NSE7 Practice Test 35 — 15 Questions

Question 1

An administrator wants to integrate a FortiExtender with a FortiGate to provide cellular WAN connectivity. Which configuration step is required on the FortiGate to use the FortiExtender as an SD-WAN member?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the FortiExtender's interface to the SD-WAN zone. To use a FortiExtender as an SD-WAN member, the FortiExtender's physical or logical interface must be added to the SD-WAN zone on the FortiGate. This allows the FortiGate to apply SD-WAN rules, load balancing, and SLA-based path selection to traffic traversing the cellular WAN link. Without this step, the interface remains a standard WAN interface and cannot participate in SD-WAN policies.

Answer

Enable BGP on the FortiExtender interface

Answer

Create a firewall policy allowing traffic from the FortiExtender

Answer

Configure a static route pointing to the FortiExtender

Question 2

Which FortiGate security feature can reconstruct files to remove potentially malicious content while preserving the file's usability?

Accepted Answer

Content Disarm and Reconstruction. Content Disarm and Reconstruction (CDR) is the correct answer because it actively removes potentially malicious content—such as macros, scripts, or embedded objects—from files (e.g., Office documents, PDFs) and then reconstructs a clean, usable version. Unlike detection-based approaches, CDR eliminates threats by sanitizing the file structure itself, ensuring the file remains functional for the end user while blocking exploits.

Answer

Antivirus outbreak prevention

Answer

FortiSandbox

Answer

IPS application control

Question 3

A network administrator is configuring SD-WAN on a FortiGate. The organization has two internet links: MPLS (primary) and broadband (backup). The administrator wants all traffic to use the MPLS link unless it fails, in which case traffic should fail over to the broadband link. Which SD-WAN configuration best achieves this requirement?

Accepted Answer

Set the MPLS link priority to 10 and the broadband link priority to 5, then configure an SD-WAN rule with the 'best quality' strategy.. Setting the MPLS link priority to 10 (higher) and broadband to 5 (lower) ensures the SD-WAN rule with 'best quality' strategy selects the MPLS link as the preferred path. The 'best quality' strategy evaluates link quality metrics and, when priorities differ, prefers the higher-priority link. If the MPLS link fails, the strategy automatically fails over to the broadband link, meeting the requirement.

Answer

Enable 'set role' on the MPLS link as 'primary' and on the broadband link as 'standby' with the 'redundant' strategy.

Answer

Configure both links in the SD-WAN zone with equal priority and use the 'lowest cost' strategy.

Answer

Create two static routes: one with higher distance for MPLS and one with lower distance for broadband.

Question 4

A FortiGate administrator runs 'diagnose debug application sslvpn -1' and sees repeated messages: 'SSL VPN tunnel error: no response from client'. What is the most likely cause?

Accepted Answer

The client cannot reach the FortiGate's SSL VPN IP or port. The 'no response from client' error in the SSL VPN debug output indicates that the FortiGate sent a tunnel setup request to the client but did not receive the expected reply. This typically happens when the client cannot reach the FortiGate's SSL VPN IP or port (default 443), often due to network connectivity issues, firewall rules blocking the port, or NAT problems. The error is specific to the transport layer between client and FortiGate, not authentication or configuration mismatches.

Answer

The authentication server is unreachable

Answer

The tunnel mode is configured for web mode instead of tunnel mode

Answer

The SSL VPN certificate has expired

Question 5

An administrator configures BFD on a BGP session between two FortiGates. After enabling BFD, the BGP session flaps intermittently. What is the most likely cause?

Accepted Answer

The BFD failure detection intervals are too low, causing false positives. When BFD is enabled on a BGP session, the BFD failure detection intervals (typically the minimum transmit and receive intervals) determine how quickly a link failure is detected. If these intervals are set too low, BFD may generate false positives due to transient network jitter or minor packet loss, causing the BGP session to flap as BFD triggers a session reset even though the underlying link is stable. This is the most likely cause because the symptom appeared immediately after enabling BFD, and the default or misconfigured intervals can be too aggressive for the network conditions.

Answer

BFD is incompatible with BGP and should not be used together

Answer

BGP hold timer is shorter than BFD detection time

Answer

The BFD minimum transmit and receive intervals are set too high

Question 6

An administrator configures FortiSandbox to quarantine files that are rated 'malicious'. They notice that some files are being quarantined even though the verdict is 'clean'. What could explain this?

Accepted Answer

The quarantine action is set to apply to files with a risk level above a certain threshold, and clean files have been incorrectly rated. FortiSandbox's quarantine action can be configured based on a risk score threshold, not solely on the verdict. If the risk score for a file rated 'clean' exceeds the configured threshold, the file may still be quarantined. This occurs because the verdict and risk score are separate attributes; a 'clean' verdict indicates no known malware, but the file's behavior or heuristics may still generate a high risk score that triggers quarantine.

Answer

FortiSandbox uses a whitelist that includes those files

Answer

The files were submitted by a different FortiGate with different settings

Answer

The administrator has enabled 'aggressive mode' which quarantines all files

Question 7

A FortiGate administrator is configuring a site-to-site IPsec VPN with IKEv2. The remote peer supports multiple proposals. The administrator wants to ensure that the VPN tunnel uses AES256-GCM for encryption and SHA256 for integrity. Which configuration setting should be used to enforce this preference?

Accepted Answer

Set the 'proposal' list with AES256-GCM and SHA256 as the first entry. In IKEv2, the proposal order determines the preference. The first matching proposal is used. To enforce AES256-GCM and SHA256, the administrator should set those as the first proposal in the phase1 and phase2 configuration.

Answer

Enable 'set proposal-mode strict'

Answer

Use IKEv2 rekey to change the proposal after initial handshake

Answer

Configure a phase2 selectors with the exact traffic of interest

Question 8

An administrator needs to integrate a FortiSwitch with a FortiGate for LAN edge management. The FortiGate will manage the switch via the LAN interface. Which TWO steps are required? (Choose two.)

Accepted Answer

Enable switch controller on the FortiGate.. Enabling the switch controller on the FortiGate activates the FortiLink management protocol, which is required for the FortiGate to discover, configure, and manage the FortiSwitch as a managed switch. Option E is correct because the physical port connecting the FortiSwitch must be configured as a 'switch' interface type (FortiLink interface) to establish the proprietary control and data plane communication between the devices.

Answer

Assign an IP address to the FortiSwitch's management VLAN on the FortiGate.

Answer

Configure the FortiSwitch in standalone mode.

Answer

Disable STP on the FortiSwitch ports connected to the FortiGate.

Question 9

An administrator needs to enable automation stitches to automatically block a malicious IP address detected by FortiSandbox. Which two components are required? (Choose two.)

Accepted Answer

A trigger that detects the FortiSandbox verdict. Automation stitches require a trigger to initiate the workflow. In this scenario, the trigger must detect the FortiSandbox verdict (e.g., malicious or clean) to start the automated response. Without a trigger, the stitch has no event to react to, making it non-functional.

Answer

A static route to the malicious IP

Answer

An SSL certificate for the FortiGate

Answer

A firewall policy that allows the traffic

Question 10

An administrator configures a FortiGate to integrate with FortiSandbox for inline scanning. The policy has an antivirus profile with FortiSandbox enabled. What condition must be met for files to be submitted to FortiSandbox?

Accepted Answer

The antivirus profile must use proxy-based inspection mode. For files to be submitted to FortiSandbox during inline scanning, the antivirus profile must use proxy-based inspection mode. This is because proxy-based inspection allows the FortiGate to buffer the entire file, perform deep analysis, and then forward it to FortiSandbox for verdict-based blocking. Flow-based inspection, in contrast, streams packets and cannot hold files for submission, making proxy mode a prerequisite for inline FortiSandbox integration.

Answer

The FortiSandbox must be on the same subnet as the FortiGate

Answer

The FortiGate must be in NAT mode

Answer

SSL inspection must be disabled

Question 11

An enterprise FortiGate is configured with multiple VDOMs, including a management VDOM. The admin logs in to the management VDOM and wants to create a new VDOM and assign interfaces. However, the 'config vdom' command requires entering a VDOM name that is not 'root'. What is the correct next step?

Accepted Answer

Run 'config global' from the management VDOM to enter the global context. The management VDOM operates within the multi-VDOM context, but VDOM creation and interface assignment are global-level operations. The 'config vdom' command to create a new VDOM must be executed from the global configuration context, not from within any VDOM (including the management VDOM). Therefore, the admin must first run 'config global' to exit the management VDOM and enter the global context, where VDOMs can be created and managed.

Answer

Configure a VDOM link between the management VDOM and the new VDOM

Answer

Use the 'config vdom' command directly in the management VDOM CLI

Answer

Reboot the FortiGate in multi-VDOM mode

Question 12

An administrator is planning a multi-VDOM deployment with a management VDOM. Which TWO statements about management VDOMs are correct? (Choose two.)

Accepted Answer

The management VDOM can be used for FortiGuard updates. The management VDOM is specifically designed to handle administrative traffic, including FortiGuard updates. By isolating FortiGuard communications to the management VDOM, administrators ensure that security updates and threat intelligence downloads do not interfere with or consume bandwidth from the data VDOMs, and they can be centrally managed from a single VDOM.

Answer

The management VDOM cannot have firewall policies

Answer

The management VDOM requires a separate license

Answer

All user traffic must pass through the management VDOM

Question 13

Two FortiGates in an HA cluster are experiencing a split-brain scenario where both units become primary. The administrator checks the HA configuration and sees that the heartbeat interfaces are configured correctly but the link status is 'down' on both units. What could cause this?

Accepted Answer

The physical cable connecting the heartbeat interfaces is faulty. A split-brain occurs when heartbeat communication is lost. If the heartbeat interfaces show link down, it indicates a physical or layer-1 issue, such as a faulty cable or switch port.

Answer

The heartbeat interface has been administratively disabled

Answer

The HA group ID is different on each unit

Answer

The HA priority values are the same on both units

Question 14

What is the purpose of a prefix list in FortiGate routing?

Accepted Answer

To match routes based on their network prefix and subnet mask.. A prefix list in FortiGate is used to match routes based on their network prefix and subnet mask (prefix length). It is commonly applied in route maps or BGP configurations to filter or manipulate routing information, such as in redistribution or neighbor policy statements. Unlike access lists, prefix lists match the exact prefix and length, providing more granular control over route advertisement and acceptance.

Answer

To configure NAT rules.

Answer

To define SD-WAN members.

Answer

To assign IP addresses to interfaces.

Question 15

An administrator configures a FortiGate in transparent mode for a VDOM. After switching to transparent mode, the administrator notices that the default route disappears and traffic fails. What must be configured to restore routing?

Accepted Answer

A management IP address and default gateway for the VDOM. In transparent mode, a FortiGate VDOM acts as a Layer 2 bridge and does not participate in Layer 3 routing. The default route disappears because the VDOM has no Layer 3 interface to host a routing table. To restore management connectivity and allow the FortiGate to reach remote networks (e.g., for firmware updates or logging), you must configure a management IP address and a default gateway for the VDOM. This management IP is used solely for outbound management traffic and does not affect the bridged data plane.

Answer

A static route on the upstream router

Answer

Enable NAT mode to allow routing

Answer

Assign an IP address to each interface