NSE7 Practice Test 30 — 15 Questions

Question 1

A FortiGate administrator wants to verify whether a specific session is being offloaded to the NP6 processor. Which CLI command should the administrator use?

Accepted Answer

diagnose sys session filter src 10.0.0.1 ; diagnose sys session list. The 'diagnose sys session filter src 10.0.0.1' command sets a filter to isolate sessions from a specific source IP, and 'diagnose sys session list' then displays the session details, including the 'offload' field. This field explicitly indicates whether the session is offloaded to the NP6 processor (e.g., 'offload yes' or 'np6 offload'). This is the standard method to verify NP6 offloading for a specific session.

Answer

get system performance status

Answer

diagnose hardware sysinfo memory

Answer

diagnose npu np6 session list

Question 2

In a FortiManager deployment with global ADOM enabled, an administrator creates a firewall policy in the global ADOM. What is the effect of this policy on the per-ADOM devices?

Accepted Answer

The policy is installed as a header policy on all managed FortiGates. In FortiManager with global ADOM enabled, policies created in the global ADOM are installed as header policies on all managed FortiGates across all ADOMs. These header policies are processed first, before any per-ADOM policies. They apply to all devices unless overridden by per-ADOM policies with higher priority. Therefore, option D is correct.

Answer

The policy is used only if no per-ADOM policy exists with the same name

Answer

The policy is applied only to devices in the same ADOM as the global ADOM

Answer

The policy is ignored unless explicitly assigned to each ADOM

Question 3

An administrator is troubleshooting a VPN tunnel that is not coming up. The remote peer is a third-party device. Which THREE actions should be taken to diagnose the issue?

Accepted Answer

Ensure that the pre-shared key matches on both sides.. IPsec IKE (Internet Key Exchange) uses the pre-shared key (PSK) during authentication phase 1 (Main Mode or Aggressive Mode). If the PSK does not match on both peers, the IKE SA will fail to establish, and the VPN tunnel will not come up. This is a fundamental prerequisite for any IPsec VPN, and mismatched PSKs are a common misconfiguration.

Answer

Confirm that UDP ports 500 and 4500 are not blocked by any firewall.

Answer

Review the routing table to ensure the remote subnet is reachable through the tunnel interface.

Question 4

Which FortiManager feature allows an administrator to roll back a policy package to a previous version?

Accepted Answer

Revision history. Revision history stores previous versions of policy packages, allowing an administrator to roll back to a previous version. Install preview (A) shows pending changes but does not provide rollback capability. Device manager (C) manages devices, not policy versioning. Automation stitch (D) automates tasks but does not handle policy rollback.

Answer

Install preview

Answer

Device manager

Answer

Automation stitch

Question 5

Which FortiGate feature allows multiple independent routing tables on a single device, enabling traffic separation for different departments or customers?

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, each with its own set of interfaces, routes, and forwarding decisions. This enables traffic separation for different departments or customers without requiring separate physical devices, as each VRF instance operates as a logically isolated router within the same hardware.

Answer

ECMP

Answer

VDOM

Answer

Policy-based routing

Question 6

What is the purpose of configuring BFD (Bidirectional Forwarding Detection) on a FortiGate?

Accepted Answer

To provide rapid failure detection between two forwarding engines.. BFD (Bidirectional Forwarding Detection) provides sub-second failure detection between two forwarding engines, such as FortiGate peers running OSPF or BGP. It operates independently of the routing protocol, using a lightweight hello mechanism to detect link or neighbor failures faster than protocol-native timers (e.g., OSPF dead interval of 40 seconds). This enables rapid convergence in SD-WAN and advanced networking scenarios.

Answer

To load balance traffic across multiple links.

Answer

To encrypt BGP updates between peers.

Answer

To authenticate OSPF neighbors.

Question 7

A security team is configuring FortiMail for email security. They want to ensure that incoming emails are authenticated using SPF, DKIM, and DMARC, and that emails failing authentication are quarantined. Which THREE settings must be configured in FortiMail? (Choose three.)

Accepted Answer

Enable DKIM verification in the anti-spam policy. DKIM verification must be explicitly enabled in the anti-spam policy to allow FortiMail to validate the DKIM signature on incoming emails. Without this setting, DKIM authentication is not performed, and the email's DKIM status will not be evaluated.

Answer

Enable TLS encryption for incoming SMTP

Answer

Configure a recipient verification policy

Question 8

Which TWO features are part of FortiGate's Advanced Threat Protection (ATP) suite?

Accepted Answer

FortiGuard Antivirus. FortiGate's Advanced Threat Protection (ATP) suite is designed to detect and block advanced, unknown, and zero-day threats. FortiGuard Antivirus (C) is a core ATP component that uses signature-based and heuristics-based scanning to detect known malware at the gateway. FortiSandbox (D) extends this by detonating suspicious files in a virtual environment to identify unknown threats, making both integral to the ATP suite.

Answer

Data Leak Prevention (DLP)

Answer

SSL Inspection

Answer

Intrusion Prevention System (IPS)

Question 9

Drag and drop the steps to configure a FortiGate VDOM in multi-VDOM mode into the correct order.

Accepted Answer

Enable VDOM mode globally, then create and assign interfaces, then configure each VDOM, then resource allocation.. First enable VDOM mode globally, then create and assign interfaces, then configure each VDOM, then resource allocation.

Answer

Create and assign interfaces, then enable VDOM mode globally, then configure each VDOM, then resource allocation.

Answer

Configure each VDOM, then enable VDOM mode globally, then create and assign interfaces, then resource allocation.

Answer

Resource allocation, then enable VDOM mode globally, then create and assign interfaces, then configure each VDOM.

Question 10

Drag and drop the steps to configure a site-to-site IPsec VPN on a FortiGate firewall into the correct order.

Accepted Answer

Phase 1, then Phase 2, then Routing, then Policies. Phase 1 establishes the IKE SA, Phase 2 creates the IPsec SA, then routing and policies are applied to allow traffic through the tunnel.

Answer

Phase 2, then Phase 1, then Routing, then Policies

Answer

Phase 1, then Policies, then Phase 2, then Routing

Answer

Policies, then Routing, then Phase 1, then Phase 2

Question 11

Match each high availability (HA) mode to its characteristic.

Accepted Answer

Active-Passive: One unit is active, others are standby.. The correct matches are A and B. Common confusions involve swapping the characteristics: Active-Passive uses a single active unit with standby, while Active-Active uses all units to handle traffic.

Answer

Active-Passive: All units are active and load balance.

Answer

Active-Active: Only one unit processes traffic, others monitor.

Question 12

An administrator wants to use policy-based routing to forward traffic from subnet 192.168.1.0/24 to a specific next-hop via port2. Which TWO configuration elements are needed?

Accepted Answer

A route-map that matches the source subnet and sets the next-hop.. Policy-based routing (PBR) on FortiGate uses a route-map to override the normal routing table lookup. Option B is correct because the route-map must match the source subnet (e.g., via a prefix-list or access-list) and set the next-hop to the desired gateway. Option D is also correct because a prefix-list is the standard method to define the subnet match condition within the route-map.

Answer

An SD-WAN rule overriding the routing decision.

Answer

A static route with a higher administrative distance.

Answer

A firewall policy matching the traffic with action 'accept'.

Question 13

An administrator wants to use FortiExtender to provide LTE WAN connectivity. After connecting the FortiExtender to the FortiGate, the LTE interface is not showing up. What is the first troubleshooting step?

Accepted Answer

Verify the FortiExtender is connected to the correct port and powered on. The first troubleshooting step is to verify the physical connection and power status of the FortiExtender. If the FortiExtender is not connected to the correct port (typically a USB or PoE port) or is not powered on, the FortiGate will not detect the LTE interface at all, making any software-level checks premature.

Answer

Run 'execute lte test' command

Answer

Configure an SD-WAN rule for LTE traffic

Answer

Check the signal strength of the LTE connection

Question 14

A network administrator runs 'get system ha status' on a FortiGate HA cluster and sees that only one unit shows as primary. The secondary unit shows as 'standalone' with no HA peer detected. What is the MOST likely cause of this issue?

Accepted Answer

The heartbeat interface is down or misconfigured. When a secondary unit shows as 'standalone' with no HA peer detected, it indicates that the heartbeat communication between the two FortiGate units has failed. The most common cause is that the heartbeat interface is down, misconfigured, or not physically connected, preventing the units from discovering each other as HA peers. Without a functioning heartbeat link, the secondary unit cannot join the cluster and remains in standalone mode.

Answer

The cluster serial numbers do not match

Answer

The HA group ID is different on each unit

Answer

The HA priority on the secondary unit is set to 0

Question 15

Which TWO configurations are required to enable SSL VPN authentication using a RADIUS server on a FortiGate?

Accepted Answer

Create a user group that includes the RADIUS server as an authentication method. A user group must be created to reference the RADIUS server as an authentication method. This group is then applied to the SSL VPN portal or firewall policy, allowing FortiGate to forward authentication requests to the RADIUS server. Without the user group, the RADIUS server cannot be associated with SSL VPN authentication.

Answer

Configure an LDAP server to synchronize user accounts

Answer

Configure an SSL VPN portal with 'Require Authentication' enabled

Answer

Set a local password policy for SSL VPN users