NSE7 Practice Test 50 — 15 Questions

Question 1

A FortiGate administrator is setting up a ZTNA environment where FortiClient EMS is used to tag endpoints. The administrator wants to create a firewall policy that allows access to a web application only for users whose endpoints have the tag 'Compliant'. Which configuration step is required to use the tag in the firewall policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a dynamic firewall address that references the ZTNA tag.. To enforce ZTNA tag-based access in a firewall policy, the administrator must create a dynamic firewall address that references the ZTNA tag. This dynamic address is then used in the policy's source or destination field. The FortiGate populates the address with IPs of endpoints that have the tag, as reported by FortiClient EMS. This allows granular control based on endpoint compliance status.

Answer

Configure a ZTNA server and add the tag to the server's rule.

Answer

Enable ZTNA tagging in the global settings.

Answer

Add the tag to the FortiClient EMS compliance rule.

Question 2

A FortiGate administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The administrator runs 'diagnose vpn ike gateway list' and sees that the IKE gateway is stuck in the 'connecting' state. The administrator confirms that the pre-shared key matches on both peers. Which action should the administrator take next to identify the cause?

Accepted Answer

Run 'diagnose debug application ike -1' and check the debug output for proposal mismatches.. When an IKE gateway is stuck in 'connecting', the most likely cause is a phase 1 negotiation failure, such as a proposal mismatch. Enabling IKE debug with 'diagnose debug application ike -1' provides detailed logs that reveal the exact reason for the failure, such as mismatched encryption or DH group. Other commands show status but not the negotiation details needed to pinpoint the issue. Thus, IKE debugging is the correct next step.

Answer

Run 'get vpn ipsec tunnel summary' to check the tunnel status.

Answer

Run 'diagnose vpn tunnel list' to check the phase 2 selectors.

Answer

Run 'execute vpn ike gateway flush' to clear the IKE gateway and retry.

Question 3

A FortiGate administrator is troubleshooting an IPsec VPN that uses IKEv2 and certificate authentication. The tunnel fails to establish, and the administrator sees that the phase 1 negotiation reaches the point of exchanging certificates but then fails. The administrator wants to verify the certificate-related configuration. Which two actions should the administrator take to resolve the issue? (Choose two.)

Accepted Answer

Ensure that the peer certificate is signed by a CA that is imported into the FortiGate and that the CA is used for peer authentication.. Certificate-based IKEv2 requires both sides to present a local certificate with a usable private key and to validate the peer certificate against a trusted CA. The negotiation failure after certificate exchange points to a problem with the local certificate and key or with the CA used to validate the peer. Importing the correct CA and confirming the local certificate selection are the two actions that directly address these requirements.

Answer

Configure the phase 1 proposal to use pre-shared key authentication instead of certificate authentication to bypass certificate validation.

Answer

Disable Dead Peer Detection on the phase 1 configuration so that the certificate exchange is not interrupted.

Answer

Set the phase 1 mode to aggressive instead of main mode to speed up certificate negotiation.

Question 4

A FortiGate is configured with an SSL inspection profile that uses a deep-inspection mode. Users complain that a banking website fails to load, but HTTP sites work. The administrator confirms the site uses TLS 1.3 with Encrypted Client Hello (ECH) and certificate pinning. Which action should the administrator take to restore access while maintaining visibility for other traffic?

Accepted Answer

Add the banking website to the SSL inspection exemption list.. The banking site fails because deep SSL inspection intercepts TLS 1.3 with Encrypted Client Hello and certificate pinning, which breaks the connection. Exempting the specific destination from SSL inspection restores access without sacrificing visibility for other traffic. Global changes like switching to certificate-inspection or disabling TLS 1.3 reduce security for all connections and do not target the root cause.

Answer

Change the SSL inspection profile to certificate-inspection mode.

Answer

Enable the 'allow invalid server certificates' option in the SSL inspection profile.

Answer

Disable TLS 1.3 support on the FortiGate SSL inspection profile.

Question 5

An administrator is configuring an SD-WAN rule to route VoIP traffic (identified by application 'VoIP') over the best available link. The SD-WAN zone 'virtual-wan-link' contains three members: port1 (cost 10), port2 (cost 20), and port3 (cost 30). A performance SLA named 'VoIP-SLA' is applied to the rule, monitoring latency, jitter, and packet loss. The administrator wants the rule to select the member with the lowest latency that meets the SLA. Which SD-WAN algorithm should be used?

Accepted Answer

Lowest Latency (SLA). The Lowest Latency (SLA) algorithm is designed to select the member with the lowest measured latency among those that meet the SLA. This is ideal for latency-sensitive applications like VoIP. Other algorithms focus on cost, bandwidth, or static assignment, none of which prioritize latency as the selection metric.

Answer

Maximize Bandwidth (SLA)

Answer

Source IP

Answer

Lowest Cost (SLA)

Question 6

A security analyst is reviewing logs from a FortiGate that uses FortiGuard IPS. The analyst notices that a signature for a recent Apache Struts vulnerability is not triggering even though the vulnerable service is exposed. The FortiGate is running the latest IPS engine and signature database. Which action should the analyst take to verify whether the signature is enabled and properly applied to the traffic?

Accepted Answer

Check the IPS sensor configuration to ensure the signature is set to 'Block' and the sensor is applied to the correct firewall policy.. When an IPS signature does not trigger, the first step is to confirm that the signature is enabled in the IPS sensor and that the sensor is applied to the firewall policy processing the traffic. Without this, the signature will never be evaluated. Other troubleshooting steps like packet capture or debug logging are useful but secondary to verifying the basic configuration.

Answer

Verify that the FortiGate has a valid FortiGuard license and can reach the FortiGuard servers.

Answer

Run a packet capture on the FortiGate to confirm the traffic is reaching the IPS engine.

Answer

Enable IPS debug logging to see if the signature is being evaluated.

Question 7

A FortiGate administrator is configuring an IPsec VPN with IKEv2. The administrator wants to ensure that the VPN tunnel uses perfect forward secrecy (PFS) for phase 2. Which parameter must be configured in the phase 2 proposal?

Accepted Answer

Enable 'set pfs enable' and select a Diffie-Hellman group.. To enable perfect forward secrecy in an IPsec VPN phase 2, the administrator must enable PFS and specify a Diffie-Hellman group in the phase 2 proposal. This forces a new key exchange for each phase 2 rekey, ensuring that session keys are not derived from the phase 1 key. Both peers must have matching PFS settings for the tunnel to establish.

Answer

Configure 'set auto-negotiate enable' in the phase 2 proposal.

Answer

Use a stronger encryption algorithm such as AES-256 in phase 2.

Answer

Set the phase 2 keylife to a value lower than the phase 1 keylife.

Question 8

A security analyst is investigating alerts from FortiGate's IPS. They notice that an attack was detected but not blocked, even though the IPS profile is set to block. The log shows the action as 'detected'. What is the most likely reason for this behavior?

Accepted Answer

The IPS signature is set to 'Monitor' instead of 'Block' in the IPS sensor.. The most likely reason is that the specific IPS signature that detected the attack is configured to 'Monitor' rather than 'Block' in the IPS sensor. Even if the overall profile is set to block, individual signatures can override this. Checking the signature's action setting in the sensor will confirm and allow correction.

Answer

The FortiGate's IPS engine is in 'learn' mode.

Answer

The FortiGate is in transparent mode, which does not support IPS blocking.

Answer

The IPS profile is applied to the wrong firewall policy.

Question 9

A FortiGate has an SD-WAN rule with two members: port1 and port2. The rule uses the 'lowest-cost' algorithm. The administrator configures a performance SLA that monitors latency to a remote server. The SLA is applied to both members. After some time, port1's latency exceeds the SLA threshold and its status becomes 'dead'. What happens to new sessions that match the SD-WAN rule?

Accepted Answer

New sessions will be sent to port2, because port1 is excluded due to SLA failure.. When a performance SLA fails, the member is marked as dead and excluded from SD-WAN rule selection. The FortiGate will use the remaining alive member, port2, for new sessions. This behavior ensures that traffic is only sent over links that meet the configured performance criteria. The lowest-cost algorithm only considers alive members, so port1 is not used while it is dead.

Answer

New sessions will be dropped until port1's SLA status becomes alive again.

Answer

New sessions will be load balanced across both members, but existing sessions on port1 will be re-evaluated.

Answer

New sessions will still be sent to port1 because lowest-cost ignores SLA status.

Question 10

A network administrator is configuring an IPsec VPN on a FortiGate to connect to a remote peer that uses a dynamic IP address. The administrator wants to ensure that the tunnel can be initiated by the remote peer and that the FortiGate accepts connections from any IP, as long as the peer ID matches. Which configuration should the administrator use?

Accepted Answer

Set the remote gateway to 0.0.0.0 and configure a peer ID with the remote peer's identifier.. For a remote peer with a dynamic IP, the FortiGate must listen for incoming connections from any IP. Setting the remote gateway to 0.0.0.0 achieves this. The peer ID is then used to uniquely identify and authenticate the remote peer, ensuring that only the legitimate peer can establish the tunnel. This combination is the correct approach.

Answer

Use a dial-up VPN with a pre-shared key and set the remote gateway to the peer's public IP address.

Answer

Configure the remote gateway as a fully qualified domain name (FQDN) and enable dynamic DNS updates.

Answer

Set the remote gateway to 0.0.0.0 and disable peer ID verification, relying on pre-shared key only.

Question 11

A FortiGate is configured with a site-to-site IPsec VPN to a remote peer. The administrator notices that the VPN tunnel is up, but traffic is not passing through it. The administrator runs 'diagnose vpn tunnel list' and sees that the tunnel is up with the correct selectors. Which command should the administrator use next to verify whether traffic is being encrypted and sent out?

Accepted Answer

diagnose sniffer packet any 'host <remote_peer_ip> and esp' 4. When an IPsec tunnel is up but traffic is not passing, it is essential to verify whether packets are being encrypted and sent. The sniffer command with an ESP filter captures encrypted packets, confirming if encryption is occurring. If no ESP packets are seen, the issue may be with routing, firewall policies, or encryption domains.

Answer

diagnose firewall iprope list 100004

Answer

diagnose ip router lookup <remote_subnet>

Answer

diagnose vpn ike log filter name <tunnel_name>

Question 12

A FortiGate is configured with a site-to-site IPsec VPN to a remote office. Users at the remote office report that they cannot access resources at the main office. The administrator checks the VPN status and sees that the tunnel is up. Which two actions should the administrator take to troubleshoot the issue? (Choose two.)

Accepted Answer

Run 'diagnose debug flow' with filters for the source and destination IPs.. Since the IPsec tunnel is up, the issue is likely with data traffic not being properly routed or encrypted. Using diagnose debug flow with filters will trace the packet path and reveal where packets are dropped. Checking phase2 selectors ensures that the traffic matches the encryption domain; mismatched selectors are a common cause of connectivity failures even when the tunnel is established.

Answer

Run 'diagnose debug application ike -1' to check for IKE errors.

Answer

Run 'diagnose vpn tunnel list' to view the tunnel status.

Answer

Restart the IPsec VPN tunnel by clearing the IKE gateway.

Question 13

A FortiGate administrator is implementing Zero Trust Network Access using ZTNA tags from FortiClient EMS to control access to internal applications. The administrator must ensure that devices losing compliance are denied access and that only managed endpoints can reach the applications. Which two configuration actions are required to meet these goals? (Choose two.)

Accepted Answer

Authorize the FortiGate on FortiClient EMS so it can receive endpoint compliance tags through the EMS connector.. Enforcing posture-based ZTNA requires two things: the FortiGate must be authorized on FortiClient EMS so the EMS connector can deliver dynamic compliance tags, and a ZTNA access-proxy policy must match those tags to allow or deny application access. Together they ensure only compliant, managed endpoints reach the internal applications and that access is revoked when compliance is lost.

Answer

Enable SSL VPN host checking and bind it to the same user group used by the ZTNA policy.

Answer

Configure a static route for the ZTNA application subnets pointing to the EMS connector interface.

Answer

Import the EMS server certificate into the FortiGate's local certificate store and set it as the ZTNA server certificate.

Question 14

An administrator is troubleshooting a FortiGate that is dropping traffic from a specific VLAN. The administrator runs 'diagnose debug flow' with a filter for the VLAN's subnet and sees the trace terminate with the message 'iprope_in_check() check failed, drop'. What is the MOST likely cause?

Accepted Answer

The traffic is being denied by a firewall policy or by the implicit deny, because no matching policy was found during the ingress policy check.. The iprope_in_check failure in the flow trace indicates the ingress policy lookup found no matching policy, so the packet hit the implicit deny. The administrator should inspect policy order, address objects, and service definitions for the VLAN subnet. Routing, NP7 offload, and interface state produce different symptoms and would not yield this specific message.

Answer

The FortiGate is dropping the traffic because the destination route is missing from the routing table.

Answer

The traffic is being dropped because the VLAN interface is administratively down.

Answer

The traffic is being dropped by the NP7 processor because the session is not offloaded.

Question 15

A FortiGate administrator is configuring a web filter profile to block access to known malicious websites. The administrator wants to ensure that the firewall blocks sites based on FortiGuard category 'Malicious Websites' and also logs the blocked attempts. Which action should the administrator take?

Accepted Answer

Create a web filter profile with the 'Malicious Websites' category set to 'Block' and apply it to a firewall policy with logging enabled.. Using a web filter profile with the 'Malicious Websites' category set to block, applied to a firewall policy with logging, ensures both blocking and logging of attempts. DNS filter is not the right profile for this category, antivirus does not handle URL blocking, and static address objects cannot replace dynamic FortiGuard categories.

Answer

Enable 'Block malicious URLs' in the antivirus profile and apply it to the firewall policy.

Answer

Create a firewall address object for the malicious websites and add it to a deny policy.

Answer

Create a DNS filter profile with the 'Malicious Websites' category set to 'Block' and apply it to a firewall policy.