NSE7 Practice Test 48 — 15 Questions

Question 1

An administrator needs to verify that a FortiGate is correctly matching a firewall policy for traffic from 192.168.1.0/24 to 10.0.0.0/8. Which command provides a list of policies that match a given source and destination?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

diagnose firewall policy lookup. The 'diagnose firewall policy lookup' command is designed to simulate a policy lookup based on specified parameters such as source IP, destination IP, and incoming interface. It returns the policy ID that would be matched, making it the ideal tool for verifying policy matching for specific traffic.

Answer

diagnose debug flow filter

Answer

diagnose firewall iprope list 100004

Answer

show firewall policy

Question 2

A FortiGate 600E is running multiple VDOMs in NAT mode. The administrator wants to assign a VLAN subinterface to VDOM-A while the parent physical interface remains in the root VDOM. Which configuration step is required to accomplish this?

Accepted Answer

Create the VLAN subinterface under the physical interface in the root VDOM, then move the VLAN subinterface to VDOM-A.. VLAN subinterfaces can be individually assigned to different VDOMs while the parent interface remains in the root VDOM. The administrator must create the VLAN under the parent in root, then change the VLAN interface's VDOM assignment. This allows a single physical port to serve multiple VDOMs without moving the parent, preserving root access and other VLANs.

Answer

Use a VDOM link between root and VDOM-A and bridge the VLAN traffic across the link.

Answer

Enable VDOM partitioning on the physical interface and assign the VLAN subinterface to VDOM-A.

Answer

Assign the physical interface to VDOM-A and create the VLAN subinterface there; the root VDOM will automatically retain management access.

Question 3

An administrator is configuring a FortiGate to detect and block traffic to known malicious domains using DNS filtering. The administrator wants to ensure that DNS queries for malicious domains are blocked and that users are redirected to a block page. Which DNS filter action should be configured?

Accepted Answer

Redirect. The 'Redirect' action in DNS filtering blocks resolution of malicious domains and redirects the user to a FortiGate block page, satisfying both blocking and user notification. 'Block' only drops the query, 'Allow' permits access, and 'Monitor' only logs. Therefore, 'Redirect' is the correct choice.

Answer

Block

Answer

Monitor

Answer

Allow

Question 4

An administrator is configuring an SD-WAN rule to load balance traffic across two WAN links. The administrator wants to distribute traffic based on the source IP address to ensure that each source uses a consistent path. Which load balancing algorithm should be used?

Accepted Answer

Source IP. The 'source-ip' load balancing algorithm uses a hash of the source IP address to select an SD-WAN member. This ensures that all traffic from a specific source IP consistently uses the same WAN link, providing session persistence. This meets the administrator's requirement to distribute traffic based on source IP and maintain consistent paths.

Answer

Weighted round robin

Answer

Lowest cost (SLA)

Answer

Volume

Question 5

A FortiGate is configured with three VDOMs: root, Sales, and Engineering. The administrator wants to ensure that the Sales VDOM can access the internet through the root VDOM, but the Engineering VDOM must not have any internet access. All VDOMs are currently in NAT mode. Which configuration is required to achieve this?

Accepted Answer

Create an inter-VDOM link between Sales and root. Assign a default route in Sales pointing to the inter-VDOM link. Do not create any inter-VDOM link or default route for Engineering.. The correct configuration is to provide internet access only to the Sales VDOM by creating an inter-VDOM link to the root VDOM and assigning a default route in Sales pointing to that link. Engineering should not have any inter-VDOM link or default route, ensuring it has no path to the internet. This method is deterministic and avoids reliance on firewall policies that could be misconfigured.

Answer

Create an inter-VDOM link between Sales and root, and another between Engineering and root. Assign default routes in both Sales and Engineering pointing to the inter-VDOM link. Apply a firewall policy in root that denies traffic from Engineering to the internet.

Answer

Create an inter-VDOM link between Engineering and root. Assign a default route in Engineering pointing to the inter-VDOM link. Apply a firewall policy in root that denies traffic from Engineering to the internet. Do not configure anything for Sales.

Answer

Place all VDOMs in transparent mode. Create VLANs for each VDOM and assign them to the root VDOM. Configure firewall policies in root to allow Sales to the internet and deny Engineering.

Question 6

A FortiGate administrator is troubleshooting a policy that is supposed to allow HTTP traffic from an internal subnet to a web server. Users report that they cannot access the web server. The administrator runs 'diagnose debug flow' and sees that the traffic is being denied by policy 0. What is the most likely cause?

Accepted Answer

The policy does not match the traffic because of incorrect source or destination interface, address, or service.. When 'diagnose debug flow' shows that traffic is denied by policy 0, it means no firewall policy matched the traffic. The most likely cause is that the policy does not match the traffic due to incorrect configuration of interfaces, addresses, or services. The administrator should verify that the policy's source and destination interfaces and addresses align with the actual traffic, and that the service is correctly set to HTTP. This is a common troubleshooting step for policy mismatches.

Answer

The traffic is being denied by a security profile.

Answer

The traffic is being denied by the implicit deny policy.

Answer

The policy is disabled or does not exist.

Question 7

A FortiGate is configured with a VIP (virtual IP) for an internal web server. Users report that the web server is unreachable from the internet, but it works from the internal network. The administrator runs 'diagnose sniffer packet any "host 203.0.113.10 and port 80" 4' and sees incoming packets on the wan1 interface but no outgoing packets on the internal interface. What is the MOST likely cause?

Accepted Answer

The firewall policy allowing traffic from wan1 to the internal server is missing or misconfigured.. When a VIP is used, the FortiGate performs destination NAT, but a firewall policy from the external interface to the internal interface (or the VIP's mapped interface) is still required to allow the translated traffic. The sniffer output indicates that packets arrive but are not forwarded, which is characteristic of a missing or incorrect policy. The VIP itself does not bypass policy checks.

Answer

The VIP is configured with port forwarding disabled.

Answer

The VIP is not configured with the correct external IP address.

Answer

The internal web server is down or not responding.

Question 8

An administrator has configured a FortiGate with an SD-WAN zone named 'virtual-wan-link' containing two members: port1 (WAN1) and port2 (WAN2). A performance SLA named 'CriticalSLA' monitors a server at 8.8.8.8 using ICMP probes every 5 seconds, with failure thresholds: latency 200 ms, jitter 50 ms, packet loss 5%. The SLA status for port1 is 'alive' and for port2 is 'dead'. An SD-WAN rule is configured to use the 'lowest-cost' algorithm with the SLA target 'CriticalSLA'. The administrator notices that all traffic is being routed through port1, even though port2 has a lower cost metric. What is the most likely reason for this behavior?

Accepted Answer

The SD-WAN rule is configured with the 'lowest-cost' algorithm, which only selects members that meet the SLA target; port2 is excluded because it is dead.. The lowest-cost algorithm selects the member with the lowest cost among those that meet the SLA target. Since port2 is dead, it is excluded from selection, leaving port1 as the only eligible member. This ensures traffic only uses links that meet the performance requirements. The cost metric is only considered after filtering by SLA status.

Answer

The performance SLA is using ICMP probes, which are not supported for SLA monitoring; the FortiGate falls back to using only port1.

Answer

The SD-WAN rule is missing a priority configuration; without priority, the FortiGate defaults to using the first member in the zone.

Answer

The 'lowest-cost' algorithm only considers the configured cost of each member, and port2 has a higher cost than port1.

Question 9

An administrator needs to configure an SD-WAN rule that routes traffic from the guest VLAN to the Internet using the most cost-effective link. The SD-WAN zone contains three members: port1 (MPLS, cost 10), port2 (Broadband, cost 5), and port3 (LTE, cost 20). All members meet the performance SLA. Which load balancing algorithm should be used to ensure traffic uses the lowest-cost link?

Accepted Answer

Lowest Cost. The 'Lowest Cost' strategy is designed to select the member with the lowest cost that meets the SLA. In this scenario, port2 has the lowest cost, so it will be chosen as long as it meets the SLA. This ensures that guest traffic uses the most cost-effective link while still maintaining acceptable performance. The other strategies do not prioritize cost and would not meet the requirement.

Answer

Best Quality

Answer

Source IP

Answer

Volume

Question 10

A FortiGate administrator is troubleshooting a connectivity issue where users cannot access a web server behind the FortiGate from the internet. The administrator suspects that the virtual IP (VIP) configuration is incorrect. Which two commands should the administrator use to verify the VIP configuration and its associated firewall policy? (Choose two.)

Accepted Answer

show firewall policy. The correct commands are 'show firewall vip' and 'show firewall policy'. The first displays the VIP configuration, ensuring the external IP and mapped IP are correct. The second shows the firewall policies, verifying that a policy exists to allow traffic to the VIP. Together, they allow the administrator to confirm both the VIP setup and the policy that permits access, which are both necessary for connectivity.

Answer

diagnose debug flow filter

Answer

diagnose firewall vip list

Answer

diagnose firewall iprope list

Question 11

A FortiGate administrator is configuring an IPsec VPN with IKEv2 between two sites. The administrator wants to ensure that the VPN tunnel uses perfect forward secrecy (PFS) and that the phase 2 selectors are restricted to specific subnets. Which two configuration elements are required to meet these goals? (Choose two.)

Accepted Answer

Configure local and remote subnets in the phase 2 selectors.. To achieve PFS, a DH group must be configured in the phase 2 proposals, which triggers a new key exchange for each phase 2 SA. To restrict the tunnel to specific subnets, the local and remote subnets must be defined in the phase 2 selectors. Together, these two elements ensure that the VPN meets both the PFS and subnet restriction requirements. Other options do not directly contribute to these goals.

Answer

Enable auto-negotiation in phase 2.

Answer

Set the phase 1 proposal to use a DH group.

Answer

Enable replay detection in phase 2.

Question 12

A FortiGate administrator is deploying ZTNA with a FortiClient EMS that tags endpoints as 'compliant' or 'non-compliant'. The administrator wants the FortiGate to grant access only to endpoints that FortiClient EMS has tagged as compliant, while still allowing non-compliant endpoints to reach a remediation portal. Which two configuration elements on the FortiGate must be aligned to enforce this?

Accepted Answer

A FortiClient EMS fabric connector with the correct EMS tags, and firewall policies that use those tags as source or destination criteria.. FortiClient EMS tags are surfaced on FortiGate through the EMS fabric connector. The FortiGate must be configured with the connector (host, credentials, and tag synchronization) so EMS tags become usable address objects, and firewall or ZTNA policies must reference those tag objects as match criteria. A separate policy can then allow non-compliant endpoints to reach the remediation portal.

Answer

A ZTNA server with an SSL certificate and a firewall policy referencing an EMS-tag-based address object, plus a second policy permitting non-compliant endpoints to the remediation portal.

Answer

An LDAP connector to Active Directory and user group policies that map AD groups to the compliant tag.

Answer

A ZTNA proxy rule with an inline CASB profile and a DLP sensor that inspects endpoint traffic for compliance indicators.

Question 13

A security administrator is configuring a FortiGate to block outbound traffic to known command-and-control (C2) servers. The administrator wants to use a dynamic, cloud-based threat intelligence service that is continuously updated by Fortinet. Which FortiGuard service should be enabled to block traffic based on the latest C2 IP addresses and domains?

Accepted Answer

FortiGuard Botnet C&C IP Database. The FortiGuard Botnet C&C IP Database is specifically designed to block traffic to known command-and-control servers. It is a dynamic list maintained by Fortinet and can be enabled in firewall policies to automatically block outbound connections to these malicious IPs. Other FortiGuard services address different threat vectors, such as web filtering or anti-spam, and do not provide the same C2-specific blocking.

Answer

FortiGuard IP Reputation

Answer

FortiGuard Web Filtering

Answer

FortiGuard Anti-Spam

Question 14

A FortiGate administrator is configuring ZTNA inline CASB to control access to a SaaS application. The administrator wants to block uploads of files containing sensitive data while allowing other operations. Which ZTNA inline CASB configuration is required to achieve this?

Accepted Answer

Create a ZTNA rule with an inline CASB profile that has a DLP profile configured to block files with sensitive data.. ZTNA inline CASB on FortiGate can inspect traffic to SaaS applications using security profiles. To block uploads of files containing sensitive data, a DLP profile must be configured with rules that detect sensitive data and set the action to block. This DLP profile is then referenced in the inline CASB profile within the ZTNA rule. This combination allows the FortiGate to inspect file contents and block only those that match sensitive data patterns, while allowing other uploads.

Answer

Create a ZTNA rule with an inline CASB profile and enable 'sensitive-data-block' in the CASB settings.

Answer

Create a ZTNA rule with a CASB profile that has 'file-upload-block' enabled.

Answer

Create a ZTNA rule with an application control profile that blocks the upload action for the SaaS application.

Question 15

A FortiGate administrator is using the built-in FortiGuard web filter to block malicious websites. Users report that they can still access a site that is categorized as 'Malware' by FortiGuard. The administrator verifies that the web filter profile is applied to the policy and that the category is set to block. What is the most likely reason for this issue?

Accepted Answer

The site is using HTTPS and SSL inspection is not enabled.. The most likely reason is that the site uses HTTPS and SSL inspection is not enabled. FortiGate cannot inspect the encrypted traffic to determine the URL category, so the web filter cannot block it. Enabling SSL inspection allows FortiGate to decrypt and apply the web filter. Other options like cache, monitor mode, or FortiGuard reachability are less likely given the scenario details. Thus, SSL inspection is the key.

Answer

The web filter profile is set to monitor mode instead of block.

Answer

The FortiGuard service is not reachable.

Answer

The web filter cache has not been updated.