NSE7 Practice Test 42 — 15 Questions

Question 1

Which FortiGate feature allows an administrator to define a granular policy based on the security posture of the endpoint device, such as OS version, antivirus status, and disk encryption, before granting access to a protected application?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ZTNA access proxy. FortiGate ZTNA access proxy enables granular policy enforcement based on endpoint security posture, such as OS version, antivirus status, and disk encryption. It acts as a reverse proxy that evaluates ZTNA tags (derived from endpoint posture) before granting access to protected applications, aligning with zero-trust principles.

Answer

Web filtering profile

Answer

SSL VPN portal

Answer

IPsec phase 1 configuration

Question 2

An administrator wants to ensure that voice traffic (UDP 16384-32768) always uses the MPLS link, while internet-bound traffic uses broadband. Which SD-WAN feature should be configured to achieve this?

Accepted Answer

SD-WAN rule. SD-WAN rules (option D) allow administrators to define policy-based forwarding by matching specific traffic characteristics—such as UDP ports 16384-32768 for voice—and steering that traffic to a preferred interface or link (e.g., the MPLS link). This is the correct feature because it directly controls traffic steering based on application or service, overriding any default load-balancing or failover behavior.

Answer

Performance SLA

Answer

SD-WAN member configuration

Answer

Load balancing algorithm

Question 3

A FortiGate administrator wants to use BFD to quickly detect link failures in an SD-WAN deployment. Which statement about BFD configuration on FortiGate is correct?

Accepted Answer

BFD can be configured under the interface or routing protocol to detect forwarding path failures. BFD (Bidirectional Forwarding Detection) on FortiGate can be configured either directly on an interface or under a dynamic routing protocol (such as OSPF or BGP). When configured under the interface, BFD monitors the forwarding path to that specific neighbor; when configured under the routing protocol, it provides sub-second failure detection for routes learned via that protocol. This flexibility allows the administrator to tailor BFD to the SD-WAN deployment's needs, ensuring rapid link failure detection without relying on routing protocol timers.

Answer

BFD is enabled by default on all FortiGate interfaces

Answer

BFD sessions are established automatically when OSPF neighbors form

Answer

BFD uses performance SLA probes to determine link health

Question 4

A FortiGate administrator wants to enable load balancing for equal-cost paths to the same destination. The FortiGate has two equal-cost routes via two different next-hop routers. Which feature should the admin enable to load balance traffic across both paths?

Accepted Answer

ECMP (Equal Cost Multi-Path). ECMP (Equal Cost Multi-Path) is the correct feature because it enables a FortiGate to distribute traffic across multiple equal-cost routes to the same destination. When the routing table contains two or more routes with identical administrative distance and metric, ECMP automatically load-balances sessions across those paths using a hash-based algorithm (e.g., source-destination IP hash), without requiring additional configuration beyond enabling the feature globally or per-VDOM.

Answer

BFD (Bidirectional Forwarding Detection)

Answer

Policy-based routing

Answer

SD-WAN load balancing

Question 5

A FortiGate administrator wants to integrate ZTNA with FortiClient EMS to control access to an internal application based on device posture. The admin has configured a ZTNA tag in EMS for 'AntiVirus enabled' and created a ZTNA rule in FortiGate. What additional configuration is required on the FortiGate to enforce access based on the ZTNA tag?

Accepted Answer

Configure the FortiGate as an EMS connector and import the tag. For FortiGate to enforce ZTNA tags created in FortiClient EMS, the FortiGate must be configured as an EMS connector so it can poll and import the tags. Once the EMS connector is authorized and the tags are imported, the ZTNA rule can match on those tags to grant or deny access based on device posture. Without the EMS connector, FortiGate has no visibility into the EMS-defined tags.

Answer

Configure SSL VPN to authenticate users and assign tags

Answer

Install a client certificate on each FortiClient from the FortiGate

Answer

Enable ZTNA inline CASB in the antivirus profile

Question 6

In a Fortinet ZTNA deployment, which component is responsible for forwarding decrypted traffic to the internal application server after the FortiGate proxy has performed SSL inspection?

Accepted Answer

ZTNA proxy on FortiGate. In Fortinet ZTNA, the FortiGate acts as the ZTNA proxy (also called the access proxy). After it terminates the client's TLS session and performs SSL inspection, the FortiGate itself re-originates the connection to the internal application server. No separate component forwards that decrypted traffic — the FortiGate proxy handles both the client-facing and server-facing legs.

Answer

FortiClient EMS

Answer

IPsec VPN tunnel

Answer

FortiNAC

Question 7

A network administrator is configuring SD-WAN on a FortiGate. They have multiple WAN links and want to ensure that traffic for a critical application uses the link with the lowest latency. Which SD-WAN configuration component should be used to achieve this?

Accepted Answer

Performance SLA with latency threshold and SD-WAN rule using best-quality strategy. The Performance SLA monitors latency (and other metrics) against a configured threshold, and the SD-WAN rule with the 'best-quality' strategy dynamically selects the WAN link that currently has the lowest latency. This ensures the critical application traffic is steered to the optimal link based on real-time performance measurements.

Answer

SD-WAN rule with spillover load balancing

Answer

SD-WAN members with static priority

Answer

Load balancing algorithm set to lowest-cost (SLA)

Question 8

An administrator wants to troubleshoot why specific traffic is not matching a configured firewall policy. Which debug command should be used?

Accepted Answer

diagnose debug flow. The 'diagnose debug flow' command is the correct tool for tracing traffic through the firewall policy engine in FortiOS. It captures the packet flow in real time, showing which policy is evaluated, why a match or no-match occurs, and any drop reasons. This directly addresses the administrator's need to troubleshoot why specific traffic is not matching a configured firewall policy.

Answer

diagnose sys session list

Answer

get firewall policy <id>

Answer

diagnose netlink interface list

Question 9

An administrator configures inter-VDOM routing between VDOMs A and B using a VDOM link. The administrator can ping from VDOM A to an interface in VDOM B, but traffic from VDOM B to VDOM A times out. What is the most likely cause?

Accepted Answer

The route back to the source subnet is missing in VDOM A. Inter-VDOM routing requires a route in both directions. Since the administrator can ping from VDOM A to VDOM B, the forward path works, but the return traffic from VDOM B to VDOM A fails due to a missing route back to the source subnet in VDOM A. This is a classic asymmetric routing issue where the destination VDOM (A) does not know how to reach the source subnet of VDOM B.

Answer

VDOM B has no traffic VDOM capability

Answer

The firewall policy in VDOM B is blocking traffic

Answer

The VDOM link's MTU is set too high

Question 10

A FortiGate administrator is configuring a security profile group and wants to enable inline blocking of malicious files based on FortiGuard cloud threat intelligence, without sending files to FortiSandbox. The administrator has already enabled the antivirus profile and selected the 'Block' action for infected files. Which additional setting should be configured to ensure that files identified as malicious by the FortiGuard service are blocked in real time?

Accepted Answer

Enable 'FortiGuard AI-Based Inline Malware Prevention' in the antivirus profile.. The correct setting is 'FortiGuard AI-Based Inline Malware Prevention', which enables real-time blocking of malicious files using FortiGuard's cloud-based AI and machine learning, without the need for a FortiSandbox. This feature is part of the antivirus profile and provides inline protection against known and unknown malware, aligning with the administrator's goal of blocking based on FortiGuard intelligence.

Answer

Enable 'Scan with FortiSandbox' in the antivirus profile.

Answer

Enable 'Use FortiSandbox Database' in the antivirus profile.

Answer

Configure 'External Blocklist' with a threat intelligence feed.

Question 11

A FortiGate administrator is troubleshooting high CPU usage. The administrator runs 'diagnose sys top' and sees that the 'ipsengine' process is consuming a large amount of CPU. Which action should the administrator take to reduce the CPU usage while maintaining security?

Accepted Answer

Review and optimize the IPS sensor configuration to reduce the number of signatures or adjust anomaly thresholds.. The ipsengine process handles IPS inspection. High CPU usage can be mitigated by optimizing the IPS sensor configuration, such as disabling signatures that are not relevant to the environment, reducing the number of policies with IPS enabled, or adjusting anomaly thresholds. This maintains security by keeping essential protections while reducing the processing load.

Answer

Disable IPS globally.

Answer

Adjust the IPS fail-open setting to enable fail-open.

Answer

Increase the FortiGate's memory allocation to the ipsengine process.

Question 12

An administrator is configuring a FortiGate with VDOMs. The administrator wants to ensure that each VDOM has its own independent routing table and that routes in one VDOM do not affect another. Which statement about VDOM routing is correct?

Accepted Answer

Each VDOM maintains its own separate routing table, and routes are isolated per VDOM.. VDOMs on a FortiGate are independent virtual instances, each with its own routing table. This means that routes configured in one VDOM are not shared with or visible to other VDOMs. This isolation is a key benefit of VDOMs, allowing separate routing domains for different departments or customers without interference.

Answer

All VDOMs share a single global routing table, but route entries are tagged with VDOM IDs.

Answer

Only the root VDOM can have a default route; other VDOMs must use inter-VDOM links for all traffic.

Answer

Routes are automatically synchronized between VDOMs to ensure consistent routing.

Question 13

A FortiGate 600E is running in multi-VDOM mode and is managed by FortiManager. The administrator needs to assign CPU and memory resource limits to a specific VDOM so that it cannot consume more than 30% of the system's resources. Which FortiGate feature should the administrator configure?

Accepted Answer

Enable VDOM resource limits under the global system settings and assign per-VDOM CPU and memory quotas.. The correct answer is to enable VDOM resource limits and assign per-VDOM quotas. This is the only method that directly enforces CPU and memory limits on a per-VDOM basis, ensuring fair resource distribution. Other options address bandwidth, administrative access, or hardware offloading, none of which satisfy the requirement to cap CPU and memory usage.

Answer

Create a traffic shaping policy for all traffic entering and leaving the VDOM.

Answer

Assign the VDOM to a dedicated NP6 processor using NPU offload settings.

Answer

Configure a separate administrative profile that restricts the VDOM's access to system resources.

Question 14

An administrator is configuring a FortiGate to detect and block command and control (C2) traffic using FortiGuard's Indicator of Compromise (IoC) service. The administrator wants to ensure that the firewall checks DNS queries and HTTP requests against the IoC database. Which feature should be enabled on the FortiGate to accomplish this?

Accepted Answer

FortiGuard IoC Service in the security fabric connector. The FortiGuard IoC Service is a security fabric connector that enables FortiGate to download indicators of compromise and inspect traffic, including DNS and HTTP, against that database. It provides comprehensive detection of C2 communications and other malicious activities. Other features like web filtering or DNS filtering may block some C2 traffic but do not utilize the IoC service as required.

Answer

Botnet C&C IP Blocklist in the firewall policy

Answer

DNS Filter profile with botnet C&C domain blocking

Answer

FortiGuard Category Based Filter in the web filter profile

Question 15

A network administrator is deploying FortiGate to protect against unknown malware. They want to use machine learning to detect and block malicious files without relying on signatures. Which antivirus scanning technique should be enabled to achieve this?

Accepted Answer

Machine learning-based malware detection. Machine learning-based malware detection uses artificial intelligence models to analyze file features and identify malicious patterns, allowing FortiGate to block unknown malware without relying on signatures. This is the only option that directly matches the requirement for machine learning. Other techniques like signatures, heuristics, or sandboxing are different approaches and do not provide the same capability.

Answer

Heuristic scanning

Answer

Signature-based detection

Answer

Sandbox analysis