NSE7 Practice Test 5 — 10 Questions

Question 1

Which SD-WAN load balancing algorithm distributes traffic based on the number of active sessions per interface?

Accepted Answer

Sessions. The Sessions algorithm in Fortinet SD-WAN distributes new sessions by selecting the interface with the fewest currently active sessions. This ensures balanced session distribution across WAN links, preventing any single interface from becoming overloaded with connections while others remain underutilized.

Answer

Volume

Answer

Source-destination IP

Answer

Spillover

Question 2

A FortiManager administrator wants to deploy a policy package that contains shared header and footer policies across multiple devices. How should these policies be configured in FortiManager?

Accepted Answer

Configure the policies as header/footer policies within the policy package. In FortiManager, header and footer policies are specifically designed to be shared across multiple devices within a policy package. By configuring them as header/footer policies, the administrator ensures that these common rules are applied consistently at the top and bottom of the device-specific policy tables, while the middle policies can vary per device. This is the correct method for deploying shared policies without duplicating them in each device's policy set.

Answer

Define the policies in the ADOM's default policy package

Answer

Create a global policy package and assign it to all devices

Answer

Use the 'install preview' feature to merge policies

Question 3

An administrator needs to configure VRF to separate traffic for two departments. Which TWO components must be configured for each VRF?

Accepted Answer

A VRF instance. A VRF instance (option A) is the foundational component that must be created for each VRF, as it establishes the separate routing table that isolates the department's traffic. Interface binding to the VRF (option B) is also required because interfaces must be assigned to the VRF so that traffic entering and leaving those interfaces uses the correct VRF routing table. A dedicated VDOM (option C) is incorrect because VDOMs are a Fortinet-specific virtualization concept separate from VRF, and VRF can be configured without VDOMs. Route leaking configuration (option D) is not mandatory for each VRF; it is only needed when you want to selectively share routes between VRFs, which is optional. A separate firewall policy for each VRF (option E) is not a required VRF component, as firewall policies are managed independently of VRF configuration and depend on the platform's security policy model.

Answer

A dedicated VDOM

Answer

Route leaking configuration

Answer

A separate firewall policy for each VRF

Question 4

Which FortiMail advanced feature allows the administrator to rewrite URLs in email bodies to redirect users to a safe scanning service when they click on a link?

Accepted Answer

URL Rewriting. URL Rewriting is the correct answer because it is a FortiMail advanced feature specifically designed to replace URLs in email bodies with rewritten links that redirect users through FortiMail's scanning service. When a user clicks the rewritten URL, FortiMail inspects the destination in real time for malicious content, such as phishing or malware sites, before allowing the redirect. This provides proactive protection against zero-hour threats by leveraging FortiGuard's web filtering and threat intelligence.

Answer

Attachment Filtering

Answer

Bounce Verification

Answer

Anti-Spam

Question 5

During a ZTNA implementation, the administrator configures a ZTNA rule for an internal application but users cannot connect. The FortiGate policy is correct and the application is reachable from the FortiGate. What is the most likely misconfiguration?

Accepted Answer

The ZTNA rule's proxy destination IP or port is wrong.. The ZTNA rule defines the mapping between the external proxy address and the internal application's actual IP and port. If the proxy destination IP or port is misconfigured, the FortiGate's ZTNA proxy cannot forward traffic to the correct internal server, even though the firewall policy and network connectivity are otherwise valid. This is a common misconfiguration when the internal application's IP or service port differs from what is specified in the ZTNA rule.

Answer

The firewall policy is set to deny traffic from the ZTNA gateway.

Answer

The client does not have a route to the internal application.

Answer

The client's FortiClient agent is not authenticated.

Question 6

In a Zero Trust Network Access architecture, which component acts as the policy enforcement point for access decisions?

Accepted Answer

FortiGate ZTNA gateway. In a Zero Trust Network Access (ZTNA) architecture, the FortiGate ZTNA gateway acts as the policy enforcement point (PEP). It terminates encrypted ZTNA tunnels from FortiClient agents, inspects traffic against configured access policies, and enforces decisions based on identity, device posture, and context. This is distinct from the control plane (FortiClient EMS) or logging (FortiAnalyzer).

Answer

FortiClient agent

Answer

FortiAnalyzer

Answer

FortiClient EMS

Question 7

A company is deploying FortiClient ATP to protect endpoints. They want to block ransomware behavior in real time. Which FortiClient feature should be enabled?

Accepted Answer

Real-Time Protection. Real-Time Protection is the FortiClient feature that uses behavioral analysis and machine learning to detect and block ransomware-like activities, such as mass file encryption or unauthorized file modifications, as they occur. This feature monitors process behavior in real time, leveraging FortiSandbox threat intelligence and local heuristics to stop ransomware before it can cause damage.

Answer

Vulnerability Scan

Answer

Web Filtering

Answer

Application Firewall

Question 8

During a failover test in an HA cluster, the primary FortiGate fails over to the secondary. After failover, some existing TCP sessions are dropped. What is the MOST likely reason?

Accepted Answer

Session pickup is not enabled on the HA cluster. In an HA cluster, session pickup (also known as session synchronization) is responsible for replicating session tables from the primary FortiGate to the secondary. When failover occurs, if session pickup is not enabled, the secondary FortiGate has no knowledge of existing TCP sessions, causing them to be dropped. This is the most likely reason because the secondary device cannot forward traffic for sessions it does not recognize, even if the network topology remains unchanged.

Answer

The failover caused a routing change

Answer

The session TTL expired during failover

Answer

The HA mode is active-passive

Question 9

An administrator needs to configure advanced email security on FortiMail to protect against phishing and spoofing. Which THREE features should be enabled to achieve comprehensive email authentication?

Accepted Answer

DKIM signing and verification. DKIM (DomainKeys Identified Mail) signing and verification is correct because it allows the sending domain to cryptographically sign outgoing emails, and the receiving server to verify that the signature matches the domain’s public DNS record. This ensures the email was not tampered with and originates from an authorized server, directly addressing phishing and spoofing by validating message integrity and sender authenticity.

Answer

Anti-spam Bayesian filtering

Answer

TLS encryption for inbound/outbound

Question 10

An organization wants to implement a solution that can detect and automatically respond to threats across multiple Fortinet security products. Which product should they use?

Accepted Answer

FortiSOAR. FortiSOAR is the correct choice because it is a security orchestration, automation, and response (SOAR) platform designed to ingest alerts from multiple Fortinet products (e.g., FortiGate, FortiSIEM, FortiMail) and execute automated playbooks for threat detection and response. Unlike management or analytics tools, FortiSOAR provides the cross-product incident response and automation capabilities required to detect and automatically respond to threats across the Fortinet security fabric.

Answer

FortiManager

Answer

FortiSIEM

Answer

FortiAnalyzer