NSE7 Practice Test 49 — 15 Questions

Question 1

A FortiGate administrator is configuring SSL VPN for remote users. The administrator wants to ensure that users can only access specific internal resources based on their user group. Which SSL VPN configuration mode should be used to provide granular access control?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Tunnel mode with firewall policies that match user groups and specific internal subnets.. SSL VPN tunnel mode combined with firewall policies that reference user groups and specific internal subnets provides granular access control. The firewall policies determine which users can access which resources, based on their group membership. This is the standard method for enforcing least privilege in SSL VPN deployments.

Answer

Web mode with a portal configured to show only specific bookmarks.

Answer

Web mode with a realm that maps to an LDAP group.

Answer

Tunnel mode with split tunneling disabled.

Question 2

An administrator is configuring a FortiGate to block outbound traffic to known malicious IP addresses. They want the block list to be updated automatically from a commercial threat intelligence service that provides a REST API. Which FortiGate feature should be used?

Accepted Answer

External Threat Feed connector. The External Threat Feed connector is designed to ingest IP or domain blocklists from external HTTP/HTTPS sources, including REST APIs. It automates updates and integrates with firewall policies. The other options are either manual, domain-focused, or tied to Fortinet's own reputation service, which cannot be customized to an arbitrary third-party feed.

Answer

FortiGuard IP Reputation service

Answer

DNS Filter with botnet C&C category

Answer

Static firewall address objects

Question 3

A FortiGate administrator is troubleshooting an IPsec VPN where Phase 1 completes but Phase 2 fails to establish. The administrator reviews the Phase 2 configuration and notices that the local and remote subnets do not match between the two peers. Which action should the administrator take to resolve the Phase 2 failure?

Accepted Answer

Adjust the Phase 2 selectors on both peers so the local and remote subnet definitions mirror each other.. Phase 2 selectors must mirror each other: one peer's local subnet must equal the other peer's remote subnet. When they do not match, the child SA negotiation fails even though Phase 1 succeeds. Aligning the selectors on both peers restores the correct traffic selectors and allows Phase 2 to complete.

Answer

Increase the Phase 1 lifetime so the tunnel stays up longer during renegotiation.

Answer

Enable PFS on both peers and set the same Diffie-Hellman group.

Answer

Change the Phase 1 authentication method from pre-shared key to certificates on both peers.

Question 4

A FortiGate is configured with multiple VDOMs. The administrator wants to enable inter-VDOM routing between VDOM-A and VDOM-B. The administrator creates an inter-VDOM link and assigns IP addresses to both ends. Which additional configuration is required to allow traffic to pass between the VDOMs?

Accepted Answer

Create a firewall policy in VDOM-A allowing traffic from the source interface to the inter-VDOM link interface, and a policy in VDOM-B allowing traffic from the inter-VDOM link interface to the destination interface.. To enable inter-VDOM routing, you must create an inter-VDOM link and assign IP addresses. Then, you must add firewall policies in each VDOM to permit traffic across the link. Specifically, a policy in the source VDOM allowing traffic from the internal interface to the inter-VDOM link interface, and a policy in the destination VDOM allowing traffic from the inter-VDOM link interface to the destination interface. These policies are required because each VDOM inspects traffic independently.

Answer

Enable inter-VDOM routing globally under System > Settings.

Answer

Assign both inter-VDOM link interfaces to the same zone.

Answer

Configure a static route in each VDOM pointing to the inter-VDOM link, and enable 'allow inter-VDOM traffic' on the link.

Question 5

A FortiGate is configured with two VRF instances: VRF10 (for the finance department) and VRF20 (for the engineering department). Each VRF has its own routing table and interfaces. The administrator needs to allow a server in VRF10 (10.10.10.10) to communicate with a server in VRF20 (10.20.20.20). The administrator has already configured the necessary firewall policies to allow the traffic. However, pings from 10.10.10.10 to 10.20.20.20 fail. What is the most likely cause?

Accepted Answer

The VRFs are isolated by default; inter-VRF routing requires configuring route leaking or a VRF-to-VRF link.. VRF instances provide isolated routing tables. By default, traffic cannot flow between them. To enable communication, the administrator must configure route leaking, which allows routes from one VRF to be imported into another. This is typically done using BGP with route targets or static route leaking commands. Firewall policies alone are insufficient because the FortiGate lacks a route to the destination network in the other VRF. Therefore, the missing configuration is route leaking or a VRF-to-VRF link.

Answer

The FortiGate requires a static route in the global routing table to route traffic between VRFs.

Answer

The FortiGate does not support inter-VRF routing; a separate physical interface is required to connect the VRFs.

Answer

The firewall policies must be configured with the 'set vrf' option to specify the source and destination VRFs.

Question 6

An administrator is configuring an SD-WAN rule to prefer a specific overlay tunnel for VoIP traffic. The rule uses the 'SLA' strategy with a performance SLA that measures jitter and latency. After applying the rule, the administrator notices that VoIP traffic is still being routed over a different member that does not meet the SLA. What is the most likely cause?

Accepted Answer

The performance SLA is not assigned to the SD-WAN rule, so the rule cannot use SLA status for member selection.. An SD-WAN rule with the SLA strategy must explicitly reference a performance SLA to use its measurements for member selection. If the SLA is not linked, the rule cannot determine which members meet the SLA and may fall back to other criteria, causing traffic to use a non-compliant member. Ensuring the correct SLA is attached to the rule resolves the issue.

Answer

The SD-WAN rule is placed below a static route in the routing table, so it is not evaluated.

Answer

The performance SLA is configured with the wrong protocol; it must use HTTP to measure jitter and latency.

Answer

The SD-WAN rule is configured with the 'load-balance' strategy instead of 'SLA', so it does not consider SLA status.

Question 7

A FortiGate is configured with multiple VDOMs. The administrator needs to provide a network engineer with read-only access to all VDOMs, but the engineer should not be able to make any configuration changes. Which administrative profile configuration should the administrator use?

Accepted Answer

Create a new administrative profile with 'Read' access for all categories, and assign it to the engineer's administrator account with 'All VDOMs' scope.. To provide read-only access to all VDOMs, you must create a custom administrative profile with 'Read' permissions for all categories. Then assign this profile to the engineer's administrator account and set the VDOM scope to 'All VDOMs'. This allows the engineer to view configurations in any VDOM but prevents any changes. Built-in profiles do not offer this specific combination of read-only access across all VDOMs, so a custom profile is necessary.

Answer

Assign the engineer the built-in 'prof_admin' profile, which provides read-only access to all VDOMs by default.

Answer

Use the built-in 'prof_readonly' profile, which provides read-only access to all VDOMs by default.

Answer

Create a new administrative profile with 'None' access for all categories, and assign it to the engineer with 'All VDOMs' scope.

Question 8

An administrator notices that a FortiGate's CPU is consistently high, and the performance dashboard shows the 'ipsengine' process consuming most CPU. The administrator suspects a specific traffic pattern is overwhelming the IPS engine. Which CLI command should be used to identify the top sessions by bandwidth that may be triggering the IPS engine?

Accepted Answer

diagnose sys session top. High CPU on the IPS engine often results from a few heavy sessions. The diagnose sys session top command lists the top sessions by bandwidth, allowing the administrator to quickly identify the offending traffic. This is more direct than dumping all sessions or looking at interface statistics.

Answer

diagnose sys session list

Answer

diagnose netlink top

Answer

diagnose sys top

Question 9

An administrator is configuring a FortiGate in multi-VDOM mode. The administrator wants to assign a physical interface to a non-management VDOM. The interface currently belongs to the root VDOM and has an IP address. What must the administrator do first?

Accepted Answer

Remove the IP address and any references from the root VDOM, then assign the interface to the target VDOM.. To move a physical interface from one VDOM to another, the interface must not have an IP address or be referenced in any configuration, such as firewall policies or routing. The administrator must remove the IP address and any references from the current VDOM first. After that, the interface can be assigned to the target VDOM.

Answer

Disable the interface, change its VDOM, and then re-enable it.

Answer

Enable administrative access on the interface and then change its VDOM assignment.

Answer

Create a VDOM link between the root VDOM and the target VDOM, then move the interface.

Question 10

A FortiGate is configured with a VIP (virtual IP) for an internal web server at 10.0.0.10, mapping to public IP 203.0.113.5. External users report that they cannot access the web server, but internal users can access it using the private IP. The administrator runs 'diagnose debug flow filter addr 203.0.113.5' and 'diagnose debug flow show function-name enable' and sees the following output: 'id=20085 trace_id=1 func=print_pkt_detail line=4793 msg="vd-root:0 received a packet(proto=6, 203.0.113.5:443->198.51.100.10:54321) from port1. flag [S], seq 123456, ack 0, win 8192"' followed by 'id=20085 trace_id=1 func=init_ip_session_common line=4970 msg="allocate a new session-00000123"' and then 'id=20085 trace_id=1 func=vf_ip_route_input_common line=2580 msg="find a route: flag=04000000 gw-10.0.0.10 via port2"'. No further output appears. What is the MOST likely cause of the issue?

Accepted Answer

The internal web server is not responding to the SYN packet, or the return traffic is being dropped by the FortiGate.. The debug flow output indicates that the FortiGate received the SYN packet, allocated a session, and performed a route lookup to forward the packet to the internal server. However, no further output appears, meaning the FortiGate did not receive a SYN-ACK from the server. This points to either the server not responding or the return traffic being blocked. The administrator should verify the server's availability and check for asymmetric routing or missing return policies that could drop the response.

Answer

The VIP is configured with port forwarding, but the external port does not match the internal port.

Answer

The VIP is not configured with the correct external IP address.

Answer

The firewall policy that allows traffic from the external interface to the VIP does not exist or is incorrect.

Question 11

A FortiGate administrator is configuring SSL VPN for remote users. The administrator wants to ensure that users can only access specific internal resources based on their user group. Which SSL VPN configuration mode should be used to provide granular access control?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create separate phase 1 configurations for each peer, and use a route-based VPN with multiple tunnel interfaces and a routing protocol to select the active path.. Automatic failover between IPsec peers requires multiple phase 1 configurations, one for each peer. Route-based VPNs with tunnel interfaces allow dynamic routing protocols to detect failures and reconverge, or static routes with link monitoring can be used. This ensures that if the primary peer becomes unreachable, traffic is redirected to the secondary peer. DPD alone only detects failure; it does not perform failover.

Answer

Configure a single phase 1 with 'set remote-gw' as a DNS name that resolves to both peers, and enable DPD.

Answer

Use a single phase 1 with 'set remote-gw 0.0.0.0' and configure multiple dial-up VPNs, then rely on DPD to failover.

Answer

Configure a single phase 1 with multiple remote gateways and enable 'set dpd on-idle'.

Question 12

A FortiGate administrator is configuring SSL VPN for remote users. The administrator wants to ensure that users can only access specific internal resources based on their user group. Which SSL VPN configuration mode should be used to provide granular access control?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Machine Learning (ML) malware detection. FortiGate antivirus profiles offer a machine learning detection option that uses models to classify files as malicious based on their characteristics and behavior. This provides protection against unknown malware without waiting for signatures. Signature-only detection, sandbox inspection, and CDR serve different purposes and do not meet the specific requirement for ML-based detection on the firewall.

Answer

Content disarm and reconstruction (CDR)

Answer

FortiGuard Antivirus signatures

Answer

Sandbox inspection

Question 13

An administrator deploys ZTNA with FortiGate as the access proxy for internal web applications. Users authenticate through FortiClient EMS, and device posture checks must be enforced before access is granted. A user with a compliant laptop can reach the application, but when the same user connects from a personal device that fails the posture check, the connection is still allowed. The administrator verifies the ZTNA rule is enabled and the EMS connector is up. Which configuration element is most likely missing to enforce device posture?

Accepted Answer

The ZTNA rule does not reference a device posture tag in the source or policy match criteria.. ZTNA posture enforcement on FortiGate depends on matching EMS-synchronized device tags within the access proxy policy. Authentication alone only proves identity; it does not prove device health. When the policy lacks a posture tag match, every authenticated user is authorized regardless of endpoint compliance. Adding the appropriate EMS tag to the policy match criteria ensures non-compliant devices are denied even though they authenticate successfully.

Answer

The FortiGate is not configured with a valid SSL certificate for the ZTNA access proxy.

Answer

The ZTNA rule is missing a schedule object, allowing access outside business hours.

Answer

The EMS connector is configured with the wrong port number for FortiClient EMS communication.

Question 14

A network administrator is troubleshooting an SD-WAN setup where a specific application is not using the intended overlay tunnel. The SD-WAN rule is configured with a destination of 'all' and a source of 'all', and the strategy is set to 'manual' with the overlay tunnel as the preferred member. However, traffic is still going out via the underlay. What is the most likely reason?

Accepted Answer

The overlay tunnel member is down or not meeting the SLA, so the rule falls back to the underlay.. When an SD-WAN rule uses a manual strategy with a preferred member, the FortiGate will use that member if it is available and healthy. If the member is down or fails its SLA, the rule will fall back to other members, such as the underlay. Thus, the most likely reason for traffic using the underlay is that the overlay member is not available or not meeting the SLA.

Answer

The 'manual' strategy requires a gateway to be specified for the preferred member.

Answer

The SD-WAN rule is placed below a static route that directs traffic to the underlay.

Answer

The SD-WAN rule is missing a matching service or application, so it does not match the traffic.

Question 15

An administrator is configuring an SD-WAN rule that uses the 'volume' load balancing algorithm. The rule includes two members: port1 with a volume ratio of 3, and port2 with a volume ratio of 1. Which two statements correctly describe how the FortiGate will distribute sessions? (Choose two.)

Accepted Answer

The FortiGate will send approximately 75% of sessions to port1 and 25% to port2.. The volume load balancing algorithm distributes sessions based on configured volume ratios. With ratios of 3 and 1, port1 receives three times the traffic volume of port2, resulting in approximately 75% and 25% distribution. The algorithm continuously uses both members according to these ratios as long as they are alive. It does not fill one member before using the other, nor does it require percentages that sum to 100.

Answer

The FortiGate will send sessions to port1 until its volume limit is reached, then switch to port2.

Answer

The volume ratio must be configured as a percentage that totals 100%.

Answer

The volume algorithm will only use port2 if port1 is down or fails its SLA.