NSE7 Practice Test 43 — 15 Questions

Question 1

A multinational corporation is implementing ZTNA for remote access to a critical internal application hosted on a server with IP 10.0.1.200:8443. The FortiGate is deployed at the edge with WAN IP 203.0.113.50. The administrator configures a ZTNA rule with proxy destination 10.0.1.200:8443, a firewall policy allowing traffic from the ZTNA gateway to the internal server, and a VIP for port forwarding for testing. However, remote users report that they can establish a ZTNA connection to the gateway but the application page fails to load, showing a blank page after a long delay. The FortiGate logs show no errors, and the debug output indicates that the proxy successfully forwarded the request to 10.0.1.200:8443 and received a response. The internal server team confirms the application is working correctly for on-site users. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The application uses hardcoded IP addresses or internal hostnames that are not resolvable externally.. The application uses hardcoded IP addresses or internal hostnames that are not resolvable externally. When the ZTNA proxy forwards the request to the internal server, the server responds with HTML content that references internal resources (e.g., images, scripts, or links) using private IP addresses (like 10.0.1.200) or internal DNS names. The remote client cannot resolve or reach these internal addresses, causing the page to load partially or display a blank page after a delay, even though the initial proxy connection and response are successful.

Answer

The ZTNA proxy is not configured to support HTTPS.

Answer

The internal server is not reachable from the FortiGate.

Answer

The client's ZTNA tags are expired.

Question 2

An administrator configures an HA cluster with two FortiGates using an FGCP active-passive configuration. After a failover, the new primary FortiGate shows all sessions are lost. The administrator has 'sync session' enabled in the HA configuration. What is the MOST likely reason sessions were not synchronized?

Accepted Answer

The HA heartbeat interface is overloaded, causing session synchronization packets to be dropped. In an FGCP active-passive cluster, session synchronization relies on the heartbeat interface to transmit session-pickup packets from the active unit to the passive unit. If the heartbeat interface is overloaded (e.g., due to excessive traffic or misconfigured bandwidth), these packets can be dropped, causing the passive unit to lack the session table after a failover. The fact that 'sync session' is enabled but sessions are still lost points directly to a transport issue on the heartbeat link, not a configuration or policy problem.

Answer

The passive unit's 'session-pickup' setting is disabled

Answer

The 'failover-monitor' interface is down on the active unit, preventing session sync

Answer

The 'session-ttl' setting is set to zero on the active unit

Question 3

An admin configures Content Disarm and Reconstruction (CDR) on FortiGate to protect against malicious macros in Office documents. After applying the CDR profile to a firewall policy, users complain that documents are not being delivered. What is the most likely cause?

Accepted Answer

The firewall policy is configured for flow-based inspection. CDR requires proxy-based inspection to intercept, disarm, and reconstruct documents. Flow-based inspection bypasses the deep inspection engine, so CDR cannot process the files, causing delivery failures. FortiGate must use proxy-based inspection mode for CDR to function correctly.

Answer

The CDR profile has 'File Filter' enabled that blocks the file type

Answer

The FortiGate is running in transparent mode

Answer

The antivirus profile is not applied to the same policy

Question 4

A FortiGate administrator wants to use PKI certificates for IPsec VPN authentication instead of pre-shared keys. Which phase1 parameter must be set to 'signature' to enable certificate-based authentication?

Accepted Answer

set authmethod signature. The IKE peer authentication method is controlled by the 'authmethod' parameter. Setting it to 'signature' enables RSA signature-based authentication using certificates.

Answer

set cert-validation enable

Answer

set ike-version 2

Answer

set peer-id certificate

Question 5

Refer to the exhibit. A FortiGate is configured with the above settings. The FortiManager at 192.168.1.100 cannot establish a management connection to the FortiGate. What is the most likely cause?

Accepted Answer

The FortiGate's port1 IP is not in the same subnet as the FortiManager. The FortiGate's port1 IP (10.0.1.1/24) is on a different subnet (10.0.1.0/24) than the FortiManager's IP (192.168.1.100), which is on the 192.168.1.0/24 subnet. For a management connection to be established, the FortiGate and FortiManager must be able to route to each other, typically requiring them to be on the same subnet unless a gateway or static route is configured. Since no routing is mentioned, the subnet mismatch is the most likely cause of the failure.

Answer

HTTPS access is not enabled on port1

Answer

The admin user 'admin' is not configured correctly

Answer

The trusthost configuration does not include the FortiManager IP

Question 6

A FortiGate in HA mode has two VDOMs: VDOM1 and VDOM2. The administrator needs to ensure that if the active unit fails, the standby unit takes over with minimal disruption. Which TWO steps should be taken?

Accepted Answer

Enable session synchronization. Session synchronization ensures that stateful firewall sessions (e.g., TCP/UDP connections) are replicated from the active FortiGate to the standby unit. In HA active-passive mode, this allows the standby to seamlessly take over active sessions upon failover, minimizing disruption. Without session synchronization, all existing connections would be dropped and must be re-established.

Answer

Set the HA mode to active-active

Answer

Enable HA on each VDOM individually

Answer

Use VDOM link for inter-VDOM traffic

Question 7

An administrator configures an ALG for SIP traffic but notices that some SIP calls are failing. The admin suspects the ALG is modifying SIP headers incorrectly. Which debug command can help verify the ALG's actions on SIP packets?

Accepted Answer

diagnose debug application sip -1. The command 'diagnose debug application sip -1' enables detailed debugging of the SIP ALG process on FortiGate, showing how the ALG inspects and modifies SIP headers (e.g., Via, Contact, SDP). This allows the admin to verify if the ALG is incorrectly rewriting IP addresses or ports, which is a common cause of call failures. The '-1' flag sets the debug level to maximum verbosity, capturing all ALG-related SIP transactions.

Answer

diagnose debug application alg -1

Answer

get system performance status

Answer

diagnose sys session filter proto 17

Question 8

A FortiGate administrator runs the following command and sees the output:

diagnose sys session filter dport 443
diagnose sys session list

Output shows sessions with proto=6 and expire time decreasing. What does this indicate?

Accepted Answer

The sessions are TCP sessions and are active. The command 'diagnose sys session filter dport 443' filters sessions with destination port 443, and 'diagnose sys session list' displays them. The output shows 'proto=6', which is the protocol number for TCP (per IANA protocol numbers). The 'expire time decreasing' indicates that the session timer is counting down, which is normal behavior for an active TCP session that is being refreshed by ongoing traffic. Therefore, the sessions are TCP and active.

Answer

The sessions are using UDP protocol

Answer

The FortiGate is performing deep packet inspection on these sessions

Answer

The sessions are being blocked by a firewall policy

Question 9

A FortiGate administrator wants to integrate ZTNA with FortiClient EMS to control access to an internal application based on device posture. The admin has configured a ZTNA tag in EMS for 'AntiVirus enabled' and created a ZTNA rule in FortiGate. What additional configuration is required on the FortiGate to enforce access based on the ZTNA tag?

Accepted Answer

Configure the FortiGate as an EMS connector and import the tag. For FortiGate ZTNA integration with EMS, the FortiGate must be configured as an EMS connector to import ZTNA tags. These tags are then used in firewall policies to enforce access based on device posture. Option D is correct because the connector enables the FortiGate to receive tags from EMS. Option A is incorrect because SSL VPN is not required for ZTNA; ZTNA uses client certificates or other methods. Option B is incorrect because client certificates are not installed from FortiGate for ZTNA; EMS handles certificate distribution. Option C is incorrect because inline CASB is a different feature and not related to ZTNA tag enforcement.

Answer

Configure SSL VPN to authenticate users and assign tags

Answer

Install a client certificate on each FortiClient from the FortiGate

Answer

Enable ZTNA inline CASB in the antivirus profile

Question 10

An administrator needs to restrict inter-VDOM traffic between two VDOMs on a FortiGate. Which TWO configurations are required?

Accepted Answer

Create firewall policies in each VDOM to allow/deny traffic. Inter-VDOM traffic on a FortiGate is controlled by firewall policies within each VDOM. By creating policies in each VDOM that specify the VDOM link as the interface, the administrator can explicitly allow or deny traffic between the VDOMs, enforcing security boundaries. Without these policies, traffic would be implicitly denied by the default firewall behavior.

Answer

Enable inter-VDOM routing globally

Answer

Assign an IP address to the VDOM link in each VDOM

Answer

Configure static routes on each VDOM

Question 11

An administrator is configuring FortiGate automation stitches to respond to a detected ransomware outbreak. The trigger is a high severity event from FortiSandbox. Which TWO actions can be used in an automation stitch to contain the threat?

Accepted Answer

Execute a CLI script to block the infected host's IP address. Executing a CLI script to block the infected host's IP address directly on the FortiGate allows immediate containment by applying a firewall policy or address-based block, which is a standard action in automation stitches for threat response. Option E is correct because quarantining the endpoint via FortiClient EMS integration leverages the FortiClient endpoint agent to isolate the infected device from the network, which is a supported action in automation stitches for ransomware containment.

Answer

Create a new FortiGate administrator account

Answer

Send an SNMP trap to a monitoring system

Answer

Change the SSID of a wireless network

Question 12

An organization wants to protect against zero-day malware by using FortiGate's outbreak prevention feature. Which configuration is required to enable outbreak prevention in the antivirus profile?

Accepted Answer

Select 'Outbreak Prevention' under Antivirus profile settings. FortiGate's outbreak prevention feature is specifically enabled within the antivirus profile by selecting the 'Outbreak Prevention' option. This setting leverages FortiGuard's outbreak alert database to block files that match known outbreak signatures, providing protection against zero-day malware before traditional signatures are available.

Answer

Enable 'Machine Learning Engine' in the antivirus profile

Answer

Enable 'FortiSandbox Inline Scan'

Answer

Configure a web filter profile to block malicious URLs

Question 13

A FortiGate is configured with two SD-WAN members (wan1, wan2) and a performance SLA for each. The SD-WAN rule uses 'Maximize Bandwidth' strategy with volume-based load balancing. The administrator notices that traffic is only using wan1, even though both links have capacity. The SLA status for wan2 shows 'alive'. What could be the problem?

Accepted Answer

The SD-WAN rule has a 'set member' statement that lists only wan1.. The 'Maximize Bandwidth' strategy with volume-based load balancing distributes traffic based on bandwidth weights, but the SD-WAN rule's 'set member' statement explicitly defines which interfaces are eligible for load balancing. If the rule lists only wan1, traffic will never be sent to wan2, regardless of SLA status or bandwidth weights. This is the most direct cause of the observed behavior.

Answer

The link cost for wan2 is too high.

Answer

The performance SLA for wan2 is not associated with the SD-WAN rule.

Answer

The bandwidth weight for wan2 is set to 0.

Question 14

An administrator needs to configure a FortiGate to use two WAN links for internet traffic with failover and load balancing. Which TWO steps are required?

Accepted Answer

Define SD-WAN rules to match internet-bound traffic.. For internet traffic failover and load balancing over two WAN links, the FortiGate must first add both WAN interfaces as SD-WAN members (option E) to form the SD-WAN zone. Then, SD-WAN rules (option D) are required to match internet-bound traffic and define how it is distributed among the members (e.g., by volume, session, or spillover) and which failover strategy to apply. Without these rules, the SD-WAN zone cannot enforce load balancing or failover policies for the traffic.

Answer

Configure a performance SLA for each SD-WAN member.

Answer

Set the SD-WAN zone to 'spillover' mode.

Answer

Enable NAT on the SD-WAN zone.

Question 15

An administrator is troubleshooting a scenario where VoIP traffic is not being properly handled by the FortiGate. The SIP ALG is enabled. Which THREE commands should the administrator run to diagnose the SIP traffic flow?

Accepted Answer

get router info routing-table all. To diagnose SIP traffic flow with SIP ALG enabled on FortiGate, the administrator should use three key commands. Option A: `get router info routing-table all` checks the routing table to ensure that SIP packets have a valid path to their destination. Option B: `diagnose sys session filter dport 5060` filters the session table to display only sessions using destination port 5060 (default SIP signaling port), allowing verification that SIP sessions are being tracked. Option C: `diagnose debug application sip -1` enables verbose debug logging for the SIP application, providing detailed information about how the SIP ALG processes each SIP packet, including parsing, rewriting, and errors. Together, these commands help identify routing issues, session tracking, and SIP ALG processing problems.

Answer

diagnose debug application sip -1