NSE7 Practice Test 2 — 30 Questions

Question 1

A FortiGate is configured as a ZTNA proxy for an internal web application. The client's device posture check fails due to an outdated antivirus definition. The administrator wants to block access but still display a warning page. Which ZTNA access rule action should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

set action block. ZTNA access rules can block or allow with optional warning. 'Allow with warning' is not available; to show a warning while blocking, the action should be 'Block' with a redirect to a warning portal.

Answer

set action redirect

Answer

set action authenticate

Answer

set action allow

Question 2

An administrator configures OSPF over an IPsec VPN tunnel between two FortiGates. The OSPF adjacency does not form. The tunnel is up and ping works between the loopback interfaces used for OSPF. What is the MOST likely issue?

Accepted Answer

The firewall policy allowing OSPF traffic (protocol 89) over the tunnel is missing.. Even if the tunnel is up, OSPF packets (protocol 89) must be explicitly permitted by a firewall policy on the tunnel. Without that policy, OSPF Hellos are dropped and adjacency fails. Network type mismatch can also cause issues, but the most common is missing policy.

Answer

OSPF is not enabled on the tunnel interface.

Answer

The OSPF network type on the tunnel interface is set to point-to-point but the remote side is broadcast.

Answer

The MTU on the tunnel interface is too large for OSPF packets.

Question 3

An administrator is configuring FortiClient EMS to enforce compliance for ZTNA. Which TWO settings are required on FortiGate to use compliance-based ZTNA tags?

Accepted Answer

FortiClient EMS is added as a security fabric connector. To use compliance tags, FortiGate must have EMS configured as a fabric connector and the ZTNA proxy rule must reference the tags.

Answer

SSL deep inspection is enabled on the firewall policy

Answer

A local user database is configured for authentication

Answer

FortiGate is configured as a SAML IdP

Question 4

An administrator configures a ZTNA gateway with inline CASB to monitor SaaS applications. Users report that access to Salesforce is blocked. The administrator reviews the ZTNA proxy rule and sees that inline CASB is enabled with a 'monitor-only' action. What is the MOST likely reason for the block?

Accepted Answer

A separate application control profile is blocking Salesforce. Inline CASB with 'monitor-only' should not block traffic. The block may be due to a separate application control or web filtering profile applied on the policy.

Answer

The inline CASB profile is set to 'block' for Salesforce

Answer

The ZTNA proxy rule does not have SSL inspection enabled

Answer

FortiClient EMS is not assigning the required ZTNA tags

Question 5

A FortiGate is experiencing high CPU usage due to IPsec VPN traffic. The admin wants to offload cryptographic operations to the hardware. Which THREE conditions must be met for hardware acceleration to work? (Choose three.)

Accepted Answer

The FortiGate must have a compatible NP7 or CP9 processor. Hardware acceleration (CP8/CP9) requires specific conditions: supported encryption algorithms, no advanced features that disable offload, and the traffic must match a VPN policy that uses the hardware acceleration capable interface.

Answer

The VPN interface must be configured with 'set acceleration-mode ipsec'

Answer

The firewall policy using the VPN interface must not have NAT enabled

Question 6

An administrator runs 'diagnose vpn ike gateway list' and sees that the IKE SA state is 'UP' but the IPsec SA state is 'DOWN'. The remote peer is a FortiGate. What is the most likely cause of this issue?

Accepted Answer

The Phase2 parameters (encryption, authentication, proxy IDs) do not match between the peers. If IKE is up but IPsec is down, the Phase2 parameters are not matching between peers. Common causes include mismatched encryption algorithms, proxy IDs, or lifetimes.

Answer

The pre-shared key is incorrect

Answer

The tunnel interface is down

Answer

The firewall policy on the remote FortiGate is blocking UDP 500

Question 7

An administrator is deploying ZTNA for a legacy application that uses a fixed IP address and port. Which ZTNA component is responsible for securely proxying traffic from the user to the application without exposing the application's actual network location?

Accepted Answer

ZTNA access proxy. The ZTNA proxy component acts as an intermediary, hiding the application server's IP address and providing secure access based on identity and posture.

Answer

ZTNA inline CASB

Answer

IPsec VPN gateway

Answer

FortiClient EMS

Question 8

A FortiGate administrator wants to integrate FortiClient EMS to enforce compliance before granting VPN access. The FortiGate is the SSL VPN gateway. Which configuration is required on the FortiGate to use FortiClient's posture check?

Accepted Answer

Add the FortiClient EMS server as a telemetry source and create a ZTNA tag based on posture data.. FortiClient EMS sends posture data to FortiGate via telemetry. The admin must define ZTNA tags for conditions (e.g., antivirus running) and use those tags in firewall policies or SSL VPN permissions. There is no direct 'compliance check' setting in SSL VPN; it's done via ZTNA.

Answer

Configure the FortiGate as a SAML IdP for FortiClient EMS.

Answer

Configure FortiClient EMS as a user group server and assign it to the SSL VPN portal.

Answer

Enable 'compliance check' under SSL VPN settings and specify the EMS IP address.

Question 9

An administrator configures ZTNA with FortiClient EMS. The goal is to restrict access to an internal application based on device posture. The administrator configures a ZTNA tag for 'Compliant' that checks antivirus and OS patch status. Which TWO additional steps are required on the FortiGate to enforce access based on this tag?

Accepted Answer

Create a ZTNA policy that includes the 'Compliant' tag as a required condition. To use ZTNA tags, the administrator must configure a ZTNA access proxy to publish the application and a ZTNA policy that references the tag to grant access.

Answer

Enable SSL deep inspection on the firewall policy

Answer

Import the FortiClient EMS certificate to FortiGate

Answer

Configure a firewall policy with source set to the EMS connector

Question 10

A FortiGate VPN administrator is configuring IKEv2 with certificate-based authentication using a PKI. The administrator has imported the CA certificate and the local certificate onto the FortiGate. When initiating the VPN, the tunnel fails to establish. The CLI log shows 'IKEv2 authentication failed' and 'certificate validation failure'. What is the most likely missing configuration?

Accepted Answer

The CA certificate is not configured for peer certificate validation. For certificate-based authentication, the FortiGate must be configured to verify the peer's certificate against the trusted CA. Option D is correct because the peer's certificate must be validated, and if the CA certificate is not properly referenced in the phase1 configuration (e.g., 'set certificate-peers' or 'set enforcesecrets'), validation fails.

Answer

The IKEv2 proposal includes an incompatible encryption algorithm

Answer

The local certificate is not associated with the phase1 interface

Answer

The remote peer's certificate is not signed by the imported CA

Question 11

An administrator wants to use SAML SSO with FortiGate as the Service Provider (SP) to allow users to authenticate via an external IdP. What must be configured first on the FortiGate to establish the SAML trust?

Accepted Answer

A certificate for SAML signing and encryption. SAML SSO requires the FortiGate to have a certificate that the IdP trusts for signing assertions. Option D is correct because the FortiGate needs to import a CA-signed certificate (or use a self-signed) to sign SAML requests and also to establish the trust relationship with the IdP.

Answer

A firewall policy to allow SAML traffic

Answer

A RADIUS server for user authentication

Answer

An LDAP server for group membership lookup

Question 12

A FortiGate administrator is configuring OSPF over an IPsec VPN overlay in a hub-and-spoke topology. The spokes have dynamic IPs and use ADVPN. Which THREE conditions are necessary for OSPF to work correctly over the VPN tunnels?

Accepted Answer

The OSPF router ID must be unique across all spokes. OSPF requires stable network types and correct interface configuration. For ADVPN, OSPF should use point-to-point network type to avoid DR elections and ensure proper neighbor relationships.

Answer

The OSPF hello interval must be less than the DPD retry interval

Answer

The hub must have all spoke routes in its routing table before OSPF starts

Question 13

A FortiGate administrator sees the following syslog message repeatedly: 'IPsec phase 2 failed to establish SA with peer due to proposal mismatch.' The administrator has already verified that the phase 2 parameters (encryption, authentication, PFS, and lifetime) match on both sides. What else should the administrator check?

Accepted Answer

The local and remote subnets defined in the phase 2 selector. Phase 2 negotiation can also fail due to mismatched traffic selectors (local and remote subnets).

Answer

The phase 1 proposal settings

Answer

The DPD configuration

Answer

The pre-shared key

Question 14

A company wants to ensure that only company-managed laptops with up-to-date antivirus can access the internal file server remotely. Which Fortinet solution integrates with FortiGate to enforce device compliance before granting ZTNA access?

Accepted Answer

FortiClient EMS. FortiClient EMS (Endpoint Management Server) manages FortiClient endpoints and can enforce compliance policies. It integrates with FortiGate to provide device posture information via ZTNA tags, enabling access control based on compliance.

Answer

FortiAnalyzer

Answer

FortiSandbox

Answer

FortiWeb

Question 15

An administrator wants to implement ZTNA with FortiClient EMS to control access to an internal web application. Which TWO components are essential for the ZTNA proxy to function correctly?

Accepted Answer

A firewall policy allowing traffic from the ZTNA gateway to the application server. A ZTNA proxy requires a configured application mapping (defining the internal server) and a firewall policy that permits traffic from the ZTNA gateway to the internal server.

Answer

A static route on FortiGate pointing to the application server's network

Answer

SSL certificate installed on the application server

Answer

A public DNS record for the ZTNA gateway's FQDN

Question 16

An administrator configures a route map named RMAP_EXPORT that sets a community for routes redistributed into BGP. The route map is applied to the 'redistribute connected' statement under BGP. However, the connected routes are not being advertised to BGP peers. What is the most likely cause?

Accepted Answer

The route map does not have a 'match ip address' statement. A route map used for redistribution into BGP must contain at least one 'match' statement to filter which routes are redistributed. Without a 'match ip address' statement, the route map does not explicitly permit any routes, causing all connected routes to be denied by default. BGP redistribution requires an explicit permit action via a match condition; otherwise, the implicit deny at the end of the route map blocks all routes.

Answer

The BGP neighbor is not configured with 'route-map in'

Answer

Connected routes are not in the routing table

Answer

The route map is missing a 'set community' action

Question 17

A company wants to receive threat intelligence feeds from external sources to enhance their FortiGate's protection. Which method should be used to integrate external threat feeds into FortiGate?

Accepted Answer

Configure an external threat feed connector in FortiGate, such as using a URL to a STIX/TAXII feed.. FortiGate supports integration with external threat intelligence feeds via the External Threat Feed connector, which can consume STIX/TAXII feeds from a URL. This allows the FortiGate to dynamically update its threat database with indicators from third-party sources, enhancing its protection without relying solely on FortiGuard services.

Answer

Use FortiGuard Threat Intelligence Service which automatically pulls feeds.

Answer

Manually add IP addresses to local address objects.

Answer

Use FortiAnalyzer to push feeds to FortiGate.

Question 18

A FortiGate is configured with SD-WAN using load balancing algorithm 'source-dest-ip'. What is the primary characteristic of this algorithm?

Accepted Answer

All traffic from the same source IP to the same destination IP uses the same SD-WAN member.. The 'source-dest-ip' load balancing algorithm in SD-WAN uses a hash of both the source IP and destination IP to deterministically select an SD-WAN member. This ensures that all packets belonging to the same flow (same source-destination pair) are consistently forwarded over the same member, preserving per-flow stickiness and avoiding out-of-order delivery.

Answer

Traffic is sent to the member with the highest bandwidth.

Answer

Traffic is sent to the member with the lowest cost metric.

Answer

Traffic is distributed evenly across all SD-WAN members regardless of source or destination.

Question 19

An organization wants to protect against unknown malware by using machine learning on FortiGate. Which antivirus setting should be enabled to achieve this?

Accepted Answer

Enable 'Machine Learning Engine' in the antivirus profile. The 'Machine Learning Engine' in the antivirus profile uses on-device machine learning models to detect unknown malware based on file characteristics, without requiring signature updates. This provides proactive protection against zero-day threats directly on the FortiGate, aligning with the requirement to protect against unknown malware using machine learning.

Answer

Enable 'Outbreak Prevention' under FortiGuard settings

Answer

Set 'av-engine' to 'flow' under system settings

Answer

Enable 'FortiSandbox inline scanning' in the antivirus profile

Question 20

A FortiGate is configured as a SAML IdP for a partner's cloud application. After configuring the application as a service provider, users report that they are prompted for credentials every time they access the application, even though they already authenticated to FortiGate. What is the MOST likely cause?

Accepted Answer

The IdP session timeout is set to a lower value than the SP session timeout. When the IdP session timeout is shorter than the SP session timeout, the SP will consider the user's session expired and force re-authentication even though the FortiGate still has a valid local session. This mismatch causes the SP to initiate a new SAML authentication flow, prompting the user for credentials again. The SAML single logout URL (A) affects logout behavior, not re-authentication triggers, and an unsigned assertion (B) would cause a different error, not repeated credential prompts.

Answer

The SAML single logout URL is misconfigured

Answer

The SAML assertion is not signed

Answer

The FortiGate is not configured to generate a Name ID