NSE7 Practice Test 29 — 15 Questions

Question 1

An administrator needs to monitor FortiGate session count and CPU usage over time using FortiAnalyzer. Which log type should be configured for this?

Accepted Answer

Performance logs. Performance logs are specifically designed to capture system resource utilization metrics such as CPU usage, memory consumption, and session counts over time. FortiAnalyzer uses these logs to generate historical performance graphs and reports, enabling administrators to monitor trends and identify resource bottlenecks. Security logs, event logs, and traffic logs do not contain the periodic, time-series resource data required for this monitoring purpose.

Answer

Security logs

Answer

Event logs

Answer

Traffic logs

Question 2

A FortiGate is configured with an IPS sensor that has protocol anomaly detection enabled. The admin notices that legitimate VoIP traffic (SIP) is being blocked. Which action should the admin take to reduce false positives?

Accepted Answer

Tune the protocol anomaly thresholds to be more lenient for SIP. Protocol anomaly detection in IPS sensors uses predefined thresholds to identify abnormal traffic patterns. When legitimate SIP traffic is being blocked, tuning the protocol anomaly thresholds to be more lenient for SIP allows the sensor to accommodate normal variations in SIP behavior without triggering false positives, while still maintaining protection against actual anomalies.

Answer

Change the IPS action from block to monitor

Answer

Add the VoIP servers to an IP exemption list in the IPS sensor

Answer

Disable protocol anomaly detection entirely

Question 3

Which TWO actions are appropriate when troubleshooting a slow network connection through a FortiGate?

Accepted Answer

Check the CPU and memory utilization on the FortiGate.. Option B is correct because high CPU or memory utilization on the FortiGate can directly degrade throughput and cause slow connections, so checking resource usage via commands like 'get system performance status' or the dashboard is a standard first troubleshooting step. Option C is correct because an incorrect or missing next-hop entry in the routing table (verifiable with 'get router info routing-table all') can cause suboptimal paths, asymmetric routing, or packet drops that manifest as slow network performance. Option A is not appropriate because increasing session TTL does not reduce session setup overhead and can actually consume more session table resources. Option D is wrong because disabling flow control on the WAN interface can worsen performance by allowing buffer overruns and packet loss rather than fixing slowness. Option E is wrong because disabling all security profiles is a drastic, security-compromising action that is not a legitimate troubleshooting step for slow connections.

Answer

Increase the session TTL to reduce session setup overhead.

Answer

Disable flow control on the WAN interface.

Answer

Disable all security profiles to free resources.

Question 4

An administrator has configured two VDOMs on a FortiGate. One VDOM is in NAT mode and the other in transparent mode. The administrator wants traffic from the transparent mode VDOM to be routed through the NAT mode VDOM. What must be configured to allow inter-VDOM routing?

Accepted Answer

Create an inter-VDOM link. Inter-VDOM routing between VDOMs in different modes (NAT and transparent) requires a dedicated inter-VDOM link (IVL), which is a virtual internal connection that allows traffic to pass between VDOMs without consuming physical ports. The IVL creates a pair of virtual interfaces, one in each VDOM, and firewall policies must be configured to permit traffic across them. This is the only method that supports routing between VDOMs of different modes on the same FortiGate.

Answer

Use a physical interface to connect the VDOMs

Answer

Enable NPU offloading

Answer

Configure firewall policies between the VDOMs

Question 5

A company with a hub-and-spoke SD-WAN topology uses FortiGates at each site. The hub has two WAN links: MPLS (10 Mbps) and broadband (100 Mbps). The spokes connect only via MPLS. The company deploys a new real-time application that requires low latency and low jitter. The network administrator creates an SD-WAN rule for this application with 'best quality' strategy and both MPLS and broadband as members. The SLA for MPLS is configured with latency < 10 ms and jitter < 5 ms. The SLA for broadband is configured with latency < 50 ms and jitter < 20 ms. The actual measured latency on MPLS is 12 ms, and jitter is 4 ms. The broadband latency is 25 ms, jitter 10 ms. Which path will the application traffic take?

Accepted Answer

The traffic will use the broadband link because MPLS SLA fails and broadband SLA is met.. The SD-WAN rule uses the 'best quality' strategy, which selects the member with the best SLA performance. The MPLS link fails its SLA because its measured latency of 12 ms exceeds the configured threshold of 10 ms, even though jitter is within limits. The broadband link meets both its latency (25 ms < 50 ms) and jitter (10 ms < 20 ms) thresholds, so it becomes the active path for the application traffic.

Answer

The traffic will be load-balanced between MPLS and broadband.

Answer

The traffic will use the MPLS link because it is the preferred member.

Answer

The traffic will be dropped because no link meets the SLA.

Question 6

Which SD-WAN load balancing algorithm distributes traffic based on the number of active sessions per SD-WAN member?

Accepted Answer

Sessions. The Sessions algorithm in Fortinet SD-WAN distributes traffic by counting the number of active sessions currently traversing each SD-WAN member interface. The member with the fewest active sessions receives the next new session, ensuring a balanced session load across the SD-WAN links. This is distinct from volume-based or hash-based algorithms, as it directly uses session count as the metric.

Answer

Source-dest-IP

Answer

Spillover

Answer

Volume

Question 7

Match each Fortinet component to its description.

Accepted Answer

FortiGate: Next-generation firewall (NGFW) with integrated security features. FortiGate is the NGFW, FortiManager manages devices, FortiAnalyzer handles logging/analytics, and FortiClient is an endpoint agent. Common confusions involve swapping these roles.

Answer

FortiGate: Centralized management for Fortinet devices

Answer

FortiManager: Next-generation firewall (NGFW) with integrated security features

Question 8

An administrator is deploying ZTNA for a legacy application that uses a fixed IP address and port. Which ZTNA component is responsible for securely proxying traffic from the user to the application without exposing the application's actual network location?

Accepted Answer

ZTNA access proxy. The ZTNA access proxy is responsible for securely proxying traffic from the user to the application, hiding the application's actual network location. It acts as a reverse proxy that enforces access policies based on user identity and device posture, ensuring that only authorized users can reach the application without exposing it directly to the network.

Answer

ZTNA inline CASB

Answer

IPsec VPN gateway

Answer

FortiClient EMS

Question 9

An administrator runs the following CLI output: 'diagnose sys session filter dport 443' and sees 'proto=6 proto_state=01 duration=3600 expire=3599'. Which statement BEST describes the session?

Accepted Answer

The session is established and has been active for one hour. The session shows 'proto=6' (TCP), 'proto_state=01' (TCP_ESTABLISHED), and 'duration=3600' seconds, which equals one hour. The 'expire=3599' indicates the session has 3599 seconds left before timeout, confirming it is active and established. Option B correctly identifies this as an established session that has been active for one hour.

Answer

The session is in the process of being torn down

Answer

The session is a UDP session incorrectly classified as TCP

Answer

The TCP session is still in the SYN-SENT state

Question 10

What is the purpose of a management VDOM in a multi-VDOM FortiGate deployment?

Accepted Answer

To host the management interfaces and administrative services (GUI, SSH) while other VDOMs carry user traffic. A management VDOM is dedicated to hosting all administrative interfaces (GUI, SSH, SNMP, syslog) and management services, isolating them from user traffic VDOMs. This separation ensures that management access remains available even if a data VDOM is overloaded or compromised, and it centralizes administrative control without mixing management and data plane functions.

Answer

To route traffic between different VDOMs

Answer

To aggregate logs from all other VDOMs

Answer

To enforce inter-VDOM traffic policies centrally

Question 11

A company uses FortiMail for email security. They want to prevent email spoofing by verifying that incoming emails originate from authorized servers. Which email authentication method should be configured on FortiMail to check the sending server's IP against a published SPF record?

Accepted Answer

SPF verification. SPF (Sender Policy Framework) verification on FortiMail checks the sending server's IP address against the SPF record published in the domain's DNS. This directly matches the requirement to verify that incoming emails originate from authorized servers, as SPF is designed to prevent spoofing by validating the envelope sender's domain against a list of permitted IPs.

Answer

DKIM verification

Answer

DMARC verification

Answer

Sender Policy Framework (SPF) is not supported on FortiMail

Question 12

A FortiGate is receiving BGP routes from a neighbor but not advertising them to other peers. The administrator runs 'get router info bgp network' and sees the routes are in the BGP table but not advertised. What is the most likely cause?

Accepted Answer

An outbound route map is applied that filters these routes. An outbound route map can explicitly filter which routes are advertised to BGP peers. Even though routes are present in the BGP table (as shown by 'get router info bgp network'), an outbound route map applied to the neighbor configuration can deny or modify those routes before they are sent, preventing their advertisement.

Answer

BGP synchronization is enabled and the routes are not in the IGP

Answer

The next hop is unreachable

Answer

The router-id is the same as the peer

Question 13

An administrator notices high CPU usage on a FortiGate. To identify which process is consuming the most CPU, which command should be used?

Accepted Answer

diagnose sys top. The 'diagnose sys top' command displays a real-time list of running processes on the FortiGate, sorted by CPU usage, allowing the administrator to identify which process is consuming the most CPU. This is the standard diagnostic tool for process-level CPU troubleshooting in FortiOS.

Answer

diagnose sys session stat

Answer

get system performance status

Answer

diagnose hardware sysinfo

Question 14

Which load balancing algorithm in SD-WAN sends new sessions to the member interface with the least number of active sessions?

Accepted Answer

Sessions. The Sessions algorithm in Fortinet SD-WAN selects the member interface with the fewest active sessions when a new session is initiated. This is the default load-balancing method and ensures even distribution of session counts across WAN links, preventing any single interface from becoming overloaded with connections.

Answer

Volume

Answer

Spillover

Answer

Source-dest IP

Question 15

A network engineer is deploying a FortiGate in transparent mode at a branch office. The goal is to insert the firewall without changing the existing IP subnet scheme. Which statement about transparent mode is TRUE?

Accepted Answer

The FortiGate acts as a Layer 2 bridge and forwards traffic based on MAC addresses. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without modifying the IP subnet scheme. This allows the firewall to be inserted into an existing network segment without requiring IP reconfiguration of connected devices.

Answer

The FortiGate must have a unique IP subnet for each interface

Answer

Transparent mode supports all routing protocols like OSPF and BGP

Answer

NAT is required for traffic to pass through the FortiGate