NSE7 Practice Test 45 — 15 Questions

Question 1

A FortiGate is configured with multiple VRF instances. The administrator needs to ensure that traffic from VRF 10 can reach a server in VRF 20. Which configuration is required?

Accepted Answer

Use static routes with the appropriate VRF tags to leak routes between VRFs. Inter-VRF route leaking in FortiGate is achieved by configuring static routes with the 'vrf' tag to specify the source VRF and using the 'dst-vrf' or 'vrf-leak' settings to export routes into the destination VRF. This allows traffic from VRF 10 to reach a server in VRF 20 by ensuring the necessary routes are present in both VRFs without merging the VRFs.

Answer

Enable inter-VRF routing by setting 'vrf-leak enable' on the VRF instances

Answer

Configure a firewall policy that allows traffic between the VRFs

Answer

Place both interfaces in the same VRF

Question 2

A FortiGate is running OSPF with multiple areas. The administrator needs to redistribute a static route into OSPF. Which command will correctly configure redistribution of static routes into OSPF process 10?

Accepted Answer

config router ospf
 set redistribute static enable
end. In FortiOS, the command to redistribute static routes into OSPF is configured directly under the OSPF process using `set redistribute static enable` within `config router ospf`. This enables the redistribution of static routes into OSPF process 10, as specified in the question.

Answer

config router ospf
 config redistribute
  edit static
   set status enable
  next
 end
end

Answer

config router policy
 set redistribute static
end

Answer

config router static
 set redistribute ospf
end

Question 3

A FortiGate administrator configures an antivirus profile with the machine learning engine enabled and applies it to a policy inspecting HTTP traffic. After deployment, the admin notices that some files are being allowed that should have been detected. What is the MOST likely cause?

Accepted Answer

The ML engine is in monitor-only mode. The most likely cause is that the machine learning engine is configured in monitor-only mode. In this mode, the ML engine will log detections and generate alerts but will not take any action to block the file, allowing it to pass through the policy. This is a common initial deployment strategy to assess the ML engine's impact before enabling active blocking.

Answer

FortiGuard outbreak prevention is disabled

Answer

The antivirus profile is using flow-based inspection instead of proxy-based

Answer

The file size exceeds the maximum scanning limit

Question 4

In a multi-VDOM deployment, inter-VDOM routing is configured using VDOM links. After configuring the VDOM links and adding static routes, traffic between VDOMs is not working. The administrator verifies that the VDOM link interfaces are up and have correct IP addresses. What is the most likely missing configuration?

Accepted Answer

Firewall policies are missing or not allowing the traffic. In a FortiGate multi-VDOM deployment, VDOM links create a direct Layer 3 connection between VDOMs, but traffic is still subject to firewall policies. Even with correct IP addresses and static routes, inter-VDOM traffic will be dropped unless explicit firewall policies are configured on both VDOMs to permit the traffic. This is because FortiGate enforces stateful inspection at every VDOM boundary, including VDOM links.

Answer

The inter-VDOM routing mode is set to 'nat' instead of 'route'

Answer

The VDOM links are not assigned to the correct VDOM

Answer

The VDOMs are in different administrative domains

Question 5

A FortiGate administrator is troubleshooting slow network performance. The administrator runs the command 'diagnose sys session filter dst 10.0.0.1' and sees many sessions in a 'proto_state=0a' state. What does this state indicate?

Accepted Answer

The session is in FIN_WAIT_2 state. In FortiOS session diagnostics, the 'proto_state' field displays a hexadecimal value representing the TCP state. The value 0x0a (decimal 10) corresponds to the TCP FIN_WAIT_2 state. TIME_WAIT corresponds to 0x0b, not 0x0a. Therefore, the session is in FIN_WAIT_2 state. An excessive number of sessions in FIN_WAIT_2 may indicate that remote peers are not properly closing connections.

Answer

The session has been reset

Answer

The session is in TIME_WAIT state

Answer

The session is actively transferring data

Answer

The session is in SYN_RECEIVED state

Question 6

An administrator wants to limit the number of VDOMs that can be created on a FortiGate. What should the administrator configure?

Accepted Answer

Set the 'max-vdom' option under 'config system global'. The 'max-vdom' option under 'config system global' directly limits the number of VDOMs that can be created on a FortiGate. This setting enforces a hard cap on the total VDOM count, regardless of licensing or administrative roles. By default, the value is set to 10 on most models, but it can be increased up to the maximum supported by the platform or license.

Answer

Use the 'config vdom' command to delete unused VDOMs

Answer

Configure the VDOM license on FortiManager

Answer

Set the 'vdom-admin' option to 'enable'

Question 7

Which load balancing algorithm in SD-WAN distributes new sessions based on the source and destination IP addresses, ensuring that all sessions from a given source-destination pair go to the same member?

Accepted Answer

Source-dest IP. The Source-dest IP algorithm in Fortinet SD-WAN uses a hash of the source and destination IP addresses to determine the outbound member for each new session. This ensures that all sessions between the same source-destination pair are consistently forwarded to the same WAN member, preserving flow affinity without requiring session-based state tracking.

Answer

Lowest cost

Answer

Volume

Answer

Sessions

Question 8

In FortiAnalyzer, which tool provides real-time traffic monitoring and allows drilling down into details such as top talkers, applications, and threats?

Accepted Answer

FortiView. FortiView in FortiAnalyzer provides real-time traffic monitoring with drill-down capabilities into top talkers, applications, and threats. It aggregates data from FortiGate logs and presents it in an interactive dashboard, allowing administrators to identify and investigate network anomalies instantly without generating reports.

Answer

Reports

Answer

Incidents

Answer

Log Viewer

Question 9

A FortiGate is configured with BGP to an SD-WAN member link. The administrator wants to prefer one link over another for specific routes based on AS path length. Which THREE configurations can influence BGP path selection? (Choose three.)

Accepted Answer

Use a route map to prepend AS numbers to the AS path for the less preferred link.. Prepending AS numbers to the AS path of the less preferred link artificially lengthens the AS path, making that route less attractive in BGP path selection. BGP prefers the shortest AS path, so the link without prepending will be chosen for the specific routes.

Answer

Set the metric (MED) to a lower value on the desired link.

Answer

Configure the 'set aspath' command in a route map to change the AS path.

Question 10

Drag and drop the steps to configure a FortiGate as a DHCP server into the correct order.

Accepted Answer

Select interface, then enable DHCP, then set scope, then configure options, then apply.. The correct sequence to configure a FortiGate as a DHCP server is: first select the interface that will serve DHCP, then enable DHCP on that interface, set the IP address scope (range), configure additional options such as default gateway and DNS servers, and finally apply the configuration. This order ensures dependencies are met and the configuration is valid.

Answer

Enable DHCP, then select interface, then set scope, then configure options, then apply.

Answer

Set scope, then configure options, then enable DHCP, then select interface, then apply.

Answer

Configure options, then apply, then select interface, then enable DHCP, then set scope.

Question 11

An administrator configures email authentication (SPF, DKIM, DMARC) on FortiMail. They find that legitimate emails are being marked as spam by FortiMail. The SPF check passes but DKIM fails. What could be the issue?

Accepted Answer

The email was forwarded by an intermediary that strips the DKIM signature. When an email is forwarded by an intermediary (e.g., a mailing list or forwarding service), the intermediary often modifies the message headers or body, which invalidates the DKIM signature. Since DKIM relies on a cryptographic hash of the original message content and selected headers, any alteration—even by a legitimate forwarder—causes the signature verification to fail. The SPF check passes because the forwarding server may be authorized in the SPF record, but DKIM failure triggers spam classification if the DMARC policy is not aligned.

Answer

The SPF record is too strict

Answer

FortiMail has a bug in the DKIM verification module

Answer

The DMARC policy is set to reject

Question 12

A FortiGate is configured with multiple VRF instances. The administrator needs to ensure that traffic from VRF 10 can reach a server in VRF 20. Which configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The BGP session is in the Active state, meaning the FortiGate is trying to establish a TCP connection to the peer. The 'Active' state in BGP indicates that the FortiGate has sent an OPEN message and is waiting for a TCP connection from the peer, or is actively retrying the TCP connection. This means the session has not yet reached the Established state, so no routes are being exchanged. Option C correctly identifies that the FortiGate is attempting to establish a TCP connection to the peer.

Answer

The BGP peer has reached the maximum prefix limit

Answer

The BGP peer has been administratively shut down

Answer

The BGP session has been established and routes are being exchanged

Question 13

Refer to the exhibit. A tunnel interface is configured with IP 10.0.1.1/30 and remote-ip 10.0.1.2/30. The phase2 defines src-subnet as 10.0.1.0/30 and dst-subnet as 10.0.2.0/30. What is the most likely problem with this configuration?

Accepted Answer

The phase2 src-subnet includes the tunnel interface IP. The phase2 src-subnet is set to 10.0.1.0/30, which includes the tunnel interface IP 10.0.1.1/30. In IPsec VPN configurations, the phase2 selector must not include the tunnel interface IP itself because the tunnel interface is used for routing encapsulated traffic; including it can cause routing loops or prevent the tunnel from establishing correctly. The correct src-subnet should be the protected internal network behind the FortiGate, not the tunnel subnet.

Answer

The remote gateway is set to a static IP but the peer might be dynamic

Answer

The tunnel interface is missing the 'ip' command

Answer

The phase2 dst-subnet overlaps with the remote gateway

Question 14

A FortiGate admin configures a policy package with header and footer policies in FortiManager. What is the purpose of header policies?

Accepted Answer

They are evaluated before other policies in the same policy package. Header policies in FortiManager are evaluated before any other policies in the same policy package. This allows administrators to enforce mandatory rules—such as blocking specific traffic or applying global inspection—that must be processed first, ensuring they are not bypassed by more specific policies later in the sequence.

Answer

They are used for NAT policies only

Answer

They provide default logging for all traffic

Answer

They apply only to the root VDOM

Question 15

What is the purpose of a management VDOM in a multi-VDOM FortiGate?

Accepted Answer

To provide a dedicated VDOM for system administration and management traffic. A management VDOM is a dedicated administrative VDOM that isolates system management traffic (e.g., SSH, HTTPS, SNMP, syslog) from data-plane VDOMs. This ensures that administrative access and logging remain available even if a data VDOM fails or is misconfigured, and it prevents management traffic from competing with production traffic for resources.

Answer

To apply security profiles for all VDOMs

Answer

To route all inter-VDOM traffic

Answer

To host customer-facing services