NSE7 Practice Test 47 — 15 Questions

Question 1

A company runs a FortiGate 600E in NAT/Route mode. They have a site-to-site VPN to a partner using route-based VPN with BGP. Recently, they added a new subnet 192.168.50.0/24 behind the FortiGate. The BGP session is up, and the route is being advertised to the partner. However, traffic from the partner to the new subnet fails. The FortiGate's routing table shows the route to 192.168.50.0/24 is present via the VPN interface. Firewall policies allow the traffic. A packet capture on the FortiGate's internal interface shows the partner's traffic arriving but no SYN-ACK being sent back. The FortiGate's session table shows sessions in 'SYN_RECV' state for the new subnet. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Phase 2 selector for the VPN does not include the new subnet, so the FortiGate does not encrypt the reply traffic.. In a route-based VPN, the Phase 2 selectors define which traffic is allowed to be encrypted and decrypted. Even though BGP advertises the new subnet 192.168.50.0/24, if the Phase 2 selector on either side does not include this subnet, the FortiGate will not encrypt the reply traffic. The packet capture shows the SYN arriving, but no SYN-ACK is sent because the FortiGate cannot find a matching Phase 2 proposal to encrypt the response, causing the session to remain in SYN_RECV state.

Answer

The reverse path forwarding (RPF) check is dropping the incoming SYN.

Answer

The firewall policy is not configured with the correct source interface.

Answer

The BGP route advertisement is being filtered by a route map on the partner side.

Question 2

A FortiGate is configured with an IPsec VPN that uses certificate-based authentication. The VPN fails to establish. The administrator checks the phase1 debug and sees the message: 'no suitable certificate found'. What is the most likely cause?

Accepted Answer

The local certificate is not imported or does not match the certificate name. The 'no suitable certificate found' error in IPsec phase1 debug indicates that the FortiGate cannot locate a local certificate that matches the peer's expected certificate name (often the peer's ID or the configured local certificate name). This typically occurs when the local certificate is not imported or the certificate's Common Name (CN) or Subject Alternative Name (SAN) does not match the configured local ID or peer's expected identifier. Without a matching local certificate, the IKE exchange cannot proceed to authenticate the FortiGate to the remote peer.

Answer

The peer's certificate is not trusted

Answer

The certificate revocation list (CRL) is outdated

Answer

The CA certificate is missing

Question 3

A FortiGate administrator receives an error when trying to create a new VDOM: 'Maximum number of VDOMs reached.' However, the FortiGate model supports more VDOMs. What could be the issue?

Accepted Answer

The VDOM license is not installed or is expired. The error 'Maximum number of VDOMs reached' occurs when the FortiGate attempts to exceed the licensed VDOM count, even if the hardware model supports more. FortiGate VDOM licensing is enforced via a separate license file; without a valid, non-expired license, the device restricts VDOM creation to the default (often 1 or 2) or previously licensed limit. This is a common issue when a license has expired or was never installed.

Answer

The administrator is in the wrong VDOM context

Answer

The FortiGate is in transparent mode

Answer

The FortiGate needs a firmware upgrade

Question 4

An administrator wants to ensure that FortiGate validates the identity of the remote VPN peer using a certificate during IKEv2 phase 1. Which authentication method should the administrator select in the IPsec phase 1 configuration?

Accepted Answer

Signature (RSA). IKEv2 supports certificate-based authentication (RSA signature) for peer identity verification.

Answer

Aggressive mode

Answer

Pre-shared key

Answer

EAP

Question 5

An administrator is troubleshooting a FortiGate in transparent mode. The FortiGate is not forwarding traffic between two segments connected to port1 and port2. The administrator checks the interface configuration. Which TWO configurations are REQUIRED for a transparent mode VDOM to forward traffic? (Choose two.)

Accepted Answer

Both interfaces must be members of the same hardware switch (or software bridge). In transparent mode, FortiGate acts as a Layer 2 bridge, so traffic must be switched between interfaces. Both interfaces must be members of the same hardware switch or software bridge to create a single broadcast domain, allowing frames to be forwarded based on MAC addresses. Without this, the interfaces are isolated and cannot forward traffic at Layer 2.

Answer

Spanning Tree Protocol (STP) must be enabled on both interfaces

Answer

Both interfaces must be assigned IP addresses in the same subnet

Answer

A firewall policy must allow all traffic between the two interfaces

Question 6

An administrator needs to ensure that all firewall policies in a FortiGate VDOM have a common set of inspection profiles added at the end of the policy list. Which FortiManager feature best achieves this?

Accepted Answer

Policy package header/footer policies. Policy package header/footer policies in FortiManager allow you to define a set of policies that are automatically appended (or prepended) to every policy package within an ADOM or VDOM. This ensures that all firewall policies in the VDOM share a common set of inspection profiles at the end of the policy list, without manually editing each policy. It is the only feature designed specifically for this use case.

Answer

ADOM overrides

Answer

Central SNAT

Answer

Revision history

Question 7

A network administrator needs to configure SD-WAN on a FortiGate to distribute traffic across two WAN links based on session count. Which load balancing algorithm should be selected in the SD-WAN rule?

Accepted Answer

Sessions. The 'Sessions' load balancing algorithm distributes new sessions across SD-WAN members based on the current session count, ensuring an even distribution of sessions. This directly matches the requirement to distribute traffic based on session count, as it selects the member with the fewest active sessions for each new session.

Answer

Volume

Answer

Lowest-cost

Answer

Spillover

Question 8

A company has deployed a Security Fabric with a root FortiGate 600E and two downstream FortiGate 200E devices. The network also includes a FortiAnalyzer and a FortiManager. The administrator notices that the Security Fabric topology in FortiGate is not showing the downstream devices. The root FortiGate can ping the management IPs of the downstream devices. Additionally, the administrator has configured the downstream devices with the correct root IP and authorization mode is set to 'none'. However, when running 'diagnose sys fabric list' on the root, it shows the downstream devices with status 'Pending'. The root FortiGate's firewall policy allows all traffic from the downstream subnets. What is the most likely cause of the issue?

Accepted Answer

The downstream devices are missing the root FortiGate's serial number in the 'downstream-authorization' configuration.. The 'Pending' status in the output of 'diagnose sys fabric list' indicates that the root FortiGate has discovered the downstream devices but they have not completed the authorization handshake. Even though the authorization mode is set to 'none', each downstream FortiGate must still have the root FortiGate's serial number explicitly listed in its 'downstream-authorization' configuration to be accepted into the Security Fabric. Without this entry, the root will not finalize the adjacency, leaving the downstream devices in a pending state.

Answer

The FortiAnalyzer is not configured to receive logs from the downstream devices.

Answer

The downstream devices are using a different management port than the root.

Answer

The root FortiGate's firewall policy is blocking the downstream devices' Fabric traffic.

Question 9

A FortiGate is configured as a SAML identity provider (IdP) for a partner's SaaS application (SP). Users authenticate via FortiGate's local user database. The administrator successfully tests the SAML flow, but after some time, users are prompted to re-authenticate frequently. What is the most likely cause?

Accepted Answer

The SAML assertion lifetime is configured too short. SAML assertions have a validity period. If the IdP (FortiGate) sets a short assertion lifetime or the SP's session timeout is shorter, users will be prompted to re-authenticate. The most common cause is the assertion lifetime being too short.

Answer

The FortiGate's SAML service provider certificate has expired

Answer

The FortiGate's clock is not synchronized with NTP

Answer

The SP is using HTTP-POST binding instead of redirect

Question 10

A FortiGate administrator is investigating a slow network performance issue. The administrator suspects that session table limits are being reached. Which TWO metrics should be monitored to confirm this? (Choose two.)

Accepted Answer

Session fail rate. The session fail rate (B) directly indicates when the FortiGate is unable to establish new sessions because the session table is full, which is a clear symptom of hitting session table limits. The current session count (C) shows how many sessions are active; when this approaches the maximum session limit (e.g., 2 million on a FortiGate-600E), it confirms the table is near capacity. Monitoring both metrics together provides definitive evidence of session table exhaustion.

Answer

Interface bandwidth utilization

Answer

CPU usage

Answer

Memory usage

Question 11

An administrator is configuring ZTNA inline CASB for a SaaS application. The goal is to block upload of files containing credit card numbers. Which configuration components are required?

Accepted Answer

Configure a ZTNA application with a CASB profile and SSL inspection. ZTNA inline CASB uses a ZTNA proxy with SSL inspection and a CASB profile that includes a data leak prevention (DLP) rule to detect credit card numbers.

Answer

Use FortiClient to enforce DLP on endpoints

Answer

Configure an IPsec VPN between FortiGate and the SaaS provider

Answer

Configure a web filter profile with DLP sensor

Question 12

A network admin needs to configure a FortiGate to load balance traffic across two ISP links using SD-WAN. The requirement is to use both links simultaneously for different sessions based on source-destination IP hash. Which two settings are required? (Select TWO.)

Accepted Answer

Create an SD-WAN zone with both WAN members. An SD-WAN zone is a logical grouping of WAN members (interfaces) that allows FortiGate to treat multiple ISP links as a single entity for load balancing and redundancy. Without creating a zone that includes both WAN members, the SD-WAN rules cannot reference them collectively for traffic distribution. Option B is correct because the 'source-dest-ip-hash' load balancing algorithm ensures that sessions with the same source and destination IP pair are consistently forwarded over the same link, enabling per-session load balancing across both ISPs simultaneously.

Answer

Add a performance SLA for each member

Answer

Set the rule strategy to 'best quality'

Answer

Enable 'spillover' under the SD-WAN rule

Question 13

An administrator runs the following command on a FortiGate: 'diagnose sys session filter dport 443' and sees output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is fully established and has been active for 1 hour. The output shows proto=6 (TCP) and proto_state=01, which in FortiGate's session table corresponds to TCP state ESTABLISHED. The duration=3600 indicates the session has existed for 3600 seconds (1 hour), and expire=3599 shows it will expire in 3599 seconds. This confirms the session is fully established, making option A correct.

Answer

The session will expire in 3600 seconds and has been active for 3599 seconds

Answer

The session is in a TCP SYN-SENT state and has not completed the three-way handshake

Answer

The session is using UDP on port 443

Question 14

An administrator deploys a FortiGate in transparent mode with two VDOMs: one for the internal network and one for DMZ. The admin notices that ARP requests from internal hosts are not reaching the DMZ servers even though they are on the same VLAN. What is the most likely cause?

Accepted Answer

VDOMs in transparent mode are isolated layer 2 domains; inter-VDOM routing is required for communication. In transparent mode, each VDOM acts as an independent Layer 2 forwarding domain with its own MAC address table and VLAN database. ARP requests are broadcast frames that are confined to the VDOM where they originate; they are not forwarded to other VDOMs. Therefore, even if the internal and DMZ interfaces are on the same VLAN, the ARP request from an internal host will never reach a DMZ server unless inter-VDOM routing (Layer 3 forwarding between VDOMs) is explicitly configured.

Answer

The FortiGate is not configured to proxy ARP

Answer

The internal and DMZ VDOMs are in different VLANs on the same physical interface

Answer

Transparent mode does not support VDOMs

Question 15

An administrator configures a VDOM link between VDOMs A and B. In VDOM A, the VDOM link interface is assigned IP 10.10.10.1/24, and in VDOM B, it is assigned 10.10.10.2/24. A firewall policy on VDOM A allows traffic from a subnet in VDOM A to a subnet in VDOM B. However, traffic fails. The admin checks the routing table in VDOM A and sees a route to the destination subnet via 10.10.10.2. What is the most likely cause?

Accepted Answer

No firewall policy in VDOM B to allow traffic from the VDOM link. In a VDOM link configuration, traffic must be permitted by firewall policies on both VDOMs. Even though VDOM A has a policy allowing traffic to the destination subnet and a valid route via 10.10.10.2, VDOM B must have a policy that allows traffic from the VDOM link interface to reach the destination subnet. Without this policy, VDOM B will drop the packets, causing the traffic failure.

Answer

The VDOM link is not administratively up in VDOM B

Answer

Inter-VDOM routing is disabled globally

Answer

The subnet in VDOM B is not defined as an address object in VDOM A's policy