NSE7 Practice Test 33 — 15 Questions

Question 1

Which SD-WAN load balancing algorithm is best for ensuring that all traffic from a specific source-destination pair uses the same WAN link?

Accepted Answer

Source-dest IP. Source-dest IP (B) is the correct algorithm because it uses a hash of both the source and destination IP addresses to deterministically select a WAN link. This ensures that all packets belonging to the same flow (same source-destination pair) are consistently forwarded over the same link, preserving packet order and avoiding reordering issues.

Answer

Spillover

Answer

Volume

Answer

Lowest-cost

Question 2

A network administrator wants to delegate management of a specific VDOM to a junior administrator. The junior should be able to modify firewall policies and objects within that VDOM but not change system settings or other VDOMs. Which administrative access configuration meets this requirement?

Accepted Answer

Create a local user with an admin profile that has permissions for that VDOM only. FortiGate allows you to create a local user with an admin profile that has permissions scoped to a specific VDOM. By assigning the junior administrator to that VDOM-only profile, they can modify firewall policies and objects within that VDOM but cannot change system settings or access other VDOMs. This is the standard method for delegating VDOM-specific administrative access without granting global or multi-VDOM privileges.

Answer

Place the VDOM in transparent mode to allow full access

Answer

Create a RADIUS user that is assigned to the VDOM group

Answer

Use the management VDOM feature to assign the junior admin to the VDOM

Question 3

A FortiGate administrator is configuring inter-VDOM routing between two VDOMs: VDOM-A and VDOM-B. The administrator wants to allow traffic from VDOM-A to reach a server in VDOM-B while keeping the VDOMs logically separated. Which configuration step is REQUIRED?

Accepted Answer

Create a VDOM link between VDOM-A and VDOM-B and configure firewall policies on both sides. Inter-VDOM routing on FortiGate requires a VDOM link, which is a logical interface pair that connects two VDOMs. Firewall policies must be configured on both sides of the VDOM link to explicitly allow traffic between the VDOMs, ensuring logical separation while enabling controlled communication. Without these policies, traffic will be dropped even if routes exist.

Answer

Configure a static route in VDOM-A pointing to the server's subnet via the VDOM-B gateway

Answer

Enable inter-VDOM routing under system settings globally

Answer

Assign the same physical interface to both VDOMs and configure routing

Question 4

A FortiGate administrator notices that traffic from a specific subnet is being dropped unexpectedly. The security policy allows the traffic, and there are no firewall policies blocking it. What is the most efficient first step to identify the cause of the drops?

Accepted Answer

Use the 'diag sniffer packet any "host 10.0.1.0/24" 4' command to capture packets and analyze where they are dropped.. The 'diag sniffer packet any "host 10.0.1.0/24" 4' command captures packets at the kernel level before firewall processing, allowing you to see if traffic is reaching the FortiGate and where it is being dropped (e.g., due to reverse-path forwarding, session helper, or DoS policies). This is the most efficient first step because it provides immediate, low-level visibility into packet drops without requiring configuration changes or waiting for logs.

Answer

Run 'diagnose debug flow' with the source IP and look for 'no matching policy' or 'dropped' messages.

Answer

Enable 'deny-log' on all policies and check logs for the subnet.

Answer

Enable global traffic logging and review logs after some traffic passes.

Question 5

An administrator wants to group firewall objects by department (e.g., Sales, Engineering) and easily filter them in FortiManager policy packages. Which feature should be used?

Accepted Answer

Meta fields. Meta fields in FortiManager allow administrators to define custom attributes (e.g., Department) for firewall objects. These fields can then be used to group and filter objects within policy packages, enabling efficient management by department without requiring separate ADOMs or VDOMs.

Answer

Tags in FortiGate

Answer

ADOM overrides

Answer

Policy package folders

Question 6

An administrator wants to integrate FortiGate with an external threat intelligence feed to block known malicious IP addresses automatically. Which object should be used to consume the feed?

Accepted Answer

External Threat Intelligence Feed. The External Threat Intelligence Feed object in FortiGate is specifically designed to consume external threat intelligence feeds (e.g., STIX/TAXII, CSV, or plain text lists) and automatically update a dynamic address object with indicators of compromise (IoCs) such as malicious IP addresses. This enables automated blocking of known malicious sources without manual intervention, making it the correct choice for integrating an external feed.

Answer

IP Pool

Answer

Address Group

Answer

Security Profile Group

Question 7

An administrator needs to verify if a FortiGate is receiving BGP routes from a peer. Which command should the admin run to see the BGP routing table?

Accepted Answer

get router info bgp table. 'get router info bgp table' is the exact FortiOS CLI command to display the BGP routing table, showing all BGP-learned routes and their attributes. This command is specific to FortiGate's proprietary CLI syntax, which differs from Cisco IOS or generic Linux networking commands. The administrator needs this output to verify received BGP prefixes from a peer.

Answer

get router info routing-table bgp

Answer

show ip bgp

Answer

diagnose ip router bgp table

Question 8

An administrator sees the following output from 'diagnose sys session list' for a particular session: proto=6 proto_state=01 duration=3600 expire=3599. What does this indicate about the session?

Accepted Answer

The session is a TCP session that is still open and will expire in 3599 seconds. The output shows proto=6, which is the protocol number for TCP. proto_state=01 indicates the TCP session is in the SYN_SENT state, meaning the session has been created but the TCP three-way handshake is not yet complete. The duration=3600 means the session has existed for 3600 seconds, and expire=3599 means it will expire in 3599 seconds if no further traffic is seen. Therefore, the session is a TCP session that is still open and will expire in 3599 seconds, making option B correct.

Answer

The session is an ICMP session

Answer

The session is a TCP session in TIME_WAIT state

Answer

The session is for UDP traffic and has been up for 3600 seconds

Question 9

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGate devices. The tunnel is established, but traffic is not passing. Which configuration should the administrator check first?

Accepted Answer

Firewall policies. When an IPsec VPN tunnel is established but traffic does not pass, the most common cause is missing or misconfigured firewall policies. Even with correct Phase 1 and Phase 2 settings, the FortiGate will not forward traffic between the tunnel interface and the destination network unless an explicit firewall policy permits it. This is because FortiGate uses a stateful inspection model where all traffic must be allowed by a policy, regardless of the VPN being up.

Answer

NAT traversal configuration

Answer

Static routes

Answer

Phase1 parameters

Question 10

You have configured a route map named 'RM-BGP' to filter routes redistributed from OSPF into BGP. The route map uses 'set community 65000:100' and 'set metric 50'. After applying the route map under 'config router bgp' with 'redistribute ospf route-map RM-BGP', you see that routes are being redistributed but without the community and metric. What is wrong?

Accepted Answer

The route map does not have any 'match' criteria, so it never applies. A route map without any 'match' statements is considered a 'permit all' by default, but it does not apply 'set' actions unless a 'match' condition is explicitly met. In FortiOS, a route map with only 'set' commands and no 'match' criteria will not execute those 'set' actions during redistribution. Therefore, the routes are redistributed with default BGP attributes, not the configured community or metric.

Answer

The route map is missing a 'set community' statement with 'additive' option

Answer

The BGP neighbor requires 'soft-reconfiguration inbound' to see the changes

Answer

The 'set metric' command is not supported for BGP redistribution

Question 11

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route for 192.168.100.0/24 into OSPF. After configuring 'config router ospf' with 'redistribute static' enabled, the route appears in the OSPF database but is not being advertised to other areas. What is the most likely cause?

Accepted Answer

The router is an ABR and the static route is being redistributed as a type 5 LSA, which is not flooded into stub areas.. An ABR does not flood Type 5 LSAs (which are generated by redistribution) into stub areas or NSSAs. Since the route appears in the OSPF database on the ABR but is not advertised to other areas, the most likely cause is that the receiving area is a stub area, which by design blocks Type 5 LSAs. The redistribution of a static route into OSPF creates a Type 5 LSA, which is only flooded throughout the AS except into stub areas and NSSAs.

Answer

The 'redistribute static' command needs a route map to filter the route correctly.

Answer

The static route's administrative distance is too high for OSPF.

Answer

OSPF must be configured with 'default-information originate' to allow redistribution.

Question 12

An administrator is configuring a firewall policy on a FortiGate in transparent mode. The policy should allow HTTP traffic from internal users to the internet. Which source and destination addresses should be used in the policy?

Accepted Answer

Source: all, Destination: all. In transparent mode, the FortiGate operates as a Layer 2 bridge but still inspects Layer 3 headers, so it can match on IP addresses in firewall policies. The correct answer is 'all' for both source and destination because the policy is intended to allow all internal users to any internet destination, and using 'all' ensures the policy applies broadly without unnecessary restrictions. Using specific IP subnets is also possible, but 'all' is simple and commonly used when no further filtering is required.

Answer

Source: the FortiGate's management IP, Destination: the web server's IP

Answer

Source: internal subnet, Destination: external subnet

Answer

Source: internal MAC addresses, Destination: external MAC addresses

Question 13

A FortiGate is configured as a ZTNA proxy. The administrator wants to ensure that only devices with a specific ZTNA tag assigned by FortiClient EMS are allowed to access the application. Which two configuration steps are required? (Choose two.)

Accepted Answer

Create a ZTNA access rule with a condition matching the tag. To restrict access based on ZTNA tags, the tag must be imported from FortiClient EMS into FortiGate (option E) and then used in a ZTNA access rule condition that matches the tag (option D). This ensures only devices with the specific tag are allowed.

Answer

Configure a firewall policy with the ZTNA proxy as destination and enable 'allow only ZTNA'

Answer

Create a firewall policy allowing all traffic to the ZTNA proxy

Answer

Enable 'set ztna-tag' on the FortiGate interface

Question 14

A company has two FortiGate devices at different sites connected via an IPsec VPN tunnel using IKEv2. The tunnel is established but intermittent packet loss is observed. Which two configuration changes should be applied to improve stability? (Choose two.)

Accepted Answer

Increase the phase2 rekey time to 8 hours.. Intermittent packet loss during stable VPN tunnels is often caused by frequent rekey events or DPD misconfiguration. Option D (increase phase2 rekey time to 8 hours) reduces the frequency of rekeying, minimizing packet loss during key regeneration. Option E (enable Dead Peer Detection on the tunnel interface) allows the FortiGate to detect peer failures more reliably without aggressive settings. Option A (reduce DPD retry interval to 3 seconds) is too aggressive and can cause flapping on lossy links. Option B (increase phase1 lifetime) does not address the packet loss issue, as phase1 rekeying is less frequent. Option C (change to IKEv1) would reduce stability since IKEv2 is more robust and supports faster rekeying.

Answer

Reduce the DPD retry interval to 3 seconds.

Answer

Increase the phase1 lifetime to 86400 seconds.

Answer

Change the IKE version to IKEv1.

Question 15

A FortiGate administrator receives a report that a user downloaded a malicious PDF file. The antivirus profile has machine learning engine enabled, CDR enabled, and FortiSandbox integration. However, the file was allowed. The log shows: 'file=malicious.pdf, action=allow, ml_score=85, cd_result=clean, sandbox=not_submitted'. What is the most likely reason the file was not submitted to FortiSandbox?

Accepted Answer

The file size exceeded the maximum file size for FortiSandbox submission. The log shows 'sandbox=not_submitted', which directly indicates the file was never sent to FortiSandbox. FortiGate has a configurable maximum file size limit for sandbox submission (default 10 MB). If the PDF exceeds this limit, the file is allowed without sandbox inspection, even if other engines like ML or CDR are enabled. The ml_score of 85 indicates a high malicious probability, but the sandbox submission was skipped due to size constraints.

Answer

CDR reconstructed the file, making it appear clean

Answer

The machine learning engine scored the file as clean (score below threshold)

Answer

The file was excluded by a file type filter in the antivirus profile