NSE7 Practice Exam 51 — 20 Questions

Question 1

Which TWO of the following are required components for a Fortinet ZTNA solution? (Select two.)

Accepted Answer

FortiGate. FortiGate is the enforcement point in a ZTNA solution, acting as the ZTNA gateway that verifies device posture and user identity before granting access to protected applications. It terminates ZTNA tunnels from FortiClient and applies identity-based policies, making it a required component for traffic inspection and access control.

Answer

FortiAuthenticator

Answer

FortiWeb

Answer

FortiAnalyzer

Question 2

A network engineer wants to deploy a FortiGate in transparent mode and have it managed by FortiManager. The FortiGate should not participate in routing, but must be able to send logs to FortiAnalyzer. Which two settings must be configured on the FortiGate to achieve this?

Accepted Answer

Configure a management IP address on the FortiGate. In transparent mode, the FortiGate operates as a Layer 2 bridge and does not participate in routing. However, to be managed by FortiManager and send logs to FortiAnalyzer, the FortiGate must have a management IP address (option B) so that it can be reached as a management endpoint. Additionally, a static route (option D) is required to direct traffic to the management and logging servers, since the FortiGate cannot rely on dynamic routing protocols in transparent mode.

Answer

Enable DHCP client on the management interface

Answer

Enable NAT on the management interface

Answer

Set the interface IP address in the same subnet as the upstream router

Question 3

Which THREE actions should be taken to optimize FortiGate ATP performance while maintaining security?

Accepted Answer

Implement allow lists for trusted IP addresses to bypass scanning. Implementing allow lists for trusted IP addresses to bypass scanning (Option A) reduces unnecessary processing of traffic that is known to be safe, thereby optimizing FortiGate ATP performance without compromising security. This approach leverages the FortiGate's ability to exempt trusted sources from deep inspection, which lowers CPU and memory load while maintaining protection for untrusted traffic.

Answer

Disable unnecessary security profiles to reduce CPU load

Answer

Enable proxy-based inspection for all traffic

Question 4

An administrator is configuring automation stitches to respond to a detected ransomware outbreak. Which THREE components are essential for an automation stitch?

Accepted Answer

Condition. In Fortinet's NSE7 context, an automation stitch requires three essential components: a Trigger (which initiates the stitch), a Condition (which filters or qualifies the trigger), and an Action (which executes the response). The Condition is correct because it allows the stitch to evaluate specific criteria—such as a ransomware detection event—before proceeding to the Action, ensuring precise and efficient automated responses.

Answer

Schedule

Answer

Log device

Question 5

During a ZTNA implementation, the administrator configures a ZTNA rule for an internal application but users cannot connect. The FortiGate policy is correct and the application is reachable from the FortiGate. What is the most likely misconfiguration?

Accepted Answer

The ZTNA rule's proxy destination IP or port is wrong.. The ZTNA rule defines the mapping between the external proxy address and the internal application's actual IP and port. If the proxy destination IP or port is misconfigured, the FortiGate's ZTNA proxy cannot forward traffic to the correct internal server, even though the firewall policy and network connectivity are otherwise valid. This is a common misconfiguration when the internal application's IP or service port differs from what is specified in the ZTNA rule.

Answer

The firewall policy is set to deny traffic from the ZTNA gateway.

Answer

The client does not have a route to the internal application.

Answer

The client's FortiClient agent is not authenticated.

Question 6

A FortiGate administrator is troubleshooting an issue where IPsec VPN traffic is not being forwarded correctly in a multi-VDOM environment. Which TWO factors should the administrator verify?

Accepted Answer

The firewall policy for the VPN traffic is present in the correct VDOM. A is correct because firewall policies are VDOM-scoped; even if the VPN tunnel is up, traffic will not be forwarded unless a policy explicitly permits it within the VDOM that owns the VPN interface. The administrator must verify that the policy allowing the IPsec traffic exists in the correct VDOM, as policies from one VDOM cannot control traffic in another.

Answer

Inter-VDOM routing is enabled globally

Answer

The management VDOM has an IPsec policy

Answer

The FortiGate is in transparent mode

Question 7

A FortiGate administrator configures a multi-peer IPsec VPN with two remote gateways for redundancy. The phase 1 configuration has 'set proposal aes256-sha256' and 'set dpd on-idle'. The tunnel is established but traffic fails over to the backup peer only after a long delay. What change would improve failover time?

Accepted Answer

Change DPD mode to 'on-demand' and reduce retry count. DPD on-idle sends probes only when there is no traffic. With DPD on-idle, failure detection can be slow. Changing to DPD on-demand (active probing) or reducing retry intervals speeds up failure detection.

Answer

Increase the phase 2 lifetime

Answer

Enable NAT traversal

Answer

Use IKEv1 instead of IKEv2

Question 8

A company wants to use FortiGate as a SAML service provider (SP) for authenticating administrators to the FortiGate GUI. The identity provider (IdP) is Azure AD. After configuration, administrators are redirected to Azure AD login but receive an error that the SAML request is invalid. What is the most likely misconfiguration?

Accepted Answer

The IdP's entity ID or SSO URL is incorrectly entered on FortiGate. As an SP, FortiGate must be configured with the correct IdP entity ID and SSO URL. If the IdP entity ID is incorrect, the IdP rejects the SAML request.

Answer

The FortiGate's SP entity ID does not match the Azure AD application's identifier

Answer

The administrator's account is not synchronized with Azure AD

Answer

The certificate used for signing is not trusted by the IdP

Question 9

A FortiGate has an IPsec VPN with a remote peer that uses IKEv2. The administrator wants to ensure that child SA rekeying uses PFS (Perfect Forward Secrecy) with Diffie-Hellman group 14. Which CLI command should the administrator configure on the FortiGate's phase 2 proposal?

Accepted Answer

set pfs enable; set dhgrp 14. To enable PFS with DH group 14 on the phase 2 proposal, the correct CLI command is 'set pfs enable' and 'set dhgrp 14'. The command 'set proposal aes256-sha256' defines encryption/integrity, not PFS. The other options do not set PFS correctly.

Answer

set auto-negotiate enable; set dh-group 14

Answer

set proposal aes256-sha256 dh-group 14

Answer

set pfs enable; set dh-group 14

Question 10

A FortiGate administrator is configuring a hub-and-spoke ADVPN with BGP. The hub has multiple spokes. Which TWO configuration steps are REQUIRED on the hub FortiGate for shortcut tunnels to be established between spokes?

Accepted Answer

Configure BGP to redistribute connected or static routes to the spokes. For ADVPN shortcut tunnels, the hub must enable auto-discovery sender and must also advertise the spoke routes to other spokes. Without route advertisement, spokes cannot know about each other's networks.

Answer

Enable 'set auto-discovery-receiver' on the hub's phase1 interface

Answer

Disable DPD on the hub's phase1 interface

Answer

Set the IKE version to IKEv1 on the hub

Question 11

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session was established 1 hour ago and will expire in about 1 hour. proto=6 indicates TCP. Fortinet's TCP state encoding: proto_state=01 means ESTABLISHED, not SYN_SENT. This session has been established for 3600 seconds (1 hour) and will expire in 3599 seconds (about 1 hour). Therefore, it is an established TCP session, not half-open.

Answer

The session is a TCP session that has been idle for 1 hour

Answer

The session is a UDP flow

Answer

The session is in a half-open state

Question 12

A FortiGate administrator is designing a VDOM configuration for a multi-tenant environment. Each tenant requires its own routing table and firewall policies. Which VDOM type should be used for each tenant?

Accepted Answer

NAT mode VDOM. In a multi-tenant VDOM environment where each tenant requires its own routing table and firewall policies, NAT mode VDOM (option D) is the correct choice because it operates as a Layer 3 routing entity with its own independent routing table, interfaces, and firewall policies. This mode allows each tenant VDOM to perform NAT, route between subnets, and enforce security policies autonomously, which is essential for tenant isolation and policy control.

Answer

TP mode VDOM

Answer

Router mode VDOM

Answer

Transparent mode VDOM

Question 13

An administrator configures a ZTNA proxy rule to allow access to an internal application. Users can connect to the FortiGate ZTNA gateway but receive a '403 Forbidden' error. Which step should the administrator take to resolve the issue?

Accepted Answer

Check that the ZTNA proxy rule's action is set to 'accept' and the correct tags are specified. A 403 error on ZTNA typically indicates that the user's device does not have the required ZTNA tags. The administrator must ensure the FortiClient has the correct tags assigned based on compliance.

Answer

Disable the 'require ZTNA tag' option on the proxy rule

Answer

Ensure the application is reachable from the FortiGate with a ping

Answer

Verify that the application's firewall policy has an SSL inspection profile applied

Question 14

Which FortiGate feature allows an administrator to define a granular policy based on the security posture of the endpoint device, such as OS version, antivirus status, and disk encryption, before granting access to a protected application?

Accepted Answer

ZTNA access proxy. ZTNA (Zero Trust Network Access) uses device posture checks to evaluate endpoint security before granting access to applications.

Answer

Web filtering profile

Answer

SSL VPN portal

Answer

IPsec phase 1 configuration

Question 15

An administrator is configuring a new VDOM on a FortiGate and needs to ensure that certain system resources are isolated for that VDOM. Which TWO settings must be configured to achieve resource isolation?

Accepted Answer

Set memory quota. Setting a memory quota on a VDOM limits the amount of physical memory (RAM) the VDOM can consume, preventing it from starving other VDOMs or the root system. Option C is correct because setting a CPU quota caps the percentage of CPU time the VDOM can use, ensuring fair scheduling across VDOMs. Together, these two settings enforce resource isolation at the system level, which is required for multi-tenant or segmented environments.

Answer

Set disk quota

Answer

Set bandwidth limit

Answer

Set session limit

Question 16

A FortiGate administrator is troubleshooting why a custom IPS signature is not triggering on traffic matching the pattern. Which TWO checks should be performed?

Accepted Answer

Confirm the IPS sensor is applied to the correct firewall policy. An IPS sensor must be explicitly attached to a firewall policy via the 'inspection-mode' or 'ips-sensor' configuration to inspect traffic. Even if a custom signature is correctly defined and enabled, it will never trigger if the sensor containing it is not applied to the policy that matches the target traffic. This is a fundamental prerequisite for any IPS signature to process packets.

Answer

Check the signature's severity level in the IPS sensor

Answer

Ensure the FortiGate is in proxy-based inspection mode

Answer

Verify the signature uses correct protocol decoder

Question 17

An administrator deploys a FortiGate in a remote office with a FortiSwitch and FortiAP. The LAN edge management features are used to manage these devices. The FortiGate is configured as a controller. Which three steps are required to manage the FortiAP via the FortiGate? (Choose THREE.)

Accepted Answer

Configure DHCP option 138 or DNS to point FortiAP to FortiGate. FortiAPs use DHCP option 138 or DNS to discover the FortiGate controller. DHCP option 138 provides the IP address of the FortiGate, while DNS resolves a predefined hostname (e.g., 'fortigate' or 'fg') to the controller's IP. Without this discovery mechanism, the FortiAP cannot locate the FortiGate to establish CAPWAP control and data tunnels.

Answer

Enable LLDP on the FortiSwitch

Answer

Configure an SSID under the FortiAP profile

Question 18

An administrator wants to see the current sessions for a specific source IP address 192.168.1.10. Which CLI command should be used?

Accepted Answer

diagnose sys session filter src 192.168.1.10; diagnose sys session list. The `diagnose sys session filter src` command sets a filter for the source IP address, and `diagnose sys session list` then displays only the sessions matching that filter. This two-step process is the standard FortiGate CLI method for viewing active sessions for a specific source IP, as it leverages the session table directly without triggering debug overhead.

Answer

get system session list src 192.168.1.10

Answer

diagnose debug flow src-addr 192.168.1.10

Answer

execute session list source 192.168.1.10

Question 19

An administrator needs to configure a FortiGate to act as a SAML identity provider (IdP) for a third-party cloud application (SP). Which TWO settings must be configured on the FortiGate to function as an IdP?

Accepted Answer

SAML IdP user group. The FortiGate requires a SAML IdP user group to define which users are allowed to authenticate via SAML. This group is referenced in the SAML IdP configuration to control access and map attributes to the service provider. Without it, the IdP cannot determine which users to authenticate or how to release attributes.

Answer

LDAP server configuration

Answer

SP metadata import

Answer

SSL VPN portal

Question 20

When troubleshooting a FortiGate that is not synchronizing configuration to its HA peer, which command should be used to check the HA synchronization status?

Accepted Answer

get system ha status. 'get system ha status' is the standard operational command on FortiGate to display the current HA synchronization status, including whether the configuration is synchronized, the HA mode, and the peer status. This command provides a clear, human-readable output that directly indicates if the configuration is in sync or out of sync, which is essential for troubleshooting synchronization issues.

Answer

diagnose sys ha sync-status

Answer

diagnose sys ha status

Answer

show system ha