NSE7 Practice Test 34 — 15 Questions

Question 1

A FortiGate administrator is configuring a ZTNA rule to protect an internal application. The administrator wants to ensure that only devices with a specific compliance tag are allowed, while all other devices are denied. The administrator has already created the ZTNA server and the FortiClient EMS tags. What is the correct way to enforce this requirement in the firewall policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a firewall policy that references the ZTNA server and includes the compliance tag as a source or destination condition, so only tagged devices match the allow rule.. ZTNA tag enforcement is achieved by referencing the ZTNA server in the firewall policy and adding the compliance tag as a matching condition. Only devices that present the tag match the allow policy; all others are denied by the implicit deny. Separate deny policies, ZTNA server mappings, and schedules do not provide the required tag-based control.

Answer

Use a firewall policy with the ZTNA server as the destination and a schedule that only allows access during business hours, which implicitly blocks non-compliant devices.

Answer

Create a firewall policy that allows all users to the ZTNA server, then create a separate deny policy for non-compliant devices below it.

Answer

Configure the ZTNA server to require the compliance tag in its application mapping, which automatically denies untagged devices at the proxy level.

Question 2

A FortiGate is deployed with multiple VDOMs in NAT/route mode. The administrator wants VDOM-A and VDOM-B to exchange routing information dynamically without using static routes. The administrator has already created a VDOM link named 'vlink' between the two VDOMs and assigned IP addresses 10.0.0.1/30 and 10.0.0.2/30 to the respective interfaces. Which additional configuration is required on each VDOM to enable OSPF adjacency over the VDOM link?

Accepted Answer

Enable OSPF on the VDOM link interface and assign both interfaces to the same OSPF area.. To enable OSPF over a VDOM link, you must configure OSPF on the link interfaces and ensure they are in the same area. This allows the two VDOMs to form an adjacency and exchange routes dynamically. The VDOM link provides the Layer 3 connectivity, but the routing protocol configuration is what enables dynamic route exchange.

Answer

Create a firewall policy allowing OSPF (protocol 89) between the VDOM link interfaces.

Answer

Set the VDOM link interfaces to 'wan' role and enable OSPF on the physical interfaces.

Answer

Configure a static route on each VDOM pointing to the other VDOM's interface IP address.

Question 3

An administrator is configuring a FortiGate in multi-VDOM mode. The administrator needs to ensure that a specific VDOM can use more system resources, such as sessions and CPU, than other VDOMs. Which FortiGate feature should the administrator use?

Accepted Answer

Configure per-VDOM resource limits in the VDOM settings.. To allocate more system resources to a specific VDOM, the administrator should configure per-VDOM resource limits. FortiGate allows setting maximum sessions, CPU usage, memory, and other resources on a per-VDOM basis. This ensures that the VDOM has sufficient resources while preventing it from monopolizing system resources. This is the correct feature for resource allocation in multi-VDOM deployments.

Answer

Enable NPU offloading for the VDOM to increase its throughput.

Answer

Create a separate administrative profile for the VDOM with elevated privileges.

Answer

Assign a higher priority to the VDOM in the global VDOM configuration.

Question 4

An administrator has a FortiGate 600E running multiple VDOMs. The administrator wants to ensure that when a VDOM is deleted, all associated firewall policies, addresses, and routes are also removed to avoid orphaned objects. Which action should the administrator take?

Accepted Answer

Ensure the VDOM is not in use by any inter-VDOM links or management services, then delete it; associated objects are removed automatically.. Deleting a VDOM in FortiOS automatically removes all associated configuration objects, but you must first eliminate dependencies like inter-VDOM links. This ensures no orphaned objects remain. The other options either invent non-existent settings, suggest unnecessary manual steps, or propose inefficient workarounds that do not align with FortiGate's native behavior.

Answer

Enable the 'vdom-delete-cascade' setting under system global.

Answer

Export the VDOM configuration, delete the VDOM, then re-import the configuration without the unwanted objects.

Answer

Manually delete all firewall policies, addresses, and routes in the VDOM before deleting the VDOM.

Question 5

A FortiGate administrator is troubleshooting an issue where IPsec VPN traffic is not being forwarded correctly in a multi-VDOM environment. Which TWO factors should the administrator verify?

Accepted Answer

The firewall policy for the VPN traffic is present in the correct VDOM. A is correct because firewall policies are VDOM-scoped; even if the VPN tunnel is up, traffic will not be forwarded unless a policy explicitly permits it within the VDOM that owns the VPN interface. The administrator must verify that the policy allowing the IPsec traffic exists in the correct VDOM, as policies from one VDOM cannot control traffic in another.

Answer

Inter-VDOM routing is enabled globally

Answer

The management VDOM has an IPsec policy

Answer

The FortiGate is in transparent mode

Question 6

A FortiGate administrator is configuring a ZTNA rule to protect an internal application. The administrator wants to ensure that only devices with a specific compliance tag are allowed, while all other devices are denied. The administrator has already created the ZTNA server and the FortiClient EMS tags. What is the correct way to enforce this requirement in the firewall policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'MFA' tag is not being synchronized from FortiClient EMS to the FortiGate.. ZTNA rules enforce access based on tags from FortiClient EMS. If the 'MFA' tag is not synchronized to the FortiGate, the rule cannot verify that the user has MFA, resulting in denial. The administrator must ensure the EMS connector is working and the tag is correctly assigned. Other options would produce different symptoms.

Answer

The users are not using the correct SSL VPN client to connect.

Answer

The ZTNA rule is not applied to the correct user group.

Answer

The ZTNA rule is configured to use the wrong authentication scheme.

Question 7

An administrator is configuring an SD-WAN rule to load balance traffic across two WAN links based on the source IP address of the traffic. Which load balancing algorithm should be used to achieve this?

Accepted Answer

Source IP-based. The source IP-based algorithm is designed to distribute traffic across SD-WAN members based on the source IP address. This ensures that all sessions from a particular source IP are consistently routed through the same member, which can be important for applications that require session persistence. It is one of the available load balancing algorithms in FortiOS SD-WAN.

Answer

Volume-based

Answer

Session-based

Answer

Spoiled-weighted round robin

Question 8

An administrator is configuring a FortiGate with multiple VDOMs. The administrator wants to assign a physical interface to a specific VDOM and ensure that the interface is dedicated to that VDOM only. Which action should the administrator take?

Accepted Answer

In the interface configuration, set the VDOM field to the desired VDOM.. To dedicate a physical interface to a VDOM, you assign the interface to that VDOM by setting its VDOM field in the interface configuration. This removes the interface from other VDOMs and makes it exclusively available to the assigned VDOM. Other methods like VLANs are used for sharing, and there is no 'dedicated' option.

Answer

Enable the 'dedicated' option in the interface settings and select the VDOM.

Answer

Create a VLAN interface on the physical interface and assign the VLAN interface to the desired VDOM.

Answer

Use the 'set vdom' command in the global configuration to move the interface to the desired VDOM.

Question 9

An administrator is troubleshooting an SD-WAN setup where a specific application's traffic is not being steered according to the configured SD-WAN rule. The rule uses a performance SLA and the 'lowest-cost' strategy. The administrator runs 'diagnose sys sdwan health-check' and sees that both members are alive and meeting the SLA. However, traffic still goes over the higher-cost member. What is the most likely cause?

Accepted Answer

The SD-WAN rule is not matching the traffic because the source or destination criteria are incorrect.. When traffic does not follow the SD-WAN rule despite healthy members, the most likely cause is that the rule is not matching the traffic. This can happen if the source, destination, application, or other match criteria are misconfigured. Without a match, the FortiGate falls back to the routing table or other rules, potentially using the higher-cost member. Administrators should verify rule match criteria and session details.

Answer

The higher-cost member is configured with a lower priority value, causing it to be preferred.

Answer

The performance SLA is not assigned to the SD-WAN zone.

Answer

The 'lowest-cost' strategy is not supported for application-based rules.

Question 10

A FortiGate 600E is running multiple VDOMs in NAT/route mode. VDOM-1 and VDOM-2 each have an inter-VDOM link interface named 'ivl-1' and 'ivl-2' respectively, and both are assigned IP addresses in the 10.10.10.0/30 subnet. VDOM-1 has a static route to 192.168.2.0/24 via 10.10.10.2, and VDOM-2 has a static route to 192.168.1.0/24 via 10.10.10.1. A user in VDOM-1 (192.168.1.10) cannot ping a server in VDOM-2 (192.168.2.10). What is the most likely cause?

Accepted Answer

A firewall policy allowing traffic from VDOM-1 to VDOM-2 is missing.. Inter-VDOM link routing requires three elements: correct IP addressing on the link interfaces, static or dynamic routes in each VDOM pointing to the other VDOM's networks, and a firewall policy permitting traffic between the VDOMs. The scenario indicates that routes are already configured, so the missing piece is the firewall policy. Without it, the FortiGate's default deny action blocks the transit traffic.

Answer

The inter-VDOM link interfaces must be configured with the same VDOM ID.

Answer

The inter-VDOM link interfaces do not have 'set allowaccess ping' enabled.

Answer

The inter-VDOM link interfaces are not assigned to a zone.

Question 11

A FortiGate 600F is running in multi-VDOM mode with VDOMs named 'root', 'finance', and 'guest'. The administrator notices that a firewall policy created in the 'finance' VDOM does not appear when logging into the 'guest' VDOM and wants to confirm that policies, address objects, and routing tables are kept completely separate per VDOM. Which FortiGate feature provides this separation by default?

Accepted Answer

Per-VDOM configuration databases that store firewall policies, objects, and routing tables independently. Each VDOM on a FortiGate keeps its own configuration database, so firewall policies, address objects, and routing tables are isolated by design. That is exactly why a policy built in the finance VDOM cannot be seen from the guest VDOM. Global configuration and administrative profiles affect management and shared objects but do not merge or split VDOM policy tables.

Answer

Global VDOM configuration that synchronizes policies across all VDOMs

Answer

Virtual clustering that partitions the cluster into separate configuration domains

Answer

Administrative profiles that restrict which VDOMs an administrator can view

Question 12

A FortiGate is configured with multiple VDOMs. The administrator wants to assign a physical interface to multiple VDOMs to save physical ports. Which feature should they use?

Accepted Answer

VLAN subinterfaces. VLAN subinterfaces allow a physical interface to be partitioned into multiple logical interfaces, each with its own VLAN ID. These subinterfaces can be assigned to different VDOMs, enabling the sharing of a single physical port while keeping traffic isolated. This is the correct feature for the scenario.

Answer

VDOM links

Answer

Transparent mode

Answer

Interface zones

Question 13

An administrator is configuring a FortiGate in multi-VDOM mode. The administrator needs to ensure that the 'Management' VDOM can be accessed via HTTPS and SSH from the internal network, while other VDOMs should not have management access enabled on their interfaces. Which TWO actions must the administrator perform? (Choose two.)

Accepted Answer

Disable administrative access on all interfaces in other VDOMs.. To allow management access to the Management VDOM, administrative protocols like HTTPS and SSH must be enabled on its interfaces. Simultaneously, to restrict management access to only that VDOM, administrative access must be disabled on interfaces in all other VDOMs. These two actions together meet the requirement.

Answer

Configure a management VDOM using the 'set manage-ip' command.

Answer

Assign the Management VDOM as the primary VDOM for administrative access.

Answer

Enable 'allowaccess' on the Management VDOM's inter-VDOM links.

Question 14

A security analyst is reviewing FortiGate logs and notices that several internal hosts are repeatedly connecting to a domain that is known to host malware. The domain is not present in any local or FortiGuard category. The analyst wants to automatically block future connections to this domain and similar malicious domains without manual intervention. Which FortiGate feature should be configured to achieve this?

Accepted Answer

Local threat intelligence feed with automation stitch. The scenario requires automatic blocking of a newly discovered malicious domain that is not categorized by FortiGuard. A local threat intelligence feed can be updated dynamically via automation stitches triggered by log events, enabling FortiGate to block the domain and similar ones. DNS filter and application control rely on static or FortiGuard-provided intelligence, and IoT detection is unrelated. Thus, the local threat feed with automation stitch is the correct solution.

Answer

DNS filter with botnet C&C category

Answer

Application control with custom signature

Answer

FortiGuard IoT detection service

Question 15

A FortiGate administrator is configuring a ZTNA rule to protect an internal application. The administrator wants to ensure that only devices with a specific compliance tag are allowed, while all other devices are denied. The administrator has already created the ZTNA server and the FortiClient EMS tags. What is the correct way to enforce this requirement in the firewall policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an exemption in the SSL inspection profile for the pinned applications and apply deep inspection to the remaining traffic.. Deep inspection is required to examine encrypted traffic for threats, but certificate-pinned applications will reject the FortiGate's re-signed certificate. The supported approach is to add those applications or destinations to an SSL exemption so they are not decrypted, while deep inspection continues for everything else. This balances security visibility with application availability and is the recommended operational practice for mixed traffic.

Answer

Configure the policy to use full SSL inspection and import the pinned applications' certificates as trusted CAs on the FortiGate.

Answer

Disable SSL inspection entirely on the policy and rely on the application control profile to identify the pinned applications.

Answer

Set the SSL inspection profile to certificate-inspection for the policy and leave the rest of the traffic uninspected.