NSE7 Practice Test 40 — 15 Questions

Question 1

An administrator wants to configure a multi-peer IPsec VPN where one FortiGate (hub) connects to multiple remote FortiGates (spokes) using a single phase 1 interface with dynamic IP addresses. Which configuration is required on the hub?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set type to dynamic and set remote-gw 0.0.0.0. For a hub-and-spoke IPsec VPN where spokes have dynamic IP addresses, the hub's phase 1 must be configured with `set type dynamic` and `set remote-gw 0.0.0.0` so it can accept connections from any peer IP. This allows a single phase 1 interface to serve multiple spokes with dynamic addresses, which is the standard FortiGate dial-up VPN configuration.

Answer

Set psksecret to a group password and enable XAuth

Answer

Set mode to aggressive and use pre-shared keys

Answer

Set type to static and configure each peer's IP in separate phase1

Question 2

Based on the exhibit, what can be concluded about the session?

Accepted Answer

The session is offloaded to the NPU for hardware acceleration.. The session state 'npu' indicates that the session has been offloaded to the Network Processor Unit (NPU) for hardware acceleration. This is a normal and expected state for traffic that matches hardware-offloadable profiles, allowing the NPU to process packets at wire speed without CPU intervention.

Answer

The session is a one-way session with only outbound traffic.

Answer

The session is not being logged.

Answer

The session is in the 'npu' state, meaning it is being processed by the CPU.

Question 3

An administrator configures ZTNA with FortiClient EMS. The goal is to restrict access to an internal application based on device posture. The administrator configures a ZTNA tag for 'Compliant' that checks antivirus and OS patch status. Which TWO additional steps are required on the FortiGate to enforce access based on this tag?

Accepted Answer

Create a ZTNA policy that includes the 'Compliant' tag as a required condition. Option B is correct because the FortiGate enforces ZTNA tag-based posture by referencing the 'Compliant' tag as a matching condition inside a ZTNA policy (ztna-policy), which is what actually allows or denies the user's traffic based on device posture. Option C is correct because ZTNA on FortiGate requires a ZTNA access proxy (ztna access-proxy) that defines the protected internal application, its real server, and the listening/portal parameters; without it there is no ZTNA object for the policy to protect. Option A is not required because SSL deep inspection is a UTM/content-inspection feature and is not needed to match ZTNA tags. Option D is not required because the FortiClient EMS certificate is used for EMS fabric authorization/connector trust, not for enforcing a ZTNA tag in the access policy. Option E is not required because a plain firewall policy with the EMS connector as source does not enforce ZTNA tag posture; tag enforcement is done through the ZTNA policy and access proxy.

Answer

Enable SSL deep inspection on the firewall policy

Answer

Import the FortiClient EMS certificate to FortiGate

Answer

Configure a firewall policy with source set to the EMS connector

Question 4

An administrator is configuring FortiClient EMS to enforce compliance for ZTNA. Which TWO settings are required on FortiGate to use compliance-based ZTNA tags?

Accepted Answer

FortiClient EMS is added as a security fabric connector. Option A is correct because FortiGate must add FortiClient EMS as a Security Fabric connector (via Fabric Connectors > Endpoint/EMS) so it can receive the compliance-based ZTNA tags that EMS dynamically assigns to endpoints. Option B is correct because the ZTNA proxy policy must reference those tags as a matching condition (e.g., source 'ZTNA Tags' with the required compliance tag) for the tags to actually enforce access; without the tag condition, compliance data is never evaluated. Option C is not required: SSL deep inspection is a traffic-inspection feature and is unrelated to receiving or matching ZTNA compliance tags. Option D is not required: ZTNA tag-based enforcement relies on EMS-assigned tags, not on a local user database for authentication. Option E is not required: FortiGate acting as a SAML IdP is an authentication scenario and is not needed to consume EMS compliance tags for ZTNA.

Answer

SSL deep inspection is enabled on the firewall policy

Answer

A local user database is configured for authentication

Answer

FortiGate is configured as a SAML IdP

Question 5

Which THREE conditions must be met for an IPsec VPN to successfully establish phase2?

Accepted Answer

Proxy IDs (local and remote subnets) match on both sides. For IPsec phase2 (Quick Mode) to establish, the proxy IDs (local and remote subnet selectors) must match on both peers, because mismatched selectors cause the responder to reject the Quick Mode proposal — so option A is correct. Option C is correct because if PFS is enabled, both peers must use the same Diffie-Hellman group (e.g., group 2, 5, or 14) during phase2; a mismatch in PFS settings or DH group will fail the key exchange. Option D is correct because phase2 proposals (encryption algorithm, hash, and SA lifetime) must match between peers for the IPsec SA to be negotiated successfully. Option B is not a phase2 negotiation requirement — firewall policies permitting subnet traffic are needed for actual data flow, not for the IKE/IPsec SA establishment itself. Option E is also not required for phase2; NAT-T is only needed when NAT devices exist between peers and is negotiated in phase1, not a mandatory condition for phase2.

Answer

Firewall policies allow traffic between the subnets

Answer

NAT traversal is enabled on both sides

Question 6

An administrator is configuring FortiAnalyzer to receive logs from FortiGates in a multi-VDOM environment. The admin wants to ensure that logs from each VDOM are separated into their own datasets. What must be configured?

Accepted Answer

Enable per-VDOM logging on the FortiGate and use ADOMs on FortiAnalyzer. Per-VDOM logging on the FortiGate must be enabled to tag logs with the VDOM identifier, and ADOMs on FortiAnalyzer must be configured to segregate those logs into separate datasets. Without both, logs from different VDOMs would be mixed in a single dataset, defeating the purpose of isolation.

Answer

Use the same log settings for all VDOMs

Answer

Configure a separate log disk partition for each VDOM

Answer

Configure each VDOM to send logs to a different FortiAnalyzer

Question 7

An administrator is configuring SSL VPN on FortiGate and wants to allow users to access internal applications via a web portal without installing any client software. Which SSL VPN mode should be used?

Accepted Answer

Web mode. Web mode (option C) is correct because it enables users to access internal web applications through a FortiGate SSL VPN web portal using only a standard browser, with no client software installation required. The portal acts as a reverse proxy, translating HTTPS requests from the client to the internal application servers, making it ideal for clientless remote access.

Answer

DTLS

Answer

Tunnel mode

Answer

Split tunneling

Question 8

A security administrator wants to generate a weekly report in FortiAnalyzer that shows the top threats detected by the FortiGate. Which feature should the administrator use to create this report?

Accepted Answer

Reports. The Reports feature in FortiAnalyzer is specifically designed to generate scheduled, customizable reports that aggregate security event data from FortiGate devices. By creating a report template with threat-based charts and tables, the administrator can schedule a weekly output showing top threats, leveraging the ADOM and SQL-based report engine for granular data selection.

Answer

Incidents

Answer

Playbooks

Answer

FortiView

Question 9

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route (192.168.100.0/24) into OSPF area 0. The route is configured as a static route on the FortiGate. Which configuration step is essential to ensure the static route is redistributed into OSPF?

Accepted Answer

Enable 'redistribute static' under the OSPF router configuration. The 'redistribute static' command under OSPF router configuration is the essential step to inject static routes into the OSPF domain. Without this explicit redistribution command, OSPF will not advertise any static routes, regardless of other filtering or metric settings. This is a fundamental requirement for route redistribution in OSPF.

Answer

Create a prefix list to allow the static route and apply it to the OSPF area

Answer

Set the administrative distance of the static route to 110

Answer

Configure a route map to match the static route and set OSPF type

Question 10

A company uses FortiManager to manage multiple FortiGate firewalls. After making changes to a policy package, the administrator runs an install preview and sees a warning: 'Policy ID 10 will be deleted on device XYZ'. What is the most likely reason for this warning?

Accepted Answer

Policy ID 10 was manually added on the device but is not present in the policy package. The warning 'Policy ID 10 will be deleted on device XYZ' indicates that the policy package on FortiManager does not contain Policy ID 10, but the device currently has it. During an install, FortiManager synchronizes the device's policy set with the policy package, so any policy present on the device but absent from the package is flagged for deletion. This is a standard consistency check to prevent unintended policy loss.

Answer

The policy package has been corrupted and needs to be re-imported

Answer

The device is in a different ADOM and cannot use the same policy ID

Answer

A revision history conflict exists that prevents the install

Question 11

A FortiGate administrator configures inter-VDOM routing. Traffic from VDOM-A to VDOM-B is blocked. The administrator checks the policy in VDOM-A allowing traffic to the VDOM link interface. What else must be verified?

Accepted Answer

That there is a corresponding policy in VDOM-B allowing traffic from the VDOM link to the destination. In inter-VDOM routing, traffic traverses a VDOM link, which consists of two interfaces—one in each VDOM. A policy in VDOM-A permits traffic to the VDOM link interface, but the packet must also be allowed by a policy in VDOM-B from the VDOM link interface to the destination. Without this second policy, VDOM-B will drop the traffic, even if VDOM-A's policy is correct.

Answer

That the VDOM link uses a different interface type

Answer

That the VDOM link interface is in the same subnet

Answer

That inter-VDOM routing is enabled in system settings

Question 12

In a multi-VDOM deployment, what is the purpose of inter-VDOM routing?

Accepted Answer

To allow traffic to pass between different VDOMs via firewall policies. Inter-VDOM routing allows traffic to be forwarded between different VDOMs on the same FortiGate unit. This is achieved by configuring inter-VDOM links (IVL) or using VDOM peering, and then applying firewall policies to control and secure the traffic flow between VDOMs. Option C correctly identifies that firewall policies are the mechanism used to permit or deny inter-VDOM traffic.

Answer

To route traffic between the management VDOM and data VDOMs

Answer

To provide redundancy for VDOMs in an HA setup

Answer

To connect VDOMs to external routers

Question 13

A network administrator is configuring SD-WAN rules with load balancing. They want to distribute HTTP traffic evenly across two WAN links based on the number of sessions. Which TWO settings should they use? (Choose two.)

Accepted Answer

Ensure the SD-WAN rule matches HTTP traffic (e.g., using protocol or port criteria).. Option A is correct because the SD-WAN rule must first identify the traffic to be balanced, so it needs to match HTTP traffic using protocol or port criteria (e.g., TCP port 80/443) before any load-balancing algorithm can be applied to it. Option E is correct because the scenario explicitly requires distributing traffic based on the number of sessions, and the 'session' load-balancing algorithm in FortiGate SD-WAN distributes sessions across the member links to achieve a per-session balance. Option B is incorrect because the 'volume' algorithm balances based on traffic volume (bytes) rather than session count, which does not meet the stated requirement. Option C is incorrect because a performance SLA monitors link health and quality (latency, jitter, packet loss) and is not the mechanism that distributes HTTP sessions evenly. Option D is incorrect because 'set update-static-route' controls whether the SD-WAN rule updates the static route for the selected interface and does not affect load-balancing behavior.

Answer

Set the load balancing algorithm to 'volume'.

Answer

Create a performance SLA to monitor the links.

Answer

Enable 'set update-static-route' on the SD-WAN rule.

Question 14

An administrator wants to ensure that all traffic from a specific LAN subnet (192.168.10.0/24) to the internet uses a particular WAN interface (wan1) in an SD-WAN setup, while other traffic uses wan2. What is the correct configuration to achieve this?

Accepted Answer

Configure an SD-WAN rule with source address matching 192.168.10.0/24 and set the preferred member to wan1. In Fortinet SD-WAN, traffic steering is achieved through SD-WAN rules, not policy routes. An SD-WAN rule with a source address matching 192.168.10.0/24 and a preferred member set to wan1 ensures that all traffic from that subnet is directed to wan1, while other traffic falls through to the default SD-WAN rule or other rules using wan2. This is the correct method because SD-WAN rules are evaluated before the routing table and provide granular control over member selection based on application, source, or destination.

Answer

Create a policy-based routing rule with source 192.168.10.0/24 and set outgoing interface to wan1

Answer

Set the default route for wan1 with a higher distance

Answer

Use a route map with prefix list to match the subnet and set next-hop to wan1

Question 15

An administrator configures FortiManager automation stitches to respond to high CPU usage on a FortiGate. The stitch should trigger a script to run diagnostics. Which THREE components are required in an automation stitch?

Accepted Answer

Trigger (e.g., event type). An automation stitch in FortiManager requires a trigger to define the event that initiates the stitch, such as a high CPU usage event. The trigger specifies the event type (e.g., 'CPU Usage High') that the FortiGate reports, which then activates the stitch. Without a trigger, the automation stitch has no starting point to respond to the condition.

Answer

Condition (e.g., severity threshold)

Answer

Result (e.g., email notification)