NSE7 Practice Test 43 — 15 Questions

Question 1

A FortiGate administrator is deploying ZTNA for remote users who connect through FortiClient. The administrator wants to enforce device compliance based on the FortiClient EMS tags. The FortiGate is already integrated with FortiClient EMS. Which configuration step is required to use EMS tags in a ZTNA policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a ZTNA rule and specify the EMS tags as a device posture check.. ZTNA rules on FortiGate can enforce device compliance by referencing EMS tags as device posture checks. The FortiGate queries FortiClient EMS for tags and applies them in the ZTNA rule to permit or deny access. This ensures that only compliant devices can reach protected resources. The other options either misplace EMS tags in firewall policies or confuse ZTNA with SSL VPN.

Answer

Enable ZTNA on the SSL VPN portal and map EMS tags to user groups.

Answer

Configure a ZTNA server and add the EMS tags as a source in the firewall policy.

Answer

Define an address object for the EMS server and use it in a firewall policy.

Question 2

An administrator is troubleshooting why a FortiGate is not applying the expected application control profile to traffic from a specific subnet. The administrator wants to verify which application signature is matching a live session in real time. Which CLI command should be used to display the application name and category for active sessions?

Accepted Answer

diagnose sys session list. The administrator needs to see the application name and category for active sessions. The diagnose sys session list command provides detailed session information, including application identification when application control is enabled. This allows real-time verification of which signature is matching, confirming whether the correct application control profile is applied to the subnet's traffic.

Answer

diagnose sys session filter clear

Answer

diagnose firewall iprope list

Answer

diagnose debug application ipsmonitor -1

Question 3

A FortiGate administrator is deploying ZTNA for remote users who connect through FortiClient. The administrator wants to enforce device compliance based on the FortiClient EMS tags. The FortiGate is already integrated with FortiClient EMS. Which configuration step is required to use EMS tags in a ZTNA policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A ZTNA server configuration that includes the virtual host, server certificate, and application mappings.. The ZTNA server configuration on the FortiGate is the component that defines the access proxy, including the virtual host, server certificate, and application mappings for protected applications. The ZTNA policy then references this server to enforce authentication and authorization. Without the ZTNA server, there is no application-level proxy to control access, so users could not be restricted to specific applications.

Answer

A firewall policy with the destination set to the internal application server's IP address and the action set to accept.

Answer

An SSL VPN portal with a tunnel mode configuration that maps internal subnets to remote users.

Answer

An IPsec dial-up VPN with extended authentication configured on the phase 1 gateway.

Question 4

A security team is deploying FortiEDR to protect endpoints. They want to ensure that when a threat is detected, the endpoint is automatically isolated from the network to prevent lateral movement. However, they also need to allow the endpoint to communicate with the FortiEDR management server for updates and remediation. Which FortiEDR feature should they configure to achieve this?

Accepted Answer

Playbook with network isolation action. FortiEDR playbooks enable automated response actions, including network isolation. The isolation action blocks all network traffic except to the FortiEDR management server, allowing the endpoint to remain managed and receive remediation instructions. This satisfies the requirement of automatic isolation while preserving management connectivity. Other options like application control, device control, or FortiGate policies do not provide the same integrated, automated endpoint isolation capability.

Answer

Firewall policy on FortiGate

Answer

Device control policy

Answer

Application control policy

Question 5

A security administrator is configuring FortiGate to detect and block command-and-control (C2) traffic using the botnet database and DNS filtering. The administrator wants to ensure that infected internal hosts are identified and their C2 communication is blocked. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Configure a DNS filter profile with FortiGuard category filtering and block malicious categories.. To detect and block C2 traffic, the administrator should enable the botnet database with a block action in the antivirus profile and configure DNS filtering to block malicious categories. These two actions provide both IP-based and domain-based blocking of C2 communication, and they leverage FortiGuard threat intelligence. Together they help identify infected hosts and prevent them from reaching C2 infrastructure.

Answer

Disable logging for botnet events to reduce log volume.

Answer

Create a firewall address for each known C2 server and manually add them to a deny policy.

Answer

Enable IPS signatures for known C2 protocols and set the action to monitor only.

Question 6

An administrator is deploying a FortiGate in multi-VDOM mode for a managed services provider. Each customer must have an isolated logical firewall with its own interfaces, policies, and administrators, and the provider wants to limit each customer administrator to only their own VDOM. Which configuration accomplishes this?

Accepted Answer

Create one VDOM per customer, assign interfaces to each VDOM, and create an administrative profile that grants access only to that customer's VDOM. Multi-VDOM mode lets a single FortiGate host multiple logical firewalls, each with dedicated interfaces, policies, and routing. Pairing each customer VDOM with an administrative profile scoped to that VDOM gives the provider both traffic isolation and delegated, restricted management, which is the core MSSP deployment pattern on FortiGate.

Answer

Use global firewall policies and global address objects shared across all customers

Answer

Enable virtual clustering and assign each customer to a different HA group within the cluster

Answer

Configure transparent mode on the FortiGate so each customer subnet is bridged independently

Question 7

A FortiGate administrator is deploying ZTNA for remote users who connect through FortiClient. The administrator wants to enforce device compliance based on the FortiClient EMS tags. The FortiGate is already integrated with FortiClient EMS. Which configuration step is required to use EMS tags in a ZTNA policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ZTNA access proxy with authentication and posture check configured on the ZTNA server.. ZTNA enforcement happens at the access proxy, which is configured on the ZTNA server and performs authentication plus posture checks before allowing traffic to the internal application. It replaces traditional NAT-based publishing with identity- and compliance-aware access. Phase2 selectors, NAT, and VIP objects operate at the network layer and cannot verify user identity or device posture.

Answer

A firewall policy with NAT enabled to hide the internal application address.

Answer

A virtual IP (VIP) object that maps an external address to the application server.

Answer

IPsec phase2 selectors that restrict traffic to the application subnet.

Question 8

An administrator has a FortiGate with multiple VDOMs in NAT/route mode. VDOM-1 and VDOM-2 are connected via an inter-VDOM link. The administrator wants to apply security profiles to traffic passing between the VDOMs. However, when checking the policy list in VDOM-1, no policy is shown for traffic destined to VDOM-2. What is the most likely reason?

Accepted Answer

The administrator must create a policy in each VDOM that allows traffic from the inter-VDOM link interface to the destination interface.. Inter-VDOM traffic requires explicit firewall policies in both the source and destination VDOMs. The administrator must create a policy in VDOM-1 allowing traffic from the internal interface to the inter-VDOM link, and a corresponding policy in VDOM-2 from the inter-VDOM link to the internal interface. Without these, traffic is not allowed and no policy exists.

Answer

The inter-VDOM link interfaces have not been assigned to a zone, so policies cannot reference them.

Answer

Inter-VDOM link traffic is not subject to firewall policies by default.

Answer

The administrator is looking at the wrong VDOM; policies for inter-VDOM traffic are only visible in the root VDOM.

Question 9

A FortiGate is configured with multiple VDOMs. The administrator wants to assign a physical interface to a specific VDOM so that it can be used for that VDOM's traffic. Which configuration step is required?

Accepted Answer

In the global configuration, edit the physical interface and set the VDOM to the desired VDOM.. Assigning a physical interface to a VDOM requires editing the interface in the global configuration and setting its VDOM attribute. This moves the interface to the target VDOM, where it can be used for that VDOM's traffic. Other methods like VLANs or VDOM-specific interface lists do not achieve the same result.

Answer

Create a VLAN subinterface on the physical interface and assign the VLAN to the VDOM.

Answer

Use the 'set vdom' command under the interface configuration in the root VDOM.

Answer

In the VDOM configuration, add the physical interface to the VDOM's interface list.

Question 10

An administrator has a FortiGate in multi-VDOM mode. VDOM-1 is assigned to the marketing team and VDOM-2 to the finance team. The administrator wants both VDOMs to be able to reach a shared DNS server at 10.10.10.53 that sits behind the root VDOM's wan1 interface, without giving either team access to the other's traffic. Which configuration accomplishes this?

Accepted Answer

Create a VDOM link between root and VDOM-1 and another between root and VDOM-2, then add static routes in VDOM-1 and VDOM-2 pointing to the root side of their respective VDOM links, and configure firewall policies on root to allow DNS to 10.10.10.53.. Inter-VDOM links create a private point-to-point Layer 3 path between exactly two VDOMs. By giving each team VDOM its own link to the root VDOM and controlling traffic with root-side policies, the administrator provides selective shared-service access while preventing any direct path between the two teams. Sharing one physical interface or one VDOM link across three VDOMs is not supported and would compromise isolation.

Answer

Configure a static route in VDOM-1 and VDOM-2 with the destination 10.10.10.53/32 and the outgoing interface set to wan1, then add a firewall policy in each VDOM allowing DNS outbound.

Answer

Assign wan1 as a secondary IP on VDOM-1 and VDOM-2 so both VDOMs share the same physical interface, then add a policy route on root that forwards DNS traffic to 10.10.10.53.

Answer

Enable inter-VDOM routing globally and create a single VDOM link shared by VDOM-1, VDOM-2, and root, then place all three VDOMs in the same OSPF area to exchange routes to 10.10.10.53.

Question 11

A FortiGate is configured with multiple VDOMs in NAT/route mode. The administrator wants to allow a server in VDOM-A to be accessed from the internet through VDOM-B, which has the public IP address. The administrator has already created a VDOM link between VDOM-A and VDOM-B. Which additional configuration is required to make the server accessible?

Accepted Answer

Configure a VIP on VDOM-B that maps the public IP to the server's private IP, and ensure firewall policies allow the traffic in both VDOMs.. To allow external access to a server behind a FortiGate with multiple VDOMs, a VIP must be configured on the VDOM with the public IP to perform destination NAT. Firewall policies in both VDOMs must permit the traffic, and the VDOM link carries the translated packets. Without the VIP, the server would not receive the traffic correctly.

Answer

Create a firewall policy in VDOM-B that allows incoming traffic to the VDOM link interface and a policy in VDOM-A that allows traffic from the VDOM link to the server.

Answer

Create a central SNAT policy in VDOM-B to translate the public IP to the server's private IP, and apply it to the VDOM link.

Answer

Enable NAT on the VDOM link interface in VDOM-B and create a static route in VDOM-A pointing to the server.

Question 12

An administrator manages a FortiGate 500E with multiple VDOMs. The administrator needs to configure a new VDOM named 'Partner' and ensure that the Partner VDOM can use a dedicated physical interface for WAN connectivity. The FortiGate has an unused interface 'port5'. The administrator wants to assign port5 to the Partner VDOM and configure it with an IP address. Which sequence of steps is correct?

Accepted Answer

In the global configuration, edit port5 and set its VDOM to 'Partner'. Then, within the Partner VDOM, configure the IP address on port5.. Physical interfaces are assigned to VDOMs from the global configuration by editing the interface and setting its VDOM attribute. Once the interface belongs to the Partner VDOM, you can enter that VDOM and configure the IP address and other settings. This is the correct and only method to dedicate a physical interface to a VDOM.

Answer

Enable 'vdom-link' on port5 and assign it to the Partner VDOM, then configure the IP address.

Answer

In the global configuration, create a virtual interface and bind it to port5, then assign it to the Partner VDOM.

Answer

Within the Partner VDOM, create a new interface and map it to port5 using the 'set interface' command.

Question 13

An administrator is configuring an SD-WAN rule on a FortiGate. They want to load balance traffic across three WAN links based on the volume of traffic sent. Which load balancing algorithm should they use?

Accepted Answer

Volume. The volume load balancing algorithm in SD-WAN distributes traffic based on the measured volume of data sent through each link. It dynamically selects the link with the least volume, ensuring that the total traffic is balanced across available links. This is the only algorithm among the options that directly uses traffic volume as the metric, making it the correct choice for the scenario.

Answer

Source IP

Answer

Session count

Answer

Weighted round robin

Question 14

A FortiGate administrator is deploying ZTNA for remote users who connect through FortiClient. The administrator wants to enforce device compliance based on the FortiClient EMS tags. The FortiGate is already integrated with FortiClient EMS. Which configuration step is required to use EMS tags in a ZTNA policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FortiClient EMS compliance rules.. In FortiGate ZTNA, endpoint compliance is enforced through integration with FortiClient EMS. FortiClient EMS compliance rules define the required posture, such as antivirus signature version, and FortiGate queries EMS for the compliance status of the device. ZTNA rules then use this information to allow or deny access. This ensures that only compliant devices can reach protected applications.

Answer

SSL VPN portal with host checking.

Answer

ZTNA proxy rules with application mapping.

Answer

Firewall policies with antivirus security profiles.

Question 15

A security analyst is investigating an alert from FortiSandbox indicating that a file has a high-risk verdict. The analyst wants to automatically prevent the file from executing on other endpoints. Which FortiSandbox integration should be configured to achieve this?

Accepted Answer

FortiSandbox to FortiGate fabric connector. Configuring the fabric connector between FortiSandbox and FortiGate allows automatic sharing of malicious file verdicts. FortiGate can then block the file hash, preventing download and execution on endpoints. Other fabric connectors are limited to email security, endpoint management, or logging, and do not provide the same automatic network-wide blocking.

Answer

FortiSandbox to FortiAnalyzer fabric connector

Answer

FortiSandbox to FortiClient EMS fabric connector

Answer

FortiSandbox to FortiMail fabric connector