NSE7 Practice Test 49 — 15 Questions

Question 1

A FortiGate administrator sees the following output:

"diagnose sys session filter dport 443
diagnose sys session list
session info: proto=6 proto_state=01 duration=3600 expire=3599"

What does this session duration and expire time indicate?

Accepted Answer

The session has a timeout of 7200 seconds (2 hours). The session duration of 3600 seconds and expire time of 3599 seconds indicate that the session has been active for 3600 seconds and has 3599 seconds remaining before timeout. Since the total timeout is the sum of duration and expire time (3600 + 3599 = 7199, approximately 7200 seconds), this matches the default TCP session timeout of 7200 seconds (2 hours) on FortiGate. The 'proto_state=01' confirms a TCP session in established state, and the output shows the session is still valid with a long remaining lifetime.

Answer

The session is about to be torn down

Answer

The session is newly established

Answer

The session is using UDP protocol

Question 2

An administrator configures a hub-and-spoke ADVPN with FortiGate at the hub and multiple remote sites. After setup, spokes establish shortcuts directly. However, traffic between two spokes consistently goes through the hub even though shortcuts should exist. Running 'diagnose npu np6 ipsec peercache' shows no shortcut entries. What is the MOST likely reason?

Accepted Answer

The spokes are not running BGP over the ADVPN tunnels.. In a hub-and-spoke ADVPN, BGP is required to propagate the spoke's private IP addresses (used as tunnel endpoints) across the overlay network. Without BGP, spokes do not learn each other's tunnel IPs, so they cannot initiate shortcut tunnels. The 'diagnose npu np6 ipsec peercache' command shows no shortcut entries because the shortcut negotiation never starts.

Answer

The firewall policies on the spokes do not allow shortcut traffic.

Answer

Shortcut tunnels are disabled on the hub phase1 configuration.

Answer

The network processor (NP6) is not enabled for IPsec acceleration.

Question 3

An admin runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is established and has been active for 1 hour. The output shows `proto=6` (TCP), `proto_state=01` (ESTABLISHED in Fortinet's session table), `duration=3600` seconds (1 hour), and `expire=3599` seconds (remaining lifetime). This combination indicates a fully established TCP session that has been active for one hour and is still valid, not blocked or in a transitional state.

Answer

The session is being blocked by a firewall policy

Answer

The session is in SYN_SENT state, waiting for a reply

Answer

The session is in TIME_WAIT state after a FIN

Question 4

An administrator configures an SD-WAN rule with the 'volume' load balancing algorithm. The two WAN members have bandwidth capacities: port1 = 100 Mbps, port2 = 50 Mbps. Traffic is HTTP and HTTPS from internal users to the internet. How will the traffic be distributed?

Accepted Answer

Traffic is sent to the member with the least number of bytes transmitted, resulting in a balanced distribution proportional to bandwidth. The 'volume' load balancing algorithm distributes traffic based on the cumulative bytes transmitted on each WAN member, sending new traffic to the member with the least total bytes transmitted. This results in a distribution proportional to the bandwidth capacities (port1: 100 Mbps, port2: 50 Mbps), ensuring that port1 carries approximately twice the traffic volume of port2 over time.

Answer

All traffic uses port1 until it reaches 100 Mbps, then uses port2

Answer

Traffic is distributed evenly session-by-session (round-robin)

Answer

Source-destination IP pairs are hashed to a specific member

Question 5

An administrator wants to use FortiManager to manage multiple FortiGates, each in a separate customer environment. The administrator needs to isolate configuration changes per customer and ensure each customer's admin can only see their own devices. What FortiManager feature should be used?

Accepted Answer

Administrative domains (ADOMs). Administrative Domains (ADOMs) in FortiManager allow the administrator to logically partition the management plane, isolating configuration changes per customer. Each ADOM can contain a set of FortiGates, and administrators assigned to an ADOM can only see and manage devices within that ADOM, ensuring strict separation of customer environments.

Answer

Administrator profiles

Answer

Policy packages

Answer

VDOMs on managed FortiGates

Question 6

A FortiGate is configured with SD-WAN and has two WAN members: Member1 (ISP1) with priority 10, and Member2 (ISP2) with priority 5. The SD-WAN rule for traffic from the internal network uses the 'best quality' strategy. During normal operation, traffic flows through Member1. After a link failure on Member1, traffic correctly fails over to Member2. However, when Member1 is restored, traffic does not fail back. What is the most likely cause?

Accepted Answer

The health-check for Member1 is configured with 'set probe-mode passive' and 'set update-static-route disable'.. When 'set probe-mode passive' is configured, the health-check server only monitors the link without actively generating probe traffic, and 'set update-static-route disable' prevents the static route associated with Member1 from being re-enabled after the link is restored. This means the route remains inactive, so SD-WAN cannot fail back to Member1 even though the physical link is up.

Answer

The static route for Member1 has a higher administrative distance than Member2.

Answer

The SD-WAN rule is configured with 'set fallback' disabled.

Answer

The priority of Member2 is higher than Member1.

Question 7

An organization wants to prevent users from downloading malicious files from the internet. Which FortiGate security profile should be applied to the outbound firewall policy to block files based on their hash if they have been identified as malicious by FortiSandbox?

Accepted Answer

Antivirus profile. The Antivirus profile is the correct choice because it integrates with FortiSandbox to block files based on their hash when identified as malicious. FortiGate's antivirus engine can submit files to FortiSandbox for analysis, and if the file's hash matches a known malicious signature, the antivirus profile will block the download. This is specifically designed for file-based threat detection at the application layer, unlike other profiles that focus on different security functions.

Answer

Application Control profile

Answer

IPS profile

Answer

Web Filter profile

Question 8

An administrator configures a FortiGate in transparent mode with two VDOMs. Each VDOM is assigned to a different VLAN. The administrator wants to apply a common security policy to traffic between the VLANs. What is the correct approach?

Accepted Answer

Use inter-VDOM routing linked to a policy in the global policy set. In transparent mode, FortiGate VDOMs are isolated by default, and traffic between VLANs assigned to different VDOMs must traverse an inter-VDOM link. The correct approach is to use inter-VDOM routing and apply a security policy in the global policy set, which allows a common policy to govern traffic crossing VDOM boundaries. This ensures that the policy is evaluated once for inter-VDOM traffic, rather than requiring separate policies in each VDOM.

Answer

Assign both VLANs to the same VDOM and apply a policy there

Answer

Apply the policy on the management VDOM

Answer

Configure a single policy on the root VDOM that matches all VLANs

Question 9

A network administrator has configured an IPsec VPN between two FortiGates using IKEv2 with pre-shared keys. The tunnel establishes successfully, but after a few minutes, traffic stops passing through. The administrator runs 'diagnose vpn ike log' and sees 'DPD timeout' messages. What is the most likely cause of this issue?

Accepted Answer

The remote FortiGate is behind a NAT device without proper NAT-T configuration. DPD timeout indicates that the remote peer is not responding to Dead Peer Detection probes. The most common cause is a misconfigured firewall on the path dropping UDP 500 or 4500 packets, or NAT keepalive issues if NAT is involved. Option A is correct because if the remote FortiGate is behind a NAT device without proper NAT-T configuration, the DPD packets may be dropped or not reach the peer, causing the timeout.

Answer

The IPsec phase2 proposal is mismatched, causing rekey failures

Answer

The IKE SA lifetime is set too long, causing the tunnel to expire

Answer

The local FortiGate's DPD interval is set too low, causing false positives

Question 10

A FortiGate administrator is troubleshooting a VPN tunnel that uses IKEv2 with certificate authentication. The tunnel fails to establish, and the IKE debug shows 'no acceptable proposal' for the initial exchange. Which TWO configuration mismatches could cause this error? (Choose two.)

Accepted Answer

Mismatched encryption algorithms between the two peers. 'No acceptable proposal' in IKEv2 phase1 indicates a mismatch in proposal parameters. Encryption algorithm mismatch (A) and authentication method mismatch (E: pre-shared key vs certificate) can both cause this error. Phase2 mismatches (B) occur later, not during initial exchange.

Answer

Mismatched phase2 encryption algorithms

Answer

Mismatched IKE version (IKEv1 vs IKEv2)

Answer

Incorrect local certificate configuration on one peer

Question 11

A FortiGate administrator wants to use Fortinac for network access control. Which of the following is the PRIMARY function of Fortinac in a network?

Accepted Answer

Provide network access control by enforcing policies based on device identity and posture. FortiNAC is Fortinet's Network Access Control (NAC) solution. Its primary function is to provide visibility, control, and automated response for endpoints based on identity and posture, enabling policy enforcement for network access. Option C correctly describes this.

Answer

Perform deep packet inspection on all traffic

Answer

Act as a VPN concentrator for remote access

Answer

Provide a cloud-based sandbox for malware analysis

Question 12

A FortiGate is configured as a ZTNA proxy for a web application. Users report that after authenticating, they receive a '502 Bad Gateway' error. What is the most likely cause?

Accepted Answer

The backend server is unreachable from the FortiGate.. The 502 Bad Gateway error indicates that the ZTNA proxy successfully received the request but could not get a valid response from the backend server. Therefore, the most likely cause is that the backend server is unreachable from the FortiGate (option A). The other options would result in different errors.

Answer

The ZTNA proxy is not configured with a valid SSL certificate.

Answer

The user's device posture is not compliant.

Answer

The ZTNA rule is not using the correct source interface.

Question 13

A FortiGate administrator is troubleshooting a scenario where users in VDOM-1 cannot reach a server in VDOM-2. Inter-VDOM routing is configured using a VDOM link. The administrator checks the session table and sees that packets are arriving on the VDOM link interface but are not being forwarded. What is the MOST likely cause?

Accepted Answer

A firewall policy is blocking the traffic from the VDOM link to the destination. When packets arrive on the VDOM link interface but are not forwarded, the issue is typically a missing or misconfigured firewall policy in the destination VDOM (VDOM-2). Even though inter-VDOM routing is correctly set up via the VDOM link, FortiGate requires an explicit firewall policy in the destination VDOM to permit traffic from the VDOM link interface to the destination server. Without this policy, the FortiGate drops the packets after routing, which matches the symptom of packets arriving but not being forwarded.

Answer

The VDOM link is in the wrong VDOM

Answer

The routing table in VDOM-1 does not have a default route

Answer

The VDOM link is not administratively up

Question 14

An administrator is configuring a FortiGate to inspect SMTP traffic for spam and viruses. The traffic must be decrypted to inspect the content. Which THREE elements are required for this configuration? (Choose three.)

Accepted Answer

A spam filter profile applied to the firewall policy. A spam filter profile is required to inspect SMTP traffic for spam. FortiGate uses this profile to apply anti-spam techniques such as DNSBL, SURBL, and heuristic analysis on the email content after decryption. Without it, spam detection cannot occur.

Answer

A web filter profile applied to the firewall policy

Answer

An application control profile applied to the firewall policy

Question 15

An administrator is troubleshooting BGP with SD-WAN. They have configured BGP on the FortiGate and the SD-WAN rule uses 'best quality' strategy. However, failover does not happen when a WAN link goes down. The BGP session is still up. What is the most likely reason?

Accepted Answer

The performance SLA is not configured to track the BGP next hop.. The 'best quality' SD-WAN strategy selects the best path based on performance SLA metrics. Without a performance SLA monitoring the BGP next hop, the FortiGate cannot detect that the link has failed from a BGP perspective, so it will not trigger a failover even if the physical interface goes down. The BGP session remains up because it is still receiving keepalives, but the SD-WAN rule does not consider the link unusable without SLA tracking.

Answer

The SD-WAN rule is configured with 'set update-static-route disable'.

Answer

The BGP session is using eBGP multihop.

Answer

The load balancing algorithm is set to 'volume'.