NSE7 Practice Test 35 — 15 Questions

Question 1

An administrator configures BFD on a FortiGate to improve convergence time for OSPF. What is the primary purpose of BFD in this context?

Accepted Answer

To detect link failures faster than OSPF hello timers. BFD (Bidirectional Forwarding Detection) provides sub-second link failure detection, typically in the range of 50-300 milliseconds, which is significantly faster than OSPF's default hello/dead intervals (e.g., 10/40 seconds for broadcast networks). By integrating BFD with OSPF, the FortiGate can trigger OSPF neighbor state changes and route convergence almost immediately upon a link failure, without waiting for OSPF's own hello timer expiration.

Answer

To reduce the number of OSPF neighbors

Answer

To encrypt OSPF packets

Answer

To load balance OSPF traffic across multiple links

Question 2

A FortiGate is configured with BGP and OSPF. The administrator wants to ensure that routes learned via BGP are redistributed into OSPF, but only specific prefixes. Which three components are needed? (Select THREE.)

Accepted Answer

A route map that references the prefix list and sets OSPF parameters. Option D is correct because a prefix list is the mechanism used to match the specific BGP-learned prefixes that should be redistributed into OSPF, allowing granular control over which networks are permitted. Option A is correct because a route map is required to reference that prefix list and apply the desired OSPF parameters (such as metric, metric-type, or tag) to the redistributed routes. Option B is correct because redistribution must be configured under the OSPF routing process with the route map applied, for example using 'config redistribute bgp' and 'set route-map <name>' under 'config router ospf', so that only the matched BGP routes are injected into OSPF. Option C is not needed because a VRF is only required to separate routing tables in multi-tenant or overlapping-address scenarios, not for basic route redistribution between BGP and OSPF. Option E is not needed because a distribute list filters OSPF routes being received or advertised within OSPF, not BGP routes being redistributed into OSPF.

Answer

A VRF to separate the routing tables

Answer

A distribute list in OSPF to filter incoming routes

Question 3

A FortiGate administrator has enabled FortiGuard Outbreak Prevention and selects the 'Use Outbreak Prevention Database' option. After a new outbreak is detected, the administrator verifies that the IPS signature is applied to all applicable policies. However, the administrator wants to ensure that the FortiGate dynamically updates its protection without requiring a full IPS engine update. Which FortiGuard service must be reachable for the FortiGate to receive outbreak prevention updates?

Accepted Answer

FortiGuard IPS service. Outbreak Prevention on FortiGate relies on the FortiGuard IPS service to receive dynamic threat intelligence, including outbreak prevention signatures and metadata. Without connectivity to the FortiGuard IPS service, the FortiGate cannot download the latest outbreak prevention database, and the feature will not function. Other FortiGuard services do not provide this specific data.

Answer

FortiGuard Anti-Spam service

Answer

FortiGuard Web Filtering service

Answer

FortiGuard SD-WAN service

Question 4

A FortiGate administrator configures SAML SSO with FortiGate as the Service Provider (SP) and an external IdP. Users report that they are prompted for credentials repeatedly without successful authentication. What is the most likely cause?

Accepted Answer

The IdP certificate is not imported or trusted on the FortiGate. When FortiGate acts as SAML SP, it must validate the IdP's signed SAML assertions using the IdP's signing certificate. If the IdP certificate is not imported and trusted on the FortiGate, signature validation fails, and authentication cannot complete — users are repeatedly redirected to the IdP and back without a successful login. This is the most common cause of SAML SSO loops in FortiGate deployments.

Answer

The SAML attribute mapping is incorrect

Answer

The FortiGate's clock is synchronized via NTP

Answer

The firewall policy does not allow SAML traffic

Question 5

A FortiGate administrator is troubleshooting why a custom IPS signature is not triggering on traffic matching the pattern. Which TWO checks should be performed?

Accepted Answer

Confirm the IPS sensor is applied to the correct firewall policy. An IPS sensor must be explicitly attached to a firewall policy via the 'inspection-mode' or 'ips-sensor' configuration to inspect traffic. Even if a custom signature is correctly defined and enabled, it will never trigger if the sensor containing it is not applied to the policy that matches the target traffic. This is a fundamental prerequisite for any IPS signature to process packets.

Answer

Check the signature's severity level in the IPS sensor

Answer

Ensure the FortiGate is in proxy-based inspection mode

Answer

Verify the signature uses correct protocol decoder

Question 6

A network security administrator is deploying a FortiSandbox appliance in a FortiGate environment. The administrator wants to ensure that when a zero-day malware sample is detonated, the FortiGate immediately blocks the file hash and the C2 callback. Which FortiSandbox integration method should the administrator configure on the FortiGate to achieve this?

Accepted Answer

Configure the FortiGate to send files to FortiSandbox via the 'fortisandbox' fabric connector and enable 'block malicious files' in the antivirus profile.. The FortiSandbox fabric connector on FortiGate enables seamless submission of files and retrieval of verdicts. When a file is deemed malicious, the FortiGate can block the file hash and C2 traffic via the antivirus profile's block action. This integrated approach automates threat protection without manual intervention, ensuring immediate response to zero-day threats.

Answer

Configure an external threat feed on the FortiGate using the FortiSandbox API to pull malicious IPs every 5 minutes.

Answer

Configure a syslog server on the FortiSandbox to send logs to the FortiGate, and create a firewall policy that denies traffic from the sandbox subnet.

Answer

Enable 'Use FortiSandbox for unknown files' in the antivirus profile and set the action to 'monitor' for all protocols.

Question 7

An enterprise deploys a FortiGate in transparent mode to bridge two broadcast domains. The administrator needs to apply a web filter to HTTP traffic between these domains. Which configuration is required?

Accepted Answer

Configure a security policy with source and destination interfaces as the bridge, action ACCEPT, and a web filter profile. In transparent mode, FortiGate bridges traffic at Layer 2, so security policies must use the bridge interface as both source and destination. Option B correctly configures a security policy with source and destination interfaces set to the bridge, action ACCEPT, and a web filter profile applied. This allows the FortiGate to inspect HTTP traffic between the two broadcast domains and apply the web filter.

Answer

Apply the web filter profile directly to the bridge interface

Answer

Enable web filtering globally under Config -> Features

Answer

Create a policy with action SET_PERMIT and enable web filtering

Question 8

A FortiGate administrator wants to stop outbound DNS queries to a known malicious domain that is not present in any static blocklist. The administrator has already licensed FortiGuard DNS Filtering and enabled DNS filtering on the firewall policy. Which FortiGuard service must the FortiGate resolve the domain against so that the query is blocked based on the latest threat intelligence?

Accepted Answer

FortiGuard DNS Filtering service. FortiGuard DNS Filtering is the service that evaluates domain names during DNS resolution and blocks queries for malicious or risky domains. Enabling DNS filtering on the firewall policy causes the FortiGate to consult this service for each lookup, so the endpoint never receives the IP address. Web Filtering, Antispam, and IP Reputation operate at different layers and cannot stop the domain from resolving.

Answer

FortiGuard IP Reputation service

Answer

FortiGuard Antispam service

Answer

FortiGuard Web Filtering

Question 9

In FortiManager, what is an automation stitch?

Accepted Answer

A sequence of automated actions triggered by a specific event. An automation stitch in FortiManager is a sequence of automated actions (such as running scripts, sending alerts, or executing CLI commands) that are triggered by a specific event (e.g., a log message, a SNMP trap, or a schedule). This allows administrators to automate incident response and policy changes without manual intervention, directly within the FortiManager fabric.

Answer

A feature to stitch multiple ADOMs together

Answer

A set of scripts that run on a schedule

Answer

A method to combine multiple policy packages

Question 10

A network administrator is configuring a FortiGate to protect against unknown malware by using machine learning. The administrator wants to enable the feature that uses machine learning to detect and block malicious files based on their behavior and characteristics, without relying solely on signatures. Which antivirus setting should the administrator enable?

Accepted Answer

Machine Learning (ML) Malware Detection. The Machine Learning Malware Detection setting in the FortiGate antivirus profile uses machine learning algorithms to detect and block unknown malware based on file characteristics and behavior. This provides protection against zero-day threats without relying solely on signatures, meeting the administrator's requirement.

Answer

Sandbox Inspection

Answer

FortiGuard Outbreak Prevention

Answer

Content Disarm and Reconstruction

Question 11

A FortiGate administrator is troubleshooting an IKEv2 VPN tunnel that fails to establish. The remote peer logs show 'no acceptable proposal' error. Which TWO possible causes should the administrator check?

Accepted Answer

The phase1 encryption algorithm or integrity algorithm is mismatched. The 'no acceptable proposal' error in IKEv2 specifically indicates that the responder could not find a matching proposal in the IKE_SA_INIT exchange, which is typically caused by a mismatch in the phase1 encryption algorithm (e.g., AES256 vs 3DES) or integrity algorithm (e.g., SHA256 vs SHA1) between the two peers. Option E is also correct because the Diffie-Hellman group is part of the IKEv2 SA proposal; if one peer offers a DH group (e.g., group 14) that the other peer does not support or has not configured, the responder rejects the proposal with the same 'no acceptable proposal' error. Option A is not correct because an unreachable peer would produce timeout or no-response errors rather than a proposal rejection, since the IKE exchange would never reach the proposal comparison stage. Option C is not correct because an IKE version mismatch (IKEv1 vs IKEv2) would cause the peers to fail to parse each other's messages entirely, resulting in different errors such as 'invalid major version' or no response, not 'no acceptable proposal'. Option D is not correct because an incorrect pre-shared key is detected during the IKE_AUTH exchange after the proposal has already been accepted, producing an authentication failure error rather than a proposal rejection.

Answer

The remote peer's IP address is unreachable

Answer

The local FortiGate has the wrong IKE version configured

Answer

The remote peer's pre-shared key is incorrect

Question 12

A security administrator is configuring a FortiGate to use a threat feed connector to block traffic from known malicious IP addresses. The administrator wants to ensure that the threat feed is updated automatically and that the FortiGate can use the feed in firewall policies. Which two actions must the administrator perform? (Choose two.)

Accepted Answer

Configure the threat feed as an external connector of type 'IP Address'.. To use a custom threat feed for blocking, the administrator must configure an external connector of type 'IP Address' and then reference the resulting dynamic address object in a firewall policy with a deny action. The refresh interval should be set to a non-zero value for automatic updates. Other options such as antivirus block lists or SSL inspection profiles are not involved in this integration.

Answer

Enable 'Use External IP Block List' in the antivirus profile.

Answer

Set the threat feed refresh interval to 0 to disable automatic updates.

Answer

Apply the threat feed connector to the SSL inspection profile.

Question 13

A security administrator is deploying FortiDeceptor in a data center network. They want to detect an attacker who is performing internal reconnaissance by scanning the subnet for live hosts. Which FortiDeceptor component should the administrator deploy to generate a decoy IP address that responds to such scans and alerts on any interaction?

Accepted Answer

Deploy a FortiDeceptor decoy VM that uses a decoy IP address on the same subnet.. FortiDeceptor uses decoy VMs, network decoys, and token decoys to lure attackers. A decoy VM with a decoy IP on the same subnet is the correct component to detect internal reconnaissance scans because it appears as a live host and alerts on any interaction. Other options either provide passive monitoring, lack decoy functionality, or are analytics tools.

Answer

Use FortiAnalyzer to create a synthetic network device that logs scan attempts.

Answer

Configure a FortiGate interface as a honeypot by enabling the decoy option in the firewall policy.

Answer

Install a FortiDeceptor virtual appliance in promiscuous mode on a SPAN port.

Question 14

An administrator is troubleshooting why a FortiGate is dropping traffic from a specific source IP (10.1.1.100). The administrator wants to see real-time per-packet details including the reason for drops. Which CLI command should the administrator use?

Accepted Answer

diagnose debug flow filter addr 10.1.1.100 && diagnose debug flow trace start 100 && diagnose debug enable. To troubleshoot dropped traffic from a specific source IP, the administrator must set a filter, start the flow trace, and enable debug output. The combination of 'diagnose debug flow filter addr', 'diagnose debug flow trace start', and 'diagnose debug enable' provides real-time per-packet details including drop reasons, allowing effective diagnosis.

Answer

diagnose debug enable

Answer

diagnose debug flow filter addr 10.1.1.100

Answer

diagnose debug flow trace start 100

Question 15

An administrator wants to automatically block a file that FortiSandbox has determined to be malicious. The FortiGate is configured with an antivirus profile that includes FortiSandbox submission. Which verdict action should be set to 'block' in the antivirus profile to achieve this?

Accepted Answer

Malicious. The 'Malicious' verdict action in the antivirus profile is specifically designed to block files that FortiSandbox has determined to be malicious. When FortiSandbox submits a file and returns a 'malicious' verdict, the FortiGate uses this action to enforce blocking, ensuring the file is not delivered to the end user.

Answer

Exempted

Answer

Unknown

Answer

Clean