NSE7 Practice Test 33 — 15 Questions

Question 1

An administrator is configuring ZTNA inline CASB on a FortiGate to control access to a sanctioned SaaS application. The requirement is to block uploads of files containing credit card numbers while allowing normal business uploads. The administrator creates an access proxy rule and a CASB profile with a data loss prevention sensor. During testing, uploads of files with credit card numbers are still allowed. Which action should the administrator take to enforce the block?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach the CASB profile to the ZTNA access proxy rule so the inline inspection can act on the upload.. Inline CASB requires the CASB profile to be attached to the ZTNA access proxy rule that handles the SaaS session. The profile contains the DLP sensor and SaaS application definitions that enable content inspection. Without this attachment, the FortiGate proxies the traffic but does not apply CASB controls, allowing sensitive uploads to proceed even though the profile and sensor exist.

Answer

Add the SaaS application FQDN to the ZTNA access proxy destination list.

Answer

Enable deep inspection on the firewall policy that carries the SaaS traffic.

Answer

Configure the DLP sensor to use the 'block' action instead of 'monitor' in the sensor definition.

Question 2

A FortiGate administrator is configuring a route-based IPsec VPN to a cloud provider. The provider requires that only traffic for the 10.20.0.0/16 network be sent through the tunnel, and that the FortiGate present a specific local subnet of 192.168.10.0/24 as its source. The administrator wants to avoid policy-based VPN configuration. Which configuration approach correctly defines the traffic selectors for this route-based tunnel?

Accepted Answer

Configure phase 2 selectors with local address 192.168.10.0/24 and remote address 10.20.0.0/16, and add a static route for 10.20.0.0/16 pointing to the tunnel interface.. Route-based IPsec uses phase 2 selectors as proxy IDs and relies on routing to steer traffic into the tunnel interface. Configuring the local selector as 192.168.10.0/24 and the remote as 10.20.0.0/16 satisfies the provider, and a static route for 10.20.0.0/16 to the tunnel interface ensures only the intended destination is sent through the VPN.

Answer

Create a policy-based IPsec VPN with firewall policies referencing the tunnel and define the source and destination addresses in those policies.

Answer

Configure phase 2 selectors as 0.0.0.0/0 to 0.0.0.0/0 and rely on firewall policies to restrict traffic to the required subnets.

Answer

Set the tunnel interface IP to 192.168.10.1/24 and configure a route for 0.0.0.0/0 through the tunnel, allowing the provider to filter traffic.

Question 3

What is the purpose of a global ADOM in FortiManager?

Accepted Answer

To provide a common object repository that can be referenced by other ADOMs. A global ADOM in FortiManager serves as a shared object repository (e.g., addresses, services, schedules) that can be referenced by other ADOMs, enabling centralized management of common objects across multiple administrative domains. This avoids duplication and ensures consistency, as changes in the global ADOM propagate to all ADOMs that reference those objects. It does not directly create or push firewall policies; instead, it provides the building blocks for policies within individual ADOMs.

Answer

To create global firewall policies applicable to all devices

Answer

To manage all devices in a single ADOM regardless of location

Answer

To store global logs from all FortiGates

Question 4

A FortiGate administrator is configuring an IPsec VPN tunnel to a remote site that is behind a NAT device. The administrator notices that the tunnel establishes, but traffic intermittently fails. Which setting should be adjusted to improve reliability?

Accepted Answer

Enable NAT traversal (NAT-T) and set the keepalive frequency.. When an IPsec peer is behind NAT, the NAT device may close the UDP session if no traffic is sent for a period. Enabling NAT traversal (NAT-T) encapsulates IPsec packets in UDP, and setting a keepalive frequency ensures that periodic packets are sent to keep the NAT mapping alive. This prevents intermittent tunnel failures caused by NAT session timeouts.

Answer

Enable Dead Peer Detection (DPD) with a shorter interval.

Answer

Configure the remote gateway as a dynamic DNS hostname.

Answer

Set the IPsec phase-1 proposal to use AES-256 encryption.

Question 5

A FortiGate administrator is configuring ZTNA to protect an internal application and wants to ensure that only users who authenticate with a valid client certificate and whose devices pass posture checks can connect. The administrator has configured FortiClient EMS integration and a ZTNA access proxy rule. During testing, users without client certificates are still able to reach the application after providing username and password. Which setting should the administrator verify to enforce certificate-based authentication?

Accepted Answer

The ZTNA access proxy rule must require client certificate authentication in its authentication settings.. Client certificate enforcement for ZTNA is controlled by the access proxy rule’s authentication settings. The rule must be configured to require certificate authentication and reference the trusted CA that signed the client certificates. If the rule only permits password authentication, users without certificates can still authenticate, so the certificate requirement is effectively absent regardless of EMS or backend policy configuration.

Answer

The firewall policy from the ZTNA server to the application must include a certificate-based user group.

Answer

The SSL VPN settings must be configured to require client certificates for ZTNA users.

Answer

The FortiClient EMS connector must be configured to issue client certificates to endpoints.

Question 6

An administrator runs 'diagnose sys session filter dport 443' and sees:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session in established state that has been up for 3600 seconds and will expire in 3599 seconds.. The output shows proto=6, which is TCP, and proto_state=01, which indicates the TCP session is in an established state (TCP_ESTABLISHED). The duration=3600 means the session has been active for 3600 seconds, and expire=3599 means it will expire in 3599 seconds (i.e., the idle timeout is counting down). This is a standard TCP session in the established state, not a multicast or UDP session.

Answer

The session is a multicast session with a duration of 3600 seconds.

Answer

The session is in SYN_SENT state and has timed out after 3600 seconds.

Answer

The session is a UDP session that has been active for 3600 seconds.

Question 7

A FortiGate administrator has configured a ZTNA access proxy for an internal web application and wants to enforce device compliance before allowing access. The administrator has integrated FortiClient EMS and created ZTNA tags for compliant devices. Users with compliant devices are still being denied access. The firewall policy references the ZTNA server and the tag. What should the administrator verify first?

Accepted Answer

That the ZTNA tags are correctly received from FortiClient EMS and that the tag names in the firewall policy match the tags assigned to the devices.. When ZTNA tag-based enforcement denies compliant users, the most common cause is a mismatch between the tags received from FortiClient EMS and the tag names referenced in the firewall policy. Confirming that the FortiGate has the expected tags and that the policy uses the exact same names is the correct first step. Certificate issues, protocol substitution, and policy ordering do not fit the reported symptom of denied compliant users.

Answer

That the FortiGate is configured to use SSL VPN instead of ZTNA for the internal application, because ZTNA does not support tag-based policies.

Answer

That the ZTNA server is configured with a valid SSL certificate and that the certificate chain is trusted by the client.

Answer

That the firewall policy is placed after a broader allow policy that matches the same users and services.

Question 8

A FortiGate is deployed with multiple VDOMs in NAT/route mode. The administrator has created a VDOM link between VDOM-1 and VDOM-2 and assigned IP addresses to both ends. A server in VDOM-1 (10.1.1.10/24) needs to reach a server in VDOM-2 (10.2.2.10/24). The administrator has added a static route in VDOM-1 for 10.2.2.0/24 pointing to the VDOM-2 link interface IP, and a static route in VDOM-2 for 10.1.1.0/24 pointing to the VDOM-1 link interface IP. However, traffic is not passing. Which additional configuration is required on the FortiGate to allow the traffic to flow?

Accepted Answer

Create firewall policies in VDOM-1 and VDOM-2 that allow traffic from the source subnet to the destination subnet on the respective VDOM link interfaces.. Inter-VDOM traffic is treated like traffic between two separate firewalls. Even with VDOM links and static routes in place, the implicit deny policy in each VDOM blocks the traffic. You must explicitly allow it with firewall policies in both VDOMs, specifying the source, destination, and VDOM link interface. No global setting or zone configuration can override this requirement.

Answer

Enable inter-VDOM routing globally using the command config system settings, set allow-inter-vdom-traffic enable.

Answer

Assign the VDOM link interfaces to the same zone in both VDOMs to permit traffic between them.

Answer

Configure a static route in the global routing table that points to both VDOMs, enabling inter-VDOM routing.

Question 9

A FortiGate is deployed in multi-VDOM mode. The administrator has created VDOM-A and VDOM-B, and configured an inter-VDOM link between them. Users in VDOM-A need to access a web server in VDOM-B. The administrator has added a static route in VDOM-A for the server's subnet pointing to the VDOM link interface, and a return route in VDOM-B. Which TWO additional configurations are required to allow the traffic? (Choose two.)

Accepted Answer

A firewall policy on VDOM-A that allows traffic from the internal interface to the VDOM link interface.. Inter-VDOM traffic requires firewall policies in both the originating and destination VDOMs. In VDOM-A, a policy must allow traffic from the internal interface to the VDOM link. In VDOM-B, a policy must allow traffic from the VDOM link to the server's interface. Routing must also be correct, but the scenario already includes static routes. NAT is not required unless specified.

Answer

Configure a central SNAT policy on VDOM-B to translate the destination IP addresses.

Answer

Add a static route in VDOM-B for the user subnet pointing to the VDOM link interface.

Answer

Enable NAT on the VDOM link interface in VDOM-A to translate the source IP addresses.

Question 10

A FortiGate 600E is deployed with multiple VDOMs in NAT/route mode. The administrator assigns VLAN 100 to VDOM-A on port1 and VLAN 200 to VDOM-B on port1, then configures the VLAN interfaces as management interfaces for each VDOM. Users in VDOM-A report intermittent connectivity to servers in VDOM-B, while pings between the VLAN interface IPs fail. What is the most likely cause?

Accepted Answer

No inter-VDOM links or firewall policies exist to permit traffic between VDOM-A and VDOM-B, so the VDOMs are isolated by design.. VDOMs on a FortiGate are isolated routing and security domains. Even when VLAN subinterfaces on the same physical port are assigned to different VDOMs, traffic between those VDOMs does not flow automatically. Inter-VDOM links must be created and firewall policies must allow the traffic in both directions. The failed pings and intermittent connectivity are classic symptoms of missing inter-VDOM routing, not a limitation of VLAN coexistence or management access.

Answer

Two VLAN interfaces with management access enabled cannot coexist on the same physical interface; the second VDOM's VLAN is silently ignored.

Answer

Management access on a VLAN interface enables the administrative gateway, which overrides inter-VDOM routing and blocks data traffic.

Answer

VLAN interfaces in different VDOMs on the same physical port require the physical interface to be in a third VDOM with explicit VLAN trunking.

Question 11

An administrator is configuring a FortiGate with multiple VDOMs. The administrator wants to ensure that the VDOMs can use overlapping IP addresses on their respective interfaces. Which setting must be enabled to allow this?

Accepted Answer

Enable 'allow-subnet-overlap' in each VDOM that requires overlapping subnets.. To use overlapping IP addresses in different VDOMs, you must enable 'allow-subnet-overlap' in each VDOM that requires it. This setting allows the FortiGate to accept the same subnet on interfaces in different VDOMs. It is configured within each VDOM's system settings, not globally. This is useful in multi-tenant environments where customers may use the same private IP ranges.

Answer

Assign the interfaces to different zones within the same VDOM to allow overlapping IPs.

Answer

Configure the interfaces to use different VDOM link IP addresses to avoid overlap.

Answer

Enable 'allow-subnet-overlap' globally in the system settings, which applies to all VDOMs.

Question 12

A FortiGate administrator wants to use FortiManager to manage multiple FortiGates in different geographic regions. To isolate configuration changes, the administrator creates separate ADOMs for each region. Which type of ADOM should be used to allow some common objects (like address groups) to be shared across all regions?

Accepted Answer

Global ADOM. The Global ADOM is designed to store and share common objects, such as address groups, policies, and schedules, across all ADOMs in a FortiManager deployment. When an administrator creates separate ADOMs for each region, the Global ADOM acts as a central repository for objects that need to be consistent everywhere, allowing per-region ADOMs to reference these shared objects without duplicating them. This ensures configuration isolation for region-specific settings while maintaining a single source of truth for global resources.

Answer

Per-Device ADOM

Answer

Regular ADOM

Answer

Meta ADOM

Question 13

An administrator runs 'diagnose debug application fnbam -1' and sees messages like 'LB_SELECT: selected server 10.0.0.2:80' but the client connection fails. The FortiGate is configured with server load balancing. What could be the issue?

Accepted Answer

The real server is not reachable or is down. The 'LB_SELECT: selected server 10.0.0.2:80' message indicates that the FortiGate's load-balancing process has chosen a real server for the connection. However, the client connection fails, which points to a problem with the selected server itself. The most common cause is that the real server is unreachable or down, preventing the TCP handshake or HTTP response from completing, even though the load-balancing decision was made successfully.

Answer

The load balancing algorithm is set to least-connection

Answer

The persistence setting is misconfigured

Answer

The virtual server IP is overlapping with a physical interface

Question 14

A FortiGate administrator is configuring an IPsec VPN with IKEv2 between two sites. The administrator wants to ensure that only specific subnets are allowed over the tunnel and that the tunnel uses strong encryption. After configuring phase1 and phase2, the administrator notices that the tunnel is up, but traffic from a subnet that should be allowed is not passing. The administrator runs 'diagnose vpn tunnel list' and sees that the tunnel is established. What is the most likely reason for the traffic not passing?

Accepted Answer

The phase2 selectors do not match the local and remote subnets exactly as configured in the firewall address objects.. Phase2 selectors must match the actual traffic subnets. If they do not, the FortiGate will not encrypt and send that traffic over the tunnel. Even with the tunnel up, mismatched selectors cause traffic to be dropped or routed elsewhere. The other options would either prevent tunnel establishment or are not relevant to the symptom.

Answer

The dead peer detection (DPD) is disabled, causing the tunnel to become stale.

Answer

The encryption algorithm used in phase2 is not supported by the remote peer.

Answer

The firewall policy allowing the traffic does not have NAT enabled.

Question 15

A FortiGate is configured with two SD-WAN members (wan1, wan2) and a performance SLA for each. The SD-WAN rule uses 'Maximize Bandwidth' strategy with volume-based load balancing. The administrator notices that traffic is only using wan1, even though both links have capacity. The SLA status for wan2 shows 'alive'. What could be the problem?

Accepted Answer

The SD-WAN rule has a 'set member' statement that lists only wan1.. The 'Maximize Bandwidth' strategy with volume-based load balancing distributes traffic based on bandwidth weights, but the SD-WAN rule's 'set member' statement explicitly defines which interfaces are eligible for load balancing. If the rule lists only wan1, traffic will never be sent to wan2, regardless of SLA status or bandwidth weights. This is the most direct cause of the observed behavior.

Answer

The link cost for wan2 is too high.

Answer

The performance SLA for wan2 is not associated with the SD-WAN rule.

Answer

The bandwidth weight for wan2 is set to 0.