NSE7 Practice Test 38 — 15 Questions

Question 1

An administrator wants to configure FortiGate to use the machine learning engine for advanced antivirus detection. Which setting must be enabled in the antivirus profile?

Accepted Answer

Enable 'Machine Learning Engine' in the antivirus profile. The machine learning engine for advanced antivirus detection is a dedicated feature within the antivirus profile that must be explicitly enabled. This engine uses behavioral analysis and heuristics to detect unknown or zero-day malware without relying solely on signature-based detection. Enabling this setting allows FortiGate to leverage on-device ML models to identify malicious files based on patterns and anomalies.

Answer

Enable 'Detect All' in the antivirus profile

Answer

Set 'Scan Mode' to 'Quick' in the antivirus profile

Answer

Enable 'Use FortiSandbox' in the antivirus profile

Question 2

A FortiGate administrator is configuring NAC (Network Access Control) integration with FortiNAC. The goal is to control access for wired clients based on device compliance. Which TWO configurations are required on the FortiGate to support this integration?

Accepted Answer

Configure a RADIUS server pointing to FortiNAC.. To integrate FortiGate with FortiNAC, two configurations are needed: first, a RADIUS server pointing to FortiNAC (A) must be configured on the FortiGate so it can query device compliance status from FortiNAC. Second, the 'nac-policy' option must be enabled on the FortiGate interface that connects to the switch (D). This allows the FortiGate to apply NAC-based access policies to wired clients. Options B (security group tag mapping) and C (802.1x on the interface) are not required on the FortiGate for this integration; 802.1x is typically handled by the switch. Option E (nac-mode to global-vlan) is not a standard setting for this scenario.

Answer

Create a security group tag (SGT) mapping.

Answer

Enable '802.1x' authentication on the interface.

Answer

Set the 'nac-mode' to 'global-vlan' under the interface.

Question 3

A FortiGate is deployed as a LAN edge switch with multiple FortiSwitch units connected. The administrator wants to configure VLANs and manage the switches centrally. Which TWO features must be enabled on the FortiGate to achieve this? (Select TWO.)

Accepted Answer

Create VLAN interfaces on the FortiGate and assign them to the FortiLink interface. VLAN interfaces must be created on the FortiGate and assigned to the FortiLink interface to enable centralized VLAN management. The FortiGate acts as the controller, pushing VLAN configurations to connected FortiSwitch units via the FortiLink tunnel, allowing the administrator to manage all VLANs from a single point without logging into each switch individually.

Answer

LLDP-MED

Answer

Configure a separate management VRF

Answer

STP (Spanning Tree Protocol) on the FortiGate

Question 4

A FortiGate administrator is troubleshooting a ZTNA problem where users are unable to connect to an internal application via FortiClient. FortiClient reports 'Connection refused'. The FortiGate ZTNA gateway is configured correctly. Which THREE steps should the administrator take to diagnose the issue?

Accepted Answer

Verify that FortiClient can reach the ZTNA gateway's IP and port. To diagnose a ZTNA connection issue where FortiClient reports 'Connection refused' but the ZTNA gateway is correctly configured, the administrator should:

1. Verify that FortiClient can reach the ZTNA gateway's IP and port (option B): This ensures the client can establish a connection to the gateway itself. If the gateway is unreachable, the client cannot initiate the ZTNA tunnel.

2. Examine the ZTNA access proxy rule to ensure the application mapping is correct (option C): The access proxy rule defines which internal application the gateway forwards traffic to. Incorrect mapping (e.g., wrong IP, port, or protocol) would cause the gateway to reject or misroute the connection.

3. Verify that the application server is reachable from the FortiGate (option E): Even if the client can reach the gateway and the mapping is correct, the gateway must be able to reach the actual application server. Use ping or telnet from the FortiGate to confirm network connectivity to the server.

Options A (antivirus update status) and D (reboot FortiClient) are not directly relevant to this ZTNA connectivity issue. The FortiClient reports 'Connection refused', which typically points to network or configuration problems, not antivirus updates or client software state.

Answer

Check the FortiGate's antivirus update status

Answer

Reboot the FortiClient computer

Question 5

A company uses FortiManager to manage multiple FortiGates. The admin wants to use a global ADOM to manage certain policies across all devices while allowing local customization. Which two statements about global ADOM are true? (Choose two.)

Accepted Answer

Header/footer policies can only be configured in the global ADOM. Header and footer policies are global constructs that can only be created and managed within the global ADOM. These policies are automatically applied to all policy packages across all regular ADOMs, ensuring consistent enforcement at the top and bottom of the policy list without local modification.

Answer

Global ADOM supports per-device policy objects

Answer

Global ADOM requires a separate FortiManager license

Answer

Global ADOM policies are installed on all managed FortiGates in all ADOMs

Question 6

Drag and drop the steps to configure a FortiGate to send logs to a FortiAnalyzer into the correct order.

Accepted Answer

Add log device, then set IP and authentication, then choose log types, then apply filters, then test connectivity. The correct sequence to configure a FortiGate to send logs to FortiAnalyzer is: first add the FortiAnalyzer as a log device, then configure its IP address and shared key for authentication, then choose which log types (e.g., traffic, event, etc.) to forward, optionally apply filters to refine the logs, and finally test the connectivity to verify the configuration. This order ensures that each step builds upon the previous one, avoiding errors such as trying to configure a device that hasn't been added yet or testing before all settings are in place.

Answer

Set IP and authentication, then choose log types, then add log device, then apply filters, then test connectivity

Answer

Choose log types, then add log device, then set IP and authentication, then test connectivity, then apply filters

Answer

Apply filters, then add log device, then set IP and authentication, then choose log types, then test connectivity

Question 7

An admin is troubleshooting an IPsec VPN tunnel that is failing phase 2. The IKE debug shows 'no matching proposal'. Which TWO settings should the admin verify on both sides? (Choose two.)

Accepted Answer

Encryption algorithm (e.g., AES128, AES256). In IPsec phase 2, the IKE debug message 'no matching proposal' indicates a mismatch in the security association (SA) parameters used to establish the IPsec SA. The encryption algorithm (option B) is a core component of the IPsec proposal that must match exactly on both peers. Perfect Forward Secrecy (PFS) using a Diffie-Hellman group (option C) is also negotiated during phase 2; if one side requires PFS and the other does not, or if the DH groups differ, phase 2 will fail with this error.

Answer

Dead Peer Detection interval

Answer

Pre-shared key

Answer

Local and remote gateway IP addresses

Question 8

An administrator needs to check the health of an SD-WAN link by viewing the last SLA probe results. Which command should be used?

Accepted Answer

diagnose sys virtual-wan-link health-check. The command `diagnose sys virtual-wan-link health-check` displays the last SLA probe results for SD-WAN links, including metrics like latency, jitter, and packet loss. This command is specifically designed for FortiGate SD-WAN (formerly virtual-wan-link) to verify real-time health-check status, which is essential for troubleshooting link performance.

Answer

diagnose sys sdwan sla-log

Answer

get system interface physical

Answer

diagnose debug application sdwan -1

Question 9

A company has deployed two FortiGate-600Es in an active-passive HA cluster. The cluster is configured with three VDOMs: VDOM-A (corporate LAN), VDOM-B (guest Wi-Fi), and VDOM-C (DMZ). Each VDOM has its own set of interfaces and policies. The cluster is also configured to use FGCP with session pickup enabled. Recently, the network team noticed that after a failover event, some user sessions in VDOM-B are not being picked up, causing disruption for guest users. The session pickup feature is enabled globally. The administrator checks the configuration and finds the following settings on the primary FortiGate:

- config system ha
  set session-pickup enable
  set session-pickup-connectionless enable
  end

- config vdom
  edit VDOM-A
    config system ha
      set session-pickup enable
    end
  next
  edit VDOM-B
    config system ha
      set session-pickup disable
    end
  next
  edit VDOM-C
    config system ha
      set session-pickup enable
    end
  next

Based on this configuration, what is the most likely reason that sessions in VDOM-B are not being picked up?

Accepted Answer

Session pickup is disabled specifically for VDOM-B in the per-VDOM HA configuration.. The per-VDOM HA configuration for VDOM-B explicitly disables session pickup with 'set session-pickup disable'. Even though the global HA settings enable session pickup, the per-VDOM setting overrides the global setting for that VDOM. As a result, after a failover, sessions in VDOM-B are not synchronized to the standby FortiGate and are not picked up, causing disruption for guest users.

Answer

The HA priority of the cluster is set too low, causing session pickup to fail for VDOM-B.

Answer

Session pickup for connectionless protocols is not enabled, so UDP sessions in VDOM-B are not picked up.

Answer

The interfaces assigned to VDOM-B do not have session pickup enabled.

Question 10

An administrator wants to enforce that only managed FortiClient endpoints with up-to-date antivirus and a specific OS version can access a sensitive internal network via IPsec VPN. Which feature should be used to achieve this?

Accepted Answer

FortiClient EMS compliance enforcement. FortiClient EMS can enforce compliance rules such as requiring up-to-date antivirus and specific OS version. When a FortiClient connects to the FortiGate VPN, the FortiGate can check the endpoint's posture via FortiClient EMS and apply a matching firewall policy.

Answer

ZTNA tags

Answer

FortiNAC

Answer

SAML SSO

Question 11

A security analyst wants to use automation stitches on FortiGate to automatically block IP addresses that trigger an IPS signature for 'SSH Brute Force'. Which two components are required to create this automation stitch? (Choose two.)

Accepted Answer

Action: 'Add to Block List'. The 'Add to Block List' action is the specific automation stitch action that dynamically adds the offending IP address to the FortiGate's local block list, effectively blocking further SSH brute-force attempts. This action directly enforces the security policy by preventing the source IP from accessing the firewall until the block expires or is manually removed.

Answer

FortiAnalyzer log query

Answer

Action: 'Email Notification'

Answer

FortiGuard category

Question 12

A network security team is evaluating options for web application security. They need to protect a critical web application from SQL injection and cross-site scripting (XSS) attacks, and they require granular control over HTTP request parameters. Which THREE factors should influence their decision between using FortiGate's WAF profiles versus deploying a dedicated FortiWeb appliance?

Accepted Answer

FortiWeb can perform SSL offloading and load balancing, reducing load on the web servers. FortiWeb is a dedicated web application firewall appliance with specialized hardware and software optimized for WAF processing, offering higher throughput and lower latency compared to the integrated WAF profiles on a FortiGate. Additionally, FortiWeb can perform SSL offloading and load balancing, which reduces the processing burden on web servers and improves overall performance. These capabilities make FortiWeb the superior choice when granular control and high-performance protection against SQL injection and XSS are required.

Answer

FortiGate's WAF supports integration with FortiSandbox for file upload inspection

Answer

FortiGate's WAF profiles offer the same level of customization as FortiWeb for signature creation

Question 13

A FortiGate administrator runs the following CLI command:
'diagnose ips anomaly log'
The output shows numerous 'tcp_syn_flood' events from a single source IP. To mitigate this, the administrator wants to block the source IP automatically. Which feature should be used?

Accepted Answer

Automation Stitch. The 'diagnose ips anomaly log' command displays anomalies detected by the FortiGate's DoS (Denial of Service) sensor, such as TCP SYN flood events. An Automation Stitch (Option D) is the correct feature to automatically block the source IP because it can trigger a 'Block IP' action based on a 'IPS Anomaly' event, creating an automated response without manual intervention.

Answer

IPS Custom Signature

Answer

Local-in Policy

Answer

IP Block List

Question 14

An admin wants to create a custom IPS signature to detect a specific exploit that sends a string 'EXPLOIT' in the HTTP Host header. Which signature syntax is correct?

Accepted Answer

F-SBID( --name "HTTP_EXPLOIT" --protocol http --header Host --content "EXPLOIT" ). The FortiGate custom IPS signature syntax requires the `--protocol http` flag to specify the application-layer protocol for HTTP inspection, and `--header Host` to target the HTTP Host header field. The `--content` parameter then defines the string 'EXPLOIT' to match within that header, enabling precise detection of the exploit.

Answer

F-SBID( --name "HTTP_EXPLOIT" --protocol http --header Host --content "EXPLOIT" )

Answer

F-SBID( --name "HTTP_EXPLOIT" --service HTTP --header Host --content "EXPLOIT" )

Answer

F-SBID( --name "HTTP_EXPLOIT" --protocol tcp --header Host --content "EXPLOIT" )

Question 15

An administrator is deploying FortiClient with ATP features. They want to ensure that if a process is detected as malicious by the FortiClient machine learning engine, the endpoint is isolated from the network. Which configuration should they use?

Accepted Answer

Configure an automation stitch with trigger 'FortiClient event' and action 'quarantine endpoint'. An automation stitch with the trigger 'FortiClient event' and action 'quarantine endpoint' allows FortiGate to automatically isolate an endpoint when the FortiClient machine learning engine detects a malicious process. This integration leverages FortiGate's Security Fabric to enforce network isolation based on endpoint telemetry, ensuring the compromised host is blocked from communicating with the rest of the network.

Answer

Create a firewall policy to block traffic from that endpoint

Answer

Enable 'auto-network-access' in the FortiClient profile

Answer

Enable 'FortiClient quarantine' in the antivirus profile