NSE7 Practice Exam 53 — 20 Questions

Question 1

Refer to the exhibit. Users report that they cannot log in to the SSL VPN portal. The stats show 15 login failures with reason 'auth_fail'. What is the most likely cause?

Accepted Answer

The SSL VPN settings do not reference the user group. The 'auth_fail' reason indicates that the authentication request was processed but rejected, typically because the SSL VPN portal is not configured to reference the user group that 'user1' belongs to. Without a group filter or group mapping in the SSL VPN settings, the FortiGate cannot match the user to any allowed group, causing the authentication to fail even if the user credentials are valid.

Answer

The user 'user1' does not exist

Answer

The login-attempt-limit is too low

Answer

The encryption algorithm is set to low

Question 2

An administrator is configuring SSL VPN on FortiGate and wants to allow users to access internal applications via a web portal without installing any client software. Which SSL VPN mode should be used?

Accepted Answer

Web mode. Web mode (option C) is correct because it enables users to access internal web applications through a FortiGate SSL VPN web portal using only a standard browser, with no client software installation required. The portal acts as a reverse proxy, translating HTTPS requests from the client to the internal application servers, making it ideal for clientless remote access.

Answer

DTLS

Answer

Tunnel mode

Answer

Split tunneling

Question 3

Refer to the exhibit. A FortiGate administrator has configured an IPsec VPN tunnel to a branch office. The tunnel fails to establish. What is the most likely cause?

Accepted Answer

Phase 2 proposal (aes256-sha1) is not compatible with Phase 1 proposal (aes256-sha256). The tunnel fails because the Phase 2 proposal (aes256-sha1) is not compatible with the Phase 1 proposal (aes256-sha256). In IPsec VPN, Phase 1 establishes the ISAKMP SA using a set of encryption and authentication algorithms, while Phase 2 negotiates the IPsec SA for data traffic. The authentication algorithm must match between Phase 1 and Phase 2; here, Phase 1 uses SHA-256 but Phase 2 uses SHA-1, causing a mismatch that prevents the tunnel from establishing.

Answer

The pre-shared key is encrypted in the configuration

Answer

The 'net-device disable' setting prevents tunnel creation

Answer

The phase2 interface name does not match the phase1 name

Question 4

Which TWO features are required to implement an always-on SSL VPN tunnel with FortiGate that automatically reconnects when the user's network changes?

Accepted Answer

Tunnel mode enabled. Option A is correct because tunnel mode is required for an always-on SSL VPN tunnel, as it encapsulates all traffic at the network layer (TUN) and maintains a persistent virtual interface on the client. This allows the VPN to stay active and automatically reconnect when the user's network changes, such as switching from Wi-Fi to cellular, without manual intervention.

Answer

DTLS enabled

Answer

Web mode portal

Answer

Split tunneling configured

Question 5

Which THREE conditions must be met for an IPsec VPN to successfully establish phase2?

Accepted Answer

Proxy IDs (local and remote subnets) match on both sides. Option A is correct because IPsec Phase 2 uses Proxy IDs (local and remote subnets) to negotiate the security associations (SAs) that define which traffic is protected. If the proxy IDs do not match on both peers, the IKEv1 or IKEv2 Quick Mode exchange will fail, preventing the establishment of Phase 2 SAs. This is a fundamental requirement for matching traffic selectors in the IPsec SA negotiation.

Answer

Firewall policies allow traffic between the subnets

Answer

NAT traversal is enabled on both sides

Question 6

Refer to the exhibit. An administrator runs the 'diagnose vpn ike stats' command on a FortiGate. What does the output indicate?

Accepted Answer

The tunnel has one IKE SA and two IPsec SAs, which is normal for a single VPN tunnel.. The 'diagnose vpn ike stats' output shows one IKE SA (phase 1) and two IPsec SAs (phase 2). This is normal for a single VPN tunnel when using IPsec with both inbound and outbound SAs, or when the tunnel is configured with separate SAs for different traffic selectors. The presence of two IPsec SAs under one IKE SA does not indicate an error or vulnerability; it is the expected behavior for a standard IPsec VPN tunnel.

Answer

The tunnel is vulnerable to a man-in-the-middle attack because the IPsec SAs are using the same encryption algorithm.

Answer

The tunnel configuration is incorrect because there are two IPsec SAs under one IKE SA.

Answer

The tunnel is using two IKE SAs for redundancy.

Question 7

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGate devices. The tunnel is established, but traffic is not passing. Which configuration should the administrator check first?

Accepted Answer

Firewall policies. When an IPsec VPN tunnel is established but traffic does not pass, the most common cause is missing or misconfigured firewall policies. Even with correct Phase 1 and Phase 2 settings, the FortiGate will not forward traffic between the tunnel interface and the destination network unless an explicit firewall policy permits it. This is because FortiGate uses a stateful inspection model where all traffic must be allowed by a policy, regardless of the VPN being up.

Answer

NAT traversal configuration

Answer

Static routes

Answer

Phase1 parameters

Question 8

A company has two FortiGate devices at different sites connected via an IPsec VPN tunnel using IKEv2. The tunnel is established but intermittent packet loss is observed. Which two configuration changes should be applied to improve stability? (Choose two.)

Accepted Answer

Increase the phase2 rekey time to 8 hours.. Increasing the phase2 rekey time to 8 hours (Option D) reduces the frequency of rekey events, which can cause brief packet loss during key regeneration. This is especially beneficial for stability when the tunnel experiences intermittent loss due to rekey timing. A longer rekey interval minimizes disruptions, making it a correct choice.

Answer

Reduce the DPD retry interval to 3 seconds.

Answer

Increase the phase1 lifetime to 86400 seconds.

Answer

Change the IKE version to IKEv1.

Question 9

A FortiGate is deployed with two ISPs and SD-WAN. The organization uses OSPF to exchange routes with a remote branch. The administrator notices that the FortiGate is not installing OSPF-learned routes into the routing table. The OSPF configuration is verified to be correct, and neighbors are established. Which configuration could be causing the issue?

Accepted Answer

A distribute-list configured under OSPF is filtering the routes from being installed.. Option C is correct because a distribute-list applied under OSPF can filter routes from being installed into the routing table even when OSPF neighbors are fully established and the OSPF database contains the routes. This is a common cause of routes being learned but not installed, as the filter operates after the SPF calculation and before route insertion.

Answer

The SD-WAN health-check is configured with 'update-static-route' and is overriding OSPF routes.

Answer

The administrative distance of OSPF is set to 200, which is higher than the default 110.

Answer

The OSPF interface is configured as 'passive', which prevents route exchange.

Question 10

An administrator is configuring SD-WAN on a FortiGate to route traffic between two internet connections (ISP1 and ISP2). The SD-WAN rules use performance SLA to measure latency. Which TWO statements are true about SD-WAN rule matching and failover?

Accepted Answer

When the SD-WAN rule action is set to 'best quality' and no member meets the SLA, the FortiGate will still forward traffic using the member with the best SLA status.. Option A is correct because when an SD-WAN rule is configured with 'best quality' strategy, the FortiGate selects the member with the best SLA status even if no member fully meets the SLA threshold. This ensures traffic is still forwarded using the least-bad option rather than being dropped, maintaining connectivity under degraded conditions.

Answer

SD-WAN automatically fails over all sessions to the backup member if the primary member exceeds the SLA threshold.

Answer

If multiple SD-WAN rules match, the rule with the highest bandwidth member is used.

Answer

When the SD-WAN rule action is set to 'lowest cost' and no member meets the SLA, the FortiGate drops the traffic.

Question 11

A FortiGate is configured with SD-WAN and has two WAN members: Member1 (ISP1) with priority 10, and Member2 (ISP2) with priority 5. The SD-WAN rule for traffic from the internal network uses the 'best quality' strategy. During normal operation, traffic flows through Member1. After a link failure on Member1, traffic correctly fails over to Member2. However, when Member1 is restored, traffic does not fail back. What is the most likely cause?

Accepted Answer

The health-check for Member1 is configured with 'set probe-mode passive' and 'set update-static-route disable'.. Option B is correct because when 'set probe-mode passive' is configured, the health-check server only monitors the link without actively generating probe traffic, and 'set update-static-route disable' prevents the static route associated with Member1 from being re-enabled after the link is restored. This means the route remains inactive, so SD-WAN cannot fail back to Member1 even though the physical link is up.

Answer

The static route for Member1 has a higher administrative distance than Member2.

Answer

The SD-WAN rule is configured with 'set fallback' disabled.

Answer

The priority of Member2 is higher than Member1.

Question 12

A network administrator is configuring SD-WAN on a FortiGate. The organization has two internet links: MPLS (primary) and broadband (backup). The administrator wants all traffic to use the MPLS link unless it fails, in which case traffic should fail over to the broadband link. Which SD-WAN configuration best achieves this requirement?

Accepted Answer

Set the MPLS link priority to 10 and the broadband link priority to 5, then configure an SD-WAN rule with the 'best quality' strategy.. Option A is correct because setting the MPLS link priority to 10 (higher) and broadband to 5 (lower) ensures the SD-WAN rule with 'best quality' strategy selects the MPLS link as the preferred path. The 'best quality' strategy evaluates link quality metrics and, when priorities differ, prefers the higher-priority link. If the MPLS link fails, the strategy automatically fails over to the broadband link, meeting the requirement.

Answer

Enable 'set role' on the MPLS link as 'primary' and on the broadband link as 'standby' with the 'redundant' strategy.

Answer

Configure both links in the SD-WAN zone with equal priority and use the 'lowest cost' strategy.

Answer

Create two static routes: one with higher distance for MPLS and one with lower distance for broadband.

Question 13

An enterprise uses FortiGate as an SD-WAN edge device with three WAN links: Link A (MPLS), Link B (broadband), and Link C (LTE). The SD-WAN rule for VoIP traffic uses the 'best quality' strategy with link-quality-measurement enabled. The VoIP traffic is routed via Link A. During peak hours, users report poor voice quality. The administrator checks the SD-WAN performance SLA logs and sees that Link A's jitter and latency are within acceptable thresholds, but packet loss is slightly elevated. Which action would most likely improve VoIP quality without manual intervention?

Accepted Answer

Configure a performance SLA for VoIP traffic with jitter < 10ms, latency < 100ms, and packet-loss < 0.5% and apply it to the SD-WAN rule.. Option B is correct because configuring a performance SLA with specific thresholds for jitter, latency, and packet loss allows FortiGate to dynamically failover VoIP traffic to another WAN link when Link A's packet loss exceeds the defined threshold (e.g., 0.5%). Since the 'best quality' strategy uses link-quality-measurement to select the link with the best SLA compliance, applying a performance SLA with a packet-loss threshold ensures that even if jitter and latency are acceptable, elevated packet loss triggers a switch to a healthier link, improving voice quality without manual intervention.

Answer

Increase the priority of Link A to ensure it remains the preferred link.

Answer

Disable link-quality-measurement to reduce overhead on Link A.

Answer

Add a new SD-WAN rule with 'lowest cost' strategy for VoIP traffic.

Question 14

Which TWO statements correctly describe the behavior of SD-WAN rules when using the 'maximize-bandwidth' strategy?

Accepted Answer

The administrator can assign different weights to members to influence the proportion of traffic each handles.. Option B is correct because the 'maximize-bandwidth' strategy in SD-WAN rules uses weighted load balancing, where the administrator assigns weights to each member link. The proportion of traffic each member handles is directly proportional to its assigned weight, allowing fine-grained control over bandwidth utilization across multiple WAN links.

Answer

The strategy ensures that all traffic uses the member with the highest bandwidth.

Answer

Traffic from a single session can be split across multiple members for better performance.

Answer

Traffic is distributed based on session count to keep each link equally utilized.

Question 15

An organization is deploying SD-WAN across multiple sites with two internet links (MPLS and broadband) at the main branch. They want voice traffic to use the MPLS link unless it fails, in which case failover to broadband should occur. Which SD-WAN rule configuration achieves this?

Accepted Answer

Configure an SD-WAN rule for voice with strategy 'best quality', set MPLS as preferred member, and define SLA targets for MPLS.. Option C is correct because the 'best quality' strategy with a preferred member and SLA targets allows voice traffic to use the MPLS link as long as it meets the defined SLA (e.g., latency, jitter, packet loss). If the MPLS link fails or degrades below the SLA threshold, the SD-WAN rule automatically fails over to the broadband link, ensuring voice traffic continuity.

Answer

Configure an SD-WAN rule for voice with strategy 'maximize bandwidth' and members MPLS and broadband.

Answer

Configure an SD-WAN rule for voice with strategy 'lowest cost' and members MPLS and broadband.

Answer

Configure an SD-WAN rule for voice with strategy 'manual' and members MPLS and broadband.

Question 16

A FortiGate is configured with two static routes to the same destination 0.0.0.0/0 with equal distance but different priorities. The priority values are 10 and 20. Which route will be used for traffic matching the default route?

Accepted Answer

The route with priority 10 will be used.. In FortiGate, when multiple static routes have the same distance (administrative distance) to the same destination, the route with the lowest priority value is selected. Priority is a FortiGate-specific metric that breaks ties among routes with equal distance. Since priority 10 is lower than 20, the route with priority 10 will be installed in the routing table and used for traffic matching 0.0.0.0/0.

Answer

The route with priority 20 will be used.

Answer

The route with lower distance will be used.

Answer

Both routes will be used for load balancing.

Question 17

Which THREE statements are true about FortiGate SD-WAN health-check configuration?

Accepted Answer

Health-check can be configured with multiple thresholds for jitter, latency, and packet loss.. Option C is correct because FortiGate SD-WAN health-check allows configuring multiple thresholds for jitter, latency, and packet loss. These thresholds are used to determine the quality of a link; if any threshold is exceeded, the link is considered failed. This enables granular control over link health assessment beyond simple reachability.

Answer

Health-check probes can be sent from any interface, including loopback.

Answer

Health-check can only be configured on physical interfaces, not VLANs or subinterfaces.

Question 18

A network engineer is troubleshooting an SD-WAN setup where traffic from a specific subnet is not being load-balanced as expected. The SD-WAN rule uses 'source IP' hashing. The engineer notices that the traffic originates from multiple hosts in the same /24 subnet. What is the most likely cause of poor load distribution?

Accepted Answer

The source IP hashing algorithm causes multiple hosts in the same subnet to map to the same member.. Source IP hashing in SD-WAN uses a hash of the source IP address to select a member for each flow. When multiple hosts reside in the same /24 subnet, their source IPs share the same first 24 bits, which can cause the hash algorithm to map them to the same SD-WAN member if the hash function is not sufficiently granular or if the number of members is small. This results in poor load distribution despite multiple sources.

Answer

The SD-WAN rule is not matching the traffic.

Answer

The SD-WAN members have different bandwidths.

Answer

Traffic is using a single destination IP and port.

Question 19

Which THREE actions can an administrator perform using FortiManager in a Security Fabric environment? (Choose three.)

Accepted Answer

Upgrade the firmware of multiple FortiGates at once. Option A is correct because FortiManager supports centralized firmware management, allowing administrators to upgrade the firmware of multiple FortiGates simultaneously via the 'Firmware Upgrade' wizard in the Device Manager. This leverages the FortiManager's role as a central management point, which can stage and push firmware images to managed devices in a Security Fabric, reducing downtime and ensuring consistency across the fabric.

Answer

Terminate IPsec VPN tunnels on the FortiManager

Answer

Configure FortiGate to manage the FortiManager

Question 20

An organization is deploying multiple FortiGate devices across different geographic locations. The central IT team manages all devices from a single FortiManager. The remote FortiGates connect to FortiManager over a WAN link. Which feature should be enabled on FortiManager to ensure that configuration changes are applied consistently and without interruption to the remote FortiGates?

Accepted Answer

Use the 'Install on Next Reboot' option in the install wizard. Option B is correct because the 'Install on Next Reboot' option ensures that configuration changes are staged on the remote FortiGate and applied atomically when the device reboots. This prevents partial or inconsistent application over an unreliable WAN link, as the FortiManager pushes the full configuration revision to the device, which then applies it during the boot process without requiring a persistent management session.

Answer

Enable auto-link configuration on the FortiManager

Answer

Use 'Install Wizard' with 'Immediate Install' option

Answer

Enable 'Configuration Override' on the managed FortiGates

NSE7 Practice Exam 53 — 20 Questions

Exhibit

NSE7 Practice Exam 53 — 20 Questions

Exhibit