NSE7 Practice Test 36 — 15 Questions

Question 1

A FortiGate administrator is configuring a firewall policy to inspect traffic for advanced threats. The administrator wants to ensure that the policy uses both antivirus and IPS inspection, and that the traffic is inspected in a way that minimizes latency while still detecting threats. Which two actions should the administrator take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply an antivirus profile and an IPS sensor to the firewall policy.. To minimize latency while inspecting for advanced threats, flow-based inspection should be used because it processes packets without full buffering. Additionally, both an antivirus profile and an IPS sensor must be applied to the firewall policy to ensure that malware and network attacks are detected. These two actions together satisfy the performance and security requirements.

Answer

Enable 'Scan with FortiSandbox' in the antivirus profile.

Answer

Enable 'Block Oversized Files' in the antivirus profile.

Answer

Enable proxy-based inspection on the firewall policy.

Question 2

A FortiManager administrator wants to push policy package changes to a managed FortiGate, but wants to see what changes will be applied before committing. Which FortiManager feature should the administrator use?

Accepted Answer

Install preview. Install preview is the correct feature because it allows the administrator to simulate the installation of policy package changes on a managed FortiGate without actually applying them. This provides a detailed diff of what will be added, modified, or removed, enabling verification before committing the changes. It is specifically designed for pre-commit validation in FortiManager's centralized management workflow.

Answer

Meta fields

Answer

Automation stitch

Answer

Revision history

Question 3

A multinational company uses FortiGate devices as VPN gateways to connect its headquarters (HQ) and branch offices via IPsec VPN tunnels. The company is migrating its remote access solution from IPsec VPN to SSL VPN using FortiClient. Currently, 500 remote users connect via IPsec VPN with pre-shared keys and XAuth authentication. The migration must be seamless with minimal downtime, and users must continue to authenticate using their existing Active Directory credentials. The SSL VPN portal must provide access to internal web applications and some legacy TCP-based applications that do not support HTTP. The security team requires that all traffic between remote users and the internal network be encrypted and that the SSL VPN use a certificate from a public CA to avoid certificate warnings on client devices. The IT team wants to use FortiToken for two-factor authentication (2FA) for all VPN users. Which of the following is the most appropriate course of action to meet all requirements?

Accepted Answer

Deploy SSL VPN with a public CA certificate, configure LDAP authentication against Active Directory, enable FortiToken for 2FA, and create a split-tunneling policy that uses both SSL VPN web mode and tunnel mode via FortiClient.. It meets all requirements: a public CA certificate avoids client certificate warnings, LDAP authentication against Active Directory allows seamless credential reuse, FortiToken provides the required 2FA, and combining SSL VPN web mode (for web apps) with tunnel mode via FortiClient (for legacy TCP applications) ensures full coverage. This approach minimizes downtime by migrating users gradually without changing their authentication backend.

Answer

Configure SSL VPN with a self-signed certificate and use the local password database for authentication. Enable FortiToken and configure the portal to provide both web and TCP forwarding applications.

Answer

Set up SSL VPN with a public CA certificate, use LDAP for authentication, but do not enable FortiToken because it would require a separate token per user.

Answer

Create a new IPsec VPN configuration using certificate-based authentication and FortiToken, and gradually move users to the new IPsec VPN.

Question 4

A security analyst is reviewing alerts from FortiEDR and wants to automatically isolate an infected endpoint from the network when a malicious process is detected. Which FortiEDR feature should the analyst configure to achieve this?

Accepted Answer

Playbook with a 'Network Isolation' action.. FortiEDR playbooks are the automation engine that can trigger actions based on event conditions. Configuring a playbook with a 'Network Isolation' action ensures that when a malicious process is detected, the endpoint is immediately quarantined from the network, stopping further damage. This is the correct way to achieve automated containment.

Answer

Vulnerability assessment scan.

Answer

Forensic data collection rule.

Answer

Application control policy to block the process.

Question 5

An administrator is configuring a FortiGate to use the external threat feed feature to block traffic from known malicious IP addresses. They want to ensure that the feed is automatically updated and that the firewall blocks traffic based on the feed. Which two actions must the administrator perform? (Choose two.)

Accepted Answer

Add the external threat feed object as a source or destination in a firewall policy with a deny action.. To use an external threat feed for blocking, the administrator must first create the threat feed object with the feed URL, then reference that object in a firewall policy with a deny action. The FortiGate will download and update the feed automatically, and the policy will block matching traffic. Other options do not achieve IP-based blocking from a threat feed.

Answer

Enable FortiGuard antivirus scanning on the firewall policy.

Answer

Set the threat feed object to 'monitor' mode in the firewall policy.

Answer

Configure a DNS filter profile to block the malicious IP addresses.

Question 6

An administrator is troubleshooting high CPU usage on a FortiGate. The administrator suspects that a specific process is causing the issue. Which TWO commands should the administrator use to identify the top CPU-consuming processes? (Choose two.)

Accepted Answer

diagnose sys top-summary. To identify the top CPU-consuming processes, the administrator should use commands that provide per-process CPU usage. 'diagnose sys top' offers an interactive real-time view, while 'diagnose sys top-summary' provides a concise summary. Both are effective for pinpointing the process responsible for high CPU.

Answer

get system performance status

Answer

diagnose sys session list

Answer

diagnose hardware sysinfo memory

Question 7

A FortiGate is configured with a site-to-site IPsec VPN to a remote peer. The VPN tunnel is up, but traffic is not passing. The administrator runs 'diagnose vpn tunnel list' and sees that the tunnel is established with the correct selectors. Which two commands should the administrator use to further troubleshoot why traffic is not passing through the tunnel? (Choose two.)

Accepted Answer

diagnose ip router lookup <destination_ip>. When an IPsec tunnel is up but traffic is not passing, the issue often lies in routing or firewall policies. Using 'diagnose debug flow filter' with the remote subnet allows the administrator to trace packet flow and see where packets are dropped. 'diagnose ip router lookup' verifies that the FortiGate routes traffic into the tunnel. Together, these commands help identify if traffic is being routed incorrectly or blocked by a policy, which are common causes for this scenario.

Answer

diagnose vpn tunnel list

Answer

diagnose firewall iprope list

Answer

diagnose vpn ike log filter src-addr <remote_gateway>

Question 8

What is the function of a VRF (Virtual Routing and Forwarding) on a FortiGate?

Accepted Answer

To create multiple independent routing tables. VRF (Virtual Routing and Forwarding) on a FortiGate allows the creation of multiple independent routing tables within a single physical device. This enables network segmentation and traffic isolation at Layer 3, where each VRF maintains its own routing table, forwarding decisions, and interface associations, preventing routes from leaking between VRFs unless explicitly configured with route leaking.

Answer

To provide redundancy for routing protocols

Answer

To aggregate multiple physical interfaces into one logical interface

Answer

To encrypt traffic between different virtual domains

Question 9

An SD-WAN rule is configured to steer traffic based on SLA metrics. The administrator notices that traffic is not using the expected member interface even though the SLA is meeting thresholds. What should the administrator check FIRST?

Accepted Answer

Run 'diagnose sys sdwan info' to verify the rule and member status. 'diagnose sys sdwan info' provides a real-time view of SD-WAN rule status, member interface health, and SLA compliance. This command directly shows whether the rule is matching traffic and if the expected member is active or has been deprioritized due to implicit factors like session stickiness or load-balancing algorithm, which are not visible in the SLA thresholds alone.

Answer

Check the firewall policy to ensure SD-WAN is enabled

Answer

Verify the BGP configuration to ensure routes are being advertised

Answer

Restart the FortiGate to clear any stale sessions

Question 10

An administrator is troubleshooting a FortiGate that is experiencing high CPU usage. The administrator wants to identify which processes are consuming the most CPU. Which command should be used?

Accepted Answer

diagnose sys top. The correct command is 'diagnose sys top' because it provides a real-time, per-process view of CPU and memory usage. This allows the administrator to quickly identify which process is causing high CPU and take corrective action.

Answer

get system performance status

Answer

diagnose hardware sysinfo cpu

Answer

diagnose sys process list

Question 11

A FortiGate is configured with a firewall policy that applies an application control profile blocking social media. Users report that they can still access Facebook. The administrator verifies that the policy is correctly matching the traffic and that the application control profile is applied. Which CLI command should the administrator use to verify whether the application control is correctly identifying the traffic?

Accepted Answer

diagnose debug application appctrl -1. The application control daemon (appctrl) is responsible for identifying applications based on signatures and behavior. Debugging it with 'diagnose debug application appctrl -1' shows real-time detection results for each session, allowing the administrator to confirm if Facebook is being recognized. If it is not, they can then check signature updates or traffic patterns.

Answer

diagnose firewall iprope list

Answer

diagnose debug application ipsmonitor -1

Answer

diagnose sys session list

Question 12

An administrator is troubleshooting a FortiGate that is experiencing high CPU usage. The administrator runs 'diagnose sys top' and sees that the 'ipsengine' process is consuming a large amount of CPU. Which two actions should the administrator take to further diagnose and potentially resolve the issue? (Choose two.)

Accepted Answer

Run 'diagnose debug application ipsmonitor -1' to check for IPS engine restarts or errors.. To diagnose high CPU from the IPS engine, checking the ipsmonitor debug can reveal if the engine is crashing or restarting, which would cause repeated high CPU spikes. Additionally, reviewing the IPS sensor configuration for heavy signatures or excessive signatures can identify if the load is due to inspection complexity. Both actions target the root cause without compromising security.

Answer

Disable IPS inspection on all firewall policies to immediately reduce CPU usage.

Answer

Increase the FortiGate's memory allocation to the IPS engine via CLI.

Answer

Restart the IPS engine using 'diagnose test application ipsmonitor 99' to clear the high CPU.

Question 13

An administrator configures inter-VDOM routing between VDOM-A and VDOM-B using a VDOM link. After configuration, traffic from VDOM-A cannot reach VDOM-B. Which configuration step is MOST likely missing?

Accepted Answer

Create a firewall policy on VDOM-A and VDOM-B allowing traffic over the VDOM link interface. VDOM links are special inter-VDOM interfaces that require firewall policies on both VDOMs to permit traffic. Without a policy on VDOM-A and VDOM-B that allows traffic over the VDOM link interface, packets will be dropped by the implicit deny rule. This is the most common missing step when inter-VDOM routing fails.

Answer

Enable 'inter-vdom-routing' under system settings

Answer

Configure a static route on VDOM-A pointing to VDOM-B's subnet via the VDOM link

Answer

Assign both VDOM link interfaces to the same VDOM

Question 14

A FortiGate is configured with a VIP (virtual IP) to publish an internal web server to the internet. External users report that they cannot access the web server, but internal users can access it using its private IP. The administrator runs 'diagnose debug flow' and sees that traffic from external users is being dropped with the message 'iprope_in_check() check failed, drop'. What is the most likely cause?

Accepted Answer

The firewall policy allowing access to the VIP is missing or placed after a deny policy.. The debug message 'iprope_in_check() check failed, drop' indicates that the traffic was dropped during the ingress policy check. This typically happens when no firewall policy matches the traffic or when a deny policy is matched before an allow policy. In this scenario, external users cannot access the VIP, but internal users can, suggesting the VIP itself is working. The most likely cause is that the firewall policy allowing external access to the VIP is missing, disabled, or incorrectly ordered. The administrator should verify the policy configuration and order.

Answer

The firewall policy allowing access to the VIP does not have NAT enabled.

Answer

There is an asymmetric routing issue or the return route is not via the FortiGate.

Answer

The VIP is not configured with the correct external interface.

Question 15

A FortiGate is configured with an IPsec VPN tunnel to a remote peer. The tunnel is up, but traffic is not passing through it. The administrator runs 'diagnose vpn tunnel list' and sees that the tunnel is established. The administrator then runs 'diagnose debug flow' and sees that traffic is being dropped with the message 'iprope_in_check() check failed, drop'. What is the MOST likely cause of the drop?

Accepted Answer

The firewall policy for the VPN traffic is missing or incorrect.. The error 'iprope_in_check() check failed, drop' is generated by the firewall policy check. It means that the packet did not match any allow policy or matched a deny policy. In an IPsec VPN scenario, this often happens when the policy allowing traffic from the VPN tunnel is missing or incorrectly configured. The administrator should verify that a policy exists with the correct incoming interface, source, destination, and service.

Answer

The VPN tunnel is using the wrong pre-shared key.

Answer

The IPsec phase2 selectors do not match the traffic being sent.

Answer

The routing table does not have a route to the remote subnet.