NSE7 Practice Test 40 — 15 Questions

Question 1

What is the primary purpose of Content Disarm and Reconstruction (CDR) in FortiGate's antivirus features?

Accepted Answer

To remove potentially malicious content from documents and rebuild them as safe files. Content Disarm and Reconstruction (CDR) is designed to remove active or potentially malicious content—such as macros, scripts, embedded objects, and OLE links—from documents (e.g., Office files, PDFs) and then reconstruct them as sanitized, safe versions. This approach prevents threats like macro-based malware or exploit-laden attachments from reaching users, even if the file contains previously unknown (zero-day) payloads, by stripping the dangerous components rather than relying solely on signature-based detection.

Answer

To convert files into PDF format for safer viewing

Answer

To detect zero-day malware using sandboxing

Answer

To block all files containing macros

Question 2

A FortiGate admin runs 'diagnose ips anomaly list' and sees many 'tcp_src_session' events from a single internal IP. The admin suspects a scanning attack. What action should be taken to block this traffic without affecting legitimate traffic?

Accepted Answer

Create a custom IPS signature to detect and block the scanning pattern. Creating a custom IPS signature allows you to define specific patterns (e.g., multiple TCP SYN packets to different ports from the same source) that match scanning behavior, and then set the action to 'block'. This granular approach blocks only the malicious scanning traffic while permitting legitimate traffic from the same IP, unlike a blanket IP block or a global anomaly action that could impact normal sessions.

Answer

Create a firewall rule to block the IP address entirely

Answer

Enable 'tcp_src_session' anomaly action to 'block' in the IPS sensor

Answer

Use a WAF profile to block the IP based on rate

Question 3

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

A TCP session on port 443 has been active for 1 hour and will expire in 3599 seconds. The output shows a TCP session (proto=6) on port 443 with a duration of 3600 seconds (1 hour) and an expire value of 3599 seconds, meaning the session has been active for 1 hour and will expire in 3599 seconds. The 'proto=6' indicates TCP, and 'proto_state=01' is the TCP established state, confirming an active TCP session.

Answer

The session has expired and is being removed

Answer

A UDP session on port 443 is being blocked

Answer

The firewall policy is incorrectly configured

Question 4

A FortiGate administrator uses FortiManager automation stitches to respond to a security incident. Which THREE components must be defined in an automation stitch? (Choose THREE.)

Accepted Answer

Trigger condition (e.g., an event or log). An automation stitch in FortiManager requires a trigger condition to define when the stitch should be activated. The trigger can be based on specific events, such as a log matching a predefined pattern or a FortiGate incident, which initiates the automated response workflow.

Answer

A report template

Answer

A schedule for the stitch to run

Question 5

An administrator wants to ensure that voice traffic (UDP 16384-32768) always uses the MPLS link, while internet-bound traffic uses broadband. Which SD-WAN feature should be configured to achieve this?

Accepted Answer

SD-WAN rule. SD-WAN rules (option D) allow administrators to define policy-based forwarding by matching specific traffic characteristics—such as UDP ports 16384-32768 for voice—and steering that traffic to a preferred interface or link (e.g., the MPLS link). This is the correct feature because it directly controls traffic steering based on application or service, overriding any default load-balancing or failover behavior.

Answer

Performance SLA

Answer

SD-WAN member configuration

Answer

Load balancing algorithm

Question 6

A FortiGate administrator configures a hub-and-spoke ADVPN with OSPF over the VPN overlay. Spoke routers receive the OSPF default route from the hub, but cannot reach subnets behind other spokes. What configuration is missing?

Accepted Answer

OSPF is not configured to redistribute connected or static routes on the spokes. In a hub-and-spoke ADVPN with OSPF, spoke routers receive the default route from the hub but cannot reach subnets behind other spokes because OSPF does not automatically advertise the spoke’s local networks into the VPN overlay. The missing configuration is redistribution of connected or static routes into OSPF on the spokes, which is required for the hub to learn those subnets and propagate them to other spokes via the OSPF database.

Answer

IKEv2 is configured instead of IKEv1

Answer

The spokes have 'set auto-discovery-receiver enable' configured

Answer

The hub has 'set auto-discovery-sender enable' configured

Question 7

An administrator wants to use FortiManager to deploy a common set of firewall rules to all VDOMs on a single FortiGate. The rules will be the same except for the source and destination addresses, which differ per VDOM. What FortiManager feature allows the administrator to reuse a policy package and customize per-VDOM objects?

Accepted Answer

Meta fields. Meta fields in FortiManager allow you to define custom variables that can be assigned to managed devices or VDOMs. When a policy package is installed, these meta fields are substituted with the per-VDOM values, enabling the reuse of a single policy package with different source and destination addresses for each VDOM. This avoids the need to create separate policy packages for each VDOM.

Answer

Policy package header/footer

Answer

Automation stitches

Answer

Global ADOM

Question 8

A FortiGate admin configures automation stitches in FortiManager to trigger a script when a specific incident occurs. The script runs but does not produce the expected result. Which FortiAnalyzer feature should the admin use to verify the automation stitch executed correctly?

Accepted Answer

Incident Management. Incident Management in FortiAnalyzer provides a detailed log of automation stitch execution, including trigger events, script actions, and any errors. This allows the admin to verify whether the stitch ran as expected and to diagnose why the script did not produce the intended result.

Answer

Reports

Answer

FortiView

Answer

Playbooks

Question 9

A multi-area OSPF network includes a FortiGate as an ABR. The administrator needs to redistribute a static route into OSPF. Which command is required on the FortiGate to achieve this?

Accepted Answer

config router ospf
config redistribute
edit 'static'
set status enable
end. To redistribute a static route into OSPF on a FortiGate, you must enter the OSPF configuration context, navigate to the 'redistribute' subcommand, select the 'static' route type, and set its status to 'enable'. This is the standard method for enabling route redistribution from one routing protocol (or static routes) into OSPF, as defined in the FortiGate CLI reference.

Answer

config router prefix-list
edit 'static'
set action permit
end

Answer

config router policy
set src 0.0.0.0/0
set dst 0.0.0.0/0
end

Answer

config router static
set redistribute ospf enable
end

Question 10

An enterprise FortiGate has multiple VDOMs. The administrator wants to allow traffic from VDOM A to reach servers in VDOM B without traversing an external router. Which configuration is required?

Accepted Answer

Create an inter-VDOM link using the 'config system interface' command with type 'vdom-link'. Inter-VDOM links are the native FortiGate mechanism for routing traffic between VDOMs without external hardware. Created via 'config system interface' with type 'vdom-link', they act as a direct Layer 3 connection between VDOMs, allowing traffic to flow internally through the FortiGate's backplane. This avoids the need for an external router or physical cabling.

Answer

Place both VDOMs in the same VDOM group

Answer

Configure a static route in each VDOM pointing to the other VDOM's management IP

Answer

Enable VDOM forwarding in global settings

Question 11

What is the primary function of FortiDeceptor in a network security architecture?

Accepted Answer

To lure attackers into interacting with decoys and generate alerts. FortiDeceptor is a deception-based threat detection solution that deploys decoys (fake assets) across the network to lure attackers. When an attacker interacts with a decoy, FortiDeceptor generates a high-fidelity alert, enabling early detection of lateral movement or reconnaissance without relying on signatures.

Answer

To provide network access control for endpoints

Answer

To aggregate logs from multiple security devices

Answer

To detect and block malware at the endpoint

Question 12

A FortiGate administrator runs 'diagnose sys session list' and sees a session for which the destination interface is 'sdwan'. The session is marked with 'state=01000048'. What does this state indicate about the session?

Accepted Answer

The session is being held until the SD-WAN load balancing decision is made. The session state value 0x01000048 corresponds to the flag 'SES_STATE_SD_WAN_HOLD' in FortiOS. This flag indicates that the session is temporarily held in a pending state while the SD-WAN load balancing decision is being made. The session will not be forwarded until the SD-WAN rule selects the appropriate member interface, preventing premature routing before the load balancing logic completes.

Answer

The session is bypassing SD-WAN load balancing and using policy-based routing

Answer

The session has completed load balancing and is being forwarded out the sdwan interface

Answer

The session has been dropped because the selected SD-WAN member is down

Question 13

Which FortiAnalyzer feature allows an administrator to create a sequence of automated response actions triggered by a specific log event?

Accepted Answer

Playbooks. Playbooks in FortiAnalyzer allow administrators to define a sequence of automated response actions that are triggered by specific log events. This feature enables event-driven automation, such as executing CLI scripts, sending alerts, or integrating with external systems via webhooks, directly from the FortiAnalyzer interface.

Answer

Reports

Answer

Incidents

Answer

FortiView

Question 14

Which FortiGate command is used to view the current CPU usage of individual processes in real time?

Accepted Answer

diagnose sys top. The 'diagnose sys top' command on FortiGate provides a real-time, top-like display of CPU and memory usage for individual processes, allowing administrators to identify which specific daemons or tasks are consuming resources. This command is essential for troubleshooting performance issues at the process level, unlike other commands that show aggregate or different diagnostic data.

Answer

diagnose sys session stat

Answer

get system performance status

Answer

diagnose hardware sysinfo memory

Question 15

A FortiGate is configured with two ISPs in an SD-WAN. The administrator wants to use the link with the highest bandwidth for bulk downloads, but if that link fails, all traffic should automatically use the backup link. Which load balancing algorithm should be used?

Accepted Answer

Spillover. The Spillover algorithm is designed to use a preferred link until its bandwidth capacity is reached, then 'spill over' traffic to a backup link. In this scenario, the administrator wants to use the highest-bandwidth link for bulk downloads and fail over to the backup link only when the primary link fails. Spillover matches this requirement because it can be configured with a bandwidth threshold; once the primary link's bandwidth is exhausted or the link fails, traffic automatically shifts to the backup link.

Answer

Sessions

Answer

Volume

Answer

Source-destination IP