NSE7 Practice Test 44 — 15 Questions

Question 1

A FortiGate administrator is troubleshooting a VPN tunnel that uses IKEv2 with certificate authentication. The tunnel fails to establish, and the IKE debug shows 'no acceptable proposal' for the initial exchange. Which TWO configuration mismatches could cause this error? (Choose two.)

Accepted Answer

Mismatched encryption algorithms between the two peers. 'No acceptable proposal' typically indicates a mismatch in phase1 parameters such as encryption, hash, DH group, or authentication method. Options A and B are correct because IKEv2 proposal includes encryption and authentication algorithms.

Answer

Mismatched phase2 encryption algorithms

Answer

Mismatched IKE version (IKEv1 vs IKEv2)

Answer

Incorrect local certificate configuration on one peer

Question 2

A FortiGate is configured as a SAML service provider (SP) for ZTNA. Users authenticate via an external IdP. After authentication, users are not able to access applications even though the ZTNA proxy rule lists them. What should the administrator check FIRST?

Accepted Answer

The ZTNA proxy rule's allowed group does not include the user's group. When using SAML, the FortiGate needs to map the SAML attributes (e.g., username) to a user group. If the user is not in the correct group, access will be denied.

Answer

The FortiClient EMS license is invalid

Answer

The application server is unreachable from FortiGate

Answer

The SAML IdP certificate is expired

Question 3

A FortiGate administrator wants to integrate FortiClient EMS with FortiGate for ZTNA. Which TWO components must be configured on FortiGate to enable ZTNA access?

Accepted Answer

A ZTNA proxy policy. ZTNA requires a proxy policy to define access rules and a ZTNA proxy/gateway to terminate user connections. Tags and EMS are configured separately.

Answer

A firewall policy to allow traffic from ZTNA proxy to internal servers

Answer

A ZTNA tag on the application server

Answer

FortiClient EMS registration on FortiGate

Question 4

An administrator needs to integrate FortiGate with FortiNAC for network access control. The goal is to dynamically quarantine endpoints that have out-of-date antivirus software. Which component is responsible for enforcing the quarantine on the network?

Answer

FortiNAC's Network Access Policy (NAP)

Answer

The RADIUS server used for 802.1X

Answer

FortiGate firewall policies with ZTNA tags

Answer

FortiClient EMS compliance rules

Question 5

A network administrator is troubleshooting an IPsec VPN tunnel that is not coming up. The configuration uses IKEv2 with pre-shared keys. The administrator runs 'diagnose vpn ike log-filter' and sees no logs. What is the most likely cause?

Accepted Answer

IKE debug is not enabled. Without enabling IKE debug, the diagnose command will not show any output even if the tunnel is failing. The log-filter only filters the debug output; debug must be started first.

Answer

The pre-shared key does not match

Answer

The tunnel name is misspelled in the filter

Answer

The remote gateway is unreachable

Question 6

A company is deploying ZTNA to replace their legacy VPN. They want to ensure that only users with a valid certificate and compliant antivirus can access the internal application. Which TWO components are required on the FortiGate for this deployment?

Accepted Answer

ZTNA proxy rule with access proxy. ZTNA uses a proxy rule (access proxy) to publish the application, and a firewall policy that references ZTNA tags and the access proxy to enforce access based on identity and posture.

Answer

Dynamic routing protocol (BGP)

Answer

SSL-VPN portal

Answer

IPsec phase1 with certificate authentication

Question 7

You run the following command on a FortiGate: 'diagnose vpn ike gateway list' and see that the DPD status for a VPN peer is 'dead'. What does this indicate?

Accepted Answer

The VPN peer has been detected as unreachable and the tunnel is considered down. DPD (Dead Peer Detection) is used to check the liveness of a VPN peer. 'Dead' means the peer is not responding to DPD messages, indicating the tunnel is down.

Answer

The remote peer has been manually disconnected from the network

Answer

The VPN tunnel is still up but the peer is not responding to DPD messages

Answer

The IKE SA is still active but the IPsec SA has expired

Question 8

A FortiGate administrator needs to integrate with FortiNAC to enforce network access control for wired and wireless devices. The administrator wants FortiNAC to dynamically assign VLANs based on the device's security posture. Which FortiNAC feature enables this?

Accepted Answer

NAC policies. NAC policies define rules for device classification and VLAN assignment based on posture assessment results.

Answer

DHCP fingerprinting

Answer

RADIUS accounting

Answer

SNMP traps

Question 9

A network administrator configures a hub-and-spoke ADVPN with FortiGates. Phase 1 and phase 2 settings are correct, and spoke gateways can communicate with the hub. However, shortcut tunnels between spokes are not being established. What is the most likely cause?

Accepted Answer

Dynamic routing (BGP/OSPF) is not configured over the VPN overlay. ADVPN requires policy-based routing or routing protocol to propagate routes and trigger shortcut setup. Without a routing protocol like BGP/OSPF, spokes will not learn routes to other spokes, and shortcut negotiation fails.

Answer

DPD is disabled on the phase 1 interface

Answer

The hub FortiGate has 'set auto-discovery-sender enable' configured

Answer

The spoke FortiGates do not have IKEv2 enabled

Question 10

A FortiGate administrator configures a hub-and-spoke VPN with OSPF routing. The spoke FortiGates are learning routes from the hub, but inter-spoke traffic is being routed through the hub instead of using shortcut tunnels. What configuration is missing on the hub to allow ADVPN shortcut establishment?

Accepted Answer

Disable route redistribution from OSPF into the VPN tunnel interface on the hub. For ADVPN to work, the hub must have 'auto-discovery-sender' enabled and also must not redistribute spoke routes back to other spokes in a way that prevents shortcut. Typically, the hub should not redistribute OSPF routes learned from one spoke into another; ADVPN relies on IKE shortcuts.

Answer

Set the VPN interface type to 'tunnel' instead of 'vlan'

Answer

Enable 'auto-discovery-sender' on the hub and 'auto-discovery-forwarder' on spokes

Answer

Configure a static route for inter-spoke traffic on the hub

Question 11

An administrator configures ZTNA inline CASB to control access to a SaaS application. The goal is to block uploads of files with credit card numbers. The administrator configures a CASB profile with a DLP rule for credit card numbers. However, uploads are not being blocked. What is the most likely reason?

Accepted Answer

SSL inspection is not enabled for the traffic. Inline CASB requires the traffic to be decrypted via SSL inspection; otherwise, the DLP engine cannot inspect the content of encrypted HTTPS traffic.

Answer

The CASB profile is not applied to the ZTNA policy

Answer

The DLP rule is configured to monitor instead of block

Answer

The SaaS application is not supported by CASB

Question 12

A FortiGate administrator is troubleshooting a scenario where remote users can connect to the VPN but cannot access internal resources. The VPN policy is configured correctly. Which TWO steps should the administrator take to diagnose the issue?

Accepted Answer

Verify that the routing table on the FortiGate includes the remote networks. Check routing and firewall policies. If the tunnel is up but traffic is not forwarded, routing may be missing or firewall policies may be blocking or not matching.

Answer

Restart the IKE daemon on the FortiGate

Answer

Disable NAT on the VPN policy

Answer

Increase the DPD retry count

Question 13

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is up but traffic is not passing. The administrator runs 'diagnose vpn ike gateway list' and sees that the IKE SA has been established. However, 'diagnose vpn tunnel list' shows no IPsec SA entries. What is the most likely cause?

Accepted Answer

The phase 2 proposal (encryption, authentication, etc.) does not match between peers. IKE SA established but no IPsec SA indicates that phase 2 parameters are misconfigured or the proposal is not matching.

Answer

The firewall policies are not configured to allow traffic through the tunnel

Answer

The pre-shared key on both sides does not match

Answer

The interface MTU is set too low

Question 14

A FortiGate is configured as a ZTNA proxy for an internal web application. The client's device posture check fails due to an outdated antivirus definition. The administrator wants to block access but still display a warning page. Which ZTNA access rule action should be used?

Accepted Answer

set action block. ZTNA access rules can block or allow with optional warning. 'Allow with warning' is not available; to show a warning while blocking, the action should be 'Block' with a redirect to a warning portal.

Answer

set action redirect

Answer

set action authenticate

Answer

set action allow

Question 15

An administrator is configuring ZTNA inline CASB for a SaaS application. The goal is to block upload of files containing credit card numbers. Which configuration components are required?

Accepted Answer

Configure a ZTNA application with a CASB profile and SSL inspection. ZTNA inline CASB uses a ZTNA proxy with SSL inspection and a CASB profile that includes a data leak prevention (DLP) rule to detect credit card numbers.

Answer

Use FortiClient to enforce DLP on endpoints

Answer

Configure an IPsec VPN between FortiGate and the SaaS provider

Answer

Configure a web filter profile with DLP sensor