NSE7 Practice Test 46 — 15 Questions

Question 1

An administrator is deploying ZTNA with FortiClient EMS to secure access to a corporate web application. Which THREE components are required for a successful ZTNA deployment? (Choose three.)

Accepted Answer

FortiClient EMS server. FortiClient EMS (Endpoint Management Server) is the central management and policy distribution point for ZTNA. It manages endpoint compliance, pushes ZTNA tags, and provides real-time telemetry to FortiGate, enabling dynamic access control based on device posture and user identity.

Answer

FortiSandbox for threat analysis

Answer

FortiAnalyzer for logging

Question 2

An administrator is planning a FortiManager deployment to manage multiple FortiGates with multiple VDOMs. The administrator wants to use ADOMs to separate configurations. Which TWO statements about ADOMs are correct? (Choose two.)

Accepted Answer

ADOMs support revision history for tracking configuration changes. ADOMs in FortiManager maintain a revision history for each managed device or VDOM, allowing administrators to track configuration changes over time, compare revisions, and roll back to previous states if needed. This revision control is essential for auditing and troubleshooting in multi-VDOM environments.

Answer

Regular ADOMs can only contain devices with a single VDOM

Answer

Policy packages in an ADOM can be shared across different ADOMs

Answer

ADOMs cannot be renamed after creation

Question 3

In FortiManager, an administrator wants to apply a set of firewall policies to multiple FortiGates in different ADOMs. The policies must be centrally managed. What is the best approach?

Accepted Answer

Use the Global ADOM to define global policies that apply to all ADOMs. The Global ADOM in FortiManager allows administrators to define firewall policies that are automatically inherited by all ADOMs, ensuring consistent, centrally managed policy enforcement across multiple FortiGates without manual duplication. This approach leverages FortiManager's hierarchical policy model, where global policies are pushed to each ADOM's policy packages and take precedence over local policies unless overridden.

Answer

Create a policy package in each ADOM and use the same policies

Answer

Configure the policies directly on each FortiGate

Answer

Use automation stitches to copy policies between ADOMs

Question 4

An organization uses FortiManager to manage multiple FortiGate devices in a Security Fabric. The administrator wants to push a new firewall policy that includes an FQDN address object. Which statement is true regarding FQDN objects in FortiManager policies?

Accepted Answer

FortiManager resolves the FQDN to IP addresses at installation time and updates the policy accordingly. When an administrator pushes a policy containing an FQDN address object from FortiManager, FortiManager resolves the FQDN to its current IP addresses at installation time. The resolved IPs are then written into the policy on the managed FortiGate, ensuring the policy is immediately effective without requiring the FortiGate to perform DNS resolution. This behavior is specific to FortiManager-managed policies and differs from locally configured FQDN objects on FortiGate.

Answer

FQDN objects must be defined on each managed FortiGate individually

Answer

The FQDN resolution is done automatically every 60 seconds by FortiManager

Answer

FQDN objects cannot be used in policies pushed from FortiManager

Question 5

A FortiGate administrator notices that the traffic log shows sessions being dropped due to 'policy deny' even though a permit policy exists. The administrator checks the policy list and sees the policy is in the correct order. What could be a reason for this?

Accepted Answer

The traffic is being processed by a different VDOM than expected. FortiGate VDOMs operate as independent virtual firewalls with separate routing and policy tables. If traffic enters a VDOM that does not contain the permit policy, the FortiGate will evaluate it against the policies within that VDOM only, resulting in a 'policy deny' drop even though a permit policy exists in a different VDOM. The administrator must verify that the traffic is being processed by the correct VDOM, typically by checking the ingress interface's VDOM association.

Answer

The session is already established and the policy change is not applied to existing sessions

Answer

The policy is disabled

Answer

The policy has an incorrect schedule

Question 6

A FortiGate admin runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session has been active for 1 hour and will expire in about 1 hour. The output shows 'duration=3600' and 'expire=3599', meaning the session has been active for 3600 seconds (1 hour) and has approximately 3599 seconds remaining before it times out. The 'proto=6' indicates TCP (protocol 6), and 'proto_state=01' is the TCP state (typically ESTABLISHED). The session is healthy and will expire in about 1 hour, confirming C.

Answer

The session is a UDP session that has been idle for 1 hour

Answer

The session has a problem because duration and expire are not equal

Answer

The session is a short-lived connection that started 3600 seconds ago

Question 7

Which THREE actions can an administrator perform using FortiManager in a Security Fabric environment? (Choose three.)

Accepted Answer

Upgrade the firmware of multiple FortiGates at once. FortiManager supports centralized firmware management, allowing administrators to upgrade the firmware of multiple FortiGates simultaneously via the 'Firmware Upgrade' wizard in the Device Manager. This leverages the FortiManager's role as a central management point, which can stage and push firmware images to managed devices in a Security Fabric, reducing downtime and ensuring consistency across the fabric.

Answer

Terminate IPsec VPN tunnels on the FortiManager

Answer

Configure FortiGate to manage the FortiManager

Question 8

An SD-WAN rule has two members: port1 (SLA target latency < 10ms) and port2 (SLA target latency < 20ms). The administrator runs 'diagnose sys sdwan sla-check' and sees that both members meet SLA. However, all traffic is going through port2. What is the MOST likely reason?

Accepted Answer

The SD-WAN rule is configured with 'set service' that does not match the traffic. If the SD-WAN rule has a 'set service' filter that does not match the traffic being tested (e.g., it only applies to HTTP traffic while the test traffic is ICMP or UDP), the rule will not be used for that traffic, causing the traffic to fall through to a default route or another rule that uses port2. Even though both members meet SLA, the traffic is not matched by the rule, so the SD-WAN load-balancing or strategy logic never applies.

Answer

The SD-WAN strategy is set to 'load balancing' and the load balancing algorithm is 'spillover'

Answer

The SD-WAN strategy is set to 'manual'

Answer

The 'update-static-route' is disabled on the SD-WAN

Question 9

A network engineer is designing a FortiGate HA cluster with two units operating in active-active mode. The cluster will be placed in a VDOM-enabled environment. The engineer wants to ensure that traffic from a specific VDOM is load-balanced across both units based on source IP address. Which setting must be configured on the cluster to achieve this?

Accepted Answer

Configure a virtual cluster with load-balance method source IP. In a VDOM-enabled active-active HA cluster, per-VDOM load balancing is achieved by configuring a virtual cluster and setting the load-balance method to source IP. This allows the cluster to distribute traffic for that specific VDOM across both units based on the source IP hash, ensuring session persistence while balancing the load.

Answer

Configure randomize-vip under config system ha

Answer

Configure vdom-load-balance under config system ha

Answer

Enable session pickup and set session-pickup-delay to 0

Question 10

An administrator wants to create an automation stitch that automatically blocks an IP address when a high-severity IPS alert is triggered. The administrator creates a trigger for 'IPS event' and an action of 'Add to Blocked IPs'. However, the action fails to execute. Which of the following is the most likely cause?

Accepted Answer

The admin account used to configure the stitch does not have permission to modify the blocked IP list. The admin account used to configure the automation stitch must have the necessary permissions to modify the blocked IP list. In FortiOS, the automation stitch action 'Add to Blocked IPs' requires write access to the firewall address object or the blocked IP list. If the admin account has read-only or restricted privileges, the action will fail silently, even if the trigger and action are correctly configured.

Answer

The automation stitch is set to execute every 5 minutes, not immediately

Answer

The blocked IP list has reached its maximum size

Answer

The IPS event trigger does not support IP address extraction

Question 11

Refer to the exhibit. An administrator has configured an active-passive HA cluster. After reviewing the configuration and status, the administrator wants to ensure that the management interface (port2) is accessible on both units using the same IP address. What additional configuration is required?

Accepted Answer

Configure a virtual management IP under the cluster settings. In an active-passive HA cluster, the management interface (port2) must be reachable on both units using the same IP address. This is achieved by configuring a virtual management IP (also known as a management IP address) under the cluster settings. The virtual management IP is assigned to the active unit and, upon failover, is automatically moved to the new active unit, ensuring continuous management access without requiring separate IP addresses per unit.

Answer

Set the gateway to 0.0.0.0

Answer

Enable ha-mgmt-status on the secondary unit

Answer

Disable session-pickup to free resources

Question 12

A FortiGate is using BFD for BGP fast failure detection. The administrator wants to ensure that if the BFD session goes down, the BGP neighbor is removed and routes are withdrawn immediately. Which configuration is necessary?

Accepted Answer

Enable BFD on the BGP neighbor and ensure BFD timers are set lower than BGP hold time. BFD provides sub-second failure detection independent of BGP's hold timer. When BFD is enabled on a BGP neighbor and the BFD session goes down, the BGP neighbor is immediately declared dead and all routes from that neighbor are withdrawn, without waiting for the BGP hold timer to expire. This ensures rapid convergence as requested by the administrator.

Answer

Configure BGP graceful restart

Answer

Set BGP hold time to 0

Answer

Use 'set bfd-desired-min-tx 100' on the interface

Question 13

An administrator configures a prefix list to filter routes received from a BGP neighbor. The prefix list permits 192.168.0.0/16 le 24. Which routes are permitted?

Accepted Answer

Any route with prefix length between 16 and 24 inclusive, starting with 192.168. The prefix list `192.168.0.0/16 le 24` permits any route that matches the prefix `192.168.0.0/16` and has a prefix length between 16 and 24 inclusive. The `le` (less-than-or-equal-to) operator sets the maximum prefix length, so routes with lengths 16, 17, 18, 19, 20, 21, 22, 23, and 24 are all allowed, as long as they fall within the 192.168.0.0/16 network.

Answer

Only routes with prefix length exactly 16 within 192.168.0.0/16

Answer

Only routes with prefix length exactly 24 within 192.168.0.0/16

Answer

Any route with prefix length greater than 24 within 192.168.0.0/16

Question 14

A FortiGate has two VDOMs: Sales and Engineering. The admin wants to allow the Engineering VDOM to manage the Sales VDOM's administrator accounts. What configuration is required?

Accepted Answer

Set the management VDOM to Engineering and configure Sales to accept admin connections from Engineering's IP. To allow the Engineering VDOM to manage the Sales VDOM's administrator accounts, the management VDOM must be set to Engineering, and the Sales VDOM must be configured to accept admin connections from Engineering's IP address. This is done via the 'set management-vdom' command under the Sales VDOM and ensuring the Sales VDOM's local-in policy permits HTTPS/SSH traffic from the Engineering VDOM's management IP. This enables cross-VDOM administrative management without requiring inter-VDOM routing or shared policies.

Answer

Use inter-VDOM routing to forward admin traffic

Answer

Enable VDOM sharing on the local-in policy

Answer

Create a super_admin account in Sales VDOM

Question 15

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish Phase 1. The debug output shows 'no acceptable proposal'. Which TWO configuration parameters should be checked to resolve this issue?

Accepted Answer

Encryption algorithm. The 'no acceptable proposal' error indicates that the two IPsec peers cannot agree on a Phase 1 proposal. The encryption algorithm and Diffie-Hellman group are both mandatory parameters in the IKE proposal that must match exactly between peers. If either parameter differs, the negotiation fails with this error.

Answer

IKE version

Answer

Pre-shared key

Answer

Local and remote subnets