NSE7 Practice Test 44 — 15 Questions

Question 1

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session has been active for 1 hour and will expire in approximately 1 hour. The output shows 'duration=3600' and 'expire=3599', meaning the session has been active for 3600 seconds (1 hour) and will expire in 3599 seconds (approximately 1 hour). The 'proto=6' indicates TCP, and 'proto_state=01' is the TCP state code for an established connection (ESTABLISHED), not a half-open state. This is a normal, healthy session.

Answer

The session is a UDP session for DNS

Answer

The session is in a half-open state (SYN_RCVD)

Answer

The session is blocked because duration exceeds the timeout

Question 2

A FortiGate administrator wants to ensure that files in email attachments are disarmed before delivery. Which security feature should be configured in the antivirus profile?

Accepted Answer

Content Disarm and Reconstruction (CDR). Content Disarm and Reconstruction (CDR) is the correct answer because it is specifically designed to remove active content (e.g., macros, scripts, embedded objects) from email attachments and rebuild them into safe, sanitized versions before delivery. Unlike detection-based methods, CDR proactively disarms threats by stripping potentially malicious elements while preserving the file's usability, making it the ideal choice for disarming attachments in an antivirus profile.

Answer

FortiSandbox inline scanning

Answer

Machine Learning Engine

Answer

Outbreak Prevention

Question 3

An administrator wants to enforce that only devices with up-to-date antivirus software can access corporate resources via ZTNA. Which FortiClient feature should be used to enforce this requirement?

Accepted Answer

ZTNA tags. ZTNA tags are used to define device posture requirements, such as antivirus status. FortiClient reports compliance, and the FortiGate uses these tags to allow or deny access.

Answer

VPN tunnel

Answer

Web filter

Answer

Application firewall

Question 4

An administrator configures a performance SLA for SD-WAN health checks. The SLA uses a ping probe to 8.8.8.8 every 2 seconds with a latency threshold of 150 ms and jitter threshold of 20 ms. After some time, the SD-WAN rule still shows the member as 'dead'. Which command should the administrator use to verify the probe results?

Accepted Answer

diagnose sys sdwan health-check. The 'diagnose sys sdwan health-check' command is the correct tool because it provides real-time, detailed probe results for each SD-WAN health-check member, including latency, jitter, packet loss, and SLA status. This allows the administrator to see exactly why the member is marked as 'dead', such as exceeding the 150 ms latency or 20 ms jitter thresholds. The 'show system sdwan health-check' command only displays configured parameters, not live probe data.

Answer

show system sdwan health-check

Answer

diagnose sys session list

Answer

execute ping-options source 8.8.8.8

Question 5

An organization wants to implement email authentication to prevent spoofing and phishing attacks. They use FortiMail as their email security gateway. Which THREE mechanisms should they configure to achieve comprehensive email authentication?

Accepted Answer

Sender Policy Framework (SPF). Sender Policy Framework (SPF) is correct because it allows the domain owner to publish a DNS TXT record listing authorized sending IP addresses, enabling receiving mail servers (like FortiMail) to verify that the email originated from an approved source. This directly prevents spoofing by rejecting messages from unauthorized IPs claiming to be from the domain.

Answer

Transport Layer Security (TLS) for SMTP

Answer

FortiGuard Antispam

Question 6

An administrator wants to enforce that only devices with corporate-owned certificates can establish an IPsec VPN tunnel. Which IPsec authentication method should be configured?

Accepted Answer

X.509 certificates. X.509 certificates provide a strong, identity-based authentication mechanism that allows the VPN gateway to verify that only devices possessing a corporate-issued certificate can establish an IPsec tunnel. This method relies on a public key infrastructure (PKI) where the gateway validates the certificate chain and optionally checks certificate revocation lists (CRLs) or OCSP responses, ensuring that unauthorized devices without a valid corporate certificate are rejected.

Answer

Pre-shared keys

Answer

Extended Authentication (XAuth)

Answer

Aggressive mode

Question 7

A FortiManager administrator creates an ADOM for the root VDOM and regular VDOMs. The administrator wants to manage only the regular VDOMs from FortiManager. Which ADOM type should be used?

Accepted Answer

Regular ADOM (non-root). A Regular ADOM (non-root) is the correct choice because it allows the administrator to manage only the regular VDOMs (non-root VDOMs) on a FortiGate, excluding the root VDOM. This ADOM type is designed for managing individual VDOMs as separate entities, providing granular control without affecting the root VDOM's global settings or other VDOMs.

Answer

Management VDOM ADOM

Answer

Root ADOM

Answer

Global ADOM

Question 8

Which THREE of the following are valid methods to deliver ZTNA tags to FortiClient? (Select three.)

Accepted Answer

FortiClient configuration profiles. FortiClient configuration profiles allow administrators to define and push ZTNA tags directly to FortiClient endpoints via the EMS-managed policy framework. This is a core method because tags are applied based on device posture and user identity, enabling granular access control without relying on network-layer attributes.

Answer

SNMP

Answer

DHCP options

Question 9

What is the purpose of a route map when used with route redistribution on a FortiGate?

Accepted Answer

To filter or modify route attributes during redistribution. Route maps are used with route redistribution to filter which routes are redistributed and to modify route attributes (such as metric, tag, or next-hop) as they are injected from one routing protocol into another. Option D is correct because route maps provide granular control over the redistribution process, allowing administrators to match specific routes using prefix lists or ACLs and then set attributes like metric or tag before the routes are redistributed.

Answer

To create a prefix list for BGP

Answer

To define the administrative distance of redistributed routes

Answer

To enable the redistribution process

Question 10

A healthcare provider is deploying ZTNA to secure access to an internal electronic health records (EHR) system. The EHR system is composed of multiple web services running on different ports behind a load balancer with IP 10.0.10.100. The load balancer listens on ports 443, 8443, and 9090. The administrator configures a single ZTNA rule with proxy destination 10.0.10.100:443, expecting that the other ports will be accessed via the same rule. However, users report that they can only access the service on port 443; connections to ports 8443 and 9090 fail. The FortiGate logs show that requests to other ports are being dropped. What should the administrator do to resolve this?

Accepted Answer

Create separate ZTNA rules for each port (8443 and 9090).. Each ZTNA rule maps to a single proxy destination port. The rule configured with proxy destination 10.0.10.100:443 only forwards traffic for that specific port. To access services on ports 8443 and 9090, separate ZTNA rules must be created for each port, each with its own proxy destination and access proxy configuration.

Answer

Configure the load balancer to redirect all traffic to port 443.

Answer

Configure the ZTNA gateway to allow all ports to the load balancer.

Answer

Ask users to change the port in their browser to 443.

Question 11

A network administrator is configuring SD-WAN on a FortiGate. They have multiple WAN links and want to ensure that traffic for a critical application uses the link with the lowest latency. Which SD-WAN configuration component should be used to achieve this?

Accepted Answer

Performance SLA with latency threshold and SD-WAN rule using best-quality strategy. The Performance SLA monitors latency (and other metrics) against a configured threshold, and the SD-WAN rule with the 'best-quality' strategy dynamically selects the WAN link that currently has the lowest latency. This ensures the critical application traffic is steered to the optimal link based on real-time performance measurements.

Answer

SD-WAN rule with spillover load balancing

Answer

SD-WAN members with static priority

Answer

Load balancing algorithm set to lowest-cost (SLA)

Question 12

A company wants to protect its internal users from malicious files attached to emails. Which FortiGate feature should be configured to inspect SMTP traffic for malware?

Accepted Answer

Antivirus. FortiGate's Antivirus feature is designed to scan SMTP traffic for malware by inspecting email attachments and body content against virus signatures. When configured in a security policy, it intercepts SMTP sessions, buffers the email data, and performs real-time scanning to block or quarantine malicious files before delivery to internal users.

Answer

Email Filter

Answer

Web Filter

Answer

IPS

Question 13

A FortiGate administrator wants to use FortiAnalyzer to generate a report on top talkers in the network. Which FortiView feature should be used?

Accepted Answer

FortiView. FortiView is the correct feature because it provides real-time and historical traffic visibility, including top talkers, directly from the FortiGate's session table and logs. FortiView's 'Top Talkers' widget aggregates traffic by source IP, destination IP, or application, allowing the administrator to generate reports on the highest bandwidth consumers without needing to run complex queries in Log Analytics.

Answer

Log Analytics

Answer

Playbooks

Answer

Incidents

Question 14

A FortiGate is configured with ECMP load balancing. What is the default behavior when multiple routes have equal cost?

Accepted Answer

Traffic is load balanced across the routes using a hash algorithm. When ECMP load balancing is configured on a FortiGate, the default behavior is to distribute traffic across multiple equal-cost routes using a hash algorithm. This hash algorithm considers fields such as source/destination IP, protocol, and ports to ensure session consistency, meaning all packets belonging to the same session follow the same path. This is the standard ECMP behavior in FortiOS, as documented in the FortiGate Administration Guide.

Answer

The route with the lowest metric is always preferred

Answer

The administrator must enable per-packet load balancing

Answer

All traffic is sent over the first route until it fails

Question 15

A FortiGate is deployed with two ISPs and SD-WAN. The organization uses OSPF to exchange routes with a remote branch. The administrator notices that the FortiGate is not installing OSPF-learned routes into the routing table. The OSPF configuration is verified to be correct, and neighbors are established. Which configuration could be causing the issue?

Accepted Answer

A distribute-list configured under OSPF is filtering the routes from being installed.. A distribute-list applied under OSPF can filter routes from being installed into the routing table even when OSPF neighbors are fully established and the OSPF database contains the routes. This is a common cause of routes being learned but not installed, as the filter operates after the SPF calculation and before route insertion.

Answer

The SD-WAN health-check is configured with 'update-static-route' and is overriding OSPF routes.

Answer

The administrative distance of OSPF is set to 200, which is higher than the default 110.

Answer

The OSPF interface is configured as 'passive', which prevents route exchange.