profile allows FortiGate to automatically block files based on the verdict received from FortiSandbox. When this option is enabled, the FortiGate will hold the file until the sandbox analysis completes, then either allow or block the file based on the verdict (e.g., malware detected). This is the direct configuration for automatic file blocking at the gateway level.

Answer

Enable Threat Feeds on FortiGate and subscribe to FortiSandbox feeds

Answer

Configure an Automation Stitch that triggers on malware detected events and blocks the source IP

Answer

Configure a security policy with a Web Filter profile that blocks malware categories

Question 4

A FortiGate has multiple VRFs configured. An administrator wants to allow traffic from VRF 1 to reach a server in VRF 2. What configuration is required?

Accepted Answer

Configure a VRF leak policy using route maps or policy routes.. VRF leaking is the standard method to allow traffic between different VRFs on a FortiGate. This is achieved by configuring route maps or policy routes to selectively import/export routes between VRFs, enabling inter-VRF communication without merging the VRFs or using VDOMs.

Answer

Use a single VDOM and enable inter-VDOM links.

Answer

Place both interfaces in the same VRF.

Answer

Create a static route from one VRF to another.

Question 5

A security engineer wants to implement advanced threat protection for email using FortiMail. Which THREE features should be enabled to provide comprehensive protection against sophisticated email threats? (Choose three.)

Accepted Answer

URL rewriting and click-time protection. URL rewriting and click-time protection (A) is correct because FortiMail rewrites embedded URLs and re-evaluates them when the user clicks, blocking advanced phishing and malicious links that were benign at delivery time. FortiSandbox integration for email attachments (B) is correct because it detonates suspicious attachments in an isolated sandbox to detect zero-day malware and advanced persistent threats that signature-based scanning misses. DMARC verification (D) is correct because it validates the alignment of SPF and DKIM with the From: domain, preventing domain spoofing and business email compromise. Anti-Spam filter (C) is not among the marked answers because it addresses bulk unsolicited mail rather than sophisticated targeted threats. Attachment size limits (E) are not among the marked answers because they only enforce message size policy and provide no threat detection capability.

Answer

Anti-Spam filter

Answer

Attachment size limits

Question 6

An administrator needs to enable automation stitches to automatically block a malicious IP address detected by FortiSandbox. Which two components are required? (Choose two.)

Accepted Answer

A trigger that detects the FortiSandbox verdict. Automation stitches require a trigger to initiate the workflow. In this scenario, the trigger must detect the FortiSandbox verdict (e.g., malicious or clean) to start the automated response. Without a trigger, the stitch has no event to react to, making it non-functional.

Answer

A static route to the malicious IP

Answer

An SSL certificate for the FortiGate

Answer

A firewall policy that allows the traffic

Question 7

An administrator wants to monitor CPU usage of specific processes on a FortiGate. Which command should be used?

Accepted Answer

diagnose sys top. The 'diagnose sys top' command is the correct tool for monitoring CPU usage of specific processes on a FortiGate because it provides a real-time, interactive view of process-level CPU and memory utilization, allowing the administrator to identify which processes are consuming resources. Unlike the other options, this diagnostic command is specifically designed for granular process monitoring in FortiOS.

Answer

get system performance status

Answer

get system performance

Answer

top

Question 8

A FortiGate is configured as a ZTNA proxy. The administrator wants to ensure that only devices with a specific ZTNA tag assigned by FortiClient EMS are allowed to access the application. Which two configuration steps are required? (Choose two.)

Accepted Answer

Create a ZTNA access rule with a condition matching the tag. Option E is correct because the FortiGate must first learn the ZTNA tags that FortiClient EMS assigns to endpoints; this is done by configuring the EMS connector (FortiClient EMS fabric connector) and importing/synchronizing the tags, which then appear under ZTNA tags on the FortiGate. Option D is correct because enforcement of a specific tag is performed by a ZTNA access rule (access-proxy rule) whose condition matches the imported tag, so only devices presenting that tag are granted access to the protected application. Option A is incorrect because simply setting the ZTNA proxy as the destination with an 'allow only ZTNA' style setting does not itself match a specific EMS tag; tag-based authorization requires the access rule in D. Option B is incorrect because a policy allowing all traffic to the ZTNA proxy would not restrict access by tag and would undermine the requirement. Option C is incorrect because there is no 'set ztna-tag' interface command; tags are matched in ZTNA access rules, not enabled on an interface.

Answer

Configure a firewall policy with the ZTNA proxy as destination and enable 'allow only ZTNA'

Answer

Create a firewall policy allowing all traffic to the ZTNA proxy

Answer

Enable 'set ztna-tag' on the FortiGate interface

Question 9

An administrator wants to ensure that traffic from a specific source IP uses a particular SD-WAN member regardless of performance SLA results. Which SD-WAN configuration element should be used?

Accepted Answer

SD-WAN rule with manual strategy. A is correct because an SD-WAN rule with a manual strategy allows the administrator to explicitly pin traffic from a specific source IP to a particular SD-WAN member interface, overriding any performance SLA-based path selection. This is achieved by configuring the rule's 'strategy' as 'manual' and specifying the preferred member, which forces all matching traffic to use that interface regardless of SLA health.

Answer

Route map

Answer

Policy-based routing on the firewall policy

Answer

Performance SLA

Question 10

A company has deployed two FortiGate-600Es in an active-passive HA cluster. The cluster is configured with three VDOMs: VDOM-A (corporate LAN), VDOM-B (guest Wi-Fi), and VDOM-C (DMZ). Each VDOM has its own set of interfaces and policies. The cluster is also configured to use FGCP with session pickup enabled. Recently, the network team noticed that after a failover event, some user sessions in VDOM-B are not being picked up, causing disruption for guest users. The session pickup feature is enabled globally. The administrator checks the configuration and finds the following settings on the primary FortiGate:

- config system ha
  set session-pickup enable
  set session-pickup-connectionless enable
  end

- config vdom
  edit VDOM-A
    config system ha
      set session-pickup enable
    end
  next
  edit VDOM-B
    config system ha
      set session-pickup disable
    end
  next
  edit VDOM-C
    config system ha
      set session-pickup enable
    end
  next

Based on this configuration, what is the most likely reason that sessions in VDOM-B are not being picked up?

Accepted Answer

Session pickup is disabled specifically for VDOM-B in the per-VDOM HA configuration.. The per-VDOM HA configuration for VDOM-B explicitly disables session pickup with 'set session-pickup disable'. Even though the global HA settings enable session pickup, the per-VDOM setting overrides the global setting for that VDOM. As a result, after a failover, sessions in VDOM-B are not synchronized to the standby FortiGate and are not picked up, causing disruption for guest users.

Answer

The HA priority of the cluster is set too low, causing session pickup to fail for VDOM-B.

Answer

Session pickup for connectionless protocols is not enabled, so UDP sessions in VDOM-B are not picked up.

Answer

The interfaces assigned to VDOM-B do not have session pickup enabled.

Question 11

What is the function of FortiAnalyzer in a Fortinet Security Fabric?

Accepted Answer

To collect logs and generate reports and incidents. FortiAnalyzer is the centralized logging and reporting appliance within the Fortinet Security Fabric. It collects logs from FortiGate and other Fabric components, correlates events, generates compliance reports, and creates incidents for security analysis. This aligns directly with option A, as its primary function is log aggregation and report generation, not real-time management or VPN termination.

Answer

To manage VDOM configurations

Answer

To act as a VPN concentrator

Answer

To provide real-time firewall management

Question 12

A FortiGate is configured with VRF. Which statement about VRF is true?

Accepted Answer

VRF allows multiple routing tables to coexist on the same FortiGate.. VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, each with its own set of interfaces, routes, and forwarding decisions. This enables network segmentation and traffic isolation without requiring separate physical devices, making option B correct.

Answer

Interfaces can belong to multiple VRFs simultaneously.

Answer

Routes from different VRFs can be automatically redistributed without configuration.

Answer

VRF can only be used when OSPF is enabled.

Question 13

An administrator wants to protect against zero-day malware that has not yet been discovered by signature-based detection. Which TWO technologies can help mitigate such threats?

Accepted Answer

Machine Learning Engine. The Machine Learning Engine (A) is correct because it uses behavioral analysis and static file analysis to detect previously unknown malware based on patterns and anomalies, without relying on signatures. This allows it to identify zero-day threats by analyzing file characteristics and runtime behavior in real time.

Answer

Signature-based antivirus

Answer

Web filtering

Answer

Application control

Question 14

A FortiGate is configured with multiple VDOMs. The administrator wants to assign a specific physical interface to a non-management VDOM and ensure that the interface is not visible or configurable from other VDOMs. The interface is currently assigned to the root VDOM. What is the correct procedure to reassign the interface to VDOM-1?

Accepted Answer

In the root VDOM, remove all references to the interface (such as firewall policies and routing entries), then use the global configuration to set the interface's VDOM to VDOM-1.. Reassigning a physical interface to a different VDOM requires removing all references to that interface in its current VDOM, such as firewall policies, routes, and DHCP settings. Once the interface is free of references, you can change its VDOM assignment in the global configuration. This process ensures that the interface is cleanly moved and becomes exclusively available to the target VDOM, maintaining proper isolation between VDOMs.

Answer

In the global configuration, directly change the interface's VDOM to VDOM-1; the FortiGate automatically deletes all references in the root VDOM.

Answer

From VDOM-1, use the command 'config system interface' and edit the interface, then set its VDOM to VDOM-1. The FortiGate automatically removes it from the root VDOM.

Answer

Create a new VDOM link between the root VDOM and VDOM-1, then bridge the physical interface to the VDOM link so that VDOM-1 can use it without reassigning the interface.

Question 15

A FortiGate administrator wants to use FortiManager automation stitches to automatically block an IP address when a specific threat is detected. Which components must be configured within the automation stitch?

Accepted Answer

A trigger, at least one action, and optionally conditions. An automation stitch in FortiManager requires a trigger (e.g., an event or log match) to start the workflow, at least one action (e.g., a CLI script to block an IP via firewall address creation), and optionally conditions to filter when the trigger fires. This three-part structure is mandatory because the trigger defines the event, the action executes the response, and conditions provide granular control without which the stitch would fire on every trigger occurrence.

Answer

A trigger and a connector to an external threat feed

Answer

An action only, since the trigger is predefined

Answer

A schedule and a script