NSE7 Practice Test 27 — 15 Questions

Question 1

A network administrator runs 'get system ha status' on a FortiGate HA cluster and sees that only one unit shows as primary. The secondary unit shows as 'standalone' with no HA peer detected. What is the MOST likely cause of this issue?

Accepted Answer

The heartbeat interface is down or misconfigured. When the HA heartbeat link is down, the secondary unit cannot detect the primary and will operate as standalone. The serial number mismatch or priority settings would cause different behavior (e.g., split-brain or both primary).

Answer

The cluster serial numbers do not match

Answer

The HA group ID is different on each unit

Answer

The HA priority on the secondary unit is set to 0

Question 2

A FortiGate in an HA cluster is experiencing intermittent session synchronization failures. The administrator runs 'diagnose sys ha dump sync-status' and sees that sessions are not being synchronized properly. Which TWO potential causes should the administrator investigate?

Accepted Answer

Excessive number of sessions exceeding the session sync limit. Session sync failures in HA can be caused by network issues on the heartbeat link or session table overload. Authentication or routing issues are less direct causes.

Answer

Mismatched HA group IDs

Answer

Incorrect BGP route advertisements

Answer

Mismatched HA passwords

Question 3

An administrator is investigating a security incident using FortiAnalyzer logs. The admin needs to identify all connections from a specific internal IP (10.0.0.100) to external servers on TCP port 443 during the last hour. Which TWO log fields should be used to filter the logs? (Choose two.)

Accepted Answer

dstport. To filter traffic from a source IP and destination port, the administrator should use the source IP field and the destination port field. The service field may also show port but is less precise.

Answer

dstip

Answer

action

Answer

policyid

Question 4

An administrator is investigating a security incident using FortiAnalyzer logs. The admin wants to identify all traffic that matched a specific firewall policy. Which TWO log fields should the admin use to filter the logs?

Accepted Answer

policyid. In FortiAnalyzer logs, the policy ID (usually 'policyid' or 'policy_id') and source interface (e.g., 'srcintf') are key fields to identify which firewall policy matched the traffic. Other fields like destination IP or user name are not directly tied to the policy ID.

Answer

user

Answer

appid

Answer

dstip

Question 5

A FortiGate administrator wants to monitor performance thresholds to be alerted when the firewall is under heavy load. Which THREE metrics can be monitored using the built-in performance monitoring features (e.g., 'diagnose sys top' or SNMP)?

Accepted Answer

CPU utilization percentage. Common performance metrics include CPU usage, memory usage, and session count. Disk usage is not a direct performance metric for firewall throughput, and interface speed is a capacity metric rather than load.

Answer

Interface speed

Answer

Disk space utilization

Question 6

A network admin is investigating a high CPU usage issue on a FortiGate firewall. The admin runs 'diagnose sys top' and sees that the 'ipsengine' process is consuming 70% CPU. Which THREE actions should the admin take to reduce CPU load?

Accepted Answer

Review and optimize IPS signatures; disable unnecessary signatures. High CPU usage from ipsengine can be mitigated by tuning IPS profiles, offloading inspection to NPU, or raising thresholds to reduce load from less important traffic.

Answer

Increase the IPS engine process priority

Answer

Increase the IPS engine process priority

Answer

Disable IPS on all policies

Question 7

An administrator notices that after upgrading FortiOS, some traffic that was previously inspected by the antivirus profile is now bypassing scanning. The administrator suspects the session helper configuration may be interfering. Which TWO session helper protocols are known to potentially affect traffic inspection if improperly configured?

Accepted Answer

FTP. Session helpers like SIP and FTP can alter sessions (e.g., opening dynamic ports) which can cause traffic to bypass security profiles if not handled correctly. TFTP and HTTP helpers are less likely to cause such issues; PPTP is less common.

Answer

TFTP

Answer

PPTP

Answer

HTTP

Question 8

An administrator is troubleshooting an IPsec VPN tunnel that establishes phase 1 but fails to establish phase 2. The phase 2 configuration shows 'set proposal aes128-sha256' on both sides. Which TWO configuration items should the administrator verify?

Accepted Answer

PFS (Perfect Forward Secrecy) settings. Even if phase 1 succeeds, phase 2 can fail due to mismatched proxy IDs (local/remote subnets) or mismatched PFS settings. Authentication method and encryption algorithm are phase 1 parameters.

Answer

The local authentication method (certificate vs pre-shared key)

Answer

The encryption algorithm for phase 2

Answer

The pre-shared key

Question 9

Which feature allows a FortiGate to participate in multiple routing tables simultaneously, enabling network segmentation and overlapping IP address spaces?

Accepted Answer

VRF. Virtual Routing and Forwarding (VRF) partitions the routing table into multiple independent tables, allowing overlapping IP addresses and separate routing policies per VRF. This is the standard method for network segmentation on FortiGate.

Answer

VDOM

Answer

Policy-based routing

Answer

Route redistribution

Question 10

An administrator configures BFD on a FortiGate to improve convergence time for OSPF. What is the primary purpose of BFD in this context?

Accepted Answer

To detect link failures faster than OSPF hello timers. BFD provides fast failure detection (sub-second) for routing protocols like OSPF, triggering quicker route convergence.

Answer

To reduce the number of OSPF neighbors

Answer

To encrypt OSPF packets

Answer

To load balance OSPF traffic across multiple links

Question 11

A network engineer is configuring SD-WAN on a FortiGate. They have three WAN interfaces (wan1, wan2, lte) and want traffic to the primary datacenter (10.10.10.0/24) to use wan1 unless its latency exceeds 50 ms, in which case failover to wan2. The engineer created an SD-WAN rule with a strategy of 'Manual' and selected 'wan1' as the preferred member. What additional configuration is required to achieve automatic failover based on latency?

Accepted Answer

Configure a performance SLA for wan1 with a latency threshold of 50 ms and associate it with the SD-WAN rule.. For automatic failover based on latency, a performance SLA must be configured to measure latency on wan1. The SD-WAN rule uses the SLA to determine if the preferred member meets the threshold; if not, traffic switches to the next available member. Option A correctly identifies this requirement.

Answer

Create a route map to prefer wan1 and apply it to the SD-WAN rule.

Answer

Set the SD-WAN rule strategy to 'Best Quality' and select latency as the metric.

Answer

Enable BFD on wan1 and wan2 with a minimum interval of 50 ms.

Question 12

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route for 192.168.100.0/24 into OSPF. After configuring 'config router ospf' with 'redistribute static' enabled, the route appears in the OSPF database but is not being advertised to other areas. What is the most likely cause?

Accepted Answer

The router is an ABR and the static route is being redistributed as a type 5 LSA, which is not flooded into stub areas.. By default, OSPF does not redistribute external routes into other areas unless the redistributing router is an ASBR and the route is a type 5 LSA. However, type 5 LSAs are not flooded into stub areas or NSSAs. If the router is in a NSSA or stub area, redistribution must be handled differently. The most common reason is that the router is an ABR and the external route is not being advertised into other areas because the router is not acting as an ASBR for those areas.

Answer

The 'redistribute static' command needs a route map to filter the route correctly.

Answer

The static route's administrative distance is too high for OSPF.

Answer

OSPF must be configured with 'default-information originate' to allow redistribution.

Question 13

An administrator wants to load balance traffic across two ISP links using SD-WAN. The requirement is that sessions from the same source IP address must always use the same ISP link. Which SD-WAN load balancing algorithm should be used?

Accepted Answer

Source-destination IP. The source-destination IP algorithm uses a hash of source and destination IP addresses to consistently map traffic to the same member. This ensures that all sessions with the same source and destination IP pair go to the same link, meeting the requirement.

Answer

Sessions

Answer

Volume

Answer

Spillover

Question 14

You are troubleshooting BFD on a FortiGate SD-WAN deployment. BFD is configured on two WAN interfaces (wan1, wan2) with a minimum transmit interval of 100 ms and a multiplier of 3. The network experiences occasional jitter causing packet loss. After a brief outage, the BFD session does not recover. Which setting should be adjusted to improve BFD resilience without significantly increasing failover time?

Accepted Answer

Increase the BFD multiplier to 4 or higher.. Increasing the multiplier allows more consecutive missed BFD packets before declaring the session down, making it more tolerant to jitter. Decreasing the interval would make it more sensitive. The multiplier of 3 means 3 * 100 ms = 300 ms before declaring down; increasing to 4 would give 400 ms tolerance, improving resilience.

Answer

Disable BFD and rely on route timers.

Answer

Enable BFD on the management interface.

Answer

Increase the BFD minimum transmit interval on both interfaces.

Question 15

A FortiGate with SD-WAN enabled uses two members: MPLS (10 ms latency) and Internet (40 ms latency). The SD-WAN rule uses 'Best Quality' strategy with latency as the metric. Traffic to a critical application (10.1.1.0/24) is currently using the MPLS link. The MPLS link's latency increases to 60 ms due to a routing issue. How will FortiGate handle new sessions to 10.1.1.0/24?

Accepted Answer

New sessions will use the Internet link; existing sessions continue on MPLS.. With 'Best Quality' strategy, FortiGate continuously monitors performance SLAs. When the MPLS link's latency exceeds the threshold or becomes worse than the Internet link, new sessions will be steered to the best available member (Internet) based on the metric. Existing sessions remain on the original link until they expire.

Answer

FortiGate will wait for the MPLS link to recover before sending new traffic.

Answer

All sessions immediately switch to the Internet link.

Answer

Existing sessions continue on MPLS; new sessions will use MPLS until the next SLA probe.