NSE7 Practice Test 50 — 15 Questions

Question 1

A FortiGate has multiple IPsec VPNs to different branch offices. The administrator notices that one VPN tunnel is flapping (going up and down repeatedly). From the CLI, 'diagnose vpn ike gateway list' shows the gateway state as 'up' but then quickly goes to 'down'. What is the MOST likely cause?

Accepted Answer

Dead Peer Detection (DPD) retry interval is too short. Tunnel flapping with IKEv2 is often due to DPD mismatches or aggressive DPD retry intervals. If DPD is configured with very short intervals, the tunnel may drop due to transient delays.

Answer

The remote gateway's certificate is expired

Answer

The phase2 proposal is mismatched

Answer

The pre-shared key is incorrect

Question 2

A FortiGate administrator is configuring Auto Discovery VPN (ADVPN) in a hub-and-spoke topology. Spokes are FortiGates with dynamic public IPs. Which setting is required on the spoke for it to automatically initiate shortcut tunnels to other spokes when needed?

Accepted Answer

set add-route enable. ADVPN shortcut tunnels require the spoke to accept shortcut offers from the hub. Setting 'set add-route enable' on the phase1 interface allows the spoke to install routes for shortcuts. Without this, the spoke will not create shortcut tunnels even if it receives the offer.

Answer

set net-device disable

Answer

set mode aggressive

Answer

set shortcut-station enable

Question 3

An organization uses FortiClient EMS to enforce compliance on endpoints. They want to ensure that only devices with updated antivirus definitions can access the corporate VPN. Which FortiClient configuration should be applied?

Accepted Answer

Create a compliance rule in FortiClient EMS to check antivirus definitions. Compliance rules in FortiClient EMS check endpoint posture, such as antivirus status. The rule can be configured to require up-to-date antivirus definitions before allowing VPN access.

Answer

Use a firewall policy to block traffic from non-compliant devices

Answer

Configure a ZTNA tag that requires updated antivirus

Answer

Enable CASB in the ZTNA proxy

Question 4

In a Fortinet ZTNA deployment, which component is responsible for forwarding decrypted traffic to the internal application server after the FortiGate proxy has performed SSL inspection?

Accepted Answer

ZTNA proxy on FortiGate. ZTNA proxy receives client requests, performs SSL inspection, and forwards the decrypted traffic to the internal server.

Answer

FortiClient EMS

Answer

IPsec VPN tunnel

Answer

FortiNAC

Question 5

A FortiGate administrator is configuring a multi-peer IPsec VPN where two remote sites (Site A and Site B) connect to a central hub. The administrator wants to ensure that if the primary peer for a site goes down, traffic automatically fails over to the backup peer. Which TWO settings must be configured on the hub's phase1?

Accepted Answer

Set 'peer-options' to include both peers with 'priority'. Multi-peer VPN requires configuring 'peer-options' with multiple peer IPs and priorities, and enabling 'failover' on the phase1 interface to allow automatic switching to the backup peer if the primary goes down.

Answer

Set 'auto-negotiate' to 'enable'

Answer

Set 'dpd' to 'on-demand'

Answer

Set 'aggregate-ipsec' to 'round-robin'

Question 6

An administrator is configuring FortiClient EMS to enforce compliance for ZTNA. Which TWO settings are required on FortiGate to use compliance-based ZTNA tags?

Accepted Answer

FortiClient EMS is added as a security fabric connector. To use compliance tags, FortiGate must have EMS configured as a fabric connector and the ZTNA proxy rule must reference the tags.

Answer

SSL deep inspection is enabled on the firewall policy

Answer

A local user database is configured for authentication

Answer

FortiGate is configured as a SAML IdP

Question 7

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal application. The application is hosted on a server with IP 10.1.1.100. Which component acts as the intermediary between users and the application in FortiGate ZTNA?

Accepted Answer

ZTNA proxy on FortiGate. FortiGate ZTNA uses a reverse proxy to forward user connections to internal applications. Users connect to the proxy, which verifies identity and posture before proxying traffic to the application server.

Answer

FortiClient EMS

Answer

ZTNA agent on the application server

Answer

ZTNA tags assigned to the application server

Question 8

A FortiGate administrator enables Dead Peer Detection (DPD) on an IPsec VPN tunnel. What is the primary purpose of DPD?

Accepted Answer

To detect when the remote peer is no longer reachable. DPD is used to monitor the liveness of the remote peer. If the peer becomes unreachable, DPD detects it and can trigger a failover or tunnel teardown, ensuring traffic does not blackhole.

Answer

To dynamically adjust the tunnel MTU

Answer

To encrypt the IKE negotiation traffic

Answer

To automatically renegotiate the IKE SA before it expires

Question 9

In a hub-and-spoke VPN using OSPF over the overlay, the hub FortiGate learns routes from spoke1 and advertises them to spoke2. However, spoke2's routing table shows the route with a next-hop of the hub's tunnel IP, not spoke1's tunnel IP. What should the administrator configure to allow spoke2 to reach spoke1 directly (using ADVPN shortcut)?

Accepted Answer

Enable 'set auto-discovery-sender' on both spokes' phase 1. To enable direct spoke-to-spoke communication, ADVPN must be enabled and the OSPF configuration should not prevent the shortcut.

Answer

Increase the OSPF metric on the hub's loopback interface

Answer

Configure the hub as an OSPF route reflector

Answer

Disable OSPF on the hub and use static routes instead

Question 10

A FortiGate administrator sees the following syslog message repeatedly: 'IPsec phase 2 failed to establish SA with peer due to proposal mismatch.' The administrator has already verified that the phase 2 parameters (encryption, authentication, PFS, and lifetime) match on both sides. What else should the administrator check?

Accepted Answer

The local and remote subnets defined in the phase 2 selector. Phase 2 negotiation can also fail due to mismatched traffic selectors (local and remote subnets).

Answer

The phase 1 proposal settings

Answer

The DPD configuration

Answer

The pre-shared key

Question 11

A network engineer is troubleshooting an ADVPN scenario where shortcut tunnels between spokes are not forming. The hub has IKEv2 configured and the spokes are behind NAT. Which THREE conditions must be met for shortcut tunnels to establish?

Accepted Answer

Spokes are configured with 'set auto-discovery' enabled. ADVPN shortcut tunnels require: IKEv2 (not IKEv1), auto-negotiate enabled on the hub phase2, and the hub's phase2 must have 'add-route' set to enable route injection. NAT traversal is automatically handled by IKEv2.

Answer

NAT traversal is enabled on all gateways

Answer

IKEv1 is used for the spoke-to-hub tunnels

Question 12

A FortiGate administrator configures SAML SSO with FortiGate as the Service Provider (SP) and an external IdP. Users report that they are prompted for credentials repeatedly without successful authentication. What is the most likely cause?

Accepted Answer

The IdP certificate is not imported or trusted on the FortiGate. SAML SSO requires certificate trust. If the IdP certificate is not trusted by the FortiGate, the SAML assertion will not be validated, causing authentication failures. The clock skew is another common issue.

Answer

The SAML attribute mapping is incorrect

Answer

The FortiGate's clock is synchronized via NTP

Answer

The firewall policy does not allow SAML traffic

Question 13

An administrator wants to ensure that only devices with up-to-date antivirus software can access a sensitive application via ZTNA. Which FortiGate feature should be used to enforce this requirement?

Answer

ZTNA tags from FortiClient EMS

Answer

SSL deep inspection profile

Answer

Application control profile

Answer

AntiVirus profile on the firewall policy

Question 14

An administrator wants to implement ZTNA inline CASB to control access to a SaaS application (e.g., Office 365). Which three components are required for this setup? (Choose THREE)

Accepted Answer

FortiClient EMS for device posture and tag assignment. ZTNA inline CASB requires FortiGate as an inline proxy, FortiClient EMS for device posture and identity, and a ZTNA rule that proxies traffic to the SaaS application. Additionally, SSL deep inspection is required to decrypt and inspect traffic.

Answer

FortiNAC for network access control

Answer

A VPN tunnel between FortiGate and the SaaS provider

Question 15

A FortiGate is configured as a ZTNA proxy. The administrator wants to ensure that only devices with a specific ZTNA tag assigned by FortiClient EMS are allowed to access the application. Which two configuration steps are required? (Choose two.)

Accepted Answer

Create a ZTNA access rule with a condition matching the tag. To restrict access based on ZTNA tags, the tag must be imported from EMS (D) and then used in a ZTNA access rule condition (A).

Answer

Configure a firewall policy with the ZTNA proxy as destination and enable 'allow only ZTNA'

Answer

Create a firewall policy allowing all traffic to the ZTNA proxy

Answer

Enable 'set ztna-tag' on the FortiGate interface