NSE7 Practice Test 30 — 15 Questions

Question 1

A network security team is evaluating options for web application security. They need to protect a critical web application from SQL injection and cross-site scripting (XSS) attacks, and they require granular control over HTTP request parameters. Which THREE factors should influence their decision between using FortiGate's WAF profiles versus deploying a dedicated FortiWeb appliance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FortiWeb can perform SSL offloading and load balancing, reducing load on the web servers. FortiWeb is a dedicated web application firewall appliance with specialized hardware and software optimized for WAF processing, offering higher throughput and lower latency compared to the integrated WAF profiles on a FortiGate. Additionally, FortiWeb can perform SSL offloading and load balancing, which reduces the processing burden on web servers and improves overall performance. These capabilities make FortiWeb the superior choice when granular control and high-performance protection against SQL injection and XSS are required.

Answer

FortiGate's WAF supports integration with FortiSandbox for file upload inspection

Answer

FortiGate's WAF profiles offer the same level of customization as FortiWeb for signature creation

Question 2

A network admin wants to use FortiClient's advanced threat protection features to detect ransomware behavior on endpoints. Which FortiClient feature should be enabled?

Accepted Answer

Advanced Threat Protection. FortiClient's Advanced Threat Protection (ATP) feature is specifically designed to detect and block ransomware behavior by using real-time behavioral analysis, machine learning, and exploit prevention. Unlike other features, ATP monitors process behavior for indicators of compromise (IoCs) such as mass file encryption or unauthorized file access patterns, making it the correct choice for ransomware detection.

Answer

Web Filtering

Answer

Application Firewall

Answer

Vulnerability Scan

Question 3

Which feature in FortiMail provides an additional layer of protection by analyzing the behavior of email attachments in a sandbox environment?

Accepted Answer

FortiSandbox integration. FortiSandbox integration allows FortiMail to forward email attachments to an external or internal FortiSandbox appliance for dynamic behavioral analysis. Unlike static signature-based detection, this sandboxing executes the attachment in a controlled environment to identify zero-day malware, ransomware, or advanced persistent threats based on runtime behavior, providing an additional layer of protection beyond traditional filtering.

Answer

Outbreak Prevention

Answer

Anti-spam

Answer

Content Disarm and Reconstruction

Question 4

An administrator configured FortiGate to forward suspected malicious files to FortiSandbox. They set the action to 'block' for malicious verdicts. Some files are being blocked, but others with a 'clean' verdict are allowed. However, they notice that some files that should have been sent to FortiSandbox are not being forwarded. Which reason is MOST likely?

Accepted Answer

The file size exceeds the maximum size configured for FortiSandbox scanning. The most likely reason is that the file size exceeds the maximum size configured for FortiSandbox scanning. FortiGate has a configurable limit (default 10 MB) for files sent to FortiSandbox; files larger than this threshold are not forwarded, even if the antivirus engine would otherwise trigger a submission. This explains why some files are blocked or allowed based on verdicts, while others are never submitted.

Answer

The FortiGate antivirus engine is set to proxy-based mode

Answer

The FortiGate has insufficient disk space for temporary files

Answer

The FortiSandbox device is overloaded and rejecting submissions

Question 5

A FortiGate administrator wants to use threat intelligence feeds to block known malicious IP addresses. Which TWO steps are required to accomplish this? (Choose two.)

Accepted Answer

Create an external threat feed connector pointing to the IoC source. An external threat feed connector must be created in FortiGate to import indicators of compromise (IoC) from a third-party source. This connector defines the URL, authentication, and update interval for the feed, allowing FortiGate to consume and store the malicious IP addresses as a local threat feed object.

Answer

Enable IPS on all policies

Answer

Configure FortiGuard to push feeds automatically

Answer

Subscribe to FortiSandbox

Question 6

Which SD-WAN load balancing algorithm distributes new sessions based on the number of active sessions on each link?

Accepted Answer

Sessions. The Sessions algorithm distributes new sessions based on the current number of active sessions on each SD-WAN link. When a new session is initiated, the SD-WAN controller selects the link with the fewest active sessions, ensuring a balanced load across all available transport interfaces. This is distinct from algorithms that consider source/destination IP pairs, traffic volume, or bandwidth thresholds.

Answer

Source-dest IP

Answer

Spillover

Answer

Volume

Question 7

An administrator configures two VDOMs as shown in the exhibit. They create an inter-VDOM link between VDOM1 and VDOM2. They then add a firewall policy in VDOM1 allowing traffic from port1 to the inter-VDOM link, and a policy in VDOM2 allowing traffic from the inter-VDOM link to port2. However, traffic from 192.168.1.10 to 10.10.10.50 fails. What is the most likely cause?

Accepted Answer

Missing route in VDOM1 for the 10.10.10.0/24 network. Inter-VDOM link traffic requires routing in both VDOMs. Even with correct firewall policies, VDOM1 must have a route to the destination network (10.10.10.0/24) pointing to the inter-VDOM link interface. Without this route, VDOM1 drops the packet before it can be forwarded across the link, causing the failure.

Answer

Firewall policies are not correctly configured

Answer

The inter-VDOM link is not configured

Answer

The allowaccess setting on port2 does not include ping

Question 8

An administrator wants to enforce that only devices with corporate-owned certificates can establish an IPsec VPN tunnel. Which IPsec authentication method should be configured?

Accepted Answer

X.509 certificates. X.509 certificates provide a strong, identity-based authentication mechanism that allows the VPN gateway to verify that only devices possessing a corporate-issued certificate can establish an IPsec tunnel. This method relies on a public key infrastructure (PKI) where the gateway validates the certificate chain and optionally checks certificate revocation lists (CRLs) or OCSP responses, ensuring that unauthorized devices without a valid corporate certificate are rejected.

Answer

Pre-shared keys

Answer

Extended Authentication (XAuth)

Answer

Aggressive mode

Question 9

Which of the following best describes the function of FortiDeceptor in an enterprise network?

Accepted Answer

It deploys decoys and lures to detect attackers inside the network.

Answer

It provides endpoint detection and response (EDR) capabilities on workstations.

Answer

It acts as a web application firewall for protecting web servers.

Answer

It provides sandboxing for advanced malware analysis.

Question 10

What is the purpose of a prefix list in FortiGate routing?

Accepted Answer

To match routes based on their network prefix and subnet mask.. A prefix list in FortiGate is used to match routes based on their network prefix and subnet mask (prefix length). It is commonly applied in route maps or BGP configurations to filter or manipulate routing information, such as in redistribution or neighbor policy statements. Unlike access lists, prefix lists match the exact prefix and length, providing more granular control over route advertisement and acceptance.

Answer

To configure NAT rules.

Answer

To define SD-WAN members.

Answer

To assign IP addresses to interfaces.

Question 11

An HA cluster of two FortiGates is experiencing split-brain. Which command should the administrator use to check the current HA status and identify which unit is the primary?

Accepted Answer

get system ha status. The correct command to check the current HA status and identify the primary unit is 'get system ha status'. This command displays the HA mode, cluster state, role (primary/secondary), and peer status in a clear, human-readable format. In a split-brain scenario, the administrator needs to quickly confirm which unit believes it is the primary, and this command provides that information directly without debug-level verbosity.

Answer

diagnose debug application had 0

Answer

diagnose sys ha dump

Answer

show system ha

Question 12

A FortiGate administrator wants to see the current number of active sessions. Which command provides this information?

Accepted Answer

diagnose sys session stat. The 'diagnose sys session stat' command displays a summary of the current session table, including the total number of active sessions, which is exactly what the administrator needs. This command is part of FortiGate's diagnostic tools and provides a quick statistical overview without listing individual session details.

Answer

show system session-info

Answer

diagnose sys session list

Answer

get system performance status

Question 13

A FortiGate is configured with OSPF multi-area. The administrator wants to ensure that routes from area 0 are redistributed into area 1. Which OSPF configuration is required?

Accepted Answer

No additional configuration is needed; ABRs automatically advertise inter-area routes. OSPF ABRs (Area Border Routers) automatically advertise inter-area routes between areas by default. In a multi-area OSPF setup, the ABR learns Type 3 LSAs from area 0 and floods them into other areas (like area 1) without any additional redistribution configuration. No explicit redistribution policy is needed for inter-area route advertisement.

Answer

Enable 'redistribute connected' on the ABR

Answer

Set the 'area type' to 'nssa' on area 1

Answer

Configure a route redistribution policy under OSPF

Question 14

A ZTNA rule is configured to allow access to an internal application only if the client device has the ZTNA tag 'Compliant' and the user is authenticated via SAML. The FortiGate is acting as ZTNA proxy. A user successfully authenticates but the device is not tagged. What happens when the user tries to access the application?

Accepted Answer

The user is denied access. ZTNA rules on FortiGate enforce both user authentication and device posture (ZTNA tags) as conditions. If the device lacks the required 'Compliant' tag, the rule does not match, so the traffic is denied even though SAML authentication succeeded. ZTNA is zero-trust: authentication alone is insufficient without device compliance.

Answer

The FortiGate dynamically assigns the 'Compliant' tag to the device

Answer

The user is redirected to a device registration portal

Answer

The user is granted access because authentication succeeded

Question 15

An organization uses FortiNAC for network access control. They want to enforce that only corporate-managed devices with up-to-date patches can access the production VLAN. Which THREE components must be integrated or configured?

Accepted Answer

FortiClient EMS with compliance rules. FortiClient EMS with compliance rules (B) is required because FortiNAC relies on the EMS integration to receive endpoint posture and compliance data (e.g., patch level, antivirus status) so it can classify corporate-managed devices as compliant before granting production VLAN access. RADIUS authentication on switches (E) is needed because FortiNAC enforces VLAN assignment and access decisions by acting as the RADIUS server (or proxy) that authenticates supplicants via 802.1X/MAC authentication and returns the appropriate VLAN or deny response. SNMP read/write community on network devices (C) is required so FortiNAC can read MAC/ARP/forwarding tables for host discovery and, with write access, send SNMP SET commands to change switch port VLANs or shut/no-shut ports for enforcement. The other options do not belong: a ZTNA proxy on FortiGate (A) is an application-access control feature unrelated to FortiNAC's LAN enforcement, an IPsec VPN between FortiNAC and FortiGate (D) is not a prerequisite for NAC posture and VLAN enforcement, and while RADIUS is correct, it must be on the switches rather than any generic VPN or proxy component.

Answer

ZTNA proxy on FortiGate

Answer

IPsec VPN between FortiNAC and FortiGate