NSE7 Practice Test 42 — 15 Questions

Question 1

An administrator is troubleshooting an IPsec VPN tunnel that connects a branch office to the main office. The tunnel is down. The administrator runs 'diagnose vpn ike gateway list' and sees the following output:
IKE gateway: branch
  state: down
  DPD: enabled
  DPD retrycount: 3
  DPD retryinterval: 10
What does the DPD configuration indicate?

Accepted Answer

The tunnel will be brought down after 3 unanswered DPD probes, each 10 seconds apart. DPD (Dead Peer Detection) is configured with a retry count of 3 and a retry interval of 10 seconds. This means the FortiGate will send DPD probes every 10 seconds and after 3 consecutive failures (30 seconds total without response), it will consider the peer dead. The tunnel is currently down, likely because DPD detected the peer as unreachable.

Answer

The tunnel will be brought down immediately after the first DPD timeout

Answer

The tunnel will stay up indefinitely because DPD is disabled

Answer

DPD will send probes every 30 seconds

Question 2

A FortiGate admin is configuring a multi-peer IPsec VPN where the remote site has two ISPs for redundancy. The admin wants to ensure that if the primary ISP fails, the VPN automatically fails over to the secondary ISP without manual intervention. Which feature should be enabled?

Accepted Answer

Dead Peer Detection (DPD) with retry and failover. DPD (Dead Peer Detection) with auto-negotiation allows the FortiGate to detect peer unreachability and automatically re-establish the tunnel using an alternate path if configured.

Answer

IPsec interface mode with DHCP

Answer

IKEv2 with mobility extension

Answer

Auto-negotiate phase 1 settings

Question 3

An administrator runs the following CLI command on a FortiGate and sees the output below:
diagnose vpn ike gateway list
vd: root/0 name: REMOTE_GW vrf: 0 version: 2
state: UP IKE SA: created 1s ago 1.2.3.4:500->5.6.7.8:500
What is the most likely explanation for the IKE SA being created only 1 second ago?

Accepted Answer

The VPN tunnel was just configured or a configuration change was applied. The IKE SA was recently created, suggesting a previous SA was deleted and a new one established. This often happens after configuration changes or a restart of IKE negotiation.

Answer

The remote peer changed its IP address

Answer

DPD detected a dead peer and renegotiated

Answer

The phase 2 SA expired and triggered phase 1 rekey

Question 4

A network administrator is troubleshooting an IPsec VPN tunnel between Site A (FortiGate) and Site B (third-party VPN peer). The tunnel fails to establish. On FortiGate, phase1 status shows 'up' but phase2 status remains 'down'. What is the MOST likely cause?

Accepted Answer

The phase2 proposal (encryption, authentication, etc.) does not match.. Phase1 being up indicates IKE SA is established. Phase2 down indicates IPsec SA negotiation failed, typically due to mismatched proposals (encryption, integrity, PFS) or traffic selector mismatch.

Answer

The firewall policies at Site B are blocking UDP port 500.

Answer

The pre-shared key does not match on both sides.

Answer

The DPD settings are incompatible between the peers.

Question 5

A FortiGate administrator wants to integrate ZTNA with FortiClient EMS to control access to an internal application based on device posture. The admin has configured a ZTNA tag in EMS for 'AntiVirus enabled' and created a ZTNA rule in FortiGate. What additional configuration is required on the FortiGate to enforce access based on the ZTNA tag?

Accepted Answer

Configure the FortiGate as an EMS connector and import the tag. ZTNA uses tags from EMS to make access decisions. The FortiGate must be configured to receive these tags via the EMS connector and then use them in firewall policies (via ZTNA rules). Option C is correct because the FortiGate needs to connect to EMS to pull tag information and then apply it in security policies.

Answer

Configure SSL VPN to authenticate users and assign tags

Answer

Install a client certificate on each FortiClient from the FortiGate

Answer

Enable ZTNA inline CASB in the antivirus profile

Question 6

A FortiGate administrator is troubleshooting a ZTNA access proxy issue. The ZTNA rule is configured to require the tag 'AV_Installed' and 'OS_Updated'. Users with compliant devices are still denied access. The admin checks the ZTNA connection monitor and sees 'Tag mismatch'. What is the MOST likely cause?

Accepted Answer

The FortiClient EMS is not configured as an endpoint control source on the FortiGate. ZTNA tags are assigned by FortiClient EMS based on device posture. If the FortiGate does not trust the EMS server or the tag names are mismatched, the tag check fails. The EMS must be configured as an endpoint control source and the tags must exactly match those defined in EMS.

Answer

The FortiGate does not have a valid PKI certificate for the ZTNA proxy

Answer

The user is not authenticated via SAML

Answer

The ZTNA rule is using the wrong port number

Question 7

A FortiGate is configured as a SAML service provider (SP) for SSO. Users authenticate via an external IdP. After successful authentication, the FortiGate should enforce a firewall policy based on the user's group membership. Which FortiGate setting must be enabled to receive group information from the IdP?

Accepted Answer

Configure the 'user-group' attribute in the SAML SP settings. FortiGate as SAML SP can receive user attributes from the IdP, including group membership, through SAML assertions. The IdP must send the group attribute, and FortiGate must be configured to accept it. Option B is correct: 'Set single-sign-on-identity-attribute' or similar? Actually, the correct setting is to enable 'SAML User Group' in the SAML SP configuration to map the group attribute from the IdP. Option B is the best: 'Set the SAML user group attribute in the SP configuration'.

Answer

Enable 'Require IdP Certificate Validation'

Answer

Create a separate firewall policy for each user

Answer

Enable 'Auto-Provision Users' on FortiGate

Question 8

Which FortiGate feature allows an administrator to define a granular policy based on the security posture of the endpoint device, such as OS version, antivirus status, and disk encryption, before granting access to a protected application?

Accepted Answer

ZTNA access proxy. ZTNA (Zero Trust Network Access) uses device posture checks to evaluate endpoint security before granting access to applications.

Answer

Web filtering profile

Answer

SSL VPN portal

Answer

IPsec phase 1 configuration

Question 9

An administrator is deploying ZTNA for a legacy application that uses a fixed IP address and port. Which ZTNA component is responsible for securely proxying traffic from the user to the application without exposing the application's actual network location?

Accepted Answer

ZTNA access proxy. The ZTNA proxy component acts as an intermediary, hiding the application server's IP address and providing secure access based on identity and posture.

Answer

ZTNA inline CASB

Answer

IPsec VPN gateway

Answer

FortiClient EMS

Question 10

A FortiGate administrator configures a multi-peer IPsec VPN with two remote gateways for redundancy. The phase 1 configuration has 'set proposal aes256-sha256' and 'set dpd on-idle'. The tunnel is established but traffic fails over to the backup peer only after a long delay. What change would improve failover time?

Accepted Answer

Change DPD mode to 'on-demand' and reduce retry count. DPD on-idle sends probes only when there is no traffic. With DPD on-idle, failure detection can be slow. Changing to DPD on-demand (active probing) or reducing retry intervals speeds up failure detection.

Answer

Increase the phase 2 lifetime

Answer

Enable NAT traversal

Answer

Use IKEv1 instead of IKEv2

Question 11

An administrator configures OSPF over an IPsec VPN tunnel between two FortiGates. The OSPF adjacency does not form. The tunnel is up and ping works between the loopback interfaces used for OSPF. What is the MOST likely issue?

Accepted Answer

The firewall policy allowing OSPF traffic (protocol 89) over the tunnel is missing.. Even if the tunnel is up, OSPF packets (protocol 89) must be explicitly permitted by a firewall policy on the tunnel. Without that policy, OSPF Hellos are dropped and adjacency fails. Network type mismatch can also cause issues, but the most common is missing policy.

Answer

OSPF is not enabled on the tunnel interface.

Answer

The OSPF network type on the tunnel interface is set to point-to-point but the remote side is broadcast.

Answer

The MTU on the tunnel interface is too large for OSPF packets.

Question 12

An administrator is troubleshooting a ZTNA application access issue. Users can authenticate but cannot reach the internal application via the ZTNA proxy. The FortiGate's ZTNA rule uses a tag requiring 'OS Type = Windows' and 'Antivirus = running'. The device meets both conditions. Which THREE possible reasons could cause the access failure?

Accepted Answer

The ZTNA proxy's destination is pointing to the wrong internal IP or port.. If the tag is met, the device passes posture. Access failure can be due to wrong proxy destination (A), missing firewall policy (C), or untrusted certificate (D). Tag assignment (B) is irrelevant if tag is already satisfied; FortiClient EMS is not required for device posture if using other telemetry (E), but even if required, not having FortiClient would prevent the tag from being met, which contradicts the premise.

Answer

The user is not assigned the ZTNA tag in the FortiClient EMS portal.

Answer

The device does not have FortiClient installed.

Question 13

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal web application. The current network uses FortiGate as the firewall. Which component is required to enforce ZTNA policies on the FortiGate?

Accepted Answer

FortiGate ZTNA proxy configuration. ZTNA on FortiGate requires the FortiGate to act as a ZTNA proxy (gateway) that intercepts traffic to internal applications. Option B is correct because the FortiGate must be configured as a ZTNA proxy to receive and forward traffic according to access rules.

Answer

FortiSandbox for content inspection

Answer

FortiAnalyzer for log analysis

Answer

FortiAuthenticator for RADIUS authentication

Question 14

An administrator wants to use SAML SSO with FortiGate as the Service Provider (SP) to allow users to authenticate via an external IdP. What must be configured first on the FortiGate to establish the SAML trust?

Accepted Answer

A certificate for SAML signing and encryption. SAML SSO requires the FortiGate to have a certificate that the IdP trusts for signing assertions. Option D is correct because the FortiGate needs to import a CA-signed certificate (or use a self-signed) to sign SAML requests and also to establish the trust relationship with the IdP.

Answer

A firewall policy to allow SAML traffic

Answer

A RADIUS server for user authentication

Answer

An LDAP server for group membership lookup

Question 15

You run 'diagnose vpn ike gateway list' and see the following:
gateway name: HUB_GW
  version: IKEv2
  state: UP
  mode: main
  local: 10.0.0.1:500
  remote: 203.0.113.5:500
  auth: psk
  dpd: on
  rekey: 86400
  num_peers: 2
  total_tunnels: 2
  auto-discovery: enabled
What does the 'auto-discovery: enabled' indicate about this VPN gateway?

Accepted Answer

The gateway is acting as an ADVPN hub and will advertise routes to spokes for shortcut tunnel creation. In an ADVPN setup, enabling auto-discovery on the hub allows it to send shortcut route advertisements to spokes, which then can establish direct tunnels. The output confirms the gateway is configured to participate in ADVPN as a hub or as a spoke that can initiate shortcuts.

Answer

The gateway will automatically create new phase2 selectors for any remote subnet

Answer

The gateway will automatically renegotiate IKEv2 keys before expiration

Answer

The gateway will discover other VPN gateways on the same network and form peer relationships