NSE7 Practice Test 34 — 15 Questions

Question 1

A network administrator configures a hub-and-spoke ADVPN with FortiGates. Phase 1 and phase 2 settings are correct, and spoke gateways can communicate with the hub. However, shortcut tunnels between spokes are not being established. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dynamic routing (BGP/OSPF) is not configured over the VPN overlay. ADVPN requires policy-based routing or routing protocol to propagate routes and trigger shortcut setup. Without a routing protocol like BGP/OSPF, spokes will not learn routes to other spokes, and shortcut negotiation fails.

Answer

DPD is disabled on the phase 1 interface

Answer

The hub FortiGate has 'set auto-discovery-sender enable' configured

Answer

The spoke FortiGates do not have IKEv2 enabled

Question 2

An administrator is troubleshooting why a new firewall policy on a managed FortiGate is not taking effect. The policy was created in FortiManager and installed successfully. Which TWO steps should the administrator verify to identify the issue? (Select TWO.)

Accepted Answer

Check if the policy is disabled. A policy that is disabled in FortiManager will be installed to the managed FortiGate in a disabled state, meaning it will not process any traffic. The administrator must verify that the policy is enabled in FortiManager before or after installation, as a disabled policy is effectively inactive regardless of installation success.

Answer

Reboot the FortiGate

Answer

Review the FortiGate's routing table

Answer

Verify the FortiGate's HA status

Question 3

A company uses FortiMail for email security. They want to prevent email spoofing by verifying that incoming emails originate from authorized servers. Which email authentication method should be configured on FortiMail to check the sending server's IP against a published SPF record?

Accepted Answer

SPF verification. SPF (Sender Policy Framework) verification on FortiMail checks the sending server's IP address against the SPF record published in the domain's DNS. This directly matches the requirement to verify that incoming emails originate from authorized servers, as SPF is designed to prevent spoofing by validating the envelope sender's domain against a list of permitted IPs.

Answer

DKIM verification

Answer

DMARC verification

Answer

Sender Policy Framework (SPF) is not supported on FortiMail

Question 4

A FortiGate has OSPF configured in multiple areas. The administrator wants to redistribute routes from area 0 into area 1 with a metric of 10. Which command is correct?

Accepted Answer

config router ospf
  set redistribute "ospf" metric 10. None of the provided commands correctly set the metric for inter-area OSPF routes. OSPF automatically floods Type 3 LSAs between areas; the metric is determined by interface costs and cannot be directly set via redistribution. Redistributing OSPF into the same process is not a supported method for inter-area metric control.

Answer

config router ospf
  config redistribute "ospf"
    set status enable
    set metric 10
  end

Answer

config router ospf
  config redistribute "connected"
    set metric 10
  end

Answer

config router ospf
  config area
    edit 1
      set type nssa
    end

Question 5

A FortiGate is operating in transparent mode and is deployed in an enterprise network. The administrator needs to apply a security policy to control traffic between two VLANs. What is a key consideration when configuring policies in transparent mode?

Accepted Answer

The policy is applied to the Layer 2 interface where the traffic enters. In transparent mode, the FortiGate acts as a Layer 2 bridge, and security policies are applied to the ingress interface where traffic enters the device. This allows the firewall to filter traffic between VLANs based on Layer 3 and Layer 4 criteria without requiring IP addresses on the interfaces, as the device is transparent to the network.

Answer

Transparent mode does not support firewall policies

Answer

The policy must be applied to the management IP address

Answer

Policies must be configured using MAC addresses only

Question 6

You run the following command on a FortiGate:

diagnose sys session filter dport 443
diagnose sys session list

Output:
proto=6 proto_state=01 duration=3600 expire=3599

What does the 'proto_state=01' indicate?

Accepted Answer

The session is in the 'init' state, meaning the first SYN packet has been seen but the handshake is not complete. In FortiGate session diagnostics, 'proto_state=01' for TCP (proto=6) indicates the session is in the 'init' state, meaning only the initial SYN packet has been observed and the three-way handshake has not yet completed. This is a transient state before the session transitions to 'established' (proto_state=02) once the final ACK of the handshake is received.

Answer

The session is fully established and in the 'established' state

Answer

The session is a UDP or ICMP session with no state tracking

Answer

The session is being torn down (FIN or RST received)

Question 7

A BGP session between FortiGate and a neighbor is in 'Active' state. The administrator has verified IP connectivity and that the neighbor IP is reachable. What is the MOST likely cause?

Accepted Answer

The remote AS number is misconfigured on either side. The BGP 'Active' state indicates that the router is actively trying to initiate a TCP connection to the neighbor but has not yet received a successful response. Since IP connectivity is verified, the most likely cause is a mismatch in the remote AS number configuration. BGP uses the AS number in the OPEN message to validate the peer; if the configured remote AS on one side does not match the local AS on the other, the neighbor will reject the connection, causing the session to remain in Active state.

Answer

The firewall policy is blocking BGP port 179

Answer

The BGP hold timer is set too high

Answer

The BGP network statement is missing

Question 8

An IPS administrator wants to detect a new custom attack that sends malformed HTTP headers. The attack pattern is a specific sequence of bytes that is not covered by existing signatures. What is the BEST way to detect this attack on FortiGate?

Accepted Answer

Create a custom IPS signature. Custom IPS signatures allow you to define a specific byte sequence or pattern (e.g., via a regular expression or hex pattern) that matches the malformed HTTP header. FortiGate's IPS engine can then inspect HTTP traffic at the application layer and trigger an alert or block when the custom pattern is found, even if no existing signature covers it.

Answer

Use an automation stitch to block traffic with unusual headers

Answer

Enable protocol anomaly detection in the IPS sensor

Answer

Deploy FortiWeb as a reverse proxy

Question 9

A security administrator is configuring FortiSandbox integration to automatically block malicious files detected in email attachments. Which TWO actions are required to achieve this integration?

Accepted Answer

Configure FortiGate to submit files to FortiSandbox for analysis. FortiGate must be configured to submit files to FortiSandbox for analysis, which is the foundational step to enable detection of malicious content in email attachments. This submission is typically done via the FortiGate antivirus profile, where the 'FortiSandbox' inline scanning option is enabled, allowing files to be sent to FortiSandbox for verdict-based blocking.

Answer

Deploy FortiClient endpoints with full disk encryption

Answer

Configure FortiSandbox to send SNMP traps when a file is malicious

Answer

Enable FortiGate's machine learning engine on the antivirus profile

Question 10

An administrator configures a session helper for FTP but notices that active FTP data connections are not being allowed through the firewall. The FTP control session establishes fine. What is the MOST likely cause?

Accepted Answer

The FTP session helper is not enabled on the firewall policy. The session helper for FTP is a feature that must be explicitly enabled on the firewall policy to inspect and dynamically create pinholes for active FTP data connections. If the session helper is not enabled on the policy, the firewall will only allow the control session (port 21) but will not open the necessary high ports for the data channel, causing active FTP to fail while passive mode (which uses the control session for data negotiation) may still work.

Answer

The FTP server is using passive mode

Answer

The ALG is configured to use proxy-based inspection instead of flow-based

Answer

The firewall policy has NAT enabled

Question 11

An administrator is troubleshooting why a custom IPS signature for protocol anomaly detection is not triggering. The signature is designed to detect abnormal DNS query lengths. Which TWO steps should the administrator take to verify the signature is working? (Choose two.)

Accepted Answer

Verify that the IPS sensor containing the signature is applied to the correct firewall policy. An IPS sensor must be explicitly applied to a firewall policy for the signatures it contains to be evaluated against traffic passing through that policy. Without this binding, the custom signature for DNS protocol anomaly detection will never be inspected, regardless of its configuration or the traffic type.

Answer

Reboot the FortiGate to reset the IPS engine

Answer

Disable the firewall policy to see if the signature triggers

Answer

Increase the signature's severity to see it in logs

Question 12

An HA cluster (active-passive) is configured. The administrator wants to perform a failover test without causing service disruption. Which command should be used?

Accepted Answer

execute ha failover. The 'execute ha failover' command triggers a controlled failover in an active-passive HA cluster, forcing the standby unit to become active without physically shutting down or rebooting the primary unit. This allows the administrator to test failover behavior while minimizing service disruption, as the cluster transitions gracefully and sessions are synchronized if session-pickup is enabled.

Answer

diagnose ha reset-uptime

Answer

execute shutdown on the primary

Answer

execute ha synchronize

Question 13

An administrator sees the following log entry:
'id=13593 msg="CDR: File attachment sanitized"'
Which feature generated this log?

Accepted Answer

Content Disarm and Reconstruction. The log entry 'CDR: File attachment sanitized' is generated by Content Disarm and Reconstruction (CDR). CDR works by removing active content (e.g., macros, scripts, embedded objects) from files and rebuilding them into a safe, sanitized version. This is distinct from sandboxing or machine learning, as CDR does not rely on detection but instead proactively neutralizes threats by reconstructing the file.

Answer

FortiSandbox

Answer

Machine Learning Engine

Answer

Outbreak Prevention

Question 14

An administrator wants to integrate FortiClient EMS with FortiGate for ZTNA. Which protocol must be allowed between FortiGate and FortiClient EMS?

Accepted Answer

HTTPS (TCP/443) [wrong]. For ZTNA integration, FortiGate communicates with FortiClient EMS over HTTPS (TCP/443) to exchange authentication and policy information. SNMP is not used for this purpose.

Answer

LDAP (TCP/389) [wrong]

Answer

SNMP (UDP/161) [CORRECT]

Answer

Syslog (UDP/514) [wrong]

Question 15

A FortiGate with SD-WAN enabled uses two members: MPLS (10 ms latency) and Internet (40 ms latency). The SD-WAN rule uses 'Best Quality' strategy with latency as the metric. Traffic to a critical application (10.1.1.0/24) is currently using the MPLS link. The MPLS link's latency increases to 60 ms due to a routing issue. How will FortiGate handle new sessions to 10.1.1.0/24?

Accepted Answer

New sessions will use the Internet link; existing sessions continue on MPLS.. The 'Best Quality' strategy with latency metric selects the link with the lowest latency for new sessions. When MPLS latency rises to 60 ms, it exceeds the Internet link's 40 ms, so new sessions will be steered to the Internet. However, SD-WAN does not preemptively rehash existing sessions; they remain on the original link (MPLS) until they expire or are torn down.

Answer

FortiGate will wait for the MPLS link to recover before sending new traffic.

Answer

All sessions immediately switch to the Internet link.

Answer

Existing sessions continue on MPLS; new sessions will use MPLS until the next SLA probe.