NSE7 Practice Exam 54 — 20 Questions

Question 1

An administrator is configuring a FortiGate as a LAN edge device with FortiSwitch and FortiAP. Which feature must be enabled on the FortiGate to centrally manage the FortiSwitch and FortiAP devices?

Accepted Answer

FortiLink. FortiLink is the proprietary protocol that enables a FortiGate to centrally manage FortiSwitch and FortiAP devices as logical extensions of the FortiGate itself. When FortiLink is enabled on a FortiGate interface, the FortiGate automatically discovers, provisions, and manages connected FortiSwitch and FortiAP units, handling VLAN assignment, PoE control, and firmware synchronization without requiring separate management platforms.

Answer

CAPWAP

Answer

LLDP

Answer

SNMP

Question 2

An administrator runs 'get router info bgp summary' and sees that the BGP session to a neighbor is in the 'Idle' state. The neighbor IP is reachable via ping. The BGP configuration uses loopback interfaces with 'update-source loopback1'. What is the MOST likely reason for the Idle state?

Accepted Answer

There is no route on the neighbor back to the FortiGate's loopback IP. The 'Idle' state in BGP indicates that the session cannot start, often due to a missing route to the neighbor's update-source IP. Since the neighbor IP is reachable via ping but the session uses loopback interfaces with 'update-source loopback1', the FortiGate's BGP packets will source from its loopback1 IP. If the neighbor does not have a route back to that loopback IP, it cannot respond to the TCP handshake, leaving the session stuck in Idle. This is a classic BGP loopback peering issue where reachability of the source IP is required, not just the physical interface IP.

Answer

The loopback interface is down or has no IP address assigned

Answer

The BGP neighbor's remote-as is misconfigured

Answer

The BGP timer values (keepalive/hold) are mismatched

Question 3

A FortiGate is configured with multiple IPsec VPNs to remote branches. One of the branch VPN tunnels goes down frequently. The administrator runs 'diagnose vpn ike log' and sees repeated INITIAL_CONTACT notifications from the remote peer. What does this indicate?

Accepted Answer

The remote peer has rebooted or restarted its VPN service. INITIAL_CONTACT is a notify message sent by an IKE peer to indicate that it has rebooted or lost its state. When the remote peer sends this, it means the peer has restarted, causing the tunnel to re-establish. This is normal behavior after a reboot but if frequent, indicates instability at the remote end.

Answer

The remote peer is rekeying the VPN tunnel

Answer

The local FortiGate has a mismatched pre-shared key

Answer

A dead peer detection timeout occurred

Question 4

An administrator wants to integrate a FortiExtender into an existing SD-WAN deployment. Which TWO steps are required for proper integration?

Accepted Answer

Authorize the FortiExtender on the FortiGate. The FortiExtender must first be authorized on the FortiGate to establish a secure management and data plane connection. Once authorized, it must be added as an SD-WAN member interface so that SD-WAN rules and load-balancing algorithms can be applied to traffic traversing the FortiExtender's cellular or LTE link.

Answer

Disable all other WAN interfaces

Answer

Enable NAT on the FortiExtender interface

Answer

Configure a separate VDOM for the FortiExtender

Question 5

A FortiGate administrator is troubleshooting a VPN tunnel that is up but no traffic passes through. The Phase 2 selectors match. The administrator runs 'diagnose vpn tunnel list' and sees that the tunnel has '0 bytes' in both directions. What is the MOST likely cause?

Accepted Answer

The static route for the remote subnet does not point to the VPN tunnel interface. When a VPN tunnel is up but shows 0 bytes in both directions, it indicates that the control plane (IKE/IPsec SA negotiation) succeeded, but the data plane has no traffic. The most likely cause is that the static route for the remote subnet does not point to the VPN tunnel interface (e.g., 'tunnel.1'), so the FortiGate does not know to send traffic into the tunnel. Without a correct route, packets destined for the remote subnet are dropped or sent out the wrong interface, resulting in zero bytes on the tunnel.

Answer

The firewall policy is not configured to allow traffic through the tunnel

Answer

The IPsec SA rekey interval is too short

Answer

The NAT traversal is not enabled

Question 6

A company is deploying ZTNA to replace their legacy VPN. They want to ensure that only users with a valid certificate and compliant antivirus can access the internal application. Which TWO components are required on the FortiGate for this deployment?

Accepted Answer

ZTNA proxy rule with access proxy. ZTNA uses a proxy rule (access proxy) to publish the application, and a firewall policy that references ZTNA tags and the access proxy to enforce access based on identity and posture.

Answer

Dynamic routing protocol (BGP)

Answer

SSL-VPN portal

Answer

IPsec phase1 with certificate authentication

Question 7

An administrator needs to ensure that traffic from the internal network (10.0.0.0/8) destined to the Internet is routed through a specific next-hop (192.168.1.1) only if a more specific route for the destination does not exist. Which routing feature should be used?

Accepted Answer

Use policy-based routing with a deny rule for the specific prefixes that have more specific routes.. Policy-based routing (PBR) allows you to define a policy that matches traffic destined to specific prefixes and applies a deny action, effectively bypassing the PBR for those destinations. This ensures that traffic with a more specific route in the routing table uses that route, while all other traffic (without a more specific route) is forced through the next-hop 192.168.1.1 via a set ip next-hop command in the PBR policy.

Answer

Configure route redistribution from BGP to OSPF.

Answer

Enable ECMP load balancing.

Answer

Create a static default route with a higher administrative distance.

Question 8

A FortiGate administrator configures SAML SSO with FortiGate as the Service Provider (SP) and an external IdP. Users report that they are prompted for credentials repeatedly without successful authentication. What is the most likely cause?

Accepted Answer

The IdP certificate is not imported or trusted on the FortiGate. SAML SSO requires certificate trust. If the IdP certificate is not trusted by the FortiGate, the SAML assertion will not be validated, causing authentication failures. The clock skew is another common issue.

Answer

The SAML attribute mapping is incorrect

Answer

The FortiGate's clock is synchronized via NTP

Answer

The firewall policy does not allow SAML traffic

Question 9

An administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is up, but traffic is not passing. The administrator runs 'diagnose vpn tunnel list' and sees that both phase 1 and phase 2 are up. The policy allows traffic from both sides. What should the administrator check next?

Accepted Answer

Check the routing table for routes to the remote subnet. Since both phases are up and policies are correct, the issue is likely routing. The administrator should verify that the correct routes are pointing to the VPN interface (tunnel interface) on both sides. Without proper routes, traffic will not be forwarded into the tunnel.

Answer

Increase the phase 2 keylife

Answer

Check the FortiGate's NTP status

Answer

Disable DPD

Question 10

An administrator has configured an OSPF overlay over an IPsec VPN between two FortiGates. The OSPF neighbors are established, but routes from one side are not being installed in the routing table on the other side. 'get router info ospf neighbor' shows FULL state. What is the most likely cause?

Accepted Answer

The route's OSPF cost is higher than an existing route with a lower administrative distance. Even though OSPF neighbors are FULL, routes may not be installed if they are not selected as best paths. One common reason is that the OSPF cost is higher than a static route or another routing protocol's metric. The other options would prevent neighbor from reaching FULL state.

Answer

The IPsec tunnel is using transport mode instead of tunnel mode

Answer

OSPF authentication is mismatched

Answer

The OSPF network type is not set to point-to-point

Question 11

An administrator needs to configure a FortiGate to ensure that antivirus scanning is performed on SMTP traffic. Which two configuration items are required? (Choose two.)

Accepted Answer

Firewall policy applying the antivirus profile. A firewall policy is required to apply an antivirus profile to SMTP traffic. Without a firewall policy that matches the SMTP traffic (typically on port 25), the FortiGate will not inspect the traffic at all. Option E is correct because the antivirus profile itself defines the scanning settings, signatures, and actions for detecting malware in SMTP attachments and message bodies.

Answer

SSL/SSH inspection profile

Answer

Application control profile

Answer

Email filter profile

Question 12

Which THREE conditions must be met for an IPsec VPN to successfully establish phase2?

Accepted Answer

Proxy IDs (local and remote subnets) match on both sides. IPsec Phase 2 uses Proxy IDs (local and remote subnets) to negotiate the security associations (SAs) that define which traffic is protected. If the proxy IDs do not match on both peers, the IKEv1 or IKEv2 Quick Mode exchange will fail, preventing the establishment of Phase 2 SAs. This is a fundamental requirement for matching traffic selectors in the IPsec SA negotiation.

Answer

Firewall policies allow traffic between the subnets

Answer

NAT traversal is enabled on both sides

Question 13

A FortiGate in NAT mode has a VDOM with interface port1 (10.0.1.0/24) and port2 (203.0.113.0/24). A policy allows traffic from port1 to port2 with source NAT using the IP of port2. A user at 10.0.1.10 initiates a connection to a web server at 198.51.100.1. What will be the source IP after NAT?

Accepted Answer

The IP address of port2 (e.g., 203.0.113.1). When source NAT is configured to use the IP address of the egress interface (port2), the FortiGate performs dynamic PAT (Port Address Translation) and translates the source IP of the packet to the primary IP address of port2 (203.0.113.1). This is the default behavior when 'set srcaddr' is set to the interface IP in the firewall policy. The user at 10.0.1.10 will therefore appear to the web server at 198.51.100.1 as coming from 203.0.113.1.

Answer

A random IP from the port2 subnet

Answer

10.0.1.10

Answer

198.51.100.1

Question 14

You run 'diagnose vpn ike gateway list' and see the following:
gateway name: HUB_GW
  version: IKEv2
  state: UP
  mode: main
  local: 10.0.0.1:500
  remote: 203.0.113.5:500
  auth: psk
  dpd: on
  rekey: 86400
  num_peers: 2
  total_tunnels: 2
  auto-discovery: enabled
What does the 'auto-discovery: enabled' indicate about this VPN gateway?

Accepted Answer

The gateway is acting as an ADVPN hub and will advertise routes to spokes for shortcut tunnel creation. In an ADVPN setup, enabling auto-discovery on the hub allows it to send shortcut route advertisements to spokes, which then can establish direct tunnels. The output confirms the gateway is configured to participate in ADVPN as a hub or as a spoke that can initiate shortcuts.

Answer

The gateway will automatically create new phase2 selectors for any remote subnet

Answer

The gateway will automatically renegotiate IKEv2 keys before expiration

Answer

The gateway will discover other VPN gateways on the same network and form peer relationships

Question 15

A ZTNA rule is configured to allow access to an internal application only if the client device has the ZTNA tag 'Compliant' and the user is authenticated via SAML. The FortiGate is acting as ZTNA proxy. A user successfully authenticates but the device is not tagged. What happens when the user tries to access the application?

Accepted Answer

The user is denied access. ZTNA rules can require both authentication and device posture (ZTNA tags). If the device tag is missing or does not match, the access will be denied. The user may see an access denied page or a generic error.

Answer

The FortiGate dynamically assigns the 'Compliant' tag to the device

Answer

The user is redirected to a device registration portal

Answer

The user is granted access because authentication succeeded

Question 16

A company uses FortiGate ZTNA to provide remote access to an internal web application. The application requires client certificates for authentication. The administrator has configured the ZTNA rule to use certificate authentication. However, users report that they are prompted for credentials repeatedly. What is the most likely cause?

Accepted Answer

The client certificate is not trusted by the FortiGate.. When a ZTNA rule is configured for certificate authentication, the FortiGate must trust the client certificate's issuing CA. If the CA certificate is not imported into the FortiGate's trusted CA list, the certificate chain validation fails, causing the authentication to be rejected and the client to be repeatedly prompted for credentials. This is the most common cause of repeated credential prompts in certificate-based ZTNA setups.

Answer

The user's password has expired.

Answer

The ZTNA rule is configured to use SAML authentication instead.

Answer

The FortiClient EMS server is not reachable from the client.

Question 17

An administrator is configuring BGP on a FortiGate to peer with an ISP router. The FortiGate is advertising a prefix (203.0.113.0/24) to the ISP. To ensure that traffic to the prefix is load balanced across two WAN links (port1 and port2) using SD-WAN, the administrator must configure which THREE of the following? (Select THREE.)

Accepted Answer

Define both port1 and port2 as SD-WAN members. SD-WAN load balancing requires that both WAN interfaces (port1 and port2) are defined as SD-WAN members. Without adding them to the SD-WAN zone, the FortiGate cannot distribute traffic across them using SD-WAN rules or load-balancing algorithms.

Answer

Configure a performance SLA to monitor each link

Answer

Configure BGP to use the same AS number on both members

Question 18

An organization uses FortiNAC for network access control. They want to enforce that only corporate-managed devices with up-to-date patches can access the production VLAN. Which THREE components must be integrated or configured?

Accepted Answer

FortiClient EMS with compliance rules. For NAC enforcement, FortiNAC typically uses SNMP to query switch port status and RADIUS to authenticate devices. FortiClient EMS provides endpoint compliance data that FortiNAC can use to determine access rights.

Answer

ZTNA proxy on FortiGate

Answer

IPsec VPN between FortiNAC and FortiGate

Question 19

A FortiGate is configured as a SAML service provider (SP) for ZTNA. Users authenticate via an external IdP. After authentication, users are not able to access applications even though the ZTNA proxy rule lists them. What should the administrator check FIRST?

Accepted Answer

The ZTNA proxy rule's allowed group does not include the user's group. When using SAML, the FortiGate needs to map the SAML attributes (e.g., username) to a user group. If the user is not in the correct group, access will be denied.

Answer

The FortiClient EMS license is invalid

Answer

The application server is unreachable from FortiGate

Answer

The SAML IdP certificate is expired

Question 20

What is the function of a route map in FortiGate routing?

Accepted Answer

To filter and modify routing information during redistribution.. A route map in FortiGate routing is primarily used to filter and modify routing information during route redistribution between different routing protocols (e.g., OSPF, BGP, RIP). It allows granular control over which routes are accepted, advertised, or tagged with attributes like metric or community values, ensuring policy-based routing decisions.

Answer

To configure load balancing between multiple WAN links.

Answer

To enable BFD on a specific interface.

Answer

To create a static route for a specific destination.