NSE7 Practice Test 3 — 10 Questions

Question 1

An administrator wants to configure a multi-peer IPsec VPN where one FortiGate (hub) connects to multiple remote FortiGates (spokes) using a single phase 1 interface with dynamic IP addresses. Which configuration is required on the hub?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set type to dynamic and set remote-gw 0.0.0.0. To allow multiple peers to connect with dynamic IPs, the hub must use a phase 1 interface with mode-cfg enabled to assign IPs to clients and accept connections from any remote IP (set remote-gw 0.0.0.0). This is commonly called a dial-up VPN configuration.

Answer

Set psksecret to a group password and enable XAuth

Answer

Set mode to aggressive and use pre-shared keys

Answer

Set type to static and configure each peer's IP in separate phase1

Question 2

A FortiGate is configured with FortiClient EMS to enforce ZTNA posture checks. The administrator finds that some Windows 10 clients are not reporting their antivirus status correctly, causing them to be blocked. However, the clients have antivirus installed and running. What is the most likely cause?

Accepted Answer

The FortiClient EMS connector is disabled on the endpoints. FortiClient requires the EMS connector to be enabled and the correct compliance profile must be applied. If the antivirus status is not reported, the connector might be disabled or the profile not assigned.

Answer

The clients are not connected to the corporate network

Answer

The antivirus definitions are outdated

Answer

FortiGate is using the wrong EMS tag

Question 3

A FortiGate administrator runs the following command on a FortiGate and sees the output:
diagnose sys session filter dport 443
diagnose sys session list

proto=6 proto_state=01 duration=3600 expire=3599
What does this output indicate about the session?

Accepted Answer

The session is in SYN_SENT state; the three-way handshake is incomplete. proto_state=01 indicates TCP SYN_SENT state, meaning the session has not completed three-way handshake.

Answer

The session has been terminated due to inactivity

Answer

The session is a UDP session

Answer

The session is fully established and has been active for 3600 seconds

Question 4

You run 'diagnose vpn ike gateway list' on a FortiGate hub and see the following output for a spoke connection: IKE SA state: ESTABLISHED, IPsec SA state: UP, but the spoke cannot route traffic to other spokes. The ADVPN shortcut tunnel is not being established. What is the MOST likely cause?

Accepted Answer

The hub has a static route for the spoke subnet pointing to the tunnel interface. In ADVPN, the hub must not include static routes for the spoke subnets, otherwise the spokes will use the hub as next-hop and not attempt shortcut establishment. The hub should use dynamic routing (BGP/OSPF) to propagate routes but not install a route with a next-hop of the hub itself for other spoke subnets. Option B is correct.

Answer

DPD is not configured on the hub

Answer

The spoke's phase2 proposal does not match the hub's proposal

Answer

The spoke is using a different IKE version than the hub

Question 5

A FortiGate administrator configures a hub-and-spoke VPN with OSPF routing. The spoke FortiGates are learning routes from the hub, but inter-spoke traffic is being routed through the hub instead of using shortcut tunnels. What configuration is missing on the hub to allow ADVPN shortcut establishment?

Accepted Answer

Disable route redistribution from OSPF into the VPN tunnel interface on the hub. For ADVPN to work, the hub must have 'auto-discovery-sender' enabled and also must not redistribute spoke routes back to other spokes in a way that prevents shortcut. Typically, the hub should not redistribute OSPF routes learned from one spoke into another; ADVPN relies on IKE shortcuts.

Answer

Set the VPN interface type to 'tunnel' instead of 'vlan'

Answer

Enable 'auto-discovery-sender' on the hub and 'auto-discovery-forwarder' on spokes

Answer

Configure a static route for inter-spoke traffic on the hub

Question 6

Which feature in FortiOS enables a FortiGate to act as a proxy for client-initiated connections to internal applications without requiring a VPN client, by verifying device posture and user identity?

Accepted Answer

ZTNA (Zero Trust Network Access) proxy. ZTNA proxy provides application-level access without full network connectivity, enforcing identity and posture checks. IPsec and SSL VPN give full network access. Explicit proxy is for web traffic only.

Answer

IPsec VPN with XAuth authentication

Answer

SSL VPN with web mode portal

Answer

FortiGate's explicit web proxy

Question 7

An organization wants to implement Network Access Control (NAC) using FortiNAC. The goal is to automatically quarantine any device that does not have the latest antivirus definitions. Which FortiNAC component enforces this policy?

Accepted Answer

FortiNAC Enforcement Engine. FortiNAC uses policies to define security requirements. The Enforcement Engine applies the policy by changing the VLAN or applying ACLs on network devices to quarantine non-compliant endpoints.

Answer

FortiNAC Collector

Answer

FortiNAC Profiler

Answer

FortiNAC Portal

Question 8

You run the following command on a FortiGate: 'diagnose vpn ike gateway list' and see that the DPD status for a VPN peer is 'dead'. What does this indicate?

Accepted Answer

The VPN peer has been detected as unreachable and the tunnel is considered down. DPD (Dead Peer Detection) is used to check the liveness of a VPN peer. 'Dead' means the peer is not responding to DPD messages, indicating the tunnel is down.

Answer

The remote peer has been manually disconnected from the network

Answer

The VPN tunnel is still up but the peer is not responding to DPD messages

Answer

The IKE SA is still active but the IPsec SA has expired

Question 9

A network engineer is troubleshooting an ADVPN scenario where shortcut tunnels between spokes are not forming. The hub has IKEv2 configured and the spokes are behind NAT. Which THREE conditions must be met for shortcut tunnels to establish?

Accepted Answer

Spokes are configured with 'set auto-discovery' enabled. ADVPN shortcut tunnels require: IKEv2 (not IKEv1), auto-negotiate enabled on the hub phase2, and the hub's phase2 must have 'add-route' set to enable route injection. NAT traversal is automatically handled by IKEv2.

Answer

NAT traversal is enabled on all gateways

Answer

IKEv1 is used for the spoke-to-hub tunnels

Question 10

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is up but traffic is not passing. The administrator runs 'diagnose vpn ike gateway list' and sees that the IKE SA has been established. However, 'diagnose vpn tunnel list' shows no IPsec SA entries. What is the most likely cause?

Accepted Answer

The phase 2 proposal (encryption, authentication, etc.) does not match between peers. IKE SA established but no IPsec SA indicates that phase 2 parameters are misconfigured or the proposal is not matching.

Answer

The firewall policies are not configured to allow traffic through the tunnel

Answer

The pre-shared key on both sides does not match

Answer

The interface MTU is set too low