NSE7 Practice Exam 52 — 20 Questions

Question 1

A FortiGate admin sees the following log: 'Action=blocked, Service=HTTP, Application=Outbreak, File=invoice.doc, ThreatScore=95'. What is the MOST likely explanation for this block?

Accepted Answer

The file was blocked by FortiGuard outbreak prevention. The log entry shows 'Application=Outbreak' and 'ThreatScore=95', which are specific indicators of FortiGuard outbreak prevention. FortiGuard outbreak prevention uses real-time threat intelligence to block files associated with widespread malware campaigns before traditional signatures are updated. The 'Outbreak' application tag and high threat score directly correspond to this feature, not to machine learning, sandbox verdicts, or custom IPS signatures.

Answer

The file was blocked by the machine learning engine

Answer

The file was blocked by FortiSandbox verdict

Answer

The file was blocked by a custom IPS signature

Question 2

An administrator has configured OSPF on a FortiGate with multiple areas. They want to ensure that routes from area 0 are redistributed into area 1, but they notice that routes from area 1 are not appearing in area 0. What is the most likely configuration issue?

Accepted Answer

The ABR is not configured with 'area 0' and 'area 1' on the same router. The most likely configuration issue is that the ABR is not properly configured as an ABR – it must have interfaces in both area 0 and area 1. Without an interface in area 0, the router cannot generate Type 3 LSAs (inter-area advertisements) between the areas, so routes from area 1 never appear in area 0. Option B is incorrect because a stub area blocks Type 5 LSAs from entering the stub area, but it does not block Type 3 LSAs from being advertised out of the stub area into the backbone; therefore, stub configuration would not prevent inter-area routes from reaching area 0.

Answer

There is a firewall policy blocking OSPF packets

Answer

The ABR has 'area 1 stub' configured, preventing LSA type 5 redistribution

Answer

The redistribution is done with a route map that is not permitting the routes

Question 3

An admin needs to verify that a new firewall policy is performing SSL inspection. Which THREE CLI commands or steps should the admin use to confirm? (Choose three.)

Accepted Answer

Use 'diagnose wad filter' to check if traffic is being processed by the web proxy for SSL inspection. 'diagnose wad filter' is used to verify that traffic is being processed by the web proxy (WAD) for SSL inspection. When SSL inspection is enabled, traffic on port 443 is intercepted by the FortiGate's proxy, and this command filters and displays relevant proxy sessions, confirming that decryption is occurring.

Answer

Run 'diagnose debug flow' to check if traffic is hitting the policy

Answer

Run 'get system performance status' to see SSL inspection statistics

Question 4

An email security administrator wants to prevent attackers from spoofing the company's domain. Which email authentication mechanism should be configured to allow receiving servers to verify that emails claiming to be from the domain are sent from authorized mail servers?

Accepted Answer

SPF. SPF (Sender Policy Framework) is the correct answer because it allows domain owners to publish DNS records specifying which mail servers are authorized to send email on behalf of their domain. Receiving servers can then verify the envelope sender (Return-Path) against the SPF record to detect spoofed messages. This directly addresses the requirement to verify that emails claiming to be from the domain originate from authorized servers.

Answer

DMARC

Answer

TLS for SMTP

Answer

DKIM

Question 5

An administrator is reviewing the HA configuration shown in the exhibit. The primary unit has failed, and the secondary unit (with priority 100) has taken over. However, the administrator notices that the secondary unit has an IP address of 10.10.10.2 on port3, but cannot ping the management gateway 10.10.10.1. What is the most likely cause?

Accepted Answer

The HA management interface IP is not active on the secondary. When the secondary unit takes over in an HA cluster, the HA management interface IP (configured under config system ha) is only active on the primary unit by default. Even after failover, the secondary unit does not automatically activate this IP unless the 'management-interface-ip' is explicitly configured to be active on the secondary. Since the secondary unit has IP 10.10.10.2 on port3 but cannot ping the management gateway 10.10.10.1, the most likely cause is that the HA management interface IP is not active on the secondary, meaning the secondary unit is using its own port3 IP (10.10.10.2) but the gateway expects the management IP to be reachable from that subnet, which it is not.

Answer

The hbdev configuration is incorrect

Answer

The override setting is preventing the secondary from taking over management

Answer

session-pickup is not enabled

Question 6

You run 'diagnose sys session filter dport 179' on a FortiGate and see many sessions with proto=6 and proto_state=01. What does this indicate about the BGP sessions?

Accepted Answer

BGP sessions are in the process of being established, but not yet fully up.. Proto=6 indicates TCP, and proto_state=01 corresponds to TCP SYN_SENT (state 1 in the Linux TCP state model used by FortiGate). This means the BGP session has sent a SYN but has not yet received a SYN-ACK, so the three-way handshake is incomplete and the session is not established. BGP uses TCP port 179, so seeing many sessions in this state indicates ongoing connection attempts that have not yet completed.

Answer

BGP sessions are fully established and exchanging routes.

Answer

BGP sessions are being actively torn down.

Answer

BGP sessions are using TCP port 179 but are idle.

Question 7

Refer to the exhibit. A user reports that accessing a legitimate HTTPS website is blocked. The FortiGate logs show that the connection was denied by the antivirus profile. What is the most likely cause?

Accepted Answer

The antivirus profile detected a false positive in the encrypted traffic. The antivirus (AV) profile on FortiGate performs deep inspection of HTTPS traffic by decrypting it, scanning the content, and re-encrypting it. If the AV signature database contains a false positive for a legitimate website's content (e.g., a benign JavaScript file matching a malware signature), the connection will be denied. The log explicitly states the denial was by the AV profile, not by any other security profile, making a false positive in encrypted traffic the most likely cause.

Answer

The application list blocked the HTTPS application

Answer

The IPS profile blocked a vulnerability in the website

Answer

The protocol options profile blocked the SSL handshake

Question 8

A company is implementing Zero Trust Network Access using Fortinet's ZTNA solution. They have deployed a FortiGate as the ZTNA gateway and are using FortiClient as the ZTNA agent. Users report that they can initiate ZTNA connections but the connections drop after a few minutes. The FortiGate logs show that the ZTNA session is being terminated due to a endpoint compliance check failure. Which action should the administrator take to resolve this issue?

Accepted Answer

Review and adjust the endpoint compliance rules in FortiClient EMS.. The FortiGate logs explicitly indicate that the ZTNA session is being terminated due to an endpoint compliance check failure. This means the FortiGate is enforcing compliance rules defined in FortiClient EMS, and when the endpoint fails those checks (e.g., missing antivirus updates, firewall disabled), the session is dropped. Reviewing and adjusting the compliance rules in EMS allows the administrator to align the requirements with the actual endpoint posture or correct the misconfiguration causing the failure.

Answer

Disable endpoint compliance checks on the FortiGate.

Answer

Increase the session timeout on the FortiGate ZTNA gateway.

Answer

Change the authentication method from certificate to LDAP.

Question 9

A network engineer is troubleshooting an OSPF multi-area setup on a FortiGate. The FortiGate is an ABR (Area Border Router) connecting area 0 and area 1. The engineer notices that routes from area 1 are not being advertised into area 0. Which TWO of the following are possible causes? (Select TWO.)

Accepted Answer

OSPF is not enabled on the interface in area 1, or the network type is mismatched. If OSPF is not enabled on the interface in area 1, the FortiGate cannot form adjacencies or exchange routes within that area. A network type mismatch (e.g., broadcast vs. point-to-point) can prevent neighbor relationships from forming, which would block Type 3 LSA generation by the ABR. Without OSPF running correctly on the area 1 interface, the ABR cannot inject area 1 routes into area 0.

Answer

The 'redistribute connected' command is missing

Answer

The FortiGate has a static route to area 1 that overrides OSPF

Answer

The administrative distance for OSPF is set too high

Question 10

What is the purpose of header and footer policies in a FortiManager policy package?

Accepted Answer

To apply policies at the top and bottom of the policy list that are not affected by reordering within the package. Header and footer policies in FortiManager policy packages allow administrators to define policies that are automatically placed at the very top (header) and very bottom (footer) of the policy list. These policies remain fixed in position and are not affected by any reordering operations performed on the regular policies within the package, ensuring that critical security controls (e.g., deny-all or allow-specific traffic) are always enforced in the correct order.

Answer

To separate IPv4 and IPv6 policies

Answer

To create backup policies

Answer

To define policies that are only used during installation

Question 11

A FortiGate cluster (A-P) has a session that is not synchronizing to the secondary unit. The administrator runs 'diagnose sys ha session-sync status' and sees that the session count is different between primary and secondary. Which is the most likely cause?

Accepted Answer

The session was created by a local-in traffic (e.g., management traffic) which is not synchronized.. FortiGate A-P clusters synchronize sessions via the HA heartbeat interface, but local-in traffic (e.g., management sessions like HTTPS, SSH, or SNMP) is never synchronized because it is destined to the cluster IP itself and is inherently unit-specific. The 'diagnose sys ha session-sync status' command shows a session count mismatch because the primary unit has local-in sessions that the secondary does not replicate, making D the correct answer.

Answer

The session is using a custom application control profile that prevents synchronization.

Answer

The HA heartbeat interface is down.

Answer

The secondary unit has insufficient memory to accept new sessions.

Question 12

Which FortiGate security feature removes potentially malicious active content from files (e.g., macros, scripts) before delivering them to end users?

Accepted Answer

Content Disarm and Reconstruction. Content Disarm and Reconstruction (CDR) is the correct answer because it specifically removes potentially malicious active content—such as macros, scripts, and embedded objects—from files (e.g., Office documents, PDFs) by stripping the active elements and reconstructing a safe, sanitized version before delivery. Unlike traditional scanning, CDR does not rely on signatures or heuristics; it assumes the file could be malicious and proactively neutralizes threats by rebuilding the file with only safe, static content.

Answer

Antivirus

Answer

Data Leak Prevention

Answer

File Filter

Question 13

A FortiGate administrator observes that traffic from an internal user to the internet is being blocked. The firewall policy allows the traffic, and the user can ping external hosts. The administrator runs 'diagnose debug flow' for the user's IP and sees 'session denied by forward policy check'. What is the MOST likely cause?

Accepted Answer

There is an implicit deny policy blocking the traffic. The 'session denied by forward policy check' message in a debug flow output indicates that the session was explicitly denied by a firewall policy check, not by a security profile or rate-limiting mechanism. Since the firewall policy allows the traffic, the most likely cause is the implicit deny policy at the end of the policy list, which blocks any traffic that does not match an explicit allow policy. The ability to ping external hosts suggests ICMP is allowed by a separate policy, while TCP/UDP traffic for other services is hitting the implicit deny.

Answer

The antivirus profile has detected a threat and is blocking the session

Answer

The user's traffic is being rate-limited by a traffic shaper

Answer

The user's source IP is in a local-in policy that denies the traffic

Question 14

What is the role of FortiGuard Outbreak Prevention in FortiGate's security suite?

Accepted Answer

To deliver real-time threat intelligence and block fast-spreading outbreaks. FortiGuard Outbreak Prevention is a real-time threat intelligence service that proactively blocks fast-spreading outbreaks by delivering immediate signature updates and threat data to FortiGate devices. Unlike scheduled updates, it uses a push mechanism to rapidly deploy protections against emerging threats, reducing the window of vulnerability during zero-day or widespread attacks.

Answer

To provide offline signature updates for antivirus

Answer

To perform sandbox analysis of files

Answer

To manage endpoint security policies

Question 15

A FortiGate admin configures a firewall policy with an antivirus profile in flow-based inspection mode. The admin notices that some large files are being scanned but others are allowed without scanning. What is the most likely cause?

Accepted Answer

The FortiGate's antivirus buffer size is exceeded, causing some files to bypass scanning. In flow-based inspection, FortiGate uses a buffer to reassemble files before scanning. When a file exceeds the configured antivirus buffer size (default 1 MB for flow-based), the FortiGate cannot buffer the entire file for scanning and allows it to pass without inspection. This explains why some large files bypass scanning while smaller ones are scanned.

Answer

The antivirus signatures are outdated

Answer

The antivirus profile has an exemption for certain file types

Answer

Flow-based inspection cannot scan files larger than 10 MB

Question 16

An administrator configures an automation stitch to respond to a high severity event. The trigger is 'event' and the action is 'CLI script'. What must be defined for the action to execute properly?

Accepted Answer

A valid CLI script that contains commands to be executed on the FortiGate. For an automation stitch action of type 'CLI script' to execute properly on a FortiGate, the action must reference a valid CLI script that contains the actual FortiGate CLI commands to be run. The script is defined locally on the FortiGate and does not require external authentication, a FortiManager, or an email server for execution.

Answer

An API token for authentication

Answer

A FortiManager to execute the script

Answer

An email server to send the script output

Question 17

A FortiGate administrator is investigating a slow network issue. The 'diagnose sys session stat' shows a high number of sessions. Which THREE commands can help identify the source of the high session count?

Accepted Answer

diagnose sys session list | grep . 'diagnose sys session list | grep ' filters the session list to show only sessions matching a specific firewall policy ID. This allows the administrator to identify which policy is handling the most sessions, helping to pinpoint the source of high session counts by correlating traffic patterns with policy usage.

Answer

diagnose sys session stat

Answer

diagnose netlink interface list

Question 18

A FortiGate is configured with OSPF multi-area. The administrator wants to redistribute a static route into OSPF area 0 and ensure it is propagated to all areas. Which THREE steps are required? (Choose three.)

Accepted Answer

Ensure the static route has a valid next-hop and is in the routing table. OSPF can only redistribute routes that are present in the routing table. If the static route is not valid (e.g., missing next-hop or interface down), it will not be installed, and redistribution will fail. The 'redistribute static' command under OSPF router configuration (Option C) is the fundamental step to inject the route into OSPF. A route map with metric type E1 (Option E) is required to ensure the redistributed route is advertised as an external type 1 (E1) metric, which carries the internal cost to the ASBR, allowing proper path selection across all areas.

Answer

Set the OSPF network type to point-to-multipoint

Answer

Disable OSPF on all interfaces to prevent loops

Question 19

Which feature allows a FortiGate to participate in multiple routing tables simultaneously, enabling network segmentation and overlapping IP address spaces?

Accepted Answer

VRF. C is correct because VRF (Virtual Routing and Forwarding) allows a FortiGate to maintain multiple separate routing tables (RIB) on the same physical device. Each VRF instance operates as an independent routing domain, enabling network segmentation and the use of overlapping IP address spaces without conflict, which is essential for MPLS L3VPN and multi-tenant environments.

Answer

VDOM

Answer

Policy-based routing

Answer

Route redistribution

Question 20

An administrator configures BGP over an IPsec VPN between two FortiGates. The BGP session is established, but routes from the remote site are not being installed in the local routing table. The admin verifies that the BGP neighbor configuration is correct and the remote site is advertising routes. What is the MOST likely cause?

Accepted Answer

A firewall policy is blocking BGP traffic on the VPN interface. BGP routes must be allowed by a firewall policy on the loopback or interface used for BGP. Even if the VPN tunnel is up, BGP traffic (TCP port 179) may be blocked by the local-in policy or by the VPN interface's firewall policy if not explicitly allowed.

Answer

The BGP timers are too aggressive causing route flapping

Answer

The BGP network statement is missing on the local FortiGate

Answer

The next-hop IP address is not reachable