NSE7 Practice Test 39 — 15 Questions

Question 1

An organization wants to deploy a web application firewall (WAF) to protect a public-facing web application. They are evaluating FortiGate versus FortiWeb. Which of the following is a key advantage of using FortiWeb over FortiGate for WAF functionality?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FortiWeb offers advanced bot detection and positive security model. FortiWeb is a dedicated web application firewall that provides advanced bot detection and a positive security model, which allows only explicitly allowed traffic based on a whitelist of known good patterns. This is a key advantage over FortiGate, which primarily uses a negative security model (signature-based) and lacks the same depth of bot mitigation and positive enforcement for web-specific threats.

Answer

FortiGate can perform SSL deep inspection without performance impact

Answer

FortiGate supports a larger number of web servers behind a single policy

Answer

FortiGate can automatically patch web application vulnerabilities

Question 2

An administrator configures an automation stitch on FortiGate to automatically block an IP address when a specific IPS signature triggers. What must be configured as the trigger and action?

Accepted Answer

Trigger: 'Event Log' with filter for the IPS signature; Action: 'Add IP to Blocklist'. An automation stitch in FortiGate requires a trigger that defines the event that starts the automation, and an action that defines what happens when the trigger fires. For automatically blocking an IP when a specific IPS signature triggers, the trigger must be 'Event Log' with a filter for that IPS signature, and the action must be 'Add IP to Blocklist', which directly adds the source IP to the FortiGate's blocklist (banned IP list). This combination ensures that when the IPS signature is logged, the stitch extracts the source IP and applies a block.

Answer

Trigger: 'Incoming Webhook'; Action: 'CLI Script'

Answer

Trigger: 'FortiOS CLI'; Action: 'Alert Email'

Answer

Trigger: 'Schedule'; Action: 'Banned IP'

Question 3

An administrator wants to add custom fields to device objects in FortiManager to track location and contact info. Which feature should be used?

Accepted Answer

Meta fields. Meta fields in FortiManager allow administrators to define custom attributes (e.g., location, contact info) that can be attached to device objects. These fields are stored in the FortiManager database and can be used for filtering, reporting, and policy mapping, providing a flexible way to enrich device metadata without modifying the device configuration itself.

Answer

System templates

Answer

Custom reports

Answer

Dynamic mapping

Question 4

What is the primary purpose of Content Disarm and Reconstruction (CDR) in FortiGate's antivirus features?

Accepted Answer

To remove potentially malicious content from documents and rebuild them as safe files. Content Disarm and Reconstruction (CDR) is designed to remove active or potentially malicious content—such as macros, scripts, embedded objects, and OLE links—from documents (e.g., Office files, PDFs) and then reconstruct them as sanitized, safe versions. This approach prevents threats like macro-based malware or exploit-laden attachments from reaching users, even if the file contains previously unknown (zero-day) payloads, by stripping the dangerous components rather than relying solely on signature-based detection.

Answer

To convert files into PDF format for safer viewing

Answer

To detect zero-day malware using sandboxing

Answer

To block all files containing macros

Question 5

An administrator needs to deploy a honeypot solution to detect and deceive attackers inside the network. Which Fortinet product is BEST suited for this purpose?

Accepted Answer

FortiDeceptor. FortiDeceptor is a dedicated deception-based security solution that deploys decoys (honeypots) and lures across the network to detect and misdirect attackers. It integrates with FortiGate and FortiSIEM to provide automated threat isolation and forensic data collection, making it the best choice for a honeypot deployment.

Answer

FortiSandbox

Answer

FortiEDR

Answer

FortiNAC

Question 6

An administrator wants to create an automation stitch that sends a webhook notification when an IPS attack is detected. Which trigger and action should be used?

Accepted Answer

Trigger: 'IPS Event'; Action: 'Webhook'. An automation stitch requires a trigger that matches the event type and an action that performs the desired response. 'IPS Event' is the correct trigger for detecting an IPS attack, and 'Webhook' is the action that sends an HTTP POST request to a configured endpoint, which is the standard method for webhook notifications in FortiOS.

Answer

Trigger: 'FortiGuard'; Action: 'Quarantine'

Answer

Trigger: 'System Event'; Action: 'Email'

Answer

Trigger: 'Incoming Webhook'; Action: 'IPS Event'

Question 7

What is the primary function of FortiDeceptor in a network security architecture?

Accepted Answer

To lure attackers into interacting with decoys and generate alerts. FortiDeceptor is a deception-based threat detection solution that deploys decoys (fake assets) across the network to lure attackers. When an attacker interacts with a decoy, FortiDeceptor generates a high-fidelity alert, enabling early detection of lateral movement or reconnaissance without relying on signatures.

Answer

To provide network access control for endpoints

Answer

To aggregate logs from multiple security devices

Answer

To detect and block malware at the endpoint

Question 8

A security administrator wants to block email spoofing attacks against their organization's domain. They configure SPF, DKIM, and DMARC records. Which protocol authenticates the domain of the email sender by verifying the email's signature against a public key published in DNS?

Accepted Answer

DKIM. DKIM (DomainKeys Identified Mail) is the correct answer because it provides email authentication by allowing the sender to cryptographically sign an email with a private key. The receiving mail server then retrieves the sender's public key from a DNS TXT record and verifies the signature, confirming that the email was not tampered with and originates from a domain the sender is authorized to use.

Answer

SPF

Answer

ARC

Answer

DMARC

Question 9

An administrator is troubleshooting an OSPF over IPsec VPN overlay. The OSPF neighbor state is stuck in EXSTART. The VPN tunnel is up. Which TWO issues could cause this?

Accepted Answer

IP fragmentation issue due to GRE/IPsec overhead. Options A and E are correct because EXSTART is the stage where OSPF routers exchange DBD packets to elect Master/Slave, and these packets are large enough to exceed the reduced MTU caused by GRE/IPsec overhead. An IP fragmentation issue due to GRE/IPsec overhead (A) prevents the large DBD packets from being delivered or reassembled, so the routers keep retransmitting DBDs and never advance past EXSTART. An MTU mismatch on the tunnel interface (E) similarly causes large DBD packets to be dropped (or black-holed when DF is set), producing the same stuck-in-EXSTART symptom. Options B, C, and D are incorrect because a hello/dead interval mismatch (B) or an area ID mismatch (C) prevents the routers from forming a neighbor relationship at all, leaving them in DOWN or INIT, not EXSTART, and an IPsec phase2 proposal mismatch (D) would prevent the VPN tunnel from coming up, whereas the scenario states the tunnel is already up.

Answer

OSPF hello/dead interval mismatch

Answer

OSPF area ID mismatch

Answer

IPsec phase2 proposal mismatch

Question 10

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is established but traffic is not passing. The administrator runs 'diagnose vpn ike log' and sees 'no matching policy for this IPsec SA'. What is the most likely cause?

Accepted Answer

There is no firewall policy allowing traffic from the local network to the remote network via the VPN tunnel interface. The log message 'no matching policy for this IPsec SA' on a FortiGate means the IKE/IPsec SA was negotiated successfully but no firewall policy matches the traffic that needs to traverse the tunnel. In FortiOS, a firewall policy with the tunnel interface as the outgoing interface (and matching source/destination) is required for traffic to be encrypted and forwarded. Without it, the tunnel stays up but no data flows.

Answer

The phase2 selectors do not match between peers

Answer

The pre-shared key is mismatched

Answer

The tunnel interface is administratively down

Question 11

An administrator wants to see the current number of active sessions on a FortiGate. Which command should the admin use?

Accepted Answer

diagnose sys session stat. The command 'diagnose sys session stat' displays a summary of session statistics, including the total number of active sessions currently tracked by the FortiGate's session table. This is the correct way to quickly see the current active session count without listing every individual session, which would be overwhelming and resource-intensive.

Answer

diagnose sys session list

Answer

get system performance status

Answer

get system ha status

Question 12

An administrator configures an ALG for SIP traffic but notices that some SIP calls are failing. The admin suspects the ALG is modifying SIP headers incorrectly. Which debug command can help verify the ALG's actions on SIP packets?

Accepted Answer

diagnose debug application sip -1. The command 'diagnose debug application sip -1' enables detailed debugging of the SIP ALG process on FortiGate, showing how the ALG inspects and modifies SIP headers (e.g., Via, Contact, SDP). This allows the admin to verify if the ALG is incorrectly rewriting IP addresses or ports, which is a common cause of call failures. The '-1' flag sets the debug level to maximum verbosity, capturing all ALG-related SIP transactions.

Answer

diagnose debug application alg -1

Answer

get system performance status

Answer

diagnose sys session filter proto 17

Question 13

An admin configures Content Disarm and Reconstruction (CDR) on FortiGate to protect against malicious macros in Office documents. After applying the CDR profile to a firewall policy, users complain that documents are not being delivered. What is the most likely cause?

Accepted Answer

The firewall policy is configured for flow-based inspection. CDR requires proxy-based inspection to intercept, disarm, and reconstruct documents. Flow-based inspection bypasses the deep inspection engine, so CDR cannot process the files, causing delivery failures. FortiGate must use proxy-based inspection mode for CDR to function correctly.

Answer

The CDR profile has 'File Filter' enabled that blocks the file type

Answer

The FortiGate is running in transparent mode

Answer

The antivirus profile is not applied to the same policy

Question 14

An administrator configures two FortiGate units in an active-passive HA cluster. During a failover test, the administrator notices that the secondary unit becomes primary but the session table is empty, causing all existing connections to drop. Which configuration change should be made to preserve session information during failover?

Accepted Answer

Enable session pickup and configure HA session synchronization. Session pickup and HA session synchronization are specifically designed to replicate the session table from the primary FortiGate to the secondary unit in an active-passive cluster. Without this feature, the secondary unit becomes primary but has no knowledge of existing sessions, causing all active connections to drop. Enabling session synchronization ensures that session state information is continuously mirrored to the standby unit, allowing seamless failover without disrupting established flows.

Answer

Enable FGCP configuration synchronization

Answer

Configure dead gateway detection on the FortiGate units

Answer

Enable link-failover on the monitored interfaces

Question 15

A network administrator is troubleshooting an IPsec VPN tunnel that is not coming up. The configuration uses IKEv2 with pre-shared keys. The administrator runs 'diagnose vpn ike log-filter' and sees no logs. What is the most likely cause?

Accepted Answer

IKE debug is not enabled. The diagnose vpn ike log-filter command sets a filter for which IKE negotiations to log, but it does not itself enable logging — the administrator must also run diagnose debug application ike -1 (or the equivalent debug enable command) to actually turn on IKE debug output. Seeing no logs after setting a filter is the classic symptom of debug not being enabled. The filter only narrows what would be logged if logging were active.

Answer

The pre-shared key does not match

Answer

The tunnel name is misspelled in the filter

Answer

The remote gateway is unreachable