NSE7 Practice Test 42 — 15 Questions

Question 1

An administrator configures FortiSandbox inline scanning for HTTP traffic. They notice that files uploaded via HTTP are being scanned but no verdict is being returned, causing delays. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file scan timeout is too short, causing FortiGate to pass the file before a verdict is received. When FortiGate sends a file to FortiSandbox for inline scanning, it waits for a verdict before allowing the traffic to proceed. If the file scan timeout is too short, FortiGate will stop waiting for the verdict and pass the file anyway, causing the observed delay without a final verdict. This is the most likely cause because the administrator sees scanning occurring but no verdict returned, which aligns with a premature timeout rather than a failure to scan.

Answer

The FortiSandbox has reached its maximum storage capacity

Answer

The FortiSandbox is not registered with the FortiGate

Answer

The file type is not supported by FortiSandbox

Question 2

A FortiGate is configured with OSPF in a multi-area design. An administrator needs to redistribute static routes from another router into OSPF on the FortiGate, but only for prefixes that match a route map. The administrator has configured 'config router ospf' with 'redistribute static route-map RM_STATIC'. However, the static routes are not appearing in the OSPF database. Which THREE troubleshooting steps should the administrator take?

Accepted Answer

Verify that the route map 'RM_STATIC' exists and has appropriate match and set statements. If the route map 'RM_STATIC' does not exist or lacks proper match/set statements, OSPF will not redistribute any static routes. The 'redistribute static route-map RM_STATIC' command requires a valid route map to filter prefixes; without it, redistribution silently fails.

Answer

Verify that OSPF is enabled on at least one interface (config router ospf -> network)

Answer

Check if a prefix-list is applied that filters the redistributed routes

Question 3

An enterprise uses FortiGate as an SD-WAN edge device with three WAN links: Link A (MPLS), Link B (broadband), and Link C (LTE). The SD-WAN rule for VoIP traffic uses the 'best quality' strategy with link-quality-measurement enabled. The VoIP traffic is routed via Link A. During peak hours, users report poor voice quality. The administrator checks the SD-WAN performance SLA logs and sees that Link A's jitter and latency are within acceptable thresholds, but packet loss is slightly elevated. Which action would most likely improve VoIP quality without manual intervention?

Accepted Answer

Configure a performance SLA for VoIP traffic with jitter < 10ms, latency < 100ms, and packet-loss < 0.5% and apply it to the SD-WAN rule.. Configuring a performance SLA with specific thresholds for jitter, latency, and packet loss allows FortiGate to dynamically failover VoIP traffic to another WAN link when Link A's packet loss exceeds the defined threshold (e.g., 0.5%). Since the 'best quality' strategy uses link-quality-measurement to select the link with the best SLA compliance, applying a performance SLA with a packet-loss threshold ensures that even if jitter and latency are acceptable, elevated packet loss triggers a switch to a healthier link, improving voice quality without manual intervention.

Answer

Increase the priority of Link A to ensure it remains the preferred link.

Answer

Disable link-quality-measurement to reduce overhead on Link A.

Answer

Add a new SD-WAN rule with 'lowest cost' strategy for VoIP traffic.

Question 4

A FortiGate administrator configures a ZTNA rule with inline CASB to control access to a SaaS application. Users can access the application but the CASB controls are not being applied. What is the most likely reason?

Accepted Answer

The firewall policy is configured for flow-based inspection. Inline CASB requires a proxy-based firewall policy that intercepts traffic to the SaaS application. If the policy is using flow-based inspection, CASB will not be invoked. Inline CASB works only with proxy-based inspection.

Answer

SSL inspection is not enabled

Answer

The CASB profile is not applied to the ZTNA rule

Answer

The SaaS application is not supported by FortiGate CASB

Question 5

You are troubleshooting a BGP session between FortiGate and an ISP router. The FortiGate shows BGP state 'Active' and the debug output shows 'No route to peer'. The ISP router's loopback IP is 203.0.113.1, and the next-hop interface is port1 (10.0.0.1/30). The FortiGate has a static route to 203.0.113.1 via port1. What is the MOST likely cause?

Accepted Answer

The static route's outgoing interface (port1) is administratively down. The 'Active' BGP state combined with 'No route to peer' indicates that the FortiGate cannot reach the BGP neighbor IP (203.0.113.1) via the routing table. Even though a static route exists, if the outgoing interface (port1) is administratively down, the route is not installed in the FIB, making the peer unreachable. This directly matches option C.

Answer

The BGP neighbor IP is not reachable due to an ACL on the ISP router

Answer

The BGP update-source is set to a different interface

Answer

The BGP configuration has 'next-hop-self' disabled

Question 6

A FortiGate in transparent mode is deployed between a router and a switch. The administrator needs to apply a deep inspection profile to HTTP traffic. What is the correct configuration for the interfaces?

Accepted Answer

Configure a management IP on the VDOM and apply the inspection profile to the policy. In transparent mode, FortiGate acts as a Layer 2 bridge, so interfaces do not require IP addresses. Deep inspection of HTTP traffic is applied via a firewall policy that references a deep inspection profile, and a management IP must be configured on the VDOM to allow the FortiGate to participate in management traffic (e.g., DNS, NTP, or proxy operations). Option A correctly identifies that the management IP is set on the VDOM and the inspection profile is applied to the policy.

Answer

Place both interfaces in the same VDOM and enable DHCP

Answer

Switch to NAT mode to enable deep inspection

Answer

Assign IPs to both interfaces and create a policy from LAN to WAN

Question 7

A FortiGate has multiple VDOMs. The administrator notices that traffic from VDOM-1 to VDOM-2 is allowed by inter-VDOM policies but is not being inspected by the security profiles. What is the most likely cause?

Accepted Answer

The security profiles are applied only on the egress VDOM. When inter-VDOM traffic flows through a VDOM link, security profiles are applied only on the egress VDOM by default. This is because the VDOM link acts as a logical wire, and inspection occurs at the point where traffic exits the link. If the administrator has applied security profiles only on the ingress VDOM (VDOM-1), they will not be enforced on traffic leaving VDOM-1 toward VDOM-2, resulting in no inspection.

Answer

The traffic is using a bypass path due to asymmetric routing

Answer

The VDOMs are in different virtual routers

Answer

The VDOM link is configured as a signal interface

Question 8

In FortiManager, what is the difference between a Global ADOM and a regular ADOM?

Accepted Answer

Global ADOM allows sharing of global objects across all ADOMs. In FortiManager, a Global ADOM is a special administrative domain that stores global objects (such as address objects, services, and policies) that can be shared and referenced by all regular ADOMs. This centralizes management of common resources, reducing duplication and ensuring consistency across multiple ADOMs. Regular ADOMs are isolated from each other by default, but they can import objects from the Global ADOM, which is the key distinction.

Answer

Regular ADOM supports automation stitches while Global ADOM does not

Answer

Regular ADOM can only manage one FortiGate

Answer

Global ADOM is used for managing FortiGates in a single VDOM environment

Question 9

An administrator notices that some traffic through the FortiGate is not being inspected by the application control profile. Which TWO reasons could explain this? (Choose two.)

Accepted Answer

The application control profile is disabled. The two valid reasons are that traffic may match a different policy without the application control profile (E), and that the application control profile may be disabled on the policy the traffic hits (D). Option A is incorrect because proxy-based inspection is required for application control; setting it to proxy-based enables inspection. Option B is incorrect because outdated signatures still allow inspection, albeit with reduced effectiveness. Option C is incorrect because high memory usage may impact performance but does not entirely prevent inspection.

Answer

The inspection mode is set to proxy-based

Answer

The application control signatures are outdated

Answer

The FortiGate has high memory usage

Question 10

An administrator wants to deploy FortiSwitch and FortiAP using LAN edge management from a FortiGate. Which TWO conditions must be met? (Choose two.)

Accepted Answer

The FortiGate must be configured with the FortiLink interface for FortiSwitch and a CAPWAP interface for FortiAP.. FortiGate uses a dedicated FortiLink interface (typically a hardware switch or aggregate interface) to manage FortiSwitch devices via L2 protocols, and a CAPWAP interface (a loopback or IP interface) to terminate CAPWAP tunnels from FortiAPs. These are the required interface types for LAN edge management, as specified in the FortiOS LAN edge deployment guide.

Answer

The FortiSwitch and FortiAP must be factory reset before connecting.

Answer

The FortiGate must have a valid FortiCare contract for unified management.

Answer

The FortiGate must have the 'set allowaccess' command enabled for HTTPS or SSH on the managing interface.

Question 11

A network administrator is troubleshooting a FortiGate that is not appearing in the Security Fabric topology on FortiManager. The FortiGate is reachable from FortiManager via ping. What is the most likely cause?

Accepted Answer

The FortiGate is not authorized in FortiManager. For a FortiGate to appear in the Security Fabric topology on FortiManager, it must first be authorized in FortiManager. Even if the FortiGate is reachable via ping, without authorization, FortiManager will not accept its registration or include it in the topology view. This is a prerequisite step that must occur before any fabric communication can be established.

Answer

FortiAnalyzer is not configured on the FortiGate

Answer

SNMP community string is mismatched

Answer

The FortiGate firewall policy is blocking traffic to FortiManager

Question 12

An administrator notices that after upgrading FortiOS, some traffic that was previously inspected by the antivirus profile is now bypassing scanning. The administrator suspects the session helper configuration may be interfering. Which TWO session helper protocols are known to potentially affect traffic inspection if improperly configured?

Accepted Answer

FTP. FTP (File Transfer Protocol) uses separate control and data channels, and FortiGate's session helper dynamically opens pinholes for the data channel. If the FTP session helper is improperly configured or disabled, the antivirus scanner may not inspect the data channel traffic, allowing it to bypass scanning. This is a known issue when upgrading FortiOS if the session helper configuration is not migrated correctly.

Answer

TFTP

Answer

PPTP

Answer

HTTP

Question 13

Match each FortiGate routing concept to its description.

Accepted Answer

Policy-based routing: Routes packets based on criteria other than destination IP, such as source IP or protocol. Correct matches: PBR, Route redistribution, Administrative distance, and Static route are correctly paired. ECMP and Metric are swapped; ECMP distributes traffic across equal-cost paths, while Metric compares routes within a protocol.

Answer

ECMP: A numeric value used to compare routes within the same routing protocol

Answer

Metric: Distributes traffic across multiple equal-cost paths to the same destination

Question 14

An administrator needs to configure advanced email security on FortiMail to protect against phishing and spoofing. Which THREE features should be enabled to achieve comprehensive email authentication?

Accepted Answer

DKIM signing and verification. DKIM (DomainKeys Identified Mail) signing and verification is correct because it allows the sending domain to cryptographically sign outgoing emails, and the receiving server to verify that the signature matches the domain’s public DNS record. This ensures the email was not tampered with and originates from an authorized server, directly addressing phishing and spoofing by validating message integrity and sender authenticity.

Answer

Anti-spam Bayesian filtering

Answer

TLS encryption for inbound/outbound

Question 15

A BGP route from an ISP is not appearing in the FortiGate's routing table. The BGP session is established and 'show ip bgp' shows the route as valid but not best. Which command should the admin use to investigate why the route is not selected as best?

Accepted Answer

diagnose ip router bgp routes. 'diagnose ip router bgp routes' is the FortiGate command that displays detailed BGP route information, including the reason a route is not selected as best (e.g., higher local preference, longer AS path, or lower MED). Since the BGP session is up and the route is valid but not best, this command reveals the tie-breaking criteria that caused the route to lose the best-path selection process.

Answer

execute router bgp show

Answer

get router info bgp summary

Answer

diagnose ip router bgp network