NSE7 Practice Test 45 — 15 Questions

Question 1

An administrator is configuring a FortiGate with multiple VDOMs. The administrator wants to ensure that each VDOM has its own separate routing table. Which statement is correct?

Accepted Answer

Each VDOM maintains its own independent routing table, and routes are not shared between VDOMs by default.. In a multi-VDOM FortiGate, each VDOM has its own independent routing table. Routes are not shared between VDOMs by default, ensuring isolation. This allows each VDOM to have separate routing policies and next-hop gateways. Inter-VDOM routing must be explicitly configured using VDOM links if communication between VDOMs is required.

Answer

All VDOMs share a single global routing table, but policies can filter routes.

Answer

Only the management VDOM has a routing table; other VDOMs use the management VDOM's routing table.

Answer

Routes are automatically synchronized between VDOMs to ensure consistent routing.

Question 2

An administrator wants to block outbound traffic from internal hosts to known malicious domains without relying on full URL inspection or certificate inspection. The requirement is to use a lightweight DNS-based security service on FortiGate that can block botnet C2 and phishing domains. Which FortiGuard feature should the administrator enable and configure in a DNS filter profile?

Accepted Answer

FortiGuard DNS Filter. FortiGuard DNS Filter is the correct choice because it provides DNS-layer security by categorizing and blocking malicious domains using FortiGuard's DNS rating service. It is lightweight and does not require full URL inspection or certificate inspection. Enabling it in a DNS filter profile and applying it to a firewall policy allows the FortiGate to block botnet C2 and phishing domains effectively.

Answer

FortiGuard Anti-Spam

Answer

FortiGuard IP Reputation

Answer

FortiGuard Web Filter

Question 3

An administrator is configuring a FortiGate with multiple VDOMs. The administrator wants to ensure that each VDOM has its own separate routing table. Which statement is correct?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Newly Observed Domain. Newly Observed Domain is a FortiGuard category that identifies domains registered recently, which are disproportionately used in phishing and malware campaigns. Blocking it provides proactive protection against unknown malicious domains without manual URL submission. Other categories either target different threat types or are reactive, so they do not meet the requirement for minimal-impact, automated blocking of newly registered domains.

Answer

Potentially Unwanted Program

Answer

Malicious Websites

Answer

Dynamic DNS

Question 4

An administrator is deploying a FortiGate with multiple VDOMs in NAT/route mode. The administrator needs to configure inter-VDOM routing between VDOM-A and VDOM-B. Which two actions are required to enable traffic to flow between the two VDOMs? (Choose two.)

Accepted Answer

Configure firewall policies in each VDOM to allow traffic from the source to the destination through the VDOM link.. Inter-VDOM routing requires a VDOM link to provide the Layer 3 connection, and firewall policies in both VDOMs to permit the traffic. The VDOM link acts as a virtual cable between the two VDOMs, and each VDOM must have a policy allowing traffic from the source to the destination via that link. Without both, traffic is blocked by the implicit deny.

Answer

Configure a static route in the global routing table pointing to both VDOMs.

Answer

Enable inter-VDOM routing globally using the command 'config system global' and set 'inter-vdom-routing enable'.

Answer

Assign the same VDOM ID to both VDOMs to allow routing between them.

Question 5

An administrator wants to use FortiGate to block outbound traffic to known malicious IP addresses based on a threat intelligence feed. They configure a threat feed connector and a firewall policy with a destination address group. However, the policy is not blocking traffic to the malicious IPs. What is the most likely cause?

Accepted Answer

The firewall policy is placed after a more permissive policy that allows the traffic.. FortiGate evaluates firewall policies sequentially. If a permissive policy appears above the blocking policy, traffic is allowed and never reaches the blocking rule. Placing the blocking policy before any permissive policies ensures malicious traffic is denied.

Answer

The destination address group does not include the threat feed connector object.

Answer

The threat feed connector is not enabled in the security fabric settings.

Answer

The threat feed connector is configured with the wrong protocol (HTTP instead of HTTPS).

Question 6

A FortiGate is configured with a firewall policy that has a URL filter profile. Users report that access to a specific website is blocked, but the administrator wants to verify which URL filter category matched the request. The administrator runs 'diagnose debug application urlfilter -1' in the CLI. However, no output appears. What is the MOST likely reason for the lack of output?

Accepted Answer

The administrator did not run 'diagnose debug enable' after setting the debug level.. To capture URL filter debug messages, the administrator must set the debug level for the urlfilter application and then enable debug globally. The command 'diagnose debug application urlfilter -1' sets the level, but without 'diagnose debug enable', no output is generated. This is a common troubleshooting step that is often missed. Once enabled, the debug will show category matches and other details.

Answer

The urlfilter debug application is not available on this FortiGate model or firmware version.

Answer

The URL filter profile is not applied to the firewall policy that matches the user traffic.

Answer

The URL filter debug level is set to 0 by default and must be enabled with 'diagnose debug enable'.

Question 7

A FortiGate is configured as a ZTNA access proxy for an internal application. The administrator wants to enforce device compliance using FortiClient EMS tags before allowing access. Which configuration step is required to ensure that only endpoints with a specific EMS tag can access the application?

Accepted Answer

Configure FortiClient EMS as a fabric connector and synchronize EMS tags.. Enforcing device compliance via EMS tags in ZTNA requires FortiGate to be integrated with FortiClient EMS using a fabric connector. This integration synchronizes EMS tags, which can then be used as source objects in ZTNA rules. Without this, tags are not available, and compliance cannot be enforced. Other steps like device detection or deny actions are secondary.

Answer

Set the ZTNA rule action to 'deny' for non-compliant devices.

Answer

Create a ZTNA rule with a source address of the EMS tag.

Answer

Enable 'device-detection' on the ZTNA rule.

Question 8

An administrator has a FortiGate with multiple VDOMs and a management VDOM enabled. The management VDOM is used for out-of-band management and logging. The administrator wants to ensure that the management VDOM can reach a syslog server on the Internet while all other VDOMs use a separate data VDOM for their Internet traffic. Which configuration is required to allow the management VDOM to use a different default route than the other VDOMs?

Accepted Answer

Configure a default route in the management VDOM pointing to the management gateway, and ensure that the management VDOM has its own interface with Internet connectivity.. To allow the management VDOM to use a different default route, you must configure that route within the management VDOM itself. Each VDOM has its own routing table, so a default route in one VDOM does not affect others. The management VDOM also needs its own interface with Internet reachability. This ensures management traffic uses the intended path while data VDOMs use theirs.

Answer

Use the global routing table to define a default route that applies only to the management VDOM.

Answer

Enable 'allow-subnet-overlap' in the management VDOM to permit a separate default route.

Answer

Create a policy route in the management VDOM that forwards all traffic to the data VDOM's default gateway.

Question 9

An administrator is deploying an ADVPN with a hub and two spokes. The hub is behind a NAT device and has a static public IP, while both spokes are behind NAT with dynamic public IPs. The administrator wants the spokes to establish shortcuts directly between each other. Which configuration is required for the shortcut to form?

Accepted Answer

Enable IPsec NAT traversal on the hub and both spokes, and ensure that the spokes can exchange IKE and ESP traffic through their NAT devices.. For ADVPN shortcuts to form between spokes that are behind NAT, every peer must support NAT traversal so IKE and ESP can be carried over UDP through the NAT devices. The hub relays the shortcut information, but the direct tunnel between spokes depends on NAT-T being enabled on those spokes as well. Static addresses and DPD changes are not prerequisites for shortcut creation.

Answer

Configure the hub to use a dial-up VPN with a pre-shared key and disable DPD on the spokes to prevent shortcut teardown.

Answer

Configure the spokes with a static public IP address so that the hub can advertise them for direct shortcut negotiation.

Answer

Enable IPsec NAT traversal on the hub only, because the hub is the device that initiates shortcut negotiation.

Question 10

An administrator has a FortiGate 600E running FortiOS 7.2 with multiple VDOMs enabled. The administrator wants to create a new VDOM named 'DMZ' and assign it a specific physical interface (port3) that is currently unused. After creating the VDOM, the administrator navigates to Network > Interfaces in the DMZ VDOM but cannot see port3 in the list of available interfaces to assign. What is the most likely reason for this?

Accepted Answer

The physical interface port3 must be assigned to a VDOM from the global configuration before it appears in the VDOM's interface list.. In a multi-VDOM FortiGate, physical interfaces belong to the global configuration by default. To use an interface within a VDOM, the administrator must explicitly assign it to that VDOM from the global VDOM settings. Until that assignment is made, the interface will not be listed in the VDOM's Network > Interfaces section, preventing configuration.

Answer

The interface port3 is currently used by another VDOM, so it is hidden until it is removed from that VDOM.

Answer

The administrator needs to reboot the FortiGate after creating the VDOM for the interface to become visible.

Answer

The administrator must enable 'VDOM mode' on the interface before it can be seen in the VDOM.

Question 11

A network administrator is troubleshooting a FortiGate HA cluster in active-passive mode. The administrator notices that the secondary unit is not receiving heartbeat packets from the primary unit, and the cluster has split. The administrator runs 'diagnose sys ha status' on both units and sees that the primary unit shows the secondary as 'not connected', while the secondary unit shows the primary as 'not connected'. The administrator verifies that the heartbeat interfaces are correctly configured and physically connected. What is the MOST likely cause of the split?

Accepted Answer

The heartbeat packets are being dropped by an intermediate switch due to a native VLAN mismatch.. The most likely cause is that heartbeat packets are being dropped by an intermediate switch due to a native VLAN mismatch. When the FortiGate heartbeat interfaces are connected through a switch, the switch must properly forward the heartbeat traffic. A native VLAN mismatch can cause untagged packets to be dropped or sent to the wrong VLAN, preventing heartbeats from reaching the peer. This leads to both units losing communication and forming separate clusters.

Answer

The primary unit is overloaded and cannot send heartbeat packets.

Answer

The heartbeat interfaces are configured with different VLAN IDs on each unit.

Answer

The HA group ID is different on the two units, preventing them from forming a cluster.

Question 12

A security analyst is reviewing FortiGate logs and notices that a web filter profile is blocking access to a known malicious domain, but the block page shows the category as 'Unrated'. The analyst confirms the domain is listed in a custom blocklist. Which FortiGate feature is responsible for overriding the category and enforcing the block?

Accepted Answer

Static URL filter with the action set to 'Block' and the type set to 'Simple'.. A static URL filter entry with the action set to Block and type Simple allows an administrator to block specific URLs or domains regardless of their FortiGuard category. This is why a domain categorized as Unrated can still be blocked and present a block page. The static URL filter is evaluated as part of the web filter profile and overrides category-based actions.

Answer

FortiGuard web filter category override using a local category definition.

Answer

DNS filter with a custom blocklist entry for the domain.

Answer

Application control signature that matches the domain's HTTP header.

Question 13

A security administrator is configuring a FortiGate to use an external threat intelligence feed via a Threat Feed connector. The administrator wants to ensure that the firewall automatically blocks traffic to malicious IP addresses and domains from the feed. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Create a firewall address object that references the external threat feed connector.. To use an external threat feed on FortiGate, you first create the external threat feed connector with the feed URL and refresh interval, then create a firewall address object that references that connector. The address object can then be used in firewall policies to block or allow traffic. Other options like antivirus profiles or DNS filters do not integrate directly with external threat feeds for IP/domain blocking.

Answer

Configure a DNS filter profile to block the domains from the feed.

Answer

Set the feed connector to 'malware' category in the security fabric settings.

Answer

Enable 'Block traffic from malicious sources' in the antivirus profile.

Question 14

An administrator is configuring an IPsec VPN on a FortiGate that will interoperate with a third-party peer. The peer requires the use of a specific encryption domain and does not support IKEv2. The administrator wants to ensure that only specific subnets are permitted through the tunnel, while all other traffic is excluded from the SA. Which configuration element on the FortiGate directly controls which traffic is selected for the IPsec tunnel?

Accepted Answer

The phase 2 selector, configured with the local and remote subnet pairs that match the peer's encryption domain.. The phase 2 selector is the configuration element that defines the encryption domain by specifying the local and remote subnet pairs permitted through the IPsec SA. It must match the third-party peer's required subnets. Firewall policies and routes influence forwarding and permission, but only the phase 2 selector determines which traffic is actually selected and encrypted for the tunnel.

Answer

The routing table entries that direct traffic to the IPsec interface.

Answer

The phase 1 proposal, which includes the encryption and authentication algorithms negotiated with the peer.

Answer

The firewall address objects referenced in the policy that permits traffic from the local subnet to the remote subnet.

Question 15

An administrator is configuring a new FortiGate with multiple VDOMs. The administrator wants to ensure that each VDOM has its own independent routing table and that traffic between VDOMs is inspected by firewall policies. Which TWO statements about inter-VDOM routing are correct? (Choose two.)

Accepted Answer

Inter-VDOM links are virtual interfaces that must be created in pairs, with each end assigned to a different VDOM.. Inter-VDOM links are virtual point-to-point interfaces that connect two VDOMs, allowing each VDOM to have its own routing table. Traffic across these links is inspected by firewall policies and can have UTM profiles applied. They do not use VLAN tagging and are not used in transparent mode VDOMs. These characteristics make them suitable for secure inter-VDOM communication.

Answer

Inter-VDOM links require the use of 802.1Q VLAN tagging to differentiate traffic.

Answer

Inter-VDOM links can be configured in transparent mode VDOMs without IP addresses.

Answer

A single inter-VDOM link can connect more than two VDOMs simultaneously.