NSE7 Practice Test 36 — 15 Questions

Question 1

An administrator is troubleshooting why a FortiAnalyzer report is not showing expected data. Which TWO potential causes should the administrator investigate?

Accepted Answer

The log data is in a different datastore than the one configured for the report. FortiAnalyzer organizes logs into datastores based on device groups or ADOMs. If the report is configured to query a datastore that does not contain the relevant logs, the report will not display the expected data, even if the logs exist elsewhere on the same FortiAnalyzer.

Answer

The report schedule is not set

Answer

The FortiAnalyzer is in a different ADOM

Answer

The FortiAnalyzer license has expired

Question 2

An administrator needs to configure a site-to-site IPsec VPN with a remote FortiGate that has a dynamic IP address. Which phase1 parameter must be set to support this?

Accepted Answer

Set mode to aggressive and use a pre-shared key. When the remote FortiGate has a dynamic IP address, the local FortiGate cannot initiate the VPN because it does not know the remote peer's IP. Setting the phase1 mode to aggressive and using a pre-shared key allows the remote peer to initiate the connection by sending its identity (ID) in the first exchange, enabling the local FortiGate to identify and authenticate the peer without requiring a static IP address for the remote side.

Answer

Enable Perfect Forward Secrecy (PFS)

Answer

Enable NAT traversal

Answer

Use certificate-based authentication

Question 3

A FortiGate admin configures inter-VDOM routing between VDOM-A and VDOM-B using a VDOM link. The admin wants traffic from VDOM-A to reach a server in VDOM-B. Which three configuration steps are required? (Choose three.)

Accepted Answer

Configure static routes pointing to the VDOM link interface on both VDOMs. Inter-VDOM routing via a VDOM link requires each VDOM to have a static route pointing to the VDOM link interface as the next hop. Without these routes, traffic from VDOM-A destined for a server in VDOM-B would have no path to the VDOM link, and the FortiGate would drop the packets. The static route ensures the firewall can forward traffic between the two VDOMs across the VDOM link.

Answer

Enable NAT on the VDOM link interface

Answer

Disable ARP on the VDOM link interfaces

Question 4

A FortiGate is configured with multiple virtual routers (VRFs). The administrator wants to allow communication between two VRFs using a firewall policy. Which type of interface is required for the policy?

Accepted Answer

VDOM link. A VDOM link is a virtual interface that connects two VDOMs (Virtual Domains) and inherently supports routing between different VRFs (Virtual Routing and Forwarding instances) within a FortiGate. When a firewall policy is applied to a VDOM link, it can control traffic flowing between the two VRFs, as the link itself is a Layer 3 interface that belongs to both VDOMs and can be assigned to different VRFs on each side. This is the only interface type that natively allows inter-VRF communication with firewall policy enforcement.

Answer

VLAN subinterface

Answer

Loopback interface

Answer

Virtual-wire pair

Question 5

An administrator observes that traffic from a specific subnet is being dropped by the FortiGate. The session table shows the sessions with 'proto_state=01' and 'expire=0'. What does this indicate?

Accepted Answer

The sessions have expired and are being cleaned up. In FortiGate session tables, 'proto_state=01' indicates a TCP session in the SYN-SENT state (the first step of the three-way handshake), and 'expire=0' means the session has no remaining time-to-live. This combination typically occurs when the session timed out or was reset before completing the handshake, and the entry is now being cleaned up by the session table garbage collector. Option A is correct because these are stale sessions that have expired and are in the process of removal.

Answer

The antivirus scanning is causing a delay

Answer

The sessions are being offloaded to the NPU

Answer

The firewall policy is blocking the traffic

Question 6

You receive an alert from FortiSandbox that a file has been rated 'highly malicious'. The FortiGate has the FortiSandbox inline scanning enabled with the action 'block malicious'. However, the file is still being downloaded by users. What is the most likely reason?

Accepted Answer

The file type is not listed in the scanning profile for FortiSandbox. FortiSandbox inline scanning only inspects file types that are explicitly listed in the scanning profile. If the file type (e.g., .zip, .pdf, or a specific executable extension) is not included in the profile, FortiGate will allow the file to pass through without sending it to FortiSandbox for analysis, even if the action is set to 'block malicious'. This explains why a file rated 'highly malicious' can still be downloaded by users.

Answer

The FortiSandbox device is not reachable from FortiGate

Answer

The IPS sensor is blocking the connection before the antivirus inspection

Answer

The antivirus database is outdated

Question 7

When configuring FortiGate with FortiSandbox integration, an administrator wants to block files that are rated 'High Risk' by the sandbox. Which setting must be enabled in the antivirus profile to automatically quarantine these files?

Accepted Answer

Enable 'Submit Files to FortiSandbox' and set action to 'Block'. The 'Submit Files to FortiSandbox' setting in the antivirus profile, when set to 'Block', directly instructs FortiGate to quarantine files that receive a 'High Risk' verdict from FortiSandbox. This action is part of the antivirus profile's sandbox integration, not a separate automation or IPS feature, and it automatically handles the quarantine without requiring additional configuration.

Answer

Configure an automation stitch to quarantine files based on sandbox verdict

Answer

Enable 'File Filter' in the antivirus profile and add a rule for high-risk files

Answer

Enable 'FortiSandbox Quarantine' in the IPS profile

Question 8

What is the purpose of BFD (Bidirectional Forwarding Detection) in a FortiGate routing configuration?

Accepted Answer

To detect forwarding path failures quickly. BFD (Bidirectional Forwarding Detection) provides fast failure detection for forwarding paths between two adjacent routers, independent of any routing protocol. In FortiGate configurations, BFD is used to detect link or neighbor failures in sub-second intervals (e.g., 50-100 ms), enabling rapid convergence for dynamic routing protocols like OSPF or BGP. This is critical for SD-WAN and high-availability scenarios where traditional keepalive timers (e.g., OSPF Hello/Dead intervals of 10-40 seconds) are too slow.

Answer

To encrypt routing protocol traffic

Answer

To authenticate routing peers

Answer

To provide load balancing across multiple paths

Question 9

An administrator configures a performance SLA to monitor a remote server. The SLA status shows 'dead' for one WAN member. The administrator checks the interface and sees that it is up and passing other traffic. What is the most likely cause?

Accepted Answer

The SLA probe is using TCP port 80 but the server is only responding to ICMP. The performance SLA status shows 'dead' because the probe is failing to reach the remote server. The administrator configured the SLA to use TCP port 80, but the server only responds to ICMP. Since the probe packets (TCP SYN) are not being acknowledged, the SLA marks the member as dead, even though the interface is up and other traffic (e.g., ICMP) passes successfully.

Answer

The FortiGate's routing table does not have a route to the probe target

Answer

The interface is not added as an SD-WAN member

Answer

The SLA probe interval is set too high

Question 10

Which Fortinet product is specifically designed to deploy decoys and lures to detect lateral movement and early-stage attacks inside the network?

Accepted Answer

FortiDeceptor. FortiDeceptor is specifically designed to deploy decoys and lures that mimic real assets (e.g., servers, endpoints, IoT devices) to attract and detect lateral movement and early-stage attacks inside the network. It uses deception technology to create a realistic attack surface, triggering alerts when an attacker interacts with a decoy, without relying on signatures or behavioral analysis.

Answer

FortiSandbox

Answer

FortiEDR

Answer

FortiClient

Question 11

An administrator needs to monitor traffic flows across multiple FortiGate devices in a Security Fabric. The administrator wants to see a unified view of all traffic, including inter-device traffic, from a single pane. Which Fortinet tool provides this capability?

Accepted Answer

FortiAnalyzer. FortiAnalyzer is the correct tool because it aggregates logs and traffic data from multiple FortiGate devices within a Security Fabric, providing a unified view of all traffic, including inter-device flows. It uses the FortiTelemetry protocol to collect logs and supports the Security Fabric's topology mapping, allowing administrators to monitor cross-device traffic from a single pane of glass.

Answer

FortiAP

Answer

FortiManager

Answer

FortiGate local logs

Question 12

Which SD-WAN load balancing algorithm distributes traffic based on the number of active sessions per SD-WAN member?

Accepted Answer

Sessions. The Sessions algorithm in Fortinet SD-WAN distributes traffic by counting the number of active sessions currently traversing each SD-WAN member interface. The member with the fewest active sessions receives the next new session, ensuring a balanced session load across the SD-WAN links. This is distinct from volume-based or hash-based algorithms, as it directly uses session count as the metric.

Answer

Source-dest-IP

Answer

Spillover

Answer

Volume

Question 13

An administrator is integrating a FortiExtender with a FortiGate. The FortiExtender is connected to port5 and configured with a cellular WAN connection. What must be configured on the FortiGate to allow the FortiExtender to provide WAN connectivity as an SD-WAN member?

Accepted Answer

Enable the 'fortiextender' option on port5 and configure the FortiExtender as an SD-WAN member using the virtual wan interface.. To integrate a FortiExtender as an SD-WAN member, the FortiGate must enable the 'fortiextender' option on the physical port (port5) to which the FortiExtender is connected. This creates a virtual wan interface that represents the FortiExtender's cellular WAN connection, allowing it to be added as an SD-WAN member for load balancing and failover policies. No static route or SIM card configuration is needed on the FortiGate, as the FortiExtender handles cellular authentication and routing internally.

Answer

Create a static route to the FortiExtender's management IP to use it as a gateway.

Answer

Configure port5 as a physical member and assign the FortiExtender's SIM card details.

Answer

Use the FortiExtender as a standalone router and configure policy-based routing on the FortiGate.

Question 14

What is the primary purpose of FortiGuard Outbreak Prevention service?

Accepted Answer

To provide proactive protection against zero-day and fast-spreading threats. FortiGuard Outbreak Prevention is designed to provide proactive protection against zero-day and fast-spreading threats by leveraging real-time threat intelligence from FortiGuard Labs. It automatically updates security policies and signatures to block emerging threats before they become widespread, reducing the window of vulnerability.

Answer

To provide real-time threat intelligence feeds to third-party SIEM systems

Answer

To automatically patch vulnerabilities in FortiGate firmware

Answer

To block all traffic from IP addresses listed in a community-based blocklist

Question 15

An administrator is troubleshooting an IPsec VPN tunnel that establishes phase 1 but fails phase 2. Which TWO commands are MOST useful to diagnose the phase 2 failure? (Choose two.)

Accepted Answer

diagnose vpn ike config. The 'diagnose vpn ike config' command (D) displays the IKE configuration that the FortiGate is actually using for phase 2 negotiations, including proxy IDs, encryption algorithms, and lifetimes. This helps identify mismatches between the local and peer configurations that cause phase 2 to fail. The 'diagnose debug application ike 255' command (E) enables verbose IKE debugging, which logs every phase 2 exchange, including error messages like 'no proposal chosen' or 'mismatched proxy ID', directly pinpointing the failure reason.

Answer

diagnose sys session list

Answer

show vpn ipsec phase2-interface

Answer

get system performance status