NSE7 Practice Test 28 — 15 Questions

Question 1

A FortiGate administrator configures a hub-and-spoke ADVPN network. Spokes are behind NAT. After deployment, spokes can communicate with each other only through the hub. What must be configured to allow spokes to establish direct shortcut tunnels?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set 'add-route' to 'enable' on the hub's ADVPN configuration. For shortcut tunnels to be established, the hub must have 'add-route' enabled so that it advertises routes to other spokes. Without this, spokes will not know how to reach each other directly and will continue to route through the hub.

Answer

Enable auto-negotiate on the IPsec phase1 interface

Answer

Configure NAT traversal on the hub's phase1

Answer

Add a firewall policy allowing IKE from spoke to spoke

Question 2

An administrator is troubleshooting an OSPF over IPsec VPN overlay. The OSPF neighbor state is stuck in EXSTART. The VPN tunnel is up. Which TWO issues could cause this?

Accepted Answer

IP fragmentation issue due to GRE/IPsec overhead. A stuck EXSTART state often indicates issues with the maximum transmission unit (MTU) or fragmentation, preventing OSPF packets from being exchanged properly. MTU mismatch or fragmentation due to encapsulation overhead can cause this.

Answer

OSPF hello/dead interval mismatch

Answer

OSPF area ID mismatch

Answer

IPsec phase2 proposal mismatch

Question 3

Based on the debug flow output, what is the reason the packet is dropped?

Accepted Answer

There is no firewall policy that matches the traffic.. The debug flow output indicates that the packet was dropped because no firewall policy matched the traffic. In FortiGate, even if a valid route exists, the packet must be evaluated against firewall policies; if no policy permits the traffic based on source, destination, service, and interface, the packet is silently dropped. The debug flow will show a message like 'no matching policy' or 'deny by policy' in such cases.

Answer

The route to the destination is missing.

Answer

The packet has an invalid source IP address.

Answer

The session table is full.

Question 4

A FortiGate administrator needs to configure a new FortiGate in FortiManager for centralized management. Which TWO steps are required to add the device to an ADOM?

Accepted Answer

Add the device to the ADOM using the device manager. The Device Manager in FortiManager is the interface used to add a device to an ADOM. After adding the device, it must be authorized (Option E) to establish a management tunnel and allow configuration synchronization. Without authorization, the device remains in a pending state and cannot be managed.

Answer

Create a policy package before adding the device

Answer

Configure a VDOM link on the FortiGate

Answer

Enable automation stitches on the FortiGate

Question 5

A FortiGate is configured with ECMP load balancing for equal-cost routes. The administrator wants to ensure that all traffic from a specific source IP uses the same next hop. Which ECMP load balancing method should be selected?

Accepted Answer

Source-IP-based. Source-IP-based ECMP load balancing ensures that all packets from a specific source IP address are forwarded to the same next hop by hashing only the source IP field. This maintains session consistency for traffic originating from a single host, which is critical for stateful inspection and applications that require symmetric routing.

Answer

Destination-IP-based

Answer

Weighted random

Answer

Round-robin

Question 6

Match each FortiGate security profile to its category.

Accepted Answer

Antivirus Profile: Protects against malware by scanning files and email attachments.. The correct matches are: Antivirus for malware scanning, Web Filter for URL categorization, and Application Control for app identification. Common confusions arise between Antivirus and Web Filter roles.

Answer

Antivirus Profile: Controls web content based on categories.

Answer

Web Filter Profile: Scans for viruses in traffic.

Question 7

A network administrator is troubleshooting an IPsec VPN between two FortiGates. The phase1 is up, but phase2 keeps failing to establish. The administrator runs 'diagnose vpn ike log' and sees: 'no proposal chosen'. Both sides have the same phase2 configuration: AES256-SHA256, DH group 14, 3600 seconds lifetime. What is the MOST likely cause?

Accepted Answer

The phase2 local and remote subnets do not match on both sides. Even if the encryption/authentication proposals match, a common issue is a mismatch in the local and remote subnets (selectors). The phase2 negotiation requires matching traffic selectors. If one side has 192.168.1.0/24 and the other has 10.0.0.0/8, the proposals will be rejected. Option C is correct.

Answer

The NAT traversal setting is inconsistent

Answer

The IKE version is different on each side

Answer

The pre-shared key is incorrect

Question 8

During a security incident, the SOC team receives an alert from FortiSIEM about a user accessing a known malicious IP. The team wants to automatically block the IP on the FortiGate. Which FortiGate feature can be used to create an automated response based on a threat intelligence feed?

Accepted Answer

Automation Stitch. Automation Stitch in FortiOS allows you to create automated responses triggered by events such as threat intelligence feeds. By configuring an Automation Stitch with a trigger from FortiSIEM (e.g., via a webhook or syslog) and an action to add a block entry to the FortiGate's local address group or dynamic block list, the SOC team can automatically block the malicious IP without manual intervention.

Answer

Local-in Policy

Answer

FortiGuard Outbreak Prevention

Answer

FortiGate VPN

Question 9

A FortiManager administrator is configuring ADOMs to manage multiple FortiGates. The administrator wants to ensure that changes to the central management policy package are automatically pushed to managed devices. Which setting should be enabled?

Accepted Answer

Enable 'Auto-update' in the policy package. Enabling 'Auto-update' in the policy package on FortiManager ensures that any changes made to the central management policy package are automatically pushed to all managed FortiGates. This setting triggers an immediate installation of the policy package to the devices whenever a change is committed, eliminating the need for manual installation. It is specifically designed for centralized policy management in ADOM environments.

Answer

Enable 'Auto-link' on the device

Answer

Configure a schedule for policy installation

Answer

Enable 'Central Management' on the FortiGate

Question 10

A FortiGate has two VDOMs: Root and CustomerA. The administrator wants to manage the CustomerA VDOM from FortiManager. What must be configured on FortiManager to allow management of the CustomerA VDOM?

Accepted Answer

Add the FortiGate's VDOM to an ADOM. FortiManager uses Administrative Domains (ADOMs) to logically group and manage VDOMs. To manage the CustomerA VDOM, the administrator must add that specific VDOM to an ADOM on FortiManager, which then allows FortiManager to push policies, objects, and configuration to that VDOM. Without this mapping, FortiManager cannot target the VDOM for management, even if the FortiGate itself is registered.

Answer

Configure an automation stitch on FortiManager

Answer

Add the FortiGate to the global ADOM

Answer

Enable VDOM management on FortiGate

Question 11

A network administrator is configuring SD-WAN rules with load balancing. They want to distribute HTTP traffic evenly across two WAN links based on the number of sessions. Which TWO settings should they use? (Choose two.)

Accepted Answer

Ensure the SD-WAN rule matches HTTP traffic (e.g., using protocol or port criteria).. The SD-WAN rule must match HTTP traffic (e.g., using destination port 80 or protocol 6) to ensure only HTTP sessions are load-balanced. Option E is correct because setting the load balancing algorithm to 'session' distributes traffic based on the number of sessions, which aligns with the requirement to distribute HTTP traffic evenly across two WAN links by session count.

Answer

Set the load balancing algorithm to 'volume'.

Answer

Create a performance SLA to monitor the links.

Answer

Enable 'set update-static-route' on the SD-WAN rule.

Question 12

A network administrator runs the command 'diagnose debug application ssl -1' and sees the following output: 'ssl_generate_proxy_cert: cannot find CA certificate for issuer CN=www.example.com'. What is the MOST likely cause?

Accepted Answer

The SSL/SSH inspection profile is configured with an incorrect CA certificate. The error 'cannot find CA certificate for issuer CN=www.example.com' indicates that the FortiGate's SSL/SSH inspection profile is configured to use a specific CA certificate to re-sign the web server's certificate, but that CA certificate is not present in the FortiGate's certificate store. This occurs when the inspection profile references a CA certificate that has been deleted, not imported, or misconfigured, preventing the generation of a proxy certificate for SSL inspection.

Answer

The FortiGate does not have an internet connection to reach the CA certificate authority

Answer

The firewall policy does not have SSL inspection enabled

Answer

The web server's certificate has expired

Question 13

A FortiGate in NAT mode has multiple VDOMs. The administrator wants to centralize logging from all VDOMs to a single FortiAnalyzer. What configuration is required on the FortiGate to ensure logs from all VDOMs are sent?

Accepted Answer

Configure FortiAnalyzer logging in each VDOM individually. In a multi-VDOM FortiGate, each VDOM operates as an independent firewall with its own logging configuration. To send logs from all VDOMs to a single FortiAnalyzer, you must configure the FortiAnalyzer IP and logging settings within each VDOM individually. This ensures that each VDOM's logs are forwarded directly to the FortiAnalyzer, as there is no global or centralized log-forwarding mechanism that aggregates logs across VDOMs.

Answer

Configure the FortiAnalyzer IP under system global settings

Answer

Use the management VDOM as a log relay to FortiAnalyzer

Answer

Enable centralized logging under config log setting

Question 14

An HA cluster of two FortiGates is experiencing split-brain. Which command should the administrator use to check the current HA status and identify which unit is the primary?

Accepted Answer

get system ha status. The correct command to check the current HA status and identify the primary unit is 'get system ha status'. This command displays the HA mode, cluster state, role (primary/secondary), and peer status in a clear, human-readable format. In a split-brain scenario, the administrator needs to quickly confirm which unit believes it is the primary, and this command provides that information directly without debug-level verbosity.

Answer

diagnose debug application had 0

Answer

diagnose sys ha dump

Answer

show system ha

Question 15

An administrator wants to integrate a FortiExtender with a FortiGate to provide additional WAN connectivity. Which configuration is required on the FortiGate to enable the FortiExtender to operate as a secondary WAN interface?

Accepted Answer

Configure the FortiExtender under Network > FortiExtender and assign it to a WAN interface. When a FortiExtender is configured under Network > FortiExtender and assigned to a WAN interface, the FortiGate treats it as a secondary WAN link, allowing it to participate in SD-WAN or load-balancing policies. The FortiExtender operates in its default routed mode, where it receives a public IP from the cellular network and the FortiGate uses it as an additional gateway for outbound traffic.

Answer

Enable LLDP on the port connected to the FortiExtender

Answer

Set the FortiExtender to bridge mode

Answer

Create a VLAN interface for the FortiExtender