NSE7 Practice Questions 1 — 50 Questions

Question 1

A large enterprise operates two FortiGate 600E firewalls in an HA active-passive cluster. They have enabled VDOMs to isolate traffic for different business units: Finance, HR, and Engineering. Each VDOM has its own internet connection through separate ISPs. The cluster has been running smoothly for months. Recently, the IT team noticed that users in the Finance VDOM experience intermittent connectivity drops to their cloud-based ERP system. The drops last 30-60 seconds and occur several times a day. During these drops, ping to the ERP IP address fails. The HA cluster status shows 'synchronized' and no failover events are logged. The Finance VDOM uses a static default route pointing to the primary ISP gateway. The other VDOMs are unaffected. What is the most likely cause of the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VDOM link configuration is not synchronized between the two units, causing asymmetric routing for the Finance VDOM.. VDOM link configurations are stored per-VDOM and must be synchronized independently. If the VDOM link configuration is not synchronized between the HA units, the passive unit may have a different or missing VDOM link, causing asymmetric routing when traffic is processed by the passive unit during a transient state (e.g., session ownership change or link flap). This leads to intermittent connectivity drops for the Finance VDOM only, as its traffic is isolated and uses a static default route.

Answer

The HA cluster is in active-active mode, causing routing loops for the Finance VDOM.

Answer

The heartbeat interface is oversubscribed, causing intermittent HA synchronization failures.

Answer

The 'set ha-mgmt-status enable' command is configured on the passive unit, preventing route synchronization.

Question 2

A FortiGate administrator wants to enable load balancing for equal-cost paths to the same destination. The FortiGate has two equal-cost routes via two different next-hop routers. Which feature should the admin enable to load balance traffic across both paths?

Accepted Answer

ECMP (Equal Cost Multi-Path). ECMP (Equal Cost Multi-Path) is the correct feature because it enables a FortiGate to distribute traffic across multiple equal-cost routes to the same destination. When the routing table contains two or more routes with identical administrative distance and metric, ECMP automatically load-balances sessions across those paths using a hash-based algorithm (e.g., source-destination IP hash), without requiring additional configuration beyond enabling the feature globally or per-VDOM.

Answer

BFD (Bidirectional Forwarding Detection)

Answer

Policy-based routing

Answer

SD-WAN load balancing

Question 3

A FortiGate is set up in a high availability (HA) cluster. The administrator notices that the primary unit is not synchronizing configuration changes to the secondary unit. The HA status shows 'synchronization failed'. What is the most likely cause?

Accepted Answer

The configuration has not been saved on the primary unit.. FortiGate HA requires the configuration to be saved (via 'execute backup config' or 'write memory') on the primary unit before it can be synchronized to the secondary unit. If the configuration is not saved, the primary unit does not have a committed configuration to push, leading to a 'synchronization failed' status even though the HA cluster is otherwise healthy.

Answer

The firmware versions are different on the two units.

Answer

The HA heartbeat interface is down.

Answer

NAT policies are misconfigured.

Question 4

A FortiGate administrator is troubleshooting an IKEv2 VPN tunnel that fails to establish. The remote peer logs show 'no acceptable proposal' error. Which TWO possible causes should the administrator check?

Accepted Answer

The phase1 encryption algorithm or integrity algorithm is mismatched. The 'no acceptable proposal' error occurs when the two peers cannot agree on a set of parameters. Common causes are mismatched encryption/integrity algorithms (phase1 proposal) or mismatched Diffie-Hellman groups.

Answer

The remote peer's IP address is unreachable

Answer

The local FortiGate has the wrong IKE version configured

Answer

The remote peer's pre-shared key is incorrect

Question 5

Refer to the exhibit. A FortiGate is connected to the Security Fabric and registered with FortiManager. However, the administrator notices that the FortiGate is not receiving policy updates from FortiManager. What is the most likely cause?

Accepted Answer

The policy package on FortiManager is not assigned to the correct device group or policy target. FortiManager uses policy packages that must be explicitly assigned to a device group or specific FortiGate. Even if the FortiGate is registered and part of the Security Fabric, if the policy package is not assigned to the correct device group or policy target, the FortiGate will not receive policy updates. This is a common misconfiguration where the policy package exists but is not linked to the device.

Answer

The Fabric Root serial number is incorrect

Answer

The FortiGate is not registered with FortiManager

Answer

The Security Fabric is not fully connected

Question 6

Which Fortinet product provides endpoint detection and response (EDR) capabilities, including automated threat containment?

Accepted Answer

FortiEDR. FortiEDR is the correct answer because it is Fortinet's dedicated endpoint detection and response solution that provides real-time behavioral analysis, automated threat containment, and forensic investigation capabilities. Unlike traditional antivirus, FortiEDR uses machine learning and pre-execution analysis to detect and block advanced threats, and it can automatically isolate compromised endpoints from the network to prevent lateral movement.

Answer

FortiClient

Answer

FortiSandbox

Answer

FortiGuard

Question 7

An administrator is configuring a new branch office VPN using IKEv2 with PKI certificates. Which TWO steps are essential to ensure the VPN tunnel establishes successfully?

Accepted Answer

Import the remote peer's certificate into the FortiGate's trusted CA list. For IKEv2 with PKI certificates, the remote peer's certificate must be validated against a trusted CA. Importing the CA certificate that signed the remote peer's certificate into the FortiGate's trusted CA list allows the FortiGate to build a valid certificate chain and authenticate the remote peer during IKEv2 phase 1. Without this, the certificate validation fails and the tunnel cannot establish.

Answer

Set the phase 1 proposal to use AES-256-GCM only

Answer

Enable DPD on the phase 1 interface

Answer

Configure the phase 2 selector to include all traffic (0.0.0.0/0)

Question 8

An administrator wants to integrate a FortiExtender with a FortiGate to provide WAN connectivity. Which interface type is used on the FortiGate to connect to the FortiExtender?

Accepted Answer

wan. The FortiGate uses a dedicated 'wan' interface type to connect to a FortiExtender, as this interface is specifically designed to manage the cellular or broadband WAN link provided by the extender. The FortiExtender appears as a WAN-facing device, and the 'wan' interface type allows the FortiGate to apply SD-WAN rules, load balancing, and failover policies directly to that connection.

Answer

lan

Answer

dmz

Answer

loopback

Question 9

An administrator notices high CPU usage on a FortiGate. To identify which process is consuming the most CPU, which command should be used?

Accepted Answer

diagnose sys top. The 'diagnose sys top' command displays a real-time list of running processes on the FortiGate, sorted by CPU usage, allowing the administrator to identify which process is consuming the most CPU. This is the standard diagnostic tool for process-level CPU troubleshooting in FortiOS.

Answer

diagnose sys session stat

Answer

get system performance status

Answer

diagnose hardware sysinfo

Question 10

An administrator is configuring a FortiGate in transparent mode for an enterprise network. The existing gateway firewall must remain in place. How should the administrator configure the FortiGate's interfaces to ensure minimal disruption?

Accepted Answer

Place both interfaces in the same VDOM and assign a shared management IP. In transparent mode, FortiGate acts as a Layer 2 bridge, so both interfaces must belong to the same VDOM and share a single management IP to allow administrative access without breaking the Layer 2 path. This configuration ensures the existing gateway firewall remains in place and traffic flows uninterrupted, as the FortiGate does not perform routing between its interfaces.

Answer

Enable VDOMs and separate the interfaces into different VDOMs

Answer

Assign each interface a unique IP address on different subnets

Answer

Use 802.1Q trunking on a single physical interface

Question 11

You want to use policy-based routing (PBR) to send traffic from a specific subnet to a different next-hop than the default route. Which configuration is required?

Accepted Answer

Configure a route map under 'config router policy'. Policy-based routing (PBR) on FortiGate is configured under 'config router policy' using route maps. This allows you to match traffic based on criteria such as source subnet and set a specific next-hop, overriding the default route. Option A correctly identifies the required configuration path for PBR.

Answer

Create a firewall policy with 'set policy-based-route enable'

Answer

Enable 'set pbr-enforce-symmetric' on the interface

Answer

Configure a prefix list and apply to the static route

Question 12

Which of the following is a requirement for FortiGate to act as a SAML Identity Provider (IdP) for ZTNA?

Accepted Answer

A configured user database and SAML IdP settings. FortiGate can be a SAML IdP, providing authentication to service providers. It requires a configured user database (e.g., local users, LDAP) and a SAML IdP profile.

Answer

A public IP address on the WAN interface

Answer

Integration with FortiClient EMS

Answer

An SSL certificate from a public CA

Question 13

A network administrator is configuring inter-VDOM routing between two VDOMs: VDOM-A and VDOM-B. The administrator creates a inter-VDOM link and adds routes pointing to the link. However, traffic from VDOM-A to VDOM-B fails. What is the most likely missing configuration?

Accepted Answer

A firewall policy must be created in each VDOM to permit traffic across the inter-VDOM link. In FortiGate, inter-VDOM routing requires firewall policies in each VDOM to explicitly permit traffic across the inter-VDOM link. Without these policies, the FortiGate drops the traffic even if routes are correctly configured, because the inter-VDOM link behaves like a virtual interface that requires policy-based access control.

Answer

Both VDOMs must be in transparent mode

Answer

The inter-VDOM link must be in the same VDOM

Answer

The management VDOM must be enabled

Question 14

Which Fortinet solution collects and correlates security events from multiple sources to provide a unified view of threats across the network?

Accepted Answer

FortiSIEM. FortiSIEM is the correct answer because it is specifically designed as a Security Information and Event Management (SIEM) solution that aggregates, normalizes, and correlates logs and events from diverse sources—including firewalls, endpoints, servers, and cloud platforms—into a single pane of glass. It uses a patented event correlation engine and a unified event database to detect multi-stage attack patterns and provide actionable threat intelligence, fulfilling the requirement for a unified view of threats across the network.

Answer

FortiSandbox

Answer

FortiDeceptor

Answer

FortiEDR

Question 15

A company is deploying FortiClient ATP to protect endpoints. They want to block ransomware behavior in real time. Which FortiClient feature should be enabled?

Accepted Answer

Real-Time Protection. Real-Time Protection is the FortiClient feature that uses behavioral analysis and machine learning to detect and block ransomware-like activities, such as mass file encryption or unauthorized file modifications, as they occur. This feature monitors process behavior in real time, leveraging FortiSandbox threat intelligence and local heuristics to stop ransomware before it can cause damage.

Answer

Vulnerability Scan

Answer

Web Filtering

Answer

Application Firewall

Question 16

A FortiGate administrator is troubleshooting why a new firewall policy is not being applied to traffic. The policy has been created and installed via FortiManager. What is the quickest way to verify the current state of the policy on the FortiGate?

Accepted Answer

Run 'show firewall policy'. Running 'show firewall policy' on the FortiGate CLI displays the currently active policy set in the kernel, including the policy ID and its enabled/disabled status. This is the quickest way to confirm whether the policy installed via FortiManager is actually present and active on the FortiGate, without generating debug logs or querying the management plane.

Answer

Use 'diagnose debug flow'

Answer

Run 'execute fortimanager reindex'

Answer

Check FortiManager revision history

Question 17

An admin needs to configure a FortiGate to send logs to FortiAnalyzer for a specific VDOM only. How can this be achieved?

Accepted Answer

Set the FortiAnalyzer IP in the specific VDOM's log settings. FortiGate allows per-VDOM log configuration, including the FortiAnalyzer IP address, under the VDOM's log settings. This ensures that only logs from that specific VDOM are sent to the designated FortiAnalyzer, while other VDOMs remain unaffected.

Answer

Create a separate ADOM in FortiAnalyzer for that VDOM

Answer

Configure log forwarding globally; it applies to all VDOMs

Answer

Use a firewall policy to filter logs to FortiAnalyzer

Question 18

A company is implementing a Security Fabric with multiple FortiGate devices. They want to use FortiAnalyzer for centralized logging and FortiManager for centralized management. Which of the following is a prerequisite for adding a FortiGate to the Security Fabric?

Accepted Answer

The FortiGate must have network connectivity to the FortiManager. For a FortiGate to join a Security Fabric, it must have network connectivity to the FortiManager that manages the fabric. FortiManager acts as the fabric root or controller, and the FortiGate registers with it using the FortiManager IP or FQDN. Without this connectivity, the FortiGate cannot be added to the Security Fabric topology.

Answer

The FortiGate must have FortiAnalyzer configured as a log device

Answer

The FortiGate's management IP must be configured via DHCP

Answer

The FortiGate must be operating in transparent mode

Question 19

In a hub-and-spoke VPN, spokes cannot communicate with each other directly. The administrator wants to allow direct spoke-to-spoke traffic without routing through the hub. Which technology should be configured?

Accepted Answer

ADVPN with IKEv2. ADVPN (Auto Discovery VPN) enables shortcut tunnels between spokes after initial hub communication, allowing direct traffic.

Answer

Static routes on spokes

Answer

IKEv1 with mode-config

Answer

GRE over IPsec

Question 20

A network administrator is troubleshooting an IPsec VPN tunnel that is not coming up. The configuration uses IKEv2 with pre-shared keys. The administrator runs 'diagnose vpn ike log-filter' and sees no logs. What is the most likely cause?

Accepted Answer

IKE debug is not enabled. Without enabling IKE debug, the diagnose command will not show any output even if the tunnel is failing. The log-filter only filters the debug output; debug must be started first.

Answer

The pre-shared key does not match

Answer

The tunnel name is misspelled in the filter

Answer

The remote gateway is unreachable