NSE7 Practice Test 44 — 15 Questions

Question 1

An administrator is deploying a FortiGate with multiple VDOMs in NAT mode. The administrator wants to ensure that traffic between VDOMs is inspected by security profiles and that inter-VDOM traffic does not bypass the firewall policy engine. Which configuration is required to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable inter-VDOM routing and create a firewall policy between the VDOM links.. Inter-VDOM routing requires VDOM links, which are virtual interfaces that connect VDOMs. To inspect inter-VDOM traffic, firewall policies must be created on each VDOM to allow and apply security profiles to traffic traversing the VDOM link. This ensures that all inter-VDOM traffic is subject to the same security policies as external traffic, preventing bypass.

Answer

Enable VDOM partitioning and assign interfaces to each VDOM.

Answer

Enable ASIC offloading for inter-VDOM traffic to ensure inspection.

Answer

Configure a single firewall policy with all interfaces as source and destination.

Question 2

A FortiGate is the hub of an IPsec VPN and also terminates SSL VPN for remote users. The administrator wants remote users to access internal resources only after the FortiGate validates the endpoint's compliance through FortiClient EMS, and wants the validation to happen before the user is placed in a VPN address pool. Which SSL VPN configuration element enforces endpoint compliance during the connection handshake?

Accepted Answer

SSL VPN host check policy that references FortiClient EMS compliance tags.. Endpoint compliance before address assignment is enforced by the SSL VPN host check policy, which can reference FortiClient EMS compliance tags and runs during the connection handshake. It blocks or restricts non-compliant endpoints before they receive a VPN address, satisfying the requirement. Certificate and portal settings affect authentication and routing but not posture evaluation.

Answer

SSL VPN settings with the 'Require Client Certificate' option enabled.

Answer

SSL VPN realm configured with a custom authentication timeout.

Answer

SSL VPN portal with split tunneling disabled.

Question 3

A FortiGate is configured as a hub in an ADVPN with multiple spokes. The administrator notices that some spokes are not learning routes from other spokes, even though the ADVPN tunnel is up. The hub is using BGP for routing. Which configuration on the hub is required to enable spoke-to-spoke route propagation?

Accepted Answer

Configure the hub as a BGP route reflector and set the spokes as route reflector clients.. For spoke-to-spoke route propagation in ADVPN, the hub must be configured as a BGP route reflector. This allows the hub to reflect routes received from one spoke to other spokes, enabling dynamic tunnel establishment between spokes. Without route reflection, spokes only learn routes from the hub and cannot directly reach other spokes.

Answer

Set the hub's BGP router ID to match the IPsec tunnel IP address.

Answer

Enable multihop on the hub's BGP peering with the spokes.

Answer

Enable split-horizon on the hub's IPsec tunnel interfaces.

Question 4

An administrator is configuring a FortiGate for SD-WAN and wants to ensure that outgoing traffic from the internal network is distributed across two WAN links based on the number of active sessions. Which SD-WAN load balancing algorithm should be used?

Accepted Answer

Session count. The 'session count' SD-WAN algorithm selects the member with the fewest active sessions, which directly load balances based on session count. Other algorithms like source IP, volume, or weighted round robin use different criteria such as source address, data volume, or static weights, and do not dynamically balance based on the number of active sessions. Therefore, 'session count' is the correct choice.

Answer

Weighted round robin

Answer

Source IP based

Answer

Volume

Question 5

A FortiGate 600E is running in multi-VDOM mode with VDOM-1 and VDOM-2. The administrator assigns physical port3 to VDOM-1 as a dedicated interface, then creates a VLAN subinterface (VLAN 100) on port3 for VDOM-2. After configuration, VLAN 100 traffic is dropped even though the VLAN interface is up. Which action resolves the issue?

Accepted Answer

Create the VLAN 100 subinterface inside VDOM-1, where the parent interface resides, rather than in VDOM-2.. On FortiGate, VLAN subinterfaces inherit the VDOM membership of their parent physical interface. Because port3 is assigned to VDOM-1, VLAN 100 must also be created within VDOM-1. Creating it under VDOM-2 leaves the traffic unhandled in the VDOM that actually receives the frames, so frames are dropped.

Answer

Configure a VDOM link between VDOM-1 and VDOM-2 and route VLAN 100 traffic through the link.

Answer

Enable the vlan-forwarding setting under config system interface on port3.

Answer

Assign the physical port3 interface to VDOM-2 as well, using the same interface in both VDOMs.

Question 6

A FortiGate administrator is troubleshooting a ZTNA access proxy rule that is not matching traffic from a specific user group. The rule is configured with a source of 'ZTNA_Users' and a destination of the internal web server. The administrator confirms that the user is authenticated and has the correct EMS tag. Which FortiGate CLI command should the administrator use to verify that the ZTNA rule is being evaluated correctly?

Accepted Answer

diagnose wad debug enable category ztna. The 'diagnose wad debug enable category ztna' command enables detailed debugging of ZTNA processing in the WAD daemon, which handles access proxy rules. It shows rule matching, user identification, and any errors. Other commands like 'diagnose firewall auth list' only show authentication status, while 'fnbamd' debugging is for authentication daemon issues. For ZTNA rule matching, WAD debug is the correct tool.

Answer

diagnose debug application fnbamd -1

Answer

diagnose vpn ike gateway list

Answer

diagnose firewall auth list

Question 7

A FortiGate administrator wants to prevent users from accessing a list of known malicious domains. The list is updated daily by a third-party provider and available as a plain text file over HTTPS. Which FortiGate feature should be used to ingest and block these domains?

Accepted Answer

External Threat Feed connector. The External Threat Feed connector is designed to import IP or domain lists from external HTTP/HTTPS sources and keep them updated. It creates a dynamic object that can be referenced in policies, providing automated blocking. The other options are either static or tied to Fortinet's own categorization, and cannot ingest a custom third-party list automatically.

Answer

FortiGuard DNS Filter with custom categories

Answer

Static DNS zone with blackhole

Answer

FortiGate local domain blocklist

Question 8

A company uses FortiEDR and wants to ensure that when an endpoint is compromised, the threat is contained and the security team receives detailed forensics. The team also wants to prevent the malicious process from communicating with its command-and-control server. Which FortiEDR feature should be configured to achieve both containment and forensic data collection?

Accepted Answer

Use 'Playbooks' with a 'Block and Remediate' action triggered by a malicious verdict.. FortiEDR playbooks automate responses based on verdicts. A Block and Remediate playbook can terminate the malicious process, sever command-and-control communication, and initiate forensic collection. Logging, exclusions, or monitoring alone do not provide containment, so they cannot meet the combined requirement for automated containment and detailed forensics.

Answer

Enable 'Security Events' with 'Log' action for all process executions.

Answer

Set the 'Threat Hunting' module to 'Monitor' mode for all endpoints.

Answer

Configure 'Exclusions' to prevent FortiEDR from scanning critical applications.

Question 9

A FortiGate administrator is troubleshooting an issue where users are unable to access a web server behind the FortiGate. The web server is on the DMZ network, and users are on the internal network. The firewall policy from internal to DMZ is configured to allow HTTP and HTTPS. The administrator runs 'diagnose debug flow' and sees that packets are being dropped with the message 'iprope_in_check() check failed, drop'. Which two actions should the administrator take to resolve this issue? (Choose two.)

Accepted Answer

Verify that the firewall policy from internal to DMZ is correctly configured with the correct source and destination interfaces and addresses.. The 'iprope_in_check()' drop indicates that the packet failed the inbound policy check. This can happen if the policy is misconfigured, such as incorrect interfaces or addresses, or if a preceding policy is denying the traffic. Therefore, verifying the policy configuration and its order are the correct actions. Routing and server-side issues would produce different symptoms.

Answer

Check the FortiGate's ARP table for the web server's MAC address.

Answer

Verify that the web server is listening on the correct ports and is reachable from the FortiGate.

Answer

Check the routing table to ensure there is a route to the DMZ network.

Question 10

An administrator is configuring an SD-WAN rule to route traffic to a specific destination through a preferred member, but wants to ensure that if that member fails, traffic automatically switches to another member. Which SD-WAN rule configuration setting should they use to define the order of member preference?

Accepted Answer

Member sequence in the SD-WAN rule. To define a preferred order of members for failover in an SD-WAN rule, the administrator should list the members in the desired sequence within the rule configuration. The FortiGate will use the first available member according to that order when the strategy is 'manual' or when failover is triggered. This ensures deterministic behavior.

Answer

SLA target

Answer

Load balancing algorithm

Answer

Priority

Question 11

A FortiGate administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The administrator runs 'diagnose vpn ike gateway list' and sees the tunnel state as 'connecting' but no phase2 selectors are listed. Which step should the administrator take next to identify the issue?

Accepted Answer

Run 'diagnose debug application ike -1' and then attempt to bring up the tunnel to capture IKE negotiation details.. When an IPsec tunnel is stuck in 'connecting' with no phase2 selectors, the issue is likely in phase2 negotiation. Enabling IKE debug with 'diagnose debug application ike -1' will show the detailed negotiation, including proposals and selectors, and any error messages. This is the best next step to identify the cause, such as mismatched phase2 proposals or incorrect proxy IDs. Other commands may not provide the necessary detail.

Answer

Run 'diagnose vpn tunnel list' to check the status of all IPsec tunnels and their selectors.

Answer

Run 'diagnose vpn ike gateway list' with the 'name' parameter to see detailed phase1 and phase2 information.

Answer

Run 'diagnose vpn ike status' to check the IKE status and any error counters.

Question 12

A FortiGate administrator is configuring ZTNA to provide access to an internal web application. The administrator wants to ensure that only devices with a specific security posture tag are allowed access. The ZTNA rule is configured with a policy that references a device group synced from FortiClient EMS. However, when a user attempts to access the application, the connection is denied even though the device has the correct tag. What is the most likely cause?

Accepted Answer

The FortiClient EMS tag is not synchronized with the FortiGate due to a certificate or connectivity issue.. The most likely cause is that the FortiClient EMS tag is not synchronized with the FortiGate. Even if the device has the tag in EMS, the FortiGate must receive that information via the EMS connector. If synchronization fails due to certificate issues or connectivity, the FortiGate will not recognize the device as compliant, resulting in a denial.

Answer

The user's device is not running FortiClient, so the tag cannot be evaluated.

Answer

The ZTNA rule is missing a matching source interface or source address.

Answer

The ZTNA proxy rule requires an application mapping that has not been configured.

Question 13

A network administrator is setting up an IPsec VPN between two FortiGates. The administrator wants to ensure that if the VPN tunnel goes down, the FortiGate can automatically re-establish it without manual intervention. Which IPsec feature should the administrator enable to detect peer failures and trigger tunnel renegotiation?

Accepted Answer

Dead Peer Detection (DPD) with the mode set to on-idle or always.. Dead Peer Detection is the IPsec mechanism that monitors peer liveness by sending probes or waiting for idle periods. When the peer fails to respond, DPD marks the tunnel as down and triggers renegotiation or failover. Setting DPD mode to on-idle or always ensures continuous monitoring, enabling automatic tunnel recovery without manual intervention.

Answer

Automatic Key Negotiation (AutoIKE) to dynamically negotiate new SAs.

Answer

Perfect Forward Secrecy (PFS) to generate new keys for each phase 2 negotiation.

Answer

IKEv2 fragmentation to allow large packets to traverse the tunnel.

Question 14

A security administrator is reviewing threat logs on a FortiGate running FortiOS 7.4. Multiple internal hosts have triggered IPS signatures for a known botnet C2 domain, but the administrator wants to ensure that DNS queries to this domain are blocked before a connection is attempted. The FortiGate is already using the default FortiGuard ISDB and IPS signatures. Which FortiGate feature should the administrator configure to block DNS resolution of the malicious domain?

Accepted Answer

DNS filter profile with a static domain filter entry set to block. The DNS filter profile is designed to inspect DNS queries and can block resolution of specific domains using static domain filters. When applied to a policy, it prevents internal hosts from resolving malicious domains, effectively stopping connections before they start. Other features like web filter or application control operate at later stages and do not block DNS resolution.

Answer

Web filter profile with a URL filter entry set to block

Answer

IPS sensor with a custom signature that matches the domain name in DNS queries

Answer

Application control profile with a signature to block the botnet application

Question 15

A security team is using FortiSandbox to analyze suspicious files. They notice that some files are being analyzed but the verdicts are not being sent back to the FortiGate, so the firewall is not blocking them. Which FortiSandbox setting should the administrator verify to ensure verdicts are returned to the FortiGate?

Accepted Answer

The FortiGate is not configured with the correct FortiSandbox IP address and API key.. The most common reason for missing verdicts is incorrect integration settings on the FortiGate. The FortiGate must have the FortiSandbox's IP address and API key configured correctly to receive verdicts. Without this, files may be submitted, but the firewall cannot authenticate or retrieve results, so blocking does not occur. Verifying these settings resolves the issue.

Answer

The FortiSandbox is configured to use 'Analysis' mode instead of 'Inline' mode.

Answer

The FortiGate is using a different protocol for file submission than for verdict retrieval.

Answer

The FortiSandbox is not licensed for verdict submission.