NSE7 Practice Test 47 — 15 Questions

Question 1

A FortiGate 600E is configured with multiple VDOMs in NAT mode. The administrator wants to route traffic between VDOM-1 and VDOM-2 without using physical interfaces. They create a VDOM link named 'vlink' with interfaces vlink0 and vlink1, assign vlink0 to VDOM-1 (IP 10.0.1.1/30) and vlink1 to VDOM-2 (IP 10.0.1.2/30). However, traffic from a host in VDOM-1 (192.168.1.0/24) to a server in VDOM-2 (192.168.2.0/24) fails. The administrator has added static routes in both VDOMs pointing to the respective VDOM link IPs. What is the most likely cause of the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VDOM link interfaces require a firewall policy to allow traffic between VDOMs.. Inter-VDOM routing via VDOM links requires both routing and firewall policies. The VDOM link provides the Layer 3 path, and static routes direct traffic, but without a firewall policy allowing traffic from the source to destination VDOM, the FortiGate drops the packets. The administrator must add a policy in VDOM-1 (and possibly VDOM-2 for return traffic) to permit the flow.

Answer

The VDOM link interfaces must be in the same VDOM.

Answer

The IP addresses on the VDOM link interfaces must be in different subnets.

Answer

The static routes must be configured with the VDOM link interface as the outgoing interface, not the next-hop IP.

Question 2

A FortiGate administrator is configuring a security profile to detect command-and-control traffic from internal hosts. The administrator wants to use a signature-based detection method that matches known botnet patterns. Which FortiGate feature should be enabled to accomplish this?

Accepted Answer

Intrusion Prevention System (IPS) with botnet signatures. The Intrusion Prevention System (IPS) on FortiGate uses a signature database that includes patterns for known botnet command-and-control traffic. Enabling IPS with botnet signatures allows the firewall to inspect packets and block or log C2 communications. Other features like web filtering, application control, or DNS filtering do not provide the same level of signature-based detection for C2 traffic.

Answer

Application Control with botnet category

Answer

DNS Filter with botnet domain database

Answer

FortiGuard Category Based Filter

Question 3

An administrator has deployed a ZTNA configuration on a FortiGate where remote users authenticate through FortiClient EMS. The administrator wants to ensure that only devices with an up-to-date operating system and active antivirus are granted access to an internal web application. The FortiGate is configured as the ZTNA access proxy. Which FortiGate component or configuration is required to enforce these device compliance checks?

Accepted Answer

Configure a ZTNA server with a tag that references the FortiClient EMS compliance tags and apply it in the ZTNA policy.. ZTNA on FortiGate integrates with FortiClient EMS to receive compliance tags. Using these tags in a ZTNA policy allows enforcement of device posture before granting access. This dynamic tagging ensures that only devices meeting the defined compliance criteria can reach the protected application, aligning with zero-trust principles.

Answer

Configure an IPsec VPN tunnel between FortiClient and FortiGate and apply a firewall policy with antivirus scanning.

Answer

Create a firewall policy that uses a schedule to allow access only during business hours, assuming devices are patched.

Answer

Enable client certificate authentication on the ZTNA server and require a specific certificate issued by the EMS.

Question 4

An administrator has a FortiGate 600E running multiple VDOMs in NAT mode. The security team wants to inspect inter-VDOM traffic between VDOM-A and VDOM-B with a firewall policy that applies UTM profiles. The administrator has already created a VDOM link named vlink1 with interfaces vlink1-A in VDOM-A and vlink1-B in VDOM-B. What must the administrator do to ensure that inter-VDOM traffic is inspected by a security policy?

Accepted Answer

Create a firewall policy in VDOM-A from the internal interface to vlink1-A and a matching policy in VDOM-B from vlink1-B to the internal interface, and apply UTM profiles to both policies.. Inter-VDOM traffic is routed through VDOM link interfaces and is subject to the firewall policies of each VDOM it enters. To inspect traffic from VDOM-A to VDOM-B, a policy in VDOM-A must allow traffic from the source interface to vlink1-A, and a policy in VDOM-B must allow traffic from vlink1-B to the destination interface. UTM profiles can be applied to either or both policies, depending on where inspection is desired. This ensures that inter-VDOM traffic is not implicitly allowed and can be inspected.

Answer

Enable UTM inspection on the VDOM link interface in VDOM-A only, because traffic is inspected once as it leaves the source VDOM.

Answer

Assign the VDOM link interfaces to a zone in each VDOM, then create a single global firewall policy that applies to both VDOMs and includes UTM profiles.

Answer

Create a single firewall policy in VDOM-A from the internal interface to vlink1-A, and rely on the implicit inter-VDOM link policy to allow return traffic without inspection.

Question 5

A security analyst is reviewing FortiGate logs and notices that a known malicious file hash is being downloaded repeatedly, but the antivirus profile is not blocking it. The file is detected by FortiSandbox, and the FortiGate has a valid FortiGuard license. Which action should the analyst take to ensure the hash is blocked on subsequent downloads?

Accepted Answer

Add the file hash to a custom antivirus signature list or threat feed and enable it in the antivirus profile.. When a specific malicious file hash is known, the most direct and reliable way to block it on FortiGate is to add that hash to a custom antivirus signature or external threat feed and enable it in the antivirus profile. This ensures detection regardless of the delivery URL or protocol, and it integrates with existing antivirus scanning. It also avoids overblocking legitimate executables and does not depend solely on sandbox verdict propagation.

Answer

Enable 'Treat Windows executable files as viruses' in the antivirus profile to block all executable downloads.

Answer

Configure FortiSandbox to send a verdict to FortiGate and set the action to 'Block' in the sandbox profile.

Answer

Enable the 'Block malicious URLs' option in the web filter profile so the download URL is blocked.

Question 6

A FortiGate administrator is setting up a ZTNA rule to allow access to an internal application only for users who are members of the 'Finance' group in FortiClient EMS. The administrator has already configured the ZTNA server and access proxy. Which additional configuration is required on the FortiGate to enforce this group membership?

Accepted Answer

Configure a user group on the FortiGate that maps to the Finance group in EMS and reference it in the ZTNA rule.. To enforce EMS group membership, the FortiGate must have a user group that is synchronized with the EMS Finance group. This is done by creating a user group with the EMS connector as the source and specifying the Finance group. The ZTNA rule then uses this user group as a source condition. This ensures that only users belonging to the Finance group in EMS are granted access, without manual user management.

Answer

Enable EMS tag synchronization and create a tag for the Finance group.

Answer

Create a firewall address object for the Finance group and reference it in the ZTNA rule.

Answer

Add the Finance group as a local user group on the FortiGate and manually add each user.

Question 7

An administrator manages a FortiGate with VDOMs 'prod' and 'dev' on a single HA pair. The administrator wants 'prod' to fail over independently from 'dev' so that maintenance on the dev environment does not trigger a failover of prod. Which FortiGate feature should be configured?

Accepted Answer

Enable virtual clustering and assign 'prod' and 'dev' to different virtual clusters within the HA pair. Virtual clustering divides a FortiGate HA cluster into multiple HA groups, each maintaining its own primary and monitored interfaces. By placing prod and dev in separate virtual clusters, the administrator achieves independent failover, so an event affecting dev does not cause prod to switch over. This is the intended mechanism for per-VDOM-group redundancy.

Answer

Configure a separate VDOM link between 'prod' and 'dev' and enable HA monitoring on that link

Answer

Configure VDOM partitioning with resource limits so each VDOM has dedicated CPU and memory

Answer

Set the HA override priority differently for each VDOM so 'prod' prefers one unit and 'dev' prefers the other

Question 8

An administrator is configuring a FortiGate with multiple VDOMs in NAT/route mode. The administrator wants to enable inter-VDOM routing between VDOM-A and VDOM-B using a VDOM link. Which TWO statements about VDOM links are correct? (Choose two.)

Accepted Answer

Each VDOM link interface must be assigned an IP address to enable routing.. VDOM links are virtual point-to-point interfaces that require manual creation and IP address assignment on each end. They connect exactly two VDOMs and traffic over them is subject to firewall policies in both VDOMs. These characteristics make them suitable for controlled inter-VDOM routing.

Answer

Traffic over a VDOM link is not subject to firewall policies.

Answer

VDOM links are automatically created when a new VDOM is added.

Answer

A VDOM link can connect more than two VDOMs simultaneously.

Question 9

A FortiGate is deployed in multi-VDOM mode with VDOM-1 and VDOM-2. The administrator creates an inter-VDOM link named IVL1 with interface ivl-1-0 in VDOM-1 and ivl-1-1 in VDOM-2. Static routes are configured in both VDOMs to route traffic across the link. However, traffic from VDOM-1 to VDOM-2 is dropped. What is the most likely reason?

Accepted Answer

Firewall policies allowing traffic from VDOM-1 to VDOM-2 across the inter-VDOM link have not been created in both VDOMs.. Inter-VDOM links provide a virtual connection between two VDOMs, but they are not exempt from firewall inspection. After creating the link and configuring static routes, you must add firewall policies in each VDOM to permit traffic from the source interface to the inter-VDOM link interface, and from the inter-VDOM link interface to the destination interface. Without these policies, the FortiGate drops the packets even though routing is correct. This is a common misconfiguration in multi-VDOM deployments.

Answer

The inter-VDOM link pair must be in the same VDOM; splitting them across VDOMs disables the link.

Answer

The inter-VDOM link interfaces must be assigned to a zone before they can pass traffic.

Answer

Inter-VDOM links do not support static routing; dynamic routing protocols must be used.

Question 10

An administrator is troubleshooting a FortiGate that is experiencing high CPU usage. The administrator runs 'diagnose sys top' and observes that the 'ipsengine' process is consuming a large amount of CPU. The administrator suspects that a specific IPS signature is causing the issue. Which command should the administrator use to identify which IPS signature is triggering the high CPU usage?

Accepted Answer

diagnose test application ipsengine 4. The 'diagnose test application ipsengine 4' command is specifically designed to show the top IPS signatures by CPU usage, allowing the administrator to identify which signature is causing high CPU. Other commands provide general IPS or session information but do not drill down to per-signature CPU consumption.

Answer

diagnose sys session full-stat

Answer

diagnose ips anomaly list

Answer

diagnose debug application ipsmonitor -1

Question 11

A FortiGate administrator is implementing Zero Trust Network Access (ZTNA) for remote users accessing internal applications. The administrator wants to ensure that only authenticated and compliant devices can access the applications, and that all traffic is inspected. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Enable device posture checking by integrating FortiClient EMS with the FortiGate.. To implement ZTNA with Zero Trust principles, you must define the applications via a ZTNA server with application mappings, and integrate FortiClient EMS to enforce device posture. These two actions ensure that only authenticated and compliant devices can access the specified applications. The ZTNA server proxies the traffic, and the EMS integration provides the necessary compliance data for policy decisions.

Answer

Set the ZTNA server to use 'transparent' mode instead of 'proxy' mode for all applications.

Answer

Create a firewall policy that allows all traffic from the ZTNA server to the internal network.

Answer

Configure SSL VPN for remote users to connect before accessing ZTNA applications.

Question 12

An administrator is troubleshooting an SD-WAN deployment where traffic is not being forwarded according to the configured SD-WAN rules. The FortiGate has two WAN interfaces, port1 and port2, both members of an SD-WAN zone. A performance SLA is configured and both members are within SLA. The administrator suspects that the SD-WAN rules are not being evaluated correctly. Which two statements about SD-WAN rule evaluation are correct? (Choose two.)

Accepted Answer

SD-WAN rules are evaluated in the order they appear in the configuration, and the first matching rule is applied.. SD-WAN rules are evaluated in a top-down order, and the first matching rule determines the path selection. They can match on various criteria, including applications identified by application control. If no rule matches, the FortiGate uses the regular routing table. SD-WAN rules are part of the routing decision and are evaluated before firewall policies. They are not limited to outbound traffic; they can apply to any traffic that matches the criteria.

Answer

If no SD-WAN rule matches, traffic is dropped by default.

Answer

SD-WAN rules are evaluated only after a firewall policy has allowed the traffic.

Answer

SD-WAN rules are applied only to outbound traffic initiated from the internal network.

Question 13

An administrator is configuring FortiGate to inspect SSL traffic for malware. They enable deep inspection in the SSL inspection profile and apply it to a firewall policy. Users report that some HTTPS websites are showing certificate errors. What is the most likely cause?

Accepted Answer

The websites are using certificate pinning, which prevents deep inspection.. Certificate pinning in applications or browsers causes certificate errors when deep inspection is used because the FortiGate presents a re-signed certificate that does not match the pinned certificate. Administrators should exempt such sites from deep inspection or use a different inspection method.

Answer

The SSL inspection profile is set to protect only the server, not the client.

Answer

The FortiGate is using a self-signed certificate for deep inspection.

Answer

The FortiGate is not configured to use SNI for SSL inspection.

Question 14

A security administrator is configuring a FortiGate to use an external threat intelligence feed to block malicious IP addresses. The administrator wants the FortiGate to automatically update the list of malicious IPs from a threat feed and use it in firewall policies. Which FortiGate feature should be used?

Accepted Answer

Threat feeds in Security Fabric > Fabric Connectors. Threat feeds in Fabric Connectors allow FortiGate to subscribe to external threat intelligence sources and automatically update dynamic firewall addresses. These addresses can be used in policies to block malicious IPs. Other options either provide static or geographic-based lists, not dynamic external feeds.

Answer

DNS filter with a threat feed category

Answer

Internet Service Database (ISDB) in firewall addresses

Answer

Geo IP database in firewall addresses

Question 15

A FortiGate administrator is configuring an IPsec VPN with IKEv2. The remote peer is behind a NAT device and has a dynamic public IP. The administrator wants the FortiGate to act as the responder and allow the remote peer to initiate the tunnel, while ensuring that only the remote peer's unique ID (FQDN) is accepted. Which configuration on the FortiGate is required to achieve this?

Accepted Answer

Set the local gateway to 0.0.0.0 and configure the remote gateway as 0.0.0.0, then set the peer ID to the remote peer's FQDN.. For a remote peer with a dynamic IP behind NAT, the FortiGate must listen on all interfaces and accept connections from any IP. Setting the local gateway to 0.0.0.0 and the remote gateway to 0.0.0.0 enables this. The peer ID is then used to authenticate the remote peer by its FQDN, providing security without relying on a static IP. This configuration is standard for dynamic IP peers.

Answer

Set the local gateway to 0.0.0.0 and configure the remote gateway as the remote peer's current public IP, then set the peer ID to the remote peer's FQDN.

Answer

Set the local gateway to the FortiGate's public IP and configure the remote gateway as 0.0.0.0, then set the peer ID to the remote peer's FQDN.

Answer

Set the local gateway to 0.0.0.0 and configure a pre-shared key with the remote peer's FQDN as the peer ID.