NSE7 Practice Test 28 — 15 Questions

Question 1

Which routing protocol is commonly used in SD-WAN deployments to exchange routes between FortiGate and the provider edge router in an MPLS network?

Accepted Answer

BGP. BGP is the correct answer because it is the standard exterior gateway protocol used in MPLS Layer 3 VPNs to exchange customer routes between a FortiGate (CE router) and the provider edge (PE) router. BGP supports advanced features like route filtering, load balancing, and traffic engineering, which are essential for SD-WAN overlay integration with MPLS underlay networks.

Answer

RIP

Answer

IS-IS

Answer

OSPF

Question 2

An administrator configures SD-WAN with two members (wan1, wan2) and a performance SLA for ICMP to 1.1.1.1. The SD-WAN rule is set to 'Best Quality' with 'latency' metric. The admin notices that traffic sometimes switches to the other link even when the current link has acceptable latency. Which action can reduce unnecessary flapping?

Accepted Answer

Configure a hysteresis value for the SLA. Configuring a hysteresis value for the SLA introduces a buffer or deadband around the latency threshold. This prevents the SD-WAN from switching links when latency fluctuates slightly above and below the threshold, which is the root cause of flapping. Without hysteresis, even a minor transient spike in latency can trigger a switch, even if the link's overall performance is acceptable.

Answer

Increase the SLA probe interval

Answer

Use 'manual' strategy instead

Answer

Increase the 'update-cascade-interface' setting

Question 3

What is the purpose of configuring BFD (Bidirectional Forwarding Detection) on a FortiGate?

Accepted Answer

To provide rapid failure detection between two forwarding engines.. BFD (Bidirectional Forwarding Detection) provides sub-second failure detection between two forwarding engines, such as FortiGate peers running OSPF or BGP. It operates independently of the routing protocol, using a lightweight hello mechanism to detect link or neighbor failures faster than protocol-native timers (e.g., OSPF dead interval of 40 seconds). This enables rapid convergence in SD-WAN and advanced networking scenarios.

Answer

To load balance traffic across multiple links.

Answer

To encrypt BGP updates between peers.

Answer

To authenticate OSPF neighbors.

Question 4

A FortiGate administrator runs the following command and sees the output:

diagnose sys session filter dport 443
diagnose sys session list

Output shows sessions with proto=6 and expire time decreasing. What does this indicate?

Accepted Answer

The sessions are TCP sessions and are active. The command 'diagnose sys session filter dport 443' filters sessions with destination port 443, and 'diagnose sys session list' displays them. The output shows 'proto=6', which is the protocol number for TCP (per IANA protocol numbers). The 'expire time decreasing' indicates that the session timer is counting down, which is normal behavior for an active TCP session that is being refreshed by ongoing traffic. Therefore, the sessions are TCP and active.

Answer

The sessions are using UDP protocol

Answer

The FortiGate is performing deep packet inspection on these sessions

Answer

The sessions are being blocked by a firewall policy

Question 5

A FortiGate is configured with a firewall policy that applies an antivirus profile with FortiSandbox inspection enabled. Users report that when they download a suspicious executable from an HTTPS website, the download completes and the file runs, but no verdict is ever returned from FortiSandbox. The administrator confirms that FortiSandbox is reachable and other protocols are being inspected successfully. Which action will most likely resolve the issue?

Accepted Answer

Enable deep inspection in the SSL inspection profile applied to the policy.. File submission to FortiSandbox requires that FortiGate can see the file content. For HTTPS downloads, this means the traffic must be decrypted using an SSL inspection profile set to deep inspection. Without decryption, the antivirus engine cannot identify or extract the file, so no submission or verdict occurs. Enabling deep inspection on the policy resolves the issue.

Answer

Enable the 'Scan encrypted traffic' option in the antivirus profile.

Answer

Change the FortiSandbox connection mode from FortiGate to inline.

Answer

Add the website's IP address to the FortiSandbox blocklist.

Question 6

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal web application. The current network uses FortiGate as the firewall. Which component is required to enforce ZTNA policies on the FortiGate?

Accepted Answer

FortiGate ZTNA proxy configuration. To enforce ZTNA policies on a FortiGate, you must configure the FortiGate as a ZTNA access proxy, which inspects and controls traffic to the internal application based on device posture and identity tags. This is done via the ZTNA proxy configuration on the FortiGate, which acts as the policy enforcement point. Without this, the FortiGate cannot apply ZTNA rules to the traffic.

Answer

FortiSandbox for content inspection

Answer

FortiAnalyzer for log analysis

Answer

FortiAuthenticator for RADIUS authentication

Question 7

A FortiGate is configured with SD-WAN and multiple members. The administrator notices that traffic to a critical application is consistently routed over a low-quality link, even though a better link is available. The SD-WAN rule uses the 'Best Quality' strategy with a performance SLA. What is the most likely reason?

Accepted Answer

The better link is failing its SLA probes. When an SD-WAN rule uses the 'Best Quality' strategy with a performance SLA, the FortiGate selects the member link that best meets the SLA targets (e.g., jitter, latency, packet loss). If the better link is failing its SLA probes, it is considered out of compliance and will not be selected, even if it is physically available and has higher bandwidth. This causes traffic to be routed over the lower-quality link that still passes the SLA.

Answer

The better link is in 'standby' mode

Answer

The SD-WAN rule is using source-based routing

Answer

The application traffic is not matching the SD-WAN rule

Question 8

An administrator is configuring SD-WAN and wants to ensure that voice traffic uses the lowest latency link. Which two configurations are required to achieve this? (Choose TWO.)

Accepted Answer

Configure a performance SLA with latency threshold. A performance SLA with a latency threshold allows FortiGate to measure real-time latency to a target server and mark the link quality. Option D is correct because an SD-WAN rule using the 'best quality' strategy will dynamically select the link with the lowest latency (as determined by the SLA) for voice traffic, ensuring optimal voice quality.

Answer

Configure a static route for the voice subnet

Answer

Set the SD-WAN rule to use 'manual' strategy

Answer

Enable NAT on the SD-WAN interface

Question 9

An administrator is troubleshooting an HA cluster (active-passive) where both units show 'primary' in 'get system ha status'. The cluster is not synchronizing configurations. What is the MOST likely cause?

Accepted Answer

The HA heartbeat interface is disconnected or misconfigured. In an active-passive HA cluster, both units showing 'primary' indicates a failure in heartbeat communication. The HA heartbeat interface is used to exchange cluster state and session information; if it is disconnected or misconfigured, each unit assumes the other is down and transitions to primary, leading to a split-brain scenario. This prevents configuration synchronization because the units cannot agree on a primary-secondary role.

Answer

The HA password is incorrect

Answer

The HA group ID is mismatched

Answer

The HA priority values are equal for both units

Question 10

A FortiGate is configured with ECMP load balancing for multiple equal-cost routes. The administrator wants to ensure that all packets belonging to the same session go out the same interface. Which ECMP load balancing method should be used?

Accepted Answer

Source-dest-IP-based. Source-dest-IP-based ECMP (often called per-flow load balancing) uses a hash of both source and destination IP addresses to consistently map all packets of a session to the same next-hop interface. This ensures session integrity because the hash remains constant for the entire flow, preventing out-of-order delivery or packet drops that would occur if packets from the same session took different paths.

Answer

Weighted

Answer

Source-IP-based

Answer

Spillover

Question 11

A FortiGate administrator is troubleshooting a scenario where traffic between two VDOMs is not working. The admin has configured inter-VDOM routing. Which TWO steps should the administrator verify? (Choose two.)

Accepted Answer

Check that there is a firewall policy in the destination VDOM allowing the return traffic. Inter-VDOM routing requires firewall policies in both the source and destination VDOMs to permit traffic. The destination VDOM must have a policy allowing the return traffic (from the destination to the source) for the session to be established. Without this, the FortiGate will drop the return packets, breaking the bidirectional flow.

Answer

Check that NAT is enabled on the policies

Answer

Check that the inter-VDOM link is configured as a physical interface

Answer

Check that both VDOMs are in the same administrative VDOM

Question 12

A company uses FortiGate ZTNA to provide remote access to an internal web application. The application requires client certificates for authentication. The administrator has configured the ZTNA rule to use certificate authentication. However, users report that they are prompted for credentials repeatedly. What is the most likely cause?

Accepted Answer

The client certificate is not trusted by the FortiGate.. When a ZTNA rule is configured for certificate authentication, the FortiGate must trust the client certificate's issuing CA. If the CA certificate is not imported into the FortiGate's trusted CA list, the certificate chain validation fails, causing the authentication to be rejected and the client to be repeatedly prompted for credentials. This is the most common cause of repeated credential prompts in certificate-based ZTNA setups.

Answer

The user's password has expired.

Answer

The ZTNA rule is configured to use SAML authentication instead.

Answer

The FortiClient EMS server is not reachable from the client.

Question 13

An administrator has configured BGP on a FortiGate with two upstream ISPs. They notice that traffic to a specific prefix is not load-balanced as expected; all traffic goes through ISP1 even though both paths are available. 'get router info bgp network' shows the prefix with two next hops. What is the MOST likely cause?

Accepted Answer

The BGP multi-path is disabled. BGP multi-path must be explicitly enabled to allow load balancing across multiple equal-cost paths. Even if both next hops are present in the BGP table, without the 'set multipath' or 'set multipath number' configuration under the BGP process, the FortiGate will select only the best path (lowest weight, local preference, AS-path length, etc.) and install that single route in the routing table. This is why all traffic uses ISP1 despite both paths being available.

Answer

The prefix is being learned via an IGP with a lower administrative distance

Answer

The administrative distance of BGP is higher than OSPF

Answer

The eBGP multihop is not configured

Question 14

A FortiGate administrator wants to use Fortinac for network access control. Which of the following is the PRIMARY function of Fortinac in a network?

Accepted Answer

Provide network access control by enforcing policies based on device identity and posture. FortiNAC's primary function is network access control (NAC): it identifies devices and users, assesses device posture (e.g., OS patches, antivirus status), and enforces access policies that determine whether a device is allowed on the network and at what level of access. This is the core purpose of FortiNAC in a Fortinet security fabric deployment.

Answer

Perform deep packet inspection on all traffic

Answer

Act as a VPN concentrator for remote access

Answer

Provide a cloud-based sandbox for malware analysis

Question 15

A network security administrator notices that FortiGate is not blocking outbound traffic to domains that FortiGuard classifies as malicious. The administrator confirms that the license is valid and FortiGuard category-based blocking is enabled. Which FortiGate feature should be verified to ensure that DNS queries for malicious domains are intercepted and sinkholed?

Accepted Answer

DNS filter with botnet C&C domain blocking enabled. The DNS filter with botnet C&C domain blocking is designed to intercept DNS responses for known malicious domains and redirect them to a sinkhole, effectively preventing communication. This is the correct mechanism when the goal is to block DNS resolution of malicious domains. Other features operate at different layers and do not provide DNS-level sinkholing, so they would not address the specific problem.

Answer

Web filter with FortiGuard category-based blocking

Answer

Application control with botnet signatures

Answer

Antivirus profile with botnet C&C IP blocking