NSE7 Practice Exam 53 — 20 Questions

Question 1

A company uses an advanced antivirus profile with machine learning engine enabled. After a recent outbreak, several files that were previously undetected are now flagged. How does the outbreak prevention feature help in this situation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It downloads the latest ML models from FortiGuard to detect new threats. The outbreak prevention feature in FortiGate's advanced antivirus profile automatically downloads the latest machine learning (ML) models from FortiGuard when a new outbreak is detected. This allows the ML engine to identify and flag previously undetected files without requiring a traditional signature update, enabling proactive detection of zero-day threats.

Answer

It sends all files to FortiSandbox for analysis

Answer

It quarantines all files for 24 hours until a signature is released

Answer

It blocks all executable files from being downloaded

Question 2

A FortiGate administrator wants to use FortiManager to push configuration changes to a managed FortiGate. To ensure changes are applied correctly, the administrator wants to review the exact CLI commands that will be sent. Which TWO tools can be used for this purpose?

Accepted Answer

Install preview. The Install Preview feature in FortiManager generates a detailed list of the exact CLI commands that will be pushed to the managed FortiGate during an installation. This allows the administrator to review and verify the changes before they are applied, ensuring accuracy and preventing unintended configuration errors.

Answer

Device manager dashboard

Answer

Policy consistency check

Answer

ADOM lock

Question 3

A FortiGate is deployed in multi-VDOM mode. The administrator wants to use FortiAnalyzer to centralize logging from all VDOMs. Which THREE steps must be performed? (Choose three.)

Accepted Answer

Ensure that the FortiAnalyzer can reach the FortiGate's management IP. The FortiAnalyzer must be able to reach the FortiGate's management IP to establish the logging connection. In multi-VDOM mode, the management VDOM handles all management traffic, including FortiAnalyzer communication, so reachability to that specific IP is essential for centralized logging.

Answer

Enable log forwarding on the management VDOM only

Answer

Enable 'log-all-vdoms' feature on the FortiGate

Question 4

An organization wants to implement multiple layers of defense against advanced persistent threats. Which three Fortinet solutions would be most effective in an ATP strategy? (Choose three.)

Accepted Answer

FortiSandbox. FortiSandbox is correct because it provides dynamic analysis of suspicious files and URLs in a controlled, isolated environment, detecting zero-day and advanced malware that signature-based solutions miss. It integrates with other Fortinet security products to share threat intelligence and automate blocking, forming a critical layer in an ATP strategy by catching threats that evade initial defenses.

Answer

FortiMail

Answer

FortiWeb

Question 5

An organization wants to use FortiManager to manage multiple FortiGate devices. The administrator needs to ensure that each device group has separate policy and object configurations. Which FortiManager feature should be configured?

Accepted Answer

Administrative Domains (ADOMs). Administrative Domains (ADOMs) in FortiManager allow you to partition the management database so that each ADOM has its own independent set of policy packages and objects. By assigning each device group to a separate ADOM, administrators ensure that policy and object configurations are isolated and cannot be shared or accidentally overwritten between groups. This directly meets the requirement for separate configurations per device group.

Answer

Policy packages with header/footer policies

Answer

Global ADOM

Answer

Meta fields

Question 6

What is the purpose of a management VDOM on a FortiGate?

Accepted Answer

To provide a dedicated environment for administrative access and management protocols. A management VDOM is a dedicated virtual domain that isolates administrative traffic (e.g., HTTPS, SSH, SNMP, syslog) from data-plane traffic. This ensures that management access and protocols like RADIUS or TACACS+ authentication are processed in a separate context, preventing interference with production VDOMs and allowing granular administrative access control.

Answer

To log all administrative actions

Answer

To route traffic between different VDOMs

Answer

To increase the number of available firewall policies

Question 7

A FortiGate is running OSPF in a multi-area topology. The administrator needs to redistribute connected routes from area 0 into area 1 but does not want to leak any other routes. Which configuration is correct?

Accepted Answer

Configure route redistribution under OSPF with 'redistribute connected' and apply a route map that permits only the desired connected networks.. OSPF does not automatically redistribute connected routes between areas; it only advertises routes learned via OSPF. To inject connected routes from area 0 into area 1 without leaking other routes, you must use 'redistribute connected' under OSPF and apply a route map that explicitly permits only the desired connected networks. This ensures that only those specific prefixes are advertised as Type 5 or Type 7 LSAs into area 1, while all other routes remain unaffected.

Answer

Use policy-based routing to forward traffic to the connected networks.

Answer

Add the connected networks as networks in area 1 using 'network x.x.x.x 255.255.255.0 area 1'.

Answer

Use 'set redistribute connected' under the OSPF interface configuration for the connected interface in area 0.

Question 8

An administrator sees the following error when trying to commit changes from FortiManager to a FortiGate: 'Policy check failed: Policy ID 5 uses a zone that does not exist on the device.' What is the most likely cause?

Accepted Answer

The zone referenced in the policy is not yet created on the FortiGate. The error 'Policy check failed: Policy ID 5 uses a zone that does not exist on the device' indicates that the FortiGate does not have the zone object referenced in the policy. When FortiManager pushes a policy that references a zone, the zone must already exist on the managed FortiGate; otherwise, the commit fails. Option B correctly identifies that the zone is missing on the FortiGate.

Answer

The policy package is locked by another administrator

Answer

The FortiGate is not running the same firmware version as FortiManager

Answer

The administrator has insufficient permissions

Question 9

An administrator wants to secure email traffic by ensuring that incoming emails are verified against the sender's domain SPF record. Which email authentication method provides this verification?

Accepted Answer

SPF. SPF (Sender Policy Framework) is the email authentication method that verifies incoming emails against the sender's domain SPF record. It works by checking whether the sending mail server's IP address is authorized by the domain owner's DNS TXT record. This directly matches the administrator's requirement to verify incoming emails against the sender's domain SPF record.

Answer

DKIM

Answer

DMARC

Answer

S/MIME

Question 10

An administrator is troubleshooting SD-WAN and runs the following CLI command:
 'execute sdwan-health-check status'
The output shows that one SD-WAN member has a status of 'dead'. What does this indicate?

Accepted Answer

The member has failed the health check probe to the target server. The 'execute sdwan-health-check status' command displays the results of active health-check probes sent to configured target servers. A status of 'dead' means that the SD-WAN member has failed to receive a successful response from the target server within the configured probe interval and retry count, indicating a loss of connectivity or reachability to that target. This is distinct from interface administrative status or SLA compliance, as the health check specifically tests end-to-end reachability to the probe target.

Answer

The member interface is administratively down

Answer

The member is not meeting the performance SLA thresholds

Answer

The SD-WAN member is not included in any SD-WAN rule

Question 11

An administrator is configuring FortiAnalyzer to receive logs from FortiGates in a multi-VDOM environment. The admin wants to ensure that logs from each VDOM are separated into their own datasets. What must be configured?

Accepted Answer

Enable per-VDOM logging on the FortiGate and use ADOMs on FortiAnalyzer. Per-VDOM logging on the FortiGate must be enabled to tag logs with the VDOM identifier, and ADOMs on FortiAnalyzer must be configured to segregate those logs into separate datasets. Without both, logs from different VDOMs would be mixed in a single dataset, defeating the purpose of isolation.

Answer

Use the same log settings for all VDOMs

Answer

Configure a separate log disk partition for each VDOM

Answer

Configure each VDOM to send logs to a different FortiAnalyzer

Question 12

When testing HA failover, you manually switch the primary unit to standby. The secondary unit becomes primary but does not take over the IP address of the virtual cluster. What is the MOST likely cause?

Accepted Answer

The HA mode is set to 'load-balance' without a virtual cluster IP. In an HA cluster configured in load-balance mode, the virtual cluster IP address is not automatically transferred during failover unless a virtual cluster IP is explicitly configured. When the primary unit is manually switched to standby, the secondary unit becomes primary but lacks the virtual cluster IP assignment, so it cannot take over that address. This is the most likely cause because the virtual cluster IP is essential for client traffic to reach the active unit in load-balance mode.

Answer

Session pickup is not enabled

Answer

The HA interface monitoring is disabled

Answer

The HA cluster is in split-brain

Question 13

An SD-WAN rule uses a performance SLA to steer traffic to the best-quality link. Traffic is consistently using the backup link even though the primary link meets SLA thresholds. The admin runs 'diagnose sys sdwan sla-check' and sees the primary link SLA status is 'pass'. What is the MOST likely cause?

Accepted Answer

The SD-WAN rule's strategy is not set to 'Best Quality' or 'SLA'. The SD-WAN rule's strategy determines how traffic is steered. If the strategy is not set to 'Best Quality' or 'SLA', the rule will not use the performance SLA results to select the best link, even if the SLA status shows 'pass'. The primary link may be passing SLA thresholds, but without the correct strategy, the rule will ignore SLA status and may use a different selection method (e.g., lowest cost or load balancing), causing traffic to use the backup link.

Answer

The primary link's interface is administratively down

Answer

The primary link's cost is set higher than the backup

Answer

The backup link has a higher bandwidth

Question 14

A FortiGate is configured with policy-based routing to force traffic from subnet 10.0.1.0/24 to go through a WAN interface. The administrator notices that traffic from 10.0.1.0/24 is still using the default route. Which debug command can confirm if the policy-based routing is being applied?

Accepted Answer

diagnose debug flow policy-based-route. The `diagnose debug flow policy-based-route` command enables flow-based debugging specifically for policy-based routing (PBR) decisions. This command shows real-time details on how the FortiGate processes packets against PBR rules, including which policy matches and which egress interface is selected, allowing the administrator to confirm whether PBR is being applied to traffic from 10.0.1.0/24.

Answer

diagnose debug routing ip-probe 10.0.1.1 8.8.8.8

Answer

diagnose debug enable && diagnose debug router policy

Answer

get router info policy-based-route

Question 15

A FortiGate administrator is troubleshooting a scenario where remote users can connect to the VPN but cannot access internal resources. The VPN policy is configured correctly. Which TWO steps should the administrator take to diagnose the issue?

Accepted Answer

Verify that the routing table on the FortiGate includes the remote networks. Check routing and firewall policies. If the tunnel is up but traffic is not forwarded, routing may be missing or firewall policies may be blocking or not matching.

Answer

Restart the IKE daemon on the FortiGate

Answer

Disable NAT on the VPN policy

Answer

Increase the DPD retry count

Question 16

A FortiManager administrator wants to use automation stitches to respond to a specific security event on managed FortiGates. Which THREE components are required to build an automation stitch? (Select THREE.)

Accepted Answer

Trigger. An automation stitch in FortiManager requires three core components: a Trigger (the event that starts the stitch), a Route (a conditional path that determines which actions to execute based on the trigger's output), and an Action (the actual response, such as a CLI script or object change). Without these three, the stitch cannot function as a complete automation workflow.

Answer

FortiView dashboard

Answer

ADOM

Question 17

A network administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The remote gateway logs show a proposal mismatch. On FortiGate, the administrator runs 'diagnose vpn ike config' and sees 'proposal: aes128-sha1, aes256-sha256'. The remote side expects 'aes256-sha1'. What is the most likely cause?

Accepted Answer

The Phase 1 proposal list does not include the algorithm combination the remote gateway requires. The 'diagnose vpn ike config' output shows the FortiGate's Phase 1 proposal list includes 'aes128-sha1' and 'aes256-sha256', but the remote gateway expects 'aes256-sha1'. Since neither of the local proposals matches the remote's required combination, the IKE negotiation fails with a 'proposal mismatch' error. The administrator must add 'aes256-sha1' to the Phase 1 proposal list on the FortiGate to align with the remote gateway's expectation.

Answer

The pre-shared key is incorrect

Answer

The Phase 2 selectors are misconfigured

Answer

The IKE version is set to 1 but remote uses 2

Question 18

A security administrator wants to generate a weekly report in FortiAnalyzer that shows the top threats detected by the FortiGate. Which feature should the administrator use to create this report?

Accepted Answer

Reports. The Reports feature in FortiAnalyzer is specifically designed to generate scheduled, customizable reports that aggregate security event data from FortiGate devices. By creating a report template with threat-based charts and tables, the administrator can schedule a weekly output showing top threats, leveraging the ADOM and SQL-based report engine for granular data selection.

Answer

Incidents

Answer

Playbooks

Answer

FortiView

Question 19

A company is deploying FortiGate in transparent mode between an existing router and LAN switch. Which TWO statements about transparent mode are true?

Accepted Answer

The FortiGate forwards traffic based on MAC addresses. In transparent mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. It inspects packets at the application layer but does not modify the Layer 3 header, making it transparent to the network.

Answer

Each interface requires an IP address

Answer

The FortiGate can perform routing

Answer

Transparent mode supports multiple VDOMs

Question 20

What is the purpose of header and footer policies in a FortiManager policy package?

Accepted Answer

They define policies that are placed at the top (header) and bottom (footer) of the policy list when applied to a FortiGate. Header and footer policies in FortiManager policy packages allow administrators to define policies that are automatically placed at the very top (header) and very bottom (footer) of the policy list when the package is installed on a FortiGate. This ensures that critical policies, such as default deny rules or inter-VDOM links, remain in a fixed position regardless of other policy changes. This mechanism is essential for maintaining a consistent security posture across managed FortiGates.

Answer

They are used for VDOM-specific policies that cannot be modified

Answer

They provide a way to group policies for reporting purposes

Answer

They allow policy packages to be installed in a specific sequence