NSE7 Practice Test 50 — 15 Questions

Question 1

A security admin notices that FortiClient ATP is not blocking threats on a managed endpoint. The FortiClient is registered with FortiGate and the ATP feature is enabled in the FortiClient profile. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The FortiGate antivirus profile applied to the FortiClient policy has 'Scan on Access' disabled. FortiClient ATP (AntiVirus/AntiMalware) relies on the FortiGate's antivirus profile to enforce real-time scanning. Even if the ATP feature is enabled in the FortiClient profile, the 'Scan on Access' setting in the FortiGate antivirus profile applied to the FortiClient policy must be enabled for the endpoint to block threats on access. If 'Scan on Access' is disabled, FortiClient will not perform real-time scanning, allowing threats to go undetected despite ATP being enabled.

Answer

The FortiGate's antivirus signatures are outdated

Answer

The FortiClient endpoint has a different antivirus product installed that conflicts

Answer

FortiClient is in standalone mode instead of managed mode

Question 2

An organization uses FortiClient EMS to enforce compliance on endpoints. They want to ensure that only devices with updated antivirus definitions can access the corporate VPN. Which FortiClient configuration should be applied?

Accepted Answer

Create a compliance rule in FortiClient EMS to check antivirus definitions. Compliance rules in FortiClient EMS check endpoint posture, such as antivirus status. The rule can be configured to require up-to-date antivirus definitions before allowing VPN access.

Answer

Use a firewall policy to block traffic from non-compliant devices

Answer

Configure a ZTNA tag that requires updated antivirus

Answer

Enable CASB in the ZTNA proxy

Question 3

A FortiGate administrator is troubleshooting an issue where a legitimate application is being blocked by the IPS. The administrator wants to ensure the application works while maintaining protection for other traffic. What is the best action?

Accepted Answer

Create a custom IPS signature to pass the specific application traffic. Creating a custom IPS signature with a 'pass' action for the specific application traffic will allow it, while the default action (block) applies to others.

Answer

Disable the IPS sensor on the firewall policy

Answer

Apply an application control profile to allow the application

Answer

Change the IPS signature action to 'monitor' for all signatures

Question 4

A FortiGate administrator notices that after upgrading the firmware, some BGP sessions to a service provider are flapping. The administrator runs 'diagnose ip router bgp all' and sees that the BGP neighbor state is Active. What is the MOST likely cause of this issue?

Accepted Answer

A configuration checksum mismatch between the two peers. After a firmware upgrade, a BGP session stuck in the Active state is most commonly caused by a configuration checksum mismatch between the two peers. FortiGate uses a BGP configuration checksum to ensure that both sides have identical BGP configurations; if the checksums do not match after an upgrade (e.g., due to a change in default parameters or a new feature), the session will not establish and will remain in Active. This is a known behavior in FortiOS where the checksum is compared during the BGP open message exchange, and a mismatch prevents the session from moving to Established.

Answer

The BGP hold timer has expired

Answer

The BGP neighbor is not reachable due to a routing issue

Answer

The BGP password is incorrect

Question 5

A FortiGate in a multi-VDOM environment has a management VDOM (mgmt-vdom) and a traffic VDOM (corp-vdom). The admin wants to access the FortiGate GUI using IP 10.0.1.1 assigned to port1 in mgmt-vdom. However, the GUI is unreachable. The admin can SSH into mgmt-vdom. What is the most likely cause?

Accepted Answer

The management VDOM has an implicit deny policy blocking inbound HTTPS. In a multi-VDOM FortiGate, each VDOM has its own independent firewall policies. Even if HTTPS access is enabled on the interface (set allowaccess https), the management VDOM (mgmt-vdom) still requires an explicit firewall policy to permit inbound HTTPS traffic from the source to the FortiGate's own IP. Without such a policy, the implicit deny rule at the end of the policy list blocks the GUI connection. SSH works because it is typically allowed by a separate policy or by default administrative access rules, but HTTPS is not implicitly permitted.

Answer

The admin must enable 'set allowaccess https' under the interface configuration

Answer

The FortiGate is in transparent mode and requires a management IP

Answer

The traffic VDOM's routing table is incorrect

Question 6

An administrator runs 'diagnose ips anomaly list' and sees many 'data_leak' events from a specific internal IP address. The IPS sensor has the default pre-defined signatures enabled. What additional step should the administrator take to block this specific anomaly?

Accepted Answer

Create a custom IPS signature to match the anomaly pattern and apply it to the IPS sensor. The 'diagnose ips anomaly list' command shows protocol anomaly events, which are detected by the IPS engine's built-in anomaly detection logic, not by pre-defined signatures. To block a specific anomaly pattern like 'data_leak', the administrator must create a custom IPS signature that matches the exact anomaly characteristics and apply it to the IPS sensor. Pre-defined signatures cannot be modified to block anomalies; only custom signatures can target these events.

Answer

Enable protocol anomaly detection in the antivirus profile

Answer

Enable the 'data_leak' signature in the IPS sensor and set action to 'block'

Answer

Configure a firewall policy with application control to block the traffic

Question 7

An organization uses FortiGate with OSPF and BGP. Recently, routes from BGP are not being preferred over OSPF routes, causing suboptimal routing. The administrator wants to ensure BGP routes are preferred. Which two actions can achieve this? (Choose two.)

Accepted Answer

Decrease the administrative distance of BGP routes to 5.. Decreasing the administrative distance (AD) of BGP routes to 5 makes them more trustworthy than OSPF routes (default AD 110). Since a lower AD is preferred, BGP routes will be installed in the routing table over OSPF routes, ensuring BGP is preferred for forwarding decisions.

Answer

Configure route-map to set metric to 1 on BGP routes.

Answer

Set a higher weight on BGP routes for the prefixes.

Question 8

Which TWO of the following are required for FortiGate to successfully obtain file verdicts from FortiSandbox? (Choose two.)

Accepted Answer

Valid FortiSandbox license on FortiGate. A valid FortiSandbox license on the FortiGate is required to authenticate and authorize communication with the FortiSandbox appliance or cloud service. Without this license, the FortiGate cannot register with the FortiSandbox or submit files for verdict analysis, even if network connectivity exists.

Answer

Proxy-based inspection mode enabled on the policy

Answer

FortiSandbox inline scanning enabled in antivirus profile

Answer

FortiGuard Security Rating subscription

Question 9

An organization wants to implement a solution that can detect and automatically respond to threats across multiple Fortinet security products. Which product should they use?

Accepted Answer

FortiSOAR. FortiSOAR is the correct choice because it is a security orchestration, automation, and response (SOAR) platform designed to ingest alerts from multiple Fortinet products (e.g., FortiGate, FortiSIEM, FortiMail) and execute automated playbooks for threat detection and response. Unlike management or analytics tools, FortiSOAR provides the cross-product incident response and automation capabilities required to detect and automatically respond to threats across the Fortinet security fabric.

Answer

FortiManager

Answer

FortiSIEM

Answer

FortiAnalyzer

Question 10

An administrator is using FortiAnalyzer to generate a compliance report. The report should include logs from multiple FortiGates in different ADOMs. Which three actions must the administrator take? (Choose three.)

Accepted Answer

Configure a meta field to tag the devices for report filtering. Meta fields in FortiAnalyzer allow you to tag devices with custom attributes, which can then be used as filters when generating compliance reports. This enables the report to include logs from multiple FortiGates across different ADOMs by filtering based on the meta field value, rather than being restricted to a single ADOM's scope.

Answer

Create a new ADOM that spans all the FortiGates

Answer

Use the 'device groups' feature in FortiAnalyzer to aggregate logs

Question 11

A company is deploying a Security Fabric with multiple FortiGate devices managed by FortiManager. The administrator wants to apply a policy package to multiple FortiGate devices in the Fabric. However, after assigning the policy package to the devices in FortiManager and installing the configuration, the policies are not applied consistently across all devices. The administrator notices that some devices have local policies that override the policy package. What is the best practice to ensure that the policy package is enforced on all devices?

Accepted Answer

Enable 'Central Management' in FortiManager and use 'Install On Policy Package' to push policies.. Enabling 'Central Management' in FortiManager ensures that the policy package is the authoritative source for all managed FortiGate devices. When 'Install On Policy Package' is used, FortiManager overwrites any local policies on the devices, enforcing consistent policy application across the Security Fabric. Without central management, local policies can persist and override the pushed policy package, leading to inconsistencies.

Answer

Disable the 'Auto Update' feature on the managed devices.

Answer

Use the same policy package name on all devices and manually sync them.

Answer

Ensure that the Security Fabric is fully established and all devices are visible in the topology.

Question 12

An administrator runs the following command on a FortiGate and sees the output:
diagnose sys session filter dport 443
diagnose sys session list
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The TCP handshake has not completed; the client sent SYN and is waiting for SYN-ACK. The output shows `proto=6` (TCP) and `proto_state=01`, which in FortiGate's session table indicates a TCP SYN_SENT state. The session has been active for 3600 seconds (1 hour) with 3599 seconds remaining, meaning the client sent a SYN but never received a SYN-ACK, so the TCP three-way handshake is incomplete. This is why option A is correct.

Answer

The session is fully established and has been idle for 1 hour

Answer

The session is in FIN_WAIT state and is closing

Answer

The session is using UDP protocol

Question 13

A security analyst notices repeated failed login attempts from a specific IP address to the FortiGate management interface. The administrator wants to automatically blacklist the IP after 3 failed attempts within 60 seconds. Which feature should be configured?

Accepted Answer

Admin lockdown and intruder lockout settings. The 'Admin lockdown and intruder lockout' settings in FortiGate are specifically designed to detect repeated failed login attempts to the management interface and automatically blacklist the offending IP address after a configurable number of failures within a defined time window. This feature operates at the authentication layer, directly monitoring admin login attempts, and can enforce a lockout threshold (e.g., 3 failures in 60 seconds) to block the source IP, which matches the requirement exactly.

Answer

Intrusion Prevention System (IPS) with custom signature

Answer

FortiGate's built-in DoS policy and blacklist

Answer

Administrative access trusted hosts

Question 14

An administrator needs to integrate FortiGate with FortiNAC for network access control. The goal is to dynamically quarantine endpoints that have out-of-date antivirus software. Which component is responsible for enforcing the quarantine on the network?

Accepted Answer

FortiNAC's Network Access Policy (NAP). FortiNAC's Network Access Policy (NAP) defines the conditions and actions for enforcing network access. When an endpoint is found to have out-of-date antivirus, the NAP triggers a quarantine action, such as moving the endpoint to a quarantine VLAN or applying an ACL. This makes FortiNAC's NAP the component responsible for enforcing the quarantine on the network. Other options: the RADIUS server handles authentication but not enforcement; FortiGate ZTNA tags are for zero trust access control; FortiClient EMS manages compliance but does not enforce network quarantine directly.

Answer

The RADIUS server used for 802.1X

Answer

FortiGate firewall policies with ZTNA tags

Answer

FortiClient EMS compliance rules

Question 15

A FortiGate is blocking HTTP traffic from 10.0.1.5 to 10.0.2.100, despite an explicit allow policy. The exhibit shows the configuration and debug flow output. What is the most likely cause?

Accepted Answer

TCP SYN flood protection is dropping the incomplete session.. The debug flow output shows the session is in a 'SYN_RECV' state and never transitions to 'ESTABLISHED', which is characteristic of TCP SYN flood protection. When the FortiGate's SYN flood protection threshold is exceeded, it drops incomplete sessions before they can be fully established, even if an explicit allow policy exists. This explains why HTTP traffic from 10.0.1.5 to 10.0.2.100 is blocked despite the policy being correctly configured.

Answer

The policy is applied to the wrong source interface.

Answer

The policy action is set to deny.

Answer

The source address object does not include 10.0.1.5.