NSE7 Practice Test 46 — 15 Questions

Question 1

A network security administrator wants to use FortiGate to automatically quarantine an endpoint when FortiEDR detects malicious behavior on that endpoint. Which FortiGate feature should be used to integrate with FortiEDR for this purpose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FortiGate Fabric Connector for FortiEDR with automated response actions.. The FortiGate Fabric Connector for FortiEDR enables integration between the endpoint detection and response platform and the FortiGate. When FortiEDR identifies malicious behavior, the connector can trigger automated actions such as quarantining the endpoint or blocking its network access. This is the correct feature for coordinating endpoint detection with network enforcement in the Security Fabric.

Answer

FortiGate IPsec VPN with dynamic routing to isolate the endpoint.

Answer

FortiGate antivirus profile with 'Block' action for all detected threats.

Answer

FortiGate DNS filter with a blocklist of the endpoint's IP address.

Question 2

A FortiGate is configured with multiple VDOMs in NAT/route mode. The administrator wants to enable communication between VDOM-A and VDOM-B using an inter-VDOM link. The administrator creates the link and assigns IP addresses 10.0.0.1/30 and 10.0.0.2/30 to the respective interfaces. The administrator then adds a static route in VDOM-A to VDOM-B's network (192.168.2.0/24) via 10.0.0.2, and a static route in VDOM-B to VDOM-A's network (192.168.1.0/24) via 10.0.0.1. However, traffic still fails. What is the most likely missing configuration?

Accepted Answer

A firewall policy allowing traffic from VDOM-A to VDOM-B is missing.. Inter-VDOM routing requires both routing and firewall policies. The administrator has configured IP addresses and static routes, but traffic is still blocked because no firewall policy permits it. A policy must be added in each VDOM to allow traffic from the source network to the destination network via the inter-VDOM link interface. Once the policies are in place, communication will succeed.

Answer

The static routes must be configured with the 'set gateway' parameter instead of 'set device'.

Answer

The inter-VDOM link interfaces must have 'set allowaccess ping' enabled.

Answer

The inter-VDOM link interfaces must be added to a zone in each VDOM.

Question 3

A security analyst is investigating a recent security incident and wants to use FortiGate's Security Fabric to gather threat intelligence. The analyst needs to view detailed information about a detected threat, including the source, destination, and the specific IPS signature that triggered. Which FortiGate feature provides a centralized view of threat events and allows drill-down into individual incidents?

Accepted Answer

FortiView. FortiView is a built-in FortiGate feature that aggregates and visualizes threat events from multiple security functions, including IPS, antivirus, and web filtering. It allows administrators to drill down into specific incidents to see source, destination, and signature details, making it a powerful tool for threat investigation within the Security Fabric.

Answer

FortiAnalyzer

Answer

FortiSandbox

Answer

FortiGuard Outbreak Prevention

Question 4

A FortiGate is configured with a VIP for an internal web server. Users report that the web server is unreachable from the internet, but it is accessible from the internal network. The administrator runs 'diagnose debug flow' with filters for the public IP and sees that the traffic reaches the FortiGate but is dropped with the message 'iprope_in_check() check failed, drop'. What is the MOST likely cause?

Accepted Answer

A firewall policy allowing traffic from the internet to the VIP is missing or misordered.. The debug flow message 'iprope_in_check() check failed, drop' indicates that the incoming packet did not match any firewall policy. For a VIP, a policy must explicitly permit traffic from the external interface to the VIP. If such a policy is absent, disabled, or ordered after a deny policy, the packet is dropped. Internal access works because it uses a different policy path, which is why the issue is isolated to external users.

Answer

The VIP is not configured with the correct external interface.

Answer

The web server's default gateway is not set to the FortiGate's internal interface.

Answer

The VIP is configured with port forwarding, but the external port does not match the service port.

Question 5

A security team uses FortiSandbox in a FortiGate security fabric. They want files that receive a 'Malicious' verdict to be automatically quarantined and their source endpoints isolated without manual intervention. Which combination of Fortinet components and features must be configured to achieve this automated response?

Accepted Answer

FortiSandbox 'Automation stitches' with FortiGate and FortiClient EMS to trigger quarantine and endpoint isolation.. Automated response to a FortiSandbox malicious verdict requires an automation stitch that links the sandbox to enforcement points. FortiSandbox can trigger actions on FortiGate to block the file and quarantine the host, and on FortiClient EMS to isolate the endpoint. Other components such as FortiAnalyzer, FortiMail, or FortiGuard feeds do not provide the direct endpoint isolation needed here.

Answer

FortiGate 'Security Fabric' connectors with FortiAnalyzer playbooks to push blocklists to FortiMail.

Answer

FortiGate 'Threat Feed' with FortiGuard IOC service and manual firewall policy updates.

Answer

FortiSandbox 'Scan Profile' with 'Block Malicious Files' enabled and FortiGate AV quarantine.

Question 6

A FortiGate is configured with two VRF instances: VRF10 (for a customer) and VRF20 (for another customer). Each VRF has its own interfaces and routing table. The administrator wants to allow a specific server in VRF10 (10.10.10.5) to be reachable from a host in VRF20 (20.20.20.5) without leaking all routes between VRFs. Which FortiGate feature should be used to achieve this?

Accepted Answer

An inter-VRF link using a pair of interfaces, one in each VRF, with a firewall policy allowing the specific traffic.. Inter-VRF routing on FortiGate is achieved by creating a link between VRFs using a pair of interfaces, each assigned to a different VRF. A firewall policy then controls what traffic can traverse that link. This allows selective reachability, such as permitting only one server, without leaking all routes between the VRFs. The other options either do not provide the necessary routing or lack the granular control required.

Answer

A firewall policy with source VRF10 and destination VRF20, using NAT to translate the server IP.

Answer

A static route in VRF20 pointing to 10.10.10.5/32 with the next-hop being the VRF10 interface gateway.

Answer

Inter-VRF routing using a route leaking policy with a route-map.

Question 7

An administrator is troubleshooting a FortiGate HA cluster that is experiencing frequent failovers. The administrator wants to verify the HA status and identify potential issues. Which TWO commands should the administrator use to gather relevant information? (Choose two.)

Accepted Answer

diagnose sys ha checksum show. To diagnose frequent HA failovers, the administrator should first check the overall HA status with 'get system ha status' to see which unit is primary and if there are any anomalies. Then, verifying configuration synchronization with 'diagnose sys ha checksum show' helps ensure both units have identical configurations, as mismatches can cause instability. These two commands provide a quick, non-intrusive overview of the cluster's health and are the standard first steps.

Answer

diagnose sys session list

Answer

execute ha manage 0

Answer

diagnose debug application hatalk -1

Question 8

An administrator has a FortiGate with two VDOMs: 'root' and 'VDOM-A'. The administrator wants to assign a physical interface to VDOM-A, but the interface is currently assigned to the root VDOM and is in use by a firewall policy. What must the administrator do before changing the interface's VDOM assignment?

Accepted Answer

Delete all firewall policies and routes that reference the interface.. On a FortiGate, a physical interface is bound to a VDOM. To reassign it, the interface must not be referenced by any configuration objects in its current VDOM, such as firewall policies, routes, or DHCP servers. The administrator must identify and delete those references. Only then can the interface's VDOM assignment be changed. This prevents configuration inconsistencies and potential security gaps.

Answer

Move the interface to a zone first, then change its VDOM.

Answer

Shut down the interface administratively, then change its VDOM.

Answer

Enable 'set vdom-override' on the interface.

Question 9

A network administrator is deploying a FortiGate in multi-VDOM mode. The administrator wants to restrict a specific VDOM so that it can only use a maximum of 2 GB of system memory and 10% of the total CPU resources. Which FortiGate feature should the administrator use?

Accepted Answer

VDOM resource limits under System > VDOM > Edit > Resource Limits. FortiGate multi-VDOM mode includes per-VDOM resource limits that allow administrators to set maximum and guaranteed amounts of memory, CPU, and sessions. These limits are configured in the VDOM settings. By setting a maximum memory of 2 GB and CPU of 10%, the administrator can prevent the VDOM from consuming more than its share. This feature is essential for multi-tenant environments where resource isolation is required.

Answer

Traffic shaping profiles applied to the VDOM's interfaces

Answer

Administrative profiles assigned to VDOM administrators

Answer

QoS queues configured on the VDOM's inter-VDOM links

Question 10

A FortiGate is configured with two SD-WAN members: port1 and port2. The administrator wants to ensure that voice traffic uses port1, but if port1's latency exceeds 150 ms, voice traffic should fail over to port2. Which configuration is required to achieve this?

Accepted Answer

Create an SD-WAN rule with the 'Application' criteria for voice, set the outgoing interface to port1 and port2, and configure a performance SLA with latency threshold 150 ms on both members.. To achieve automatic failover based on latency, the SD-WAN rule must include both members as possible outgoing interfaces, and a performance SLA must be configured to monitor latency on both. If the preferred member exceeds the threshold, it is marked out of SLA, and the rule selects the next best member.

Answer

Create an SD-WAN rule with the 'Application' criteria for voice, set the outgoing interface to port1, and enable 'SLA target' with a latency threshold of 150 ms on port1.

Answer

Create two SD-WAN rules: one for port1 with a latency threshold of 150 ms, and one for port2 with a higher priority. Voice traffic will automatically use port1 and fail over to port2.

Answer

Create an SD-WAN rule with the 'Application' criteria for voice, set the outgoing interface to port1, and configure a performance SLA with latency threshold 150 ms on port1 only.

Question 11

A FortiGate is configured with an explicit web proxy on port 8080. Users report that some websites load slowly while others fail to load at all. The administrator runs 'diagnose debug application wad 8' and sees messages about 'proxy worker' and 'connection failed'. Which command should the administrator use to view the current proxy sessions in real time?

Accepted Answer

diagnose wad session list. The explicit web proxy on FortiGate is handled by the wad daemon. To view current proxy sessions in real time, the administrator should use 'diagnose wad session list'. This command provides details such as client IP, destination, and session state, which are essential for troubleshooting why some websites load slowly or fail. The debug output already indicated wad as the relevant process, making this the correct diagnostic step.

Answer

diagnose firewall iprope list

Answer

diagnose debug application proxy -1

Answer

diagnose sys session list

Question 12

A FortiGate administrator is troubleshooting a site-to-site IPsec tunnel that intermittently drops. The administrator runs 'diagnose vpn ike gateway list' and observes that the tunnel re-establishes every few minutes, and 'diagnose debug application ike -1' shows repeated INVALID_KE_PAYLOAD notifications. The remote peer is a third-party gateway that only supports a specific Diffie-Hellman group. What is the most likely cause of the repeated renegotiation?

Accepted Answer

The FortiGate phase 1 proposal includes a Diffie-Hellman group that the remote gateway does not support, causing IKE to restart with a different group.. INVALID_KE_PAYLOAD is emitted when the proposed Diffie-Hellman group is unacceptable to the peer, and the initiator then retries with a different group. A third-party gateway restricted to one group will keep rejecting the FortiGate's default proposal, producing the periodic renegotiation. Matching the phase 1 DH group to the remote gateway's supported value fixes the loop.

Answer

Dead peer detection is configured with an interval shorter than the remote gateway's idle timeout, causing premature tunnel deletion.

Answer

The pre-shared key on the FortiGate does not match the remote gateway, so authentication fails and IKE restarts.

Answer

The phase 2 selectors do not match between peers, so the quick mode negotiation fails and the tunnel is torn down.

Question 13

An administrator is configuring an SD-WAN rule to distribute traffic across two WAN links based on the number of active sessions. They want to ensure that new sessions are assigned to the link with the fewest current sessions. Which load balancing algorithm should they use?

Accepted Answer

Session count. The 'session count' load balancing algorithm selects the WAN member with the fewest active sessions for each new session. This directly achieves the administrator's goal of distributing traffic based on the number of active sessions, ensuring balanced utilization of the links. Other algorithms like source IP, volume, or round robin do not specifically target session count.

Answer

Source IP

Answer

Round robin

Answer

Volume

Question 14

A FortiGate administrator is deploying ZTNA to replace SSL VPN for remote access. The requirement is that endpoint posture (antivirus status, OS patch level) must be verified before a user is allowed to reach internal web applications through the ZTNA proxy, and that posture must be re-evaluated on each new connection. Which FortiGate configuration element is required to enforce this dynamic, per-connection posture check?

Accepted Answer

A ZTNA server object referencing an access-proxy policy, with an EMS connector tag used as the policy source.. ZTNA on FortiGate enforces access through an access-proxy policy, and endpoint posture is expressed as EMS connector tags that FortiClient EMS updates. Because the policy matches those tags at connection time, a device that falls out of compliance stops matching and loses access on its next request, satisfying the per-connection posture requirement. Identity-only mechanisms cannot deliver this behaviour.

Answer

An SSL VPN portal with host-check enforcement bound to the user group.

Answer

An IPsec dial-up tunnel with extended authentication and a peer group tied to the user group.

Answer

A firewall authentication rule using a local user group with two-factor authentication enabled.

Question 15

An administrator has configured an SD-WAN zone named 'virtual-wan-link' with two members: port1 (WAN1) and port2 (WAN2). A performance SLA named 'SLA1' is created and assigned to the zone. The administrator wants to ensure that SD-WAN rules use the SLA results to select the best member. Which statement correctly describes how the FortiGate uses the performance SLA results in SD-WAN rule selection?

Accepted Answer

The FortiGate uses the SLA status to mark members as 'alive' or 'dead' and only selects members that are 'alive' when the rule's strategy is 'SLA' or when the rule is configured to use SLA information.. When a performance SLA is assigned to an SD-WAN zone, the FortiGate actively probes the members. If a member fails to meet the SLA thresholds, it is marked as dead. SD-WAN rules that are configured to use SLA information will then avoid that member, ensuring traffic is sent over a link that meets the required performance criteria. This is a core feature of Fortinet SD-WAN.

Answer

The performance SLA results are used only for monitoring and logging; SD-WAN rules do not consider them.

Answer

The FortiGate uses the SLA results to automatically adjust the link cost of each member, which then influences routing decisions.

Answer

The performance SLA results are used only for load balancing algorithms like 'source-ip-based' and 'session-based'.