NSE7 Practice Test 48 — 15 Questions

Question 1

Which command is used on a FortiGate to view the current routing table including VRF instances?

Accepted Answer

get router info routing-table all. 'get router info routing-table all' is the FortiGate CLI command that displays the complete routing table, including all VRF instances. This command retrieves the kernel routing table entries for every VRF, showing routes from all routing protocols (static, OSPF, BGP, etc.) and is the standard way to view the full routing context on FortiGate.

Answer

show ip route

Answer

diagnose ip route list

Answer

execute router list

Question 2

An administrator runs 'diagnose debug application ssl-helper -1' and sees that sessions to certain HTTPS sites are being terminated by the FortiGate. What is the MOST likely cause?

Accepted Answer

The FortiGate is performing TCP RST injection due to a mismatch in the SSL/TLS handshake as part of deep inspection. The 'diagnose debug application ssl-helper -1' command shows SSL helper events, including TCP RST injection. When deep inspection is enabled and the FortiGate cannot complete the SSL/TLS handshake with the server (e.g., due to cipher mismatch, certificate validation failure, or unsupported protocol version), it sends a TCP RST to both the client and server to terminate the session. This is the most direct cause of sessions being terminated as observed in the debug output.

Answer

The FortiGate's certificate authority (CA) certificate has expired, causing SSL inspection to fail

Answer

The antivirus profile is blocking the HTTPS connections due to a virus signature match

Answer

The SSL deep inspection policy is set to 'certificate-inspection' which blocks sessions with mismatched certificates

Question 3

A network administrator wants to block known malicious IP addresses using threat intelligence feeds on FortiGate. Which feature should they use?

Accepted Answer

External Threat Intelligence. FortiGate's External Threat Intelligence feature allows administrators to import and consume threat intelligence feeds (e.g., STIX/TAXII, CSV, or custom URLs) to block known malicious IP addresses. This is the correct feature because it is specifically designed to ingest external threat data and apply it to firewall policies for dynamic blocking, unlike the other options which serve different purposes.

Answer

FortiGuard Web Filtering

Answer

Application Control

Answer

IP Reputation

Question 4

An administrator configures a VDOM on a FortiGate and assigns two interfaces (port1, port2) to it. The administrator wants to route traffic between two different subnets within the same VDOM. Which configuration is required?

Accepted Answer

Configure static or dynamic routing. Routing between two subnets within the same VDOM is standard intra-VDOM routing. Since both interfaces (port1, port2) belong to the same VDOM, no inter-VDOM constructs are needed; the FortiGate simply requires a route (static or dynamic) to forward packets between the subnets. A firewall policy allowing the traffic is also necessary, but the question specifically asks for the routing configuration.

Answer

Configure a VDOM link

Answer

Create a policy with inter-VDOM link

Answer

Enable inter-VDOM routing

Question 5

What is the primary purpose of an administrative VDOM on a FortiGate?

Accepted Answer

To provide independent management and administrative access for different tenants or departments. An administrative VDOM on a FortiGate provides independent management and administrative access for different tenants or departments. Each administrative VDOM has its own administrator accounts, authentication settings, and management interfaces (HTTPS, SSH, SNMP), allowing multi-tenant isolation without requiring separate physical firewalls. This is distinct from traffic-forwarding VDOMs, which handle data plane operations.

Answer

To enable transparent mode operation

Answer

To increase the maximum number of firewall policies

Answer

To route traffic between different VDOMs

Question 6

An organization uses FortiWeb to protect its web applications. The security team wants to block requests that contain a specific custom pattern in the URL. Which feature should be used?

Accepted Answer

Custom Attack Signature. Custom Attack Signatures in FortiWeb allow administrators to define user-specific patterns to match against HTTP request elements, including the URL. This feature is designed to block requests containing custom patterns, such as a specific string in the URL, by inspecting the request and triggering an action (e.g., alert or block) when the pattern is matched. Unlike other features, Custom Attack Signatures provide the granularity needed to detect and block arbitrary, organization-defined patterns in the URL.

Answer

Inline Protection Profile

Answer

URL Access Rule

Answer

Web Application Firewall Policy

Question 7

What is the primary purpose of Content Disarm and Reconstruction (CDR) in advanced antivirus protection?

Accepted Answer

To reconstruct files by removing potentially malicious active content such as macros and scripts. Content Disarm and Reconstruction (CDR) is designed to proactively neutralize threats by stripping or disabling potentially dangerous active content—such as macros, scripts, and embedded objects—from files while preserving the file's usability. Unlike signature-based detection, CDR does not rely on known threat signatures; instead, it reconstructs the file in a safe state, removing any elements that could execute malicious code. This makes CDR a zero-day prevention technique that blocks threats before they can be analyzed or detected by traditional methods.

Answer

To detect and block known malware using signature-based detection

Answer

To submit files to FortiSandbox for behavioral analysis

Answer

To encrypt files in transit to prevent interception

Question 8

A network engineer is configuring SD-WAN on a FortiGate. They have three WAN interfaces (wan1, wan2, lte) and want traffic to the primary datacenter (10.10.10.0/24) to use wan1 unless its latency exceeds 50 ms, in which case failover to wan2. The engineer created an SD-WAN rule with a strategy of 'Manual' and selected 'wan1' as the preferred member. What additional configuration is required to achieve automatic failover based on latency?

Accepted Answer

Configure a performance SLA for wan1 with a latency threshold of 50 ms and associate it with the SD-WAN rule.. SD-WAN automatic failover based on latency requires a Performance SLA (performance-sla) configured with a latency threshold of 50 ms, and that SLA must be associated with the SD-WAN rule. The rule's strategy should be set to 'Manual' with wan1 as preferred member, but the SLA triggers the failover when the latency exceeds the threshold, causing the rule to select the next available member (wan2). Without the SLA, the Manual strategy simply pins traffic to wan1 and never fails over.

Answer

Create a route map to prefer wan1 and apply it to the SD-WAN rule.

Answer

Set the SD-WAN rule strategy to 'Best Quality' and select latency as the metric.

Answer

Enable BFD on wan1 and wan2 with a minimum interval of 50 ms.

Question 9

An administrator needs to generate a report showing top applications by bandwidth usage across all VDOMs for the last 30 days. Which FortiAnalyzer feature should be used?

Accepted Answer

FortiView. FortiView is the correct feature because it provides pre-aggregated, real-time and historical traffic analytics, including top applications by bandwidth usage, across all VDOMs without requiring custom queries. It leverages the FortiAnalyzer’s built-in data summarization engine to display per-VDOM and cross-VDOM application usage over a specified time range, such as the last 30 days.

Answer

Playbooks

Answer

Log browsing

Answer

Incident management

Question 10

A multi-tenant FortiGate uses VDOMs. The administrator notices that logins via SSH to the management VDOM succeed, but attempts to SSH to a traffic VDOM's management IP fail. The traffic VDOM has an administrative user configured. What is the most likely cause?

Accepted Answer

SSH access is not enabled on the traffic VDOM's management interface. SSH access to a VDOM's management IP requires that the management interface explicitly permits SSH administrative access. In a multi-tenant FortiGate with VDOMs, each VDOM's management interface has its own independent administrative access settings. Even if the admin user exists and the VDOM is licensed, SSH will be rejected if the management interface does not have SSH access enabled under config system interface or via the GUI. The fact that SSH to the management VDOM succeeds but fails to the traffic VDOM's management IP points directly to this per-interface access control.

Answer

The traffic VDOM does not have a license

Answer

The traffic VDOM is in transparent mode

Answer

The admin user is not in the correct trust group

Question 11

A BGP peering between two FortiGates is not establishing. The administrator runs 'get router info bgp neighbor' and sees that the neighbor state is 'Idle' and the BGP configuration appears correct. What should the administrator check next?

Accepted Answer

Verify that the BGP neighbor IP is reachable via the routing table. When a BGP neighbor is stuck in the 'Idle' state, it typically indicates that BGP cannot initiate the TCP connection to the neighbor. The most common cause is that the neighbor IP address is not reachable via the routing table. Even if the BGP configuration (AS number, neighbor IP) is correct, BGP will remain Idle until it can successfully open a TCP session on port 179. Therefore, verifying IP reachability (e.g., with 'ping' or checking the routing table) is the logical next step.

Answer

Run 'diagnose ip router bgp all enable' to enable debug

Answer

Check the BGP AS number configuration

Answer

Increase the BGP timers

Question 12

During a security audit, it is found that traffic between two VDOMs is allowed even though no inter-VDOM routing policy is configured. The VDOMs are connected via a VDOM link. What could explain this behavior?

Accepted Answer

The VDOM link is operating in transparent mode. When a VDOM link operates in transparent mode, it acts as a Layer 2 bridge between the connected VDOMs. In transparent mode, the VDOM link does not require an inter-VDOM routing policy because traffic is forwarded based on MAC addresses rather than IP routing, effectively allowing all traffic between the VDOMs unless explicitly filtered by firewall policies. This explains why traffic flows even without a configured inter-VDOM routing policy.

Answer

The FortiGate is in NAT mode

Answer

The VDOMs are in the same administrative domain

Answer

The VDOM link is using the same interface IP

Question 13

An administrator runs 'get router info routing-table bgp' and sees that a route for 10.20.0.0/16 is learned via BGP from a neighbor. However, the route does not appear in the routing table. The administrator checks the BGP configuration and sees that 'network 10.20.0.0 255.255.0.0' is not configured under BGP. What is the most likely reason?

Accepted Answer

A route map is filtering the received route. The route for 10.20.0.0/16 is learned via BGP from a neighbor and appears in the BGP table, but it is not installed in the routing table. The most likely reason is that a route map is filtering the received route, preventing it from being installed. Since the network statement is not configured under BGP, the route is not originated locally, but it can still be received from a neighbor; however, an inbound or outbound route map can deny the route from entering the routing table.

Answer

The route is a default route (0.0.0.0/0) and is being suppressed

Answer

The BGP neighbor is not in the Established state

Answer

The route is not in the routing table because BGP requires the network statement to originate the route

Question 14

An administrator is troubleshooting an IPsec VPN Phase 2 negotiation failure. The debug shows 'no matching phase 2 proposal' from the remote peer. Which TWO of the following are likely causes? (Choose two.)

Accepted Answer

The local and remote proxy IDs (subnets) are not matching. IPsec Phase 2 negotiation requires the proxy IDs (local and remote subnets) to match exactly between peers. The 'no matching phase 2 proposal' debug message indicates the remote peer received a proposal with a subnet or traffic selector that does not match its configured proxy ID. This is a common misconfiguration when defining which traffic should be encrypted over the VPN tunnel.

Answer

The pre-shared key is incorrect

Answer

The firewall policy does not allow UDP port 500

Answer

The IKE version (IKEv1 vs IKEv2) is different

Question 15

A FortiGate is connected to a FortiSwitch via a trunk port. The administrator wants to manage the FortiSwitch using FortiLink. Which of the following is a prerequisite for FortiLink to function?

Accepted Answer

A dedicated FortiLink interface (physical or VLAN) must be configured on the FortiGate. FortiLink requires a dedicated interface on the FortiGate, either a physical port or a VLAN sub-interface, to establish the proprietary control and management channel with the FortiSwitch. This interface is automatically configured with the necessary FortiLink settings, including an internal management IP range and DHCP server, to discover and manage the switch. Without this dedicated interface, the FortiGate cannot initiate the FortiLink adjacency.

Answer

The FortiSwitch must be running a firmware version that supports CAPWAP

Answer

The FortiSwitch must be configured with a DHCP server to assign IP addresses

Answer

The FortiSwitch must have a management IP in the same subnet as the FortiGate's management IP