NSE7 Practice Test 32 — 15 Questions

Question 1

An administrator has an SD-WAN deployment with two members, port1 (primary, low latency) and port2 (secondary, high latency). A performance SLA is configured using a ping probe to 8.8.8.8 with a 100 ms latency threshold. The SLA status for port1 is 'alive' and for port2 is 'dead'. The administrator creates an SD-WAN rule with the 'SLA' strategy that includes both members. They expect traffic to use port1 and, if it fails, port2. However, after applying the rule, all traffic is still going out port1 and never uses port2. What is the cause of this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SD-WAN rule's 'SLA' strategy only uses members that meet the SLA; since port2 is 'dead', it is excluded, and port1 is used exclusively as long as it meets SLA.. The 'SLA' strategy in an SD-WAN rule prioritizes members that meet the performance SLA. When at least one member meets the SLA, only those members are used. A member with a 'dead' SLA status is excluded from selection unless all members are dead, in which case the rule falls back to the best available member. In this scenario, port1 meets the SLA, so it is used exclusively, and port2 is not used. The administrator's expectation of immediate fallback is a misunderstanding of the strategy's behavior.

Answer

The performance SLA probe target 8.8.8.8 is unreachable from port2, causing the SLA to be 'dead' and thus port2 is excluded from the rule.

Answer

The SD-WAN rule is missing the 'load-balance' setting; by default, it uses only the first member in the list.

Answer

The SD-WAN rule must include a manual order of members; the 'SLA' strategy does not automatically fall back to a member with 'dead' SLA status.

Question 2

An administrator is configuring an SD-WAN rule to route VoIP traffic over the most reliable link. They have two WAN members: port1 (MPLS) and port2 (Internet). They create a performance SLA that monitors latency and jitter, and set the SLA target to 150 ms latency and 30 ms jitter. They apply the SLA to both members. The SD-WAN rule is set to 'Best Quality' strategy. After applying the configuration, they notice that VoIP traffic is sometimes routed over port2 even though port1 has lower latency and jitter. What is the most likely reason?

Accepted Answer

Port1 is intermittently failing the SLA due to jitter spikes, causing the FortiGate to temporarily select port2 until port1 meets the SLA again.. With the 'Best Quality' strategy, the FortiGate continuously evaluates member health against the SLA. If port1 experiences jitter spikes that exceed the configured threshold, it is considered to have failed the SLA, and the rule will select the next best member, which is port2. This can cause VoIP traffic to temporarily switch to port2. Once port1's jitter returns below the threshold, it will be preferred again. This behavior ensures that traffic only uses links that meet the required quality.

Answer

The performance SLA is not enabled on the SD-WAN rule, so the FortiGate falls back to a default load balancing method.

Answer

The 'Best Quality' strategy selects the member with the lowest cost, not the best quality, so port2 is chosen because it has a lower cost.

Answer

The SD-WAN rule is configured with a source IP-based load balancing method, which overrides the 'Best Quality' strategy.

Question 3

A FortiGate is configured with two SD-WAN members: port1 (WAN1) and port2 (WAN2). An SD-WAN rule routes traffic from the internal subnet 10.0.1.0/24 to the internet using the 'volume' load-balancing algorithm. The rule is configured with a volume ratio of 70:30 for port1:port2. After some time, the administrator notices that port1 is handling approximately 90% of the traffic volume, while port2 handles only 10%. What is the most likely cause of this imbalance?

Accepted Answer

The volume algorithm may not achieve the exact ratio if there are long-lived sessions that are not re-evaluated; existing sessions remain on their original member, causing an imbalance over time.. The volume algorithm aims to distribute traffic volume according to the configured ratio, but it does not rebalance existing sessions. Long-lived sessions can cause a persistent imbalance because they remain on their original member. The algorithm only affects new session assignments, so if a few large flows are pinned to one member, the overall volume can deviate from the target ratio.

Answer

The volume algorithm uses the configured volume ratio only when both members are alive and meet the SLA; if port2 is dead, all traffic goes to port1.

Answer

The volume algorithm distributes traffic based on the configured ratio, but the ratio is applied to the number of sessions, not the volume of data.

Answer

The volume algorithm uses the configured ratio only as a target, but it also considers the current bandwidth usage; if port1 has higher bandwidth, it may receive more traffic.

Question 4

An administrator needs to ensure that all firewall policies in a FortiGate VDOM have a common set of inspection profiles added at the end of the policy list. Which FortiManager feature best achieves this?

Accepted Answer

Policy package header/footer policies. Policy package header/footer policies in FortiManager allow you to define a set of policies that are automatically appended (or prepended) to every policy package within an ADOM or VDOM. This ensures that all firewall policies in the VDOM share a common set of inspection profiles at the end of the policy list, without manually editing each policy. It is the only feature designed specifically for this use case.

Answer

ADOM overrides

Answer

Central SNAT

Answer

Revision history

Question 5

An admin configures a FortiManager ADOM for a customer with multiple FortiGates. The admin wants to use meta fields to group firewalls by location. After defining a meta field 'Location' and assigning values to devices, where can the admin use the meta field for policy targeting?

Accepted Answer

In the installation target of a policy package, the admin can filter devices by meta field values. In FortiManager, meta fields are used within ADOM-level policy packages to filter devices during installation targeting. This allows the admin to select only FortiGates with a specific 'Location' meta field value, enabling policy targeting based on location without manual device grouping.

Answer

Meta fields are automatically synced to FortiGate and used in firewall policies

Answer

In the ADOM level policy package, meta fields are used as variables in policy names

Answer

Meta fields are only used for generating reports in FortiAnalyzer

Question 6

You are troubleshooting BFD on a FortiGate SD-WAN deployment. BFD is configured on two WAN interfaces (wan1, wan2) with a minimum transmit interval of 100 ms and a multiplier of 3. The network experiences occasional jitter causing packet loss. After a brief outage, the BFD session does not recover. Which setting should be adjusted to improve BFD resilience without significantly increasing failover time?

Accepted Answer

Increase the BFD multiplier to 4 or higher.. Increasing the BFD multiplier (from 3 to 4 or higher) allows the session to tolerate more lost BFD control packets before declaring a failure. This directly addresses the jitter-induced packet loss without changing the detection timing for sustained outages, as the multiplier only affects the number of missed packets required to trigger a failure. The minimum transmit interval remains at 100 ms, so the base detection time (multiplier × interval) increases only slightly, preserving fast failover for true link failures.

Answer

Disable BFD and rely on route timers.

Answer

Enable BFD on the management interface.

Answer

Increase the BFD minimum transmit interval on both interfaces.

Question 7

A network admin configures OSPF on a FortiGate with multiple areas, including one area that is not directly connected to the backbone (Area 0). To ensure that routes from that area are advertised into other areas, which OSPF feature must be properly configured?

Accepted Answer

OSPF virtual-link. OSPF virtual-links are used to connect a non-backbone area to the backbone area through a transit area. This ensures that the area has a logical path to the backbone, allowing ABRs to generate Type 3 summary LSAs and advertise routes between areas. Without proper virtual-link configuration, routes from an area not directly connected to the backbone cannot be advertised to other areas.

Answer

OSPF route redistribution

Answer

OSPF passive interface

Answer

OSPF network type

Question 8

An administrator wants to isolate tenant traffic in a single FortiGate by creating separate virtual firewalls with independent routing tables, administrators, and policies. Which feature should the administrator use?

Accepted Answer

Virtual Domains (VDOMs). VDOMs (Virtual Domains) are the correct feature because they partition a single FortiGate into multiple independent virtual firewalls, each with its own routing table, administrator access, and security policies. This allows complete tenant isolation within one physical appliance, meeting the administrator's requirement for separate virtual firewalls with independent routing, administration, and policy control.

Answer

Policy-based routing (PBR)

Answer

Virtual Router Redundancy Protocol (VRRP)

Answer

Virtual LANs (VLANs)

Question 9

An administrator is building an ADVPN with a single hub and many spokes. Spokes are behind NAT devices and receive dynamic public IP addresses. The administrator wants shortcuts to form directly between spokes without routing traffic through the hub. Which combination of features must be configured on the hub and spokes to allow shortcut negotiation to succeed in this environment?

Accepted Answer

Configure IKEv2 with auto-discovery sender and receiver, and enable NAT traversal on all participating FortiGates.. ADVPN relies on IKEv2 auto-discovery to propagate shortcut offers from spoke to spoke through the hub, and on NAT traversal to keep IKE and ESP reachable across NAT devices. With auto-discovery sender and receiver roles configured and NAT traversal enabled, spokes with dynamic addresses can negotiate direct tunnels. Static addressing or unrelated interface features do not substitute for this signalling.

Answer

Enable IPsec aggregate interfaces and set net-device disable on all tunnel interfaces.

Answer

Enable exchange-interface-ip and set mode-cfg on the spokes while disabling DPD on the hub.

Answer

Set the hub as a dial-up server and configure the spokes with static VIP addresses on the NAT devices.

Question 10

A FortiGate administrator has deployed ZTNA with FortiClient EMS tagging. A remote user's endpoint is tagged as 'Compliant' in EMS, but the FortiGate ZTNA policy still denies the user's connection to the internal web application. The administrator confirmed the EMS connector status on the FortiGate shows 'Connected' and the tag is visible in the FortiGate's device inventory. What is the most likely cause of the access denial?

Accepted Answer

The ZTNA firewall policy references the tag as a source address, but the user's traffic is being matched by a broader policy above it that denies access.. A correctly tagged endpoint can still be denied if a policy earlier in the top-down evaluation order matches the traffic first. The FortiGate applies the first matching firewall policy, so a broad deny or restrictive allow placed above the ZTNA tag-based policy will intercept the connection before the tag-based rule is evaluated. Verifying policy order and specificity resolves the denial.

Answer

FortiClient EMS requires the endpoint to be re-registered with the FortiGate before the tag can be used in a ZTNA policy.

Answer

The ZTNA policy must use the EMS tag as a destination address rather than a source address to match the endpoint.

Answer

The FortiGate requires a valid SSL certificate on the endpoint before it will honor any EMS compliance tag in a ZTNA policy.

Question 11

You are troubleshooting an SD-WAN rule where traffic is not matching the expected SLA. The FortiGate shows 'SLA mismatch' in logs. What is the MOST likely cause?

Accepted Answer

The measured SLA values exceed the configured thresholds. The 'SLA mismatch' log indicates that the measured SLA values (e.g., jitter, latency, packet loss) for the traffic have exceeded the configured thresholds in the SD-WAN rule. This causes the FortiGate to consider the link as not meeting the SLA, even though the interface is up and the probe server is reachable. The SD-WAN rule itself is enabled, but the traffic is steered away from the preferred member because the SLA is not satisfied.

Answer

The interface is down

Answer

The SLA probe server is unreachable

Answer

The SD-WAN rule is not enabled

Question 12

What is the difference between a global ADOM and a regular ADOM in FortiManager?

Accepted Answer

Global ADOM allows sharing policy packages and objects across multiple ADOMs. In FortiManager, a Global ADOM is a special administrative domain that allows you to centrally manage and share policy packages, objects, and templates across multiple regular ADOMs. This enables consistent security policies and objects (like addresses, services, and schedules) to be pushed to all managed FortiGates, regardless of which ADOM they belong to. Regular ADOMs are isolated and cannot share objects or policies with other ADOMs, making the Global ADOM essential for large-scale, multi-tenant deployments.

Answer

Global ADOM manages only FortiGates in transparent mode

Answer

Regular ADOM cannot use meta fields

Answer

Global ADOM has unlimited device capacity

Question 13

A FortiGate administrator is configuring an IPsec VPN to a remote peer behind a device that performs NAT. The administrator notices that the tunnel establishes but rekeys fail after the Phase 1 lifetime expires. Which setting should the administrator enable on the FortiGate to allow the IKE negotiation to survive NAT and pass through the NAT device reliably?

Accepted Answer

NAT traversal (NAT-T) on the IPsec Phase 1 interface.. NAT-T allows IKE and ESP to be encapsulated in UDP so NAT devices can translate and track the flow. Enabling NAT-T on the Phase 1 interface lets the tunnel establish and rekey reliably when a peer sits behind NAT, which directly addresses the rekey failures observed after the Phase 1 lifetime expires.

Answer

Dead Peer Detection (DPD) with an aggressive retry interval on Phase 1.

Answer

Aggressive mode for IKE Phase 1 instead of main mode.

Answer

Perfect Forward Secrecy (PFS) on the IPsec Phase 2 interface.

Question 14

A FortiGate administrator is implementing Zero Trust Network Access (ZTNA) for remote users accessing an internal web application. The administrator wants to ensure that only users who have authenticated and whose devices meet posture requirements can reach the application, and that the application itself is never directly exposed to the internet. Which two FortiGate configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Create a firewall policy that matches ZTNA traffic and enforces user authentication and device posture via EMS tags.. ZTNA requires a ZTNA server to define the external FQDN and internal application mapping with a server certificate, and a firewall policy to enforce authentication and device posture using user groups and FortiClient EMS tags. Together these broker access without exposing the application directly to the internet.

Answer

Configure a site-to-site IPsec VPN between the remote user's device and the FortiGate.

Answer

Publish the internal application through a public IP with a DNAT VIP so remote users can connect directly.

Answer

Enable inline CASB on the policy to inspect SaaS application usage.

Question 15

A company wants to detect and block phishing emails that contain malicious links. Which FortiGate security profile should be used?

Accepted Answer

Email Filtering profile. FortiGate's Email Filtering profile is specifically designed to inspect SMTP, POP3, and IMAP traffic for phishing indicators, including malicious URLs in email bodies and attachments. It can block or quarantine emails based on URL reputation, sender authentication (SPF/DKIM/DMARC), and content analysis, directly addressing the requirement to detect and block phishing emails with malicious links.

Answer

Antivirus profile

Answer

Web Filtering profile

Answer

Data Leak Prevention profile