NSE7 Practice Test 38 — 15 Questions

Question 1

An administrator is configuring ZTNA inline CASB for a SaaS application. The goal is to block upload of files containing credit card numbers. Which configuration components are required?

Accepted Answer

Configure a ZTNA application with a CASB profile and SSL inspection. ZTNA inline CASB for a SaaS application requires configuring a ZTNA application entry that includes a CASB profile and SSL inspection. The CASB profile defines the DLP rules (e.g., blocking credit card numbers), and SSL inspection decrypts the traffic so the CASB can inspect file uploads. This combination is the required configuration to enforce inline DLP on SaaS uploads.

Answer

Use FortiClient to enforce DLP on endpoints

Answer

Configure an IPsec VPN between FortiGate and the SaaS provider

Answer

Configure a web filter profile with DLP sensor

Question 2

A FortiGate administrator is investigating a slow network issue. The 'diagnose sys session stat' shows a high number of sessions. Which THREE commands can help identify the source of the high session count?

Accepted Answer

diagnose sys session list | grep . 'diagnose sys session list | grep ' filters the session list to show only sessions matching a specific firewall policy ID. This allows the administrator to identify which policy is handling the most sessions, helping to pinpoint the source of high session counts by correlating traffic patterns with policy usage.

Answer

diagnose sys session stat

Answer

diagnose netlink interface list

Question 3

An email security administrator wants to prevent attackers from spoofing the company's domain. Which email authentication mechanism should be configured to allow receiving servers to verify that emails claiming to be from the domain are sent from authorized mail servers?

Accepted Answer

SPF. SPF (Sender Policy Framework) is the correct answer because it allows domain owners to publish DNS records specifying which mail servers are authorized to send email on behalf of their domain. Receiving servers can then verify the envelope sender (Return-Path) against the SPF record to detect spoofed messages. This directly addresses the requirement to verify that emails claiming to be from the domain originate from authorized servers.

Answer

DMARC

Answer

TLS for SMTP

Answer

DKIM

Question 4

During a failover test in an HA cluster, the administrator observes that the secondary unit becomes primary but does not have the latest configuration. What is the most likely cause?

Accepted Answer

Config sync is not enabled. Config sync is the mechanism that replicates configuration changes from the primary unit to the secondary unit in a FortiGate HA cluster. If config sync is not enabled, the secondary unit will not receive configuration updates, so when it becomes primary after a failover, it will operate with an outdated or default configuration. This directly explains why the secondary unit lacks the latest configuration after the failover.

Answer

The password encryption is mismatched

Answer

The HA priority is set too low

Answer

session-pickup is disabled

Question 5

An administrator runs 'diagnose sys session list' and sees sessions with 'proto=6 proto_state=02' and a long duration. The administrator is troubleshooting why sessions are not being terminated after a policy change that should block the traffic. What does 'proto_state=02' indicate?

Accepted Answer

The session is in established state (TCP connection active). In Fortinet's 'diagnose sys session list' output, 'proto=6' indicates TCP, and 'proto_state=02' maps to the TCP established state (ESTABLISHED). This means the session has completed the three-way handshake and is actively passing data. A long duration in this state explains why the session persists even after a policy change that should block new traffic—the existing session remains in the kernel session table until it times out or is explicitly cleared, because FortiGate's stateful inspection does not retroactively terminate established sessions upon policy modification.

Answer

The session is in TIME_WAIT state

Answer

The session is in SYN_SENT state, waiting for a SYN-ACK

Answer

The session is in FIN_WAIT state, closing the connection

Question 6

A FortiGate administrator wants to use PKI certificates for IPsec VPN authentication instead of pre-shared keys. Which phase1 parameter must be set to 'signature' to enable certificate-based authentication?

Accepted Answer

set authmethod signature. In FortiGate IPsec phase1 configuration, certificate-based authentication is enabled by setting authmethod to signature, which tells the FortiGate to use digital signatures (certificates) instead of pre-shared keys. This is the specific phase1 parameter that switches authentication from PSK to certificate-based.

Answer

set cert-validation enable

Answer

set ike-version 2

Answer

set peer-id certificate

Question 7

An administrator is troubleshooting SD-WAN and runs the following CLI command:
 'execute sdwan-health-check status'
The output shows that one SD-WAN member has a status of 'dead'. What does this indicate?

Accepted Answer

The member has failed the health check probe to the target server. The 'execute sdwan-health-check status' command displays the results of active health-check probes sent to configured target servers. A status of 'dead' means that the SD-WAN member has failed to receive a successful response from the target server within the configured probe interval and retry count, indicating a loss of connectivity or reachability to that target. This is distinct from interface administrative status or SLA compliance, as the health check specifically tests end-to-end reachability to the probe target.

Answer

The member interface is administratively down

Answer

The member is not meeting the performance SLA thresholds

Answer

The SD-WAN member is not included in any SD-WAN rule

Question 8

In FortiGate's ZTNA, what is the purpose of a 'ZTNA tag'?

Accepted Answer

To identify a device's compliance status and attributes for policy enforcement.. ZTNA tags are dynamic attributes (e.g., OS type, antivirus status) assigned to devices based on posture checks. They are used in firewall policies to grant access based on device compliance, not for routing or QoS.

Answer

To mark packets for quality of service (QoS) prioritization.

Answer

To label network interfaces for traffic steering.

Answer

To assign a security level to application traffic.

Question 9

A FortiGate with two WAN interfaces configured in an SD-WAN setup uses the 'lowest-cost' load balancing algorithm. The performance SLA monitors latency and jitter. If wan1 has a cost of 10 and wan2 has a cost of 20, but wan1 is experiencing 50% packet loss, what will happen to traffic?

Accepted Answer

Traffic is sent to wan2 because wan1 is considered dead. When an SD-WAN member interface fails the performance SLA (e.g., 50% packet loss), FortiGate marks it as 'dead' and removes it from the active member set. The 'lowest-cost' algorithm then selects the next lowest-cost member that is alive, which is wan2 (cost 20). Traffic is not load-balanced equally because wan1 is dead, and it is not dropped because wan2 is available.

Answer

Traffic is distributed equally between both links

Answer

Traffic is dropped until wan1 recovers

Answer

Traffic continues using wan1 because cost is lower

Question 10

A FortiGate has two WAN interfaces (port1, port2) as SD-WAN members. The performance SLA monitor is configured for both with a latency threshold of 50 ms. The measured latency on port1 is 45 ms and on port2 is 55 ms. An SD-WAN rule uses 'lowest-cost' algorithm. Which interface will be selected for new sessions?

Accepted Answer

port1 because its latency is within threshold and lower than port2. The SD-WAN rule uses the 'lowest-cost' algorithm, which selects the interface with the lowest cost among those that meet the performance SLA threshold. Here, port1 has a measured latency of 45 ms, which is below the 50 ms threshold, while port2's latency of 55 ms exceeds the threshold, making port2 ineligible. Therefore, port1 is the only qualifying interface and is selected for new sessions.

Answer

port2 because port1's latency is close to threshold

Answer

The session is dropped

Answer

Both interfaces are used equally

Question 11

Which FortiGate feature allows multiple independent routing tables on a single device, enabling traffic separation for different departments or customers?

Accepted Answer

VRF. VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, each with its own set of interfaces, routes, and forwarding decisions. This enables traffic separation for different departments or customers without requiring separate physical devices, as each VRF instance operates as a logically isolated router within the same hardware.

Answer

ECMP

Answer

VDOM

Answer

Policy-based routing

Question 12

An organization wants to use FortiManager to manage multiple FortiGate devices. The administrator needs to ensure that each device group has separate policy and object configurations. Which FortiManager feature should be configured?

Accepted Answer

Administrative Domains (ADOMs). Administrative Domains (ADOMs) in FortiManager allow you to partition the management database so that each ADOM has its own independent set of policy packages and objects. By assigning each device group to a separate ADOM, administrators ensure that policy and object configurations are isolated and cannot be shared or accidentally overwritten between groups. This directly meets the requirement for separate configurations per device group.

Answer

Policy packages with header/footer policies

Answer

Global ADOM

Answer

Meta fields

Question 13

What is the purpose of a route map when used with route redistribution on a FortiGate?

Accepted Answer

To filter or modify route attributes during redistribution. Route maps are used with route redistribution to filter which routes are redistributed and to modify route attributes (such as metric, tag, or next-hop) as they are injected from one routing protocol into another. Option D is correct because route maps provide granular control over the redistribution process, allowing administrators to match specific routes using prefix lists or ACLs and then set attributes like metric or tag before the routes are redistributed.

Answer

To create a prefix list for BGP

Answer

To define the administrative distance of redistributed routes

Answer

To enable the redistribution process

Question 14

A network administrator is configuring VDOMs on a FortiGate and wants to separate management traffic from production data traffic. What is the best practice when using a management VDOM?

Accepted Answer

Create a dedicated management VDOM and assign only management interfaces to it. Creating a dedicated management VDOM and assigning only management interfaces to it is the best practice because it isolates management traffic from production data traffic, reducing the attack surface and preventing management access from being exposed to untrusted networks. This aligns with Fortinet's security best practices for VDOM administration, ensuring that management functions are logically separated from data-plane operations.

Answer

Disable management access on all VDOMs except the root VDOM

Answer

Use inter-VDOM routing to route management traffic to the root VDOM

Answer

Assign all interfaces to the management VDOM

Question 15

A FortiGate administrator is troubleshooting a scenario where users in VDOM-1 cannot reach a server in VDOM-2. Inter-VDOM routing is configured using a VDOM link. The administrator checks the session table and sees that packets are arriving on the VDOM link interface but are not being forwarded. What is the MOST likely cause?

Accepted Answer

A firewall policy is blocking the traffic from the VDOM link to the destination. When packets arrive on the VDOM link interface but are not forwarded, the issue is typically a missing or misconfigured firewall policy in the destination VDOM (VDOM-2). Even though inter-VDOM routing is correctly set up via the VDOM link, FortiGate requires an explicit firewall policy in the destination VDOM to permit traffic from the VDOM link interface to the destination server. Without this policy, the FortiGate drops the packets after routing, which matches the symptom of packets arriving but not being forwarded.

Answer

The VDOM link is in the wrong VDOM

Answer

The routing table in VDOM-1 does not have a default route

Answer

The VDOM link is not administratively up