NSE7 Practice Test 46 — 15 Questions

Question 1

A network administrator configures an IPsec VPN between two FortiGates using IKEv2. The tunnel establishes, but after a period of inactivity, traffic stops passing and the logs show 'IPsec phase 1 down'. The administrator wants to ensure the tunnel is quickly re-established when traffic resumes. Which setting should be configured?

Answer

Set the phase1 proposal to use AES-256-GCM.

Answer

Configure the phase1 to use main mode instead of aggressive mode.

Answer

Enable Dead Peer Detection (DPD) with 'on-idle' mode.

Answer

Set the IKE idle timeout to 0 (disabled).

Question 2

An administrator configures OSPF over an IPsec VPN overlay between two FortiGates. The OSPF neighbors form, but routes learned from the remote site are not appearing in the routing table. What is the most likely cause?

Answer

The firewall policy allows OSPF traffic (protocol 89) but not IPsec ESP.

Answer

The IPsec interface MTU is too low for OSPF packets.

Answer

The OSPF network type is not set to point-to-point.

Answer

The 'allowaccess' setting on the IPsec interface does not include OSPF.

Question 3

A FortiGate administrator needs to block an application (e.g., Facebook) while allowing HTTPS traffic for ZTNA users. Which TWO configurations are required to achieve this?

Answer

Web filter profile with Facebook categorized as blocked.

Answer

Enable 'inline CASB' on the ZTNA rule.

Answer

SSL deep inspection profile to decrypt HTTPS traffic.

Answer

Application control profile with Facebook blocked applied to the firewall policy.

Answer

Add a ZTNA tag for Facebook blocking.

Question 4

A FortiGate administrator receives an error during IPsec VPN configuration: 'Certificate validation failed: certificate uses weak key.' The admin is using a PKI certificate with RSA 2048-bit key. The FortiGate firmware is up-to-date. What is the MOST likely reason for this error?

Accepted Answer

The FortiGate has a security policy that rejects certificates with keys less than 3072 bits.. In recent FortiOS versions, a security hardening setting may require minimum RSA key size of 3072 bits. RSA 2048 is considered weak by some compliance standards and may be blocked by the 'weak key' validation check. The admin can adjust the setting or use a stronger key.

Answer

The certificate has expired or is not yet valid.

Answer

The certificate's private key is not imported on the FortiGate.

Answer

The certificate authority is not trusted by the FortiGate.

Question 5

An administrator wants to enforce that only devices with antivirus software installed and running can access a sensitive application via ZTNA. Which ZTNA feature should be used to verify this requirement?

Accepted Answer

ZTNA tags with device posture checks. ZTNA uses tags to indicate device posture. The FortiGate or FortiClient EMS can check for antivirus status and include that information in the device's posture tag. The ZTNA access proxy rule can then require that tag for access.

Answer

ZTNA inline CASB

Answer

NAC with FortiNAC

Answer

IPsec VPN with DPD

Question 6

A network administrator is configuring a hub-and-spoke ADVPN with FortiGates. The spokes are behind NAT and use dynamic IPs. The hub has a static IP. Which IKEv2 configuration is REQUIRED to allow the spokes to initiate the VPN and receive shortcut tunnels?

Accepted Answer

Set the phase1 remote-gateway to 0.0.0.0 and enable 'accept-any-remote-gateway' on the hub. Aggressive mode is not supported in IKEv2 (only main mode). Setting the local ID is not sufficient for NAT traversal. Allowing IKE and ESP from any source is required because spokes may have dynamic IPs, and the hub must accept incoming connections from unknown source IPs. However, the key requirement for ADVPN is that the hub must accept connections from any source, which is achieved by setting the interface to 'any' or allowing 0.0.0.0/0. Option C is the common practice: the hub uses a wildcard selector and accepts connections from any peer ID. But the question asks for 'REQUIRED' – the most accurate is that the hub must be configured to accept connections from any source IP, which is done by setting the remote gateway to 0.0.0.0 or using a peer ID with accept-any. Option C is the best answer.

Answer

Set IKE version 2 to aggressive mode to allow rapid negotiation

Answer

Configure the hub with a static IP in the phase1 local-gateway interface

Answer

Use a preshared key and set the local ID to the spoke's public IP

Question 7

What is the purpose of Dead Peer Detection (DPD) in an IPsec VPN?

Accepted Answer

Detect loss of connectivity to the remote VPN peer. DPD is used to detect if the remote peer is still alive. It sends periodic messages and if no response is received, the tunnel is considered down. Option A is correct.

Answer

Detect if the VPN tunnel is using the correct encryption algorithm

Answer

Detect duplicate IP addresses on the network

Answer

Detect packet loss over the VPN tunnel

Question 8

An administrator receives an error when trying to create a ZTNA proxy rule: 'The ZTNA proxy rule requires a valid application mapping.' What does this indicate?

Accepted Answer

The application mapping object is not defined. A ZTNA proxy rule maps an external FQDN/port to an internal application. The error means the application mapping (which defines the internal server) is missing or misconfigured.

Answer

The FortiClient EMS is not reachable

Answer

The SSL certificate is missing

Answer

The firewall policy is not in place

Question 9

An administrator is deploying ADVPN with a hub-and-spoke topology. The hub FortiGate is configured with 'set auto-discovery enable' and 'set add-route enable'. Spokes have 'set auto-discovery-sender enable'. However, shortcut tunnels are not being established. Which two additional conditions must be met for shortcut tunnels to form? (Choose two.)

Accepted Answer

The phase 2 configuration on the hub must have 'set auto-discovery enable'. Shortcut tunnels require traffic between spokes (A) and the hub's phase 2 must have auto-discovery enabled (C).

Answer

The spokes must have a static route to each other's networks

Answer

The spokes must have 'set dpd enable' on the phase 1

Answer

The hub must be configured as a route reflector for BGP

Question 10

A FortiGate is the SAML Service Provider (SP) for a ZTNA application. The IdP is Azure AD. After successful authentication, the user is redirected to the ZTNA proxy with a '403 Forbidden' error. The ZTNA rule has the correct groups allowed. What is the most likely missing configuration?

Answer

The IdP is not sending the user's group membership in the SAML assertion.

Answer

The ZTNA proxy certificate is not trusted by the browser.

Answer

The SAML user group is not mapped to a FortiGate local group.

Answer

The FortiGate's clock is not synchronized with the IdP.

Question 11

A network administrator is configuring an ADVPN hub-and-spoke topology. The hub is FortiGate-A and the spokes are FortiGate-B and FortiGate-C. The administrator wants spoke-to-spoke traffic to dynamically establish direct tunnels when needed. Which two settings must be enabled on the hub's phase 1 interface to support this?

Accepted Answer

set auto-discovery-sender enable. Option B (set auto-discovery-sender enable) on the hub and Option C (set auto-discovery-receiver enable) on each spoke are required. However, since the question asks for the hub's settings, the correct answer is the hub must be configured as sender and also set add-route to enable shortcut tunnels.

Answer

set mode aggressive

Answer

set auto-discovery-shortcut-mode both

Question 12

A FortiGate administrator is configuring ZTNA to provide secure access to an internal application. The application is hosted on a server with IP 10.0.1.100 and port 8080. The administrator creates a ZTNA rule on the FortiGate as an access proxy. What is the correct configuration for the ZTNA rule's 'Application Access' entry?

Accepted Answer

External port: 443, Mapped port: 8080, Destination: 10.0.1.100. For ZTNA access proxy, the destination virtual IP maps the external address and port to the internal server. Option A is correct: the external port is the port that the client connects to (e.g., 443) and the mapped port is the internal server port (8080).

Answer

External port: 0, Mapped port: 8080, Destination: 10.0.1.100

Answer

External port: 8080, Mapped port: 443, Destination: 10.0.1.100

Answer

External port: 443, Mapped port: 443, Destination: 10.0.1.100

Question 13

An administrator has configured an OSPF overlay over an IPsec VPN between two FortiGates. The OSPF neighbors are established, but routes from one side are not being installed in the routing table on the other side. 'get router info ospf neighbor' shows FULL state. What is the most likely cause?

Accepted Answer

The route's OSPF cost is higher than an existing route with a lower administrative distance. Even though OSPF neighbors are FULL, routes may not be installed if they are not selected as best paths. One common reason is that the OSPF cost is higher than a static route or another routing protocol's metric. The other options would prevent neighbor from reaching FULL state.

Answer

The IPsec tunnel is using transport mode instead of tunnel mode

Answer

OSPF authentication is mismatched

Answer

The OSPF network type is not set to point-to-point

Question 14

A FortiGate administrator is configuring NAC (Network Access Control) integration with FortiNAC. The goal is to control access for wired clients based on device compliance. Which TWO configurations are required on the FortiGate to support this integration?

Accepted Answer

Configure a RADIUS server pointing to FortiNAC.. FortiGate integrates with FortiNAC via RADIUS (B) to query device compliance and NAC policies (A) on the interface to enforce access. 802.1x is typically handled by the switch, not FortiGate directly. SGT and nac-mode are not standard for this integration.

Answer

Create a security group tag (SGT) mapping.

Answer

Enable '802.1x' authentication on the interface.

Answer

Set the 'nac-mode' to 'global-vlan' under the interface.

Question 15

A FortiGate is configured with a ZTNA access proxy rule for a web application. The administrator wants to enforce that only devices with a specific FortiClient tag (e.g., 'Compliant') can access the application. Where is this tag-based access control configured?

Accepted Answer

In the ZTNA access proxy rule under the ZTNA gateway configuration. In ZTNA, device posture tags from FortiClient are used in access proxy rules to grant or deny access. The tags are matched in the ZTNA proxy rule (access proxy rule) under the ZTNA gateway configuration. Option C is correct.

Answer

In the FortiClient EMS policy

Answer

In the firewall policy that permits traffic from the ZTNA gateway to the application

Answer

In the SSL inspection profile