NSE7 Practice Test 41 — 15 Questions

Question 1

Which FortiGate security feature can reconstruct files to remove potentially malicious content while preserving the file's usability?

Accepted Answer

Content Disarm and Reconstruction. Content Disarm and Reconstruction (CDR) is the correct answer because it actively removes potentially malicious content—such as macros, scripts, or embedded objects—from files (e.g., Office documents, PDFs) and then reconstructs a clean, usable version. Unlike detection-based approaches, CDR eliminates threats by sanitizing the file structure itself, ensuring the file remains functional for the end user while blocking exploits.

Answer

Antivirus outbreak prevention

Answer

FortiSandbox

Answer

IPS application control

Question 2

You run 'diagnose sys session filter dport 443' and see sessions with a duration of 7200 seconds and expire time of 3600 seconds. What does this indicate?

Accepted Answer

The session has been alive for 7200 seconds and will expire in 3600 seconds. The 'duration' field in the 'diagnose sys session filter' output shows how long the session has been active (7200 seconds), while the 'expire' field indicates the remaining time before the session times out (3600 seconds). Option C correctly interprets both values. This is standard FortiGate session table behavior, where each session has a configurable timeout (e.g., default TCP timeout is 3600 seconds for established sessions).

Answer

The session has been idle for 7200 seconds

Answer

The session helper is interfering with the session

Answer

The session has already expired

Question 3

An administrator wants to use FortiManager to manage multiple FortiGates, each in a separate customer environment. The administrator needs to isolate configuration changes per customer and ensure each customer's admin can only see their own devices. What FortiManager feature should be used?

Accepted Answer

Administrative domains (ADOMs). Administrative Domains (ADOMs) in FortiManager allow the administrator to logically partition the management plane, isolating configuration changes per customer. Each ADOM can contain a set of FortiGates, and administrators assigned to an ADOM can only see and manage devices within that ADOM, ensuring strict separation of customer environments.

Answer

Administrator profiles

Answer

Policy packages

Answer

VDOMs on managed FortiGates

Question 4

An admin wants to ensure that office documents (e.g., Word, Excel) downloaded from the internet are safe before users open them. Which feature should be used to remove potentially malicious macros and active content?

Accepted Answer

Content Disarm and Reconstruction (CDR). Content Disarm and Reconstruction (CDR) is the correct feature because it proactively removes potentially malicious macros, scripts, and active content from office documents by stripping the original file's active elements and rebuilding a safe, sanitized version. Unlike detection-based methods, CDR eliminates threats before the file reaches the user, ensuring that even unknown or zero-day macro-based attacks are neutralized.

Answer

Machine learning engine

Answer

Antivirus pattern matching

Answer

FortiSandbox file submission

Question 5

A FortiGate with FortiExtender is using LTE as a backup WAN link. When the primary link fails, the LTE link does not take over. What could be the cause?

Accepted Answer

The LTE interface is not added as an SD-WAN member.. For an LTE interface to be used as a backup WAN link in an SD-WAN setup, it must be explicitly added as an SD-WAN member. Without this, the FortiGate will not consider the LTE interface for traffic steering or failover, even if the primary link fails. The SD-WAN rules and performance SLA are only evaluated against interfaces that are members of the SD-WAN zone.

Answer

The primary link's performance SLA is still passing.

Answer

The FortiExtender is not configured in pass-through mode.

Answer

The FortiExtender firmware is out of date.

Question 6

An admin receives an email from FortiMail regarding a message that was rejected due to SPF failure. What does this indicate about the email?

Accepted Answer

The email's From address domain does not match the sending server's IP per the domain's SPF record. SPF (Sender Policy Framework) validation checks whether the sending mail server's IP address is authorized to send mail for the domain in the envelope 'From' (RFC 5321.MailFrom) or the header 'From' address. When FortiMail rejects a message due to SPF failure, it means the IP of the connecting server does not match any of the authorized IPs listed in the domain's SPF TXT record (as defined in RFC 7208). This is a direct authentication failure, not a content-based or signature-based issue.

Answer

The email's DKIM signature is invalid

Answer

The email contains a virus

Answer

The email is missing a Message-ID header

Question 7

An administrator is configuring FortiDeceptor to detect threats within the network. Which TWO statements about FortiDeceptor are correct?

Accepted Answer

It sends alerts to FortiSIEM or FortiSOAR for automated response. FortiDeceptor integrates with FortiSIEM and FortiSOAR to automatically trigger incident response workflows when a threat is detected. This integration allows security teams to quickly contain and remediate attacks without manual intervention, leveraging the Fortinet Security Fabric's automation capabilities.

Answer

It requires a separate hardware appliance for each network segment

Answer

It uses signature-based detection to identify malware

Answer

It can replace firewall functionality

Question 8

An administrator wants to use FortiManager to push a new firewall policy to a managed FortiGate. Before installing, the administrator wants to review what changes will be applied. Which FortiManager feature should be used?

Accepted Answer

Install Preview. Install Preview (Option A) is the correct feature because it allows the administrator to see a detailed, side-by-side comparison of the current configuration on the managed FortiGate versus the pending changes that FortiManager will push. This preview is generated by FortiManager's policy compilation engine, which calculates the exact CLI commands and object modifications required to synchronize the device database (ADOM) with the managed FortiGate. It provides a safe, non-disruptive way to validate changes before committing them, reducing the risk of misconfiguration.

Answer

Policy & Objects - Install Wizard

Answer

Configuration Rollback

Answer

Revision History

Question 9

A FortiGate administrator is deploying a multi-VDOM setup for a service provider. The provider wants each customer VDOM to have its own administrative access, yet the overall device management (including firmware upgrades) should be centralized from the management VDOM. Which TWO statements are true regarding administrative VDOMs?

Accepted Answer

The management VDOM can be used to manage all other VDOMs. Option A is correct because in a multi-VDOM FortiGate, the management VDOM is specifically designed to centrally administer and manage all other VDOMs, allowing the provider to oversee the entire device from one administrative domain. Option D is correct because device-level functions such as firmware upgrades, global settings, and system-wide operations are handled by the management VDOM, which is why centralized device management is possible. Option B is incorrect because traffic VDOMs can be configured with administrative access (for example, HTTPS, SSH, or Telnet on their interfaces) so each customer can manage its own VDOM. Option C is incorrect because a separate management IP address per VDOM is not mandatory; administrative access can be enabled on existing interfaces, and the management VDOM itself provides centralized access. Option E is incorrect because administrators are scoped to their assigned VDOM and cannot automatically view other VDOMs' configurations unless they have the appropriate multi-VDOM or super-admin privileges.

Answer

Traffic VDOMs cannot have any administrative access

Answer

Each VDOM must have a separate management IP address

Answer

An administrator assigned to one VDOM can automatically view configurations of other VDOMs

Question 10

A network admin runs 'diagnose sys top' on a FortiGate and sees that the process 'httpsd' is consistently using 95% CPU. Which of the following actions is MOST appropriate to troubleshoot this issue?

Accepted Answer

Check the number of active admin sessions and consider stopping the web GUI service temporarily. The httpsd process handles the FortiGate web GUI (HTTPS) and API requests. High CPU usage by httpsd typically indicates excessive admin sessions or web GUI activity. Option D is correct because checking active admin sessions and temporarily stopping the web GUI service (e.g., via 'config system global set admin-https-redirect disable' or stopping the service) directly addresses the likely cause without disrupting firewall processing or requiring policy changes.

Answer

Restart the FortiGate firewall engine with 'diagnose test application fgwbd 255'

Answer

Disable the antivirus profile on all policies to reduce processing load

Answer

Increase the log rate to capture more details about the httpsd process

Question 11

A company has deployed FortiClient with advanced threat protection (ATP) features. Which TWO capabilities does FortiClient ATP provide beyond basic antivirus?

Accepted Answer

Exploit prevention and vulnerability scanning

Answer

Application control and inventory

Answer

VPN connectivity

Answer

Web filtering and URL rating

Question 12

A FortiGate administrator is using FortiNAC to enforce network access control for wired endpoints. The administrator wants to quarantine any endpoint that fails antivirus compliance. Which action should be configured in the FortiNAC policy to achieve this?

Accepted Answer

Assign the endpoint to a quarantine VLAN. FortiNAC policies can enforce compliance by moving endpoints to a quarantine VLAN or applying a quarantine ACL. The typical action is to place the endpoint in a quarantine VLAN where access is restricted.

Answer

Disable the switch port

Answer

Send a SNMP trap to the admin

Answer

Block the MAC address at the switch port

Question 13

An administrator wants to ensure that only devices with up-to-date antivirus software can access a sensitive application via ZTNA. Which FortiGate feature should be used to enforce this requirement?

Accepted Answer

ZTNA tags from FortiClient EMS. ZTNA tags from FortiClient EMS are used to enforce device posture requirements such as up-to-date antivirus software. FortiClient EMS assesses endpoint compliance and assigns tags, which FortiGate uses in ZTNA access policies to grant or deny access based on the tag. An AntiVirus profile on a firewall policy scans traffic content but does not directly check the device's antivirus status for ZTNA access.

Answer

SSL deep inspection profile

Answer

Application control profile

Answer

AntiVirus profile on the firewall policy

Question 14

A network administrator is troubleshooting an IPsec VPN tunnel between Site A (FortiGate) and Site B (third-party VPN peer). The tunnel fails to establish. On FortiGate, phase1 status shows 'up' but phase2 status remains 'down'. What is the MOST likely cause?

Accepted Answer

The phase2 proposal (encryption, authentication, etc.) does not match.. Phase1 being up indicates IKE SA is established. Phase2 down indicates IPsec SA negotiation failed, typically due to mismatched proposals (encryption, integrity, PFS) or traffic selector mismatch.

Answer

The firewall policies at Site B are blocking UDP port 500.

Answer

The pre-shared key does not match on both sides.

Answer

The DPD settings are incompatible between the peers.

Question 15

A FortiGate has multiple equal-cost routes to the same destination via two different interfaces. ECMP load balancing is enabled. What determines how traffic is distributed among the routes?

Accepted Answer

A hash of source and destination IP addresses. When ECMP load balancing is enabled on a FortiGate, traffic distribution among equal-cost routes is determined by a hash algorithm that uses source and destination IP addresses (and optionally ports) to select the egress interface. This ensures that all packets belonging to the same flow are consistently forwarded via the same path, preserving packet order and avoiding reordering issues.

Answer

The interface speed

Answer

Round-robin per packet

Answer

The route metric