NSE7 Practice Test 41 — 15 Questions

Question 1

A FortiGate administrator receives an error during IPsec VPN configuration: 'Certificate validation failed: certificate uses weak key.' The admin is using a PKI certificate with RSA 2048-bit key. The FortiGate firmware is up-to-date. What is the MOST likely reason for this error?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The FortiGate has a security policy that rejects certificates with keys less than 3072 bits.. In recent FortiOS versions, a security hardening setting may require minimum RSA key size of 3072 bits. RSA 2048 is considered weak by some compliance standards and may be blocked by the 'weak key' validation check. The admin can adjust the setting or use a stronger key.

Answer

The certificate has expired or is not yet valid.

Answer

The certificate's private key is not imported on the FortiGate.

Answer

The certificate authority is not trusted by the FortiGate.

Question 2

A network engineer is deploying FortiGate VDOMs and needs to limit the number of VDOMs per FortiGate to comply with licensing. Which command can be used to check the maximum VDOMs allowed?

Accepted Answer

get system status. The 'get system status' command displays the current FortiGate system status, including the maximum number of VDOMs allowed by the installed license. This is the correct command to verify the licensed VDOM limit before deploying additional VDOMs.

Answer

show system vdom

Answer

execute vdom limit

Answer

diagnose sys vdom list

Question 3

In a multi-VDOM deployment, an administrator needs to centralize logging for all VDOMs. Which FortiGate feature should be used to send logs to a central FortiAnalyzer?

Accepted Answer

Log configuration under each VDOM's settings. In a multi-VDOM FortiGate deployment, each VDOM operates as an independent virtual firewall with its own log settings. To centralize logging to a FortiAnalyzer, you must configure the log settings individually under each VDOM, specifying the FortiAnalyzer as the log destination. This ensures that logs from all VDOMs are forwarded to the central FortiAnalyzer, as global log settings do not apply across VDOMs.

Answer

FortiGate Cloud

Answer

Global log settings

Answer

Syslog server

Question 4

An administrator configures two VDOMs as shown in the exhibit. They create an inter-VDOM link between VDOM1 and VDOM2. They then add a firewall policy in VDOM1 allowing traffic from port1 to the inter-VDOM link, and a policy in VDOM2 allowing traffic from the inter-VDOM link to port2. However, traffic from 192.168.1.10 to 10.10.10.50 fails. What is the most likely cause?

Accepted Answer

Missing route in VDOM1 for the 10.10.10.0/24 network. Inter-VDOM link traffic requires routing in both VDOMs. Even with correct firewall policies, VDOM1 must have a route to the destination network (10.10.10.0/24) pointing to the inter-VDOM link interface. Without this route, VDOM1 drops the packet before it can be forwarded across the link, causing the failure.

Answer

Firewall policies are not correctly configured

Answer

The inter-VDOM link is not configured

Answer

The allowaccess setting on port2 does not include ping

Question 5

A FortiGate running FortiOS 7.4.1 has two VDOMs: CustomerA and CustomerB. The administrator wants CustomerA to access an HTTP server in CustomerB. Both VDOMs have appropriate policies. What additional configuration is required?

Accepted Answer

Configure a VDOM link between CustomerA and CustomerB. A VDOM link is required to enable Layer-2 or Layer-3 connectivity between two VDOMs on the same FortiGate. Without a VDOM link, the VDOMs are isolated from each other, even if policies exist. The VDOM link acts as a virtual interface pair that forwards traffic between CustomerA and CustomerB, allowing the HTTP server access.

Answer

Create a policy allowing traffic from CustomerA to CustomerB

Answer

Enable inter-VDOM routing under system settings

Answer

Assign both VDOMs to the same administrative domain in FortiManager

Question 6

An administrator is troubleshooting a BGP session that is not establishing between two FortiGates. The administrator has verified that the neighbor IP is reachable. Which TWO commands should be used to further diagnose the issue? (Choose two.)

Accepted Answer

get router info bgp neighbor . 'get router info bgp neighbor ' displays detailed BGP session state information, including the current state (e.g., Idle, Connect, Active, OpenSent, OpenConfirm, Established), hold timer, keepalive interval, and any error codes or notifications. This command directly reveals why the session is not establishing, such as a mismatch in BGP capabilities, AS numbers, or authentication.

Answer

diagnose debug flow filter daddr <IP>

Answer

get router info routing-table bgp

Answer

diagnose sys session filter dport 179

Question 7

A FortiGate administrator observes the following CLI output from 'diagnose vpn ike gateway list':
vd: root/0
name: VPN_TO_HUB
version: IKEv2
status: up
mode: main
DPD: on
...
Number of IPsec tunnels: 1
  name: phase2_tunnel
  status: up
  inbound: 0 bytes
  outbound: 0 bytes
The tunnel shows up but no traffic is passing. What is the MOST likely cause?

Accepted Answer

Firewall policies are not configured to permit traffic through the VPN tunnel. The output shows the IKE gateway is up but the IPsec tunnel has zero traffic. This often indicates a policy or routing misconfiguration. The most common cause is missing firewall policies to allow traffic through the tunnel.

Answer

Dead Peer Detection is disabled

Answer

The phase1 proposal is mismatched

Answer

The tunnel is in 'down' status

Question 8

A FortiGate is in a multi-area OSPF environment. The administrator needs to redistribute connected routes from area 1 into OSPF. Which THREE steps are required? (Choose three.)

Accepted Answer

Configure 'redistribute connected' under the OSPF configuration.. The 'redistribute connected' command under OSPF configuration is the fundamental step to inject connected routes into the OSPF domain. Without this command, OSPF will not advertise any connected routes that are not already part of an OSPF-enabled interface.

Answer

Configure the connected interfaces as OSPF passive interfaces.

Answer

Enable 'default-information originate' to advertise a default route.

Question 9

A company is deploying FortiGate with Advanced Threat Protection (ATP) and wants to block advanced malware that uses encrypted C2 communications. Which security profile should be configured to perform SSL inspection and detect malicious traffic?

Accepted Answer

Antivirus profile with SSL inspection. An Antivirus profile with SSL inspection enabled is required to decrypt encrypted C2 (command-and-control) traffic so that FortiGate can inspect the payload for malware signatures, heuristics, and behavioral patterns. Without SSL inspection, the ATP engine cannot see inside the encrypted tunnel, rendering the antivirus and other security profiles ineffective against encrypted C2 communications.

Answer

Data Leak Prevention profile

Answer

Web Filtering profile

Answer

Intrusion Prevention profile

Question 10

An organization has multiple ADOMs in FortiManager. The admin wants to share a set of firewall objects across all ADOMs. What is the best approach?

Accepted Answer

Use the Global ADOM to create global objects. The Global ADOM in FortiManager is specifically designed to create and manage global objects (such as address objects, services, and schedules) that can be shared across all regular ADOMs. When an object is created in the Global ADOM, it is automatically available in all ADOMs that are linked to it, eliminating the need for duplication. This is the only native, supported method for sharing objects across multiple ADOMs in FortiManager.

Answer

Create a meta field and assign objects

Answer

Manually recreate the objects in each ADOM

Answer

Enable object sharing in the system settings

Question 11

Which feature on FortiGate uses machine learning to detect never-before-seen malware based on file characteristics?

Accepted Answer

Machine Learning Engine. The Machine Learning Engine (option A) on FortiGate uses static file analysis and machine learning models to detect never-before-seen malware based on file characteristics such as entropy, structure, and opcode sequences, without requiring signatures or behavioral execution. This allows it to identify zero-day threats pre-execution, directly matching the question's description.

Answer

Outbreak Prevention

Answer

FortiSandbox

Answer

Content Disarm and Reconstruction

Question 12

An enterprise FortiGate has multiple VDOMs. The security policy requires that all traffic between VDOMs must be inspected by a next-generation firewall profile. Which three steps are necessary to achieve this? (Choose three.)

Accepted Answer

Ensure routing is properly configured to forward traffic through the inter-VDOM link. For traffic to traverse between VDOMs via an inter-VDOM link, proper routing must be configured in each VDOM to forward traffic through the inter-VDOM link interface. Without correct routing entries (static or dynamic), packets will not be directed to the inter-VDOM link, and the next-generation firewall profile cannot be applied.

Answer

Place both VDOMs in the same ADOM in FortiManager

Answer

Enable VDOM inspection mode in global settings

Question 13

Drag and drop the steps to perform a firmware upgrade on a FortiGate device into the correct order.

Accepted Answer

Backup configuration, then Upload firmware image, then Confirm upgrade, then Verify upgrade. The correct sequence for a FortiGate firmware upgrade is to first back up the configuration, then upload the new firmware image, confirm the upgrade to start the process, and finally verify the upgrade after the device reboots. This ensures configuration safety and successful upgrade completion.

Answer

Upload firmware image, then Backup configuration, then Confirm upgrade, then Verify upgrade

Answer

Backup configuration, then Confirm upgrade, then Upload firmware image, then Verify upgrade

Answer

Backup configuration, then Upload firmware image, then Verify upgrade, then Confirm upgrade

Question 14

A FortiGate has two equal-cost paths to a destination network through two different ISPs. The administrator wants to load balance traffic across both links using ECMP, but notices that all traffic uses only one link. What should the administrator check first?

Accepted Answer

Check that both routes have the same administrative distance and priority. ECMP requires that all candidate routes have identical administrative distance and priority values. If either differs, FortiGate will select only the route with the lower distance/priority, breaking load balancing. The administrator should verify these parameters first because they directly control route selection before ECMP is applied.

Answer

Configure 'set v4-ecmp-mode' to 'source-ip-based'

Answer

Verify that 'set load-balance-eligible' is enabled on both WAN interfaces

Answer

Disable 'anti-replay' on the security policy

Question 15

An administrator is configuring SD-WAN with multiple members. When a rule matches, traffic is not being load-balanced as expected. Which command should the admin use to verify the SD-WAN rule selection for a specific flow?

Accepted Answer

diagnose sys sdwan info. 'diagnose sys sdwan info' is the FortiOS command that displays detailed SD-WAN rule selection information, including which rule matched for a specific flow and how traffic is being load-balanced across members. This command provides real-time diagnostics on SD-WAN path selection, rule IDs, and member usage, which directly addresses the administrator's need to verify rule matching and load-balancing behavior.

Answer

diagnose sys session list

Answer

get system sdwan status

Answer

diagnose netlink interface list