NSE7 Practice Exam 54 — 20 Questions

Question 1

Refer to the exhibit. A FortiGate is configured with the above settings. The FortiManager at 192.168.1.100 cannot establish a management connection to the FortiGate. What is the most likely cause?

Accepted Answer

The FortiGate's port1 IP is not in the same subnet as the FortiManager. The FortiGate's port1 IP (192.168.2.1/24) is on a different subnet (192.168.2.0/24) than the FortiManager's IP (192.168.1.100), which is on the 192.168.1.0/24 subnet. For a management connection to be established, the FortiGate and FortiManager must be able to route to each other, typically requiring them to be on the same subnet unless a gateway or static route is configured. Since no routing is mentioned, the subnet mismatch is the most likely cause of the failure.

Answer

HTTPS access is not enabled on port1

Answer

The admin user 'admin' is not configured correctly

Answer

The trusthost configuration does not include the FortiManager IP

Question 2

A network administrator is troubleshooting a FortiGate that is not appearing in the Security Fabric topology on FortiManager. The FortiGate is reachable from FortiManager via ping. What is the most likely cause?

Accepted Answer

The FortiGate is not authorized in FortiManager. For a FortiGate to appear in the Security Fabric topology on FortiManager, it must first be authorized in FortiManager. Even if the FortiGate is reachable via ping, without authorization, FortiManager will not accept its registration or include it in the topology view. This is a prerequisite step that must occur before any fabric communication can be established.

Answer

FortiAnalyzer is not configured on the FortiGate

Answer

SNMP community string is mismatched

Answer

The FortiGate firewall policy is blocking traffic to FortiManager

Question 3

An organization uses FortiManager to manage multiple FortiGate devices in a Security Fabric. The administrator wants to push a new firewall policy that includes an FQDN address object. Which statement is true regarding FQDN objects in FortiManager policies?

Accepted Answer

FortiManager resolves the FQDN to IP addresses at installation time and updates the policy accordingly. When an administrator pushes a policy containing an FQDN address object from FortiManager, FortiManager resolves the FQDN to its current IP addresses at installation time. The resolved IPs are then written into the policy on the managed FortiGate, ensuring the policy is immediately effective without requiring the FortiGate to perform DNS resolution. This behavior is specific to FortiManager-managed policies and differs from locally configured FQDN objects on FortiGate.

Answer

FQDN objects must be defined on each managed FortiGate individually

Answer

The FQDN resolution is done automatically every 60 seconds by FortiManager

Answer

FQDN objects cannot be used in policies pushed from FortiManager

Question 4

Match each Fortinet security feature to its primary function.

Question 5

A network engineer is troubleshooting a Security Fabric where a downstream FortiGate (model 60F) is not appearing in the Fabric topology of the root FortiGate (model 600E). Both devices are running FortiOS 7.4. The root FortiGate shows the downstream device as 'Unreachable' in the Security Fabric widget. The engineer has verified that the downstream FortiGate can ping the root FortiGate's management IP. What is the most likely cause of this issue?

Accepted Answer

The downstream FortiGate has insufficient memory to support Security Fabric features.. The FortiGate 60F has limited memory (typically 512 MB or less), and FortiOS 7.4 enforces a minimum memory requirement for downstream devices to participate in the Security Fabric. When the downstream device has insufficient memory, the root FortiGate marks it as 'Unreachable' even though basic IP connectivity (ping) works. This is a known hardware limitation for lower-end models like the 60F when running newer FortiOS versions.

Answer

The root FortiGate does not have HTTPS access to the downstream FortiGate.

Answer

The downstream FortiGate's management interface is configured on a different VLAN.

Answer

The administrator account on the downstream FortiGate does not have 'super_admin' privileges.

Question 6

Drag and drop the steps to configure a site-to-site IPsec VPN on a FortiGate firewall into the correct order.

Question 7

A company is deploying a Security Fabric with multiple FortiGate devices managed by FortiManager. The administrator wants to apply a policy package to multiple FortiGate devices in the Fabric. However, after assigning the policy package to the devices in FortiManager and installing the configuration, the policies are not applied consistently across all devices. The administrator notices that some devices have local policies that override the policy package. What is the best practice to ensure that the policy package is enforced on all devices?

Accepted Answer

Enable 'Central Management' in FortiManager and use 'Install On Policy Package' to push policies.. Option A is correct because enabling 'Central Management' in FortiManager ensures that the policy package is the authoritative source for all managed FortiGate devices. When 'Install On Policy Package' is used, FortiManager overwrites any local policies on the devices, enforcing consistent policy application across the Security Fabric. Without central management, local policies can persist and override the pushed policy package, leading to inconsistencies.

Answer

Disable the 'Auto Update' feature on the managed devices.

Answer

Use the same policy package name on all devices and manually sync them.

Answer

Ensure that the Security Fabric is fully established and all devices are visible in the topology.

Question 8

A network engineer wants to deploy a FortiGate in transparent mode and have it managed by FortiManager. The FortiGate should not participate in routing, but must be able to send logs to FortiAnalyzer. Which two settings must be configured on the FortiGate to achieve this?

Accepted Answer

Configure a management IP address on the FortiGate. In transparent mode, the FortiGate operates as a Layer 2 bridge and does not participate in routing. However, to be managed by FortiManager and send logs to FortiAnalyzer, the FortiGate must have a management IP address (option B) so that it can be reached as a management endpoint. Additionally, a static route (option D) is required to direct traffic to the management and logging servers, since the FortiGate cannot rely on dynamic routing protocols in transparent mode.

Answer

Enable DHCP client on the management interface

Answer

Enable NAT on the management interface

Answer

Set the interface IP address in the same subnet as the upstream router

Question 9

In a Zero Trust Network Access architecture, which component acts as the policy enforcement point for access decisions?

Accepted Answer

FortiGate ZTNA gateway. In a Zero Trust Network Access (ZTNA) architecture, the FortiGate ZTNA gateway acts as the policy enforcement point (PEP). It terminates encrypted ZTNA tunnels from FortiClient agents, inspects traffic against configured access policies, and enforces decisions based on identity, device posture, and context. This is distinct from the control plane (FortiClient EMS) or logging (FortiAnalyzer).

Answer

FortiClient agent

Answer

FortiAnalyzer

Answer

FortiClient EMS

Question 10

Which TWO of the following can be used to authenticate users in a ZTNA connection? (Select two.)

Accepted Answer

SAML authentication. In a ZTNA connection, authentication can be performed using SAML (Security Assertion Markup Language) because it enables federated identity management and single sign-on (SSO), allowing the FortiGate to verify user identity via an external identity provider (IdP) without direct password handling. Certificate authentication is also valid because ZTNA leverages client certificates (X.509) to establish mutual TLS (mTLS) between the user device and the FortiGate, ensuring device identity and trust before granting access.

Answer

LDAP authentication

Answer

FortiToken

Answer

IPsec authentication

Question 11

Match each Fortinet command to its function.

Question 12

An organization is designing a Zero Trust Network Access solution with Fortinet. They want to ensure that only devices with up-to-date antivirus software can access sensitive applications. Which component is responsible for enforcing this requirement?

Accepted Answer

FortiClient EMS. FortiClient EMS is the correct component because it manages endpoint compliance policies, including antivirus status. It enforces the requirement by checking that devices have up-to-date antivirus software before issuing a ZTNA access token, which the FortiGate ZTNA gateway then validates to grant access.

Answer

FortiAnalyzer

Answer

FortiAuthenticator

Answer

FortiGate ZTNA gateway

Question 13

During a ZTNA deployment, an administrator notices that traffic from a specific internal application is being routed through the ZTNA gateway but is not reaching the destination server. The FortiGate policy allows the traffic, and the client has a valid ZTNA connection. What is the most likely cause of the issue?

Accepted Answer

The ZTNA proxy rule on the FortiGate is misconfigured, pointing to the wrong destination IP or port.. Option A is correct because in a ZTNA deployment, the FortiGate acts as a reverse proxy for internal applications. If the ZTNA proxy rule is misconfigured with an incorrect destination IP or port, the FortiGate will forward the traffic to the wrong backend server or service, causing the connection to fail even though the client has a valid ZTNA connection and the firewall policy permits the traffic.

Answer

The client's FortiClient agent is not connected to the EMS server.

Answer

The destination server does not have internet connectivity.

Answer

The FortiGate policy is set to deny traffic from the client's subnet.

Question 14

A security analyst is investigating a phishing email that bypassed email security. The email's headers show SPF=pass, DKIM=pass, but DMARC=quarantine. The email was delivered to the inbox. What is the most likely reason DMARC did not block or quarantine the email?

Accepted Answer

The SPF and DKIM alignment checks passed, so DMARC treated the email as authentic. Option B is correct because DMARC uses SPF and DKIM alignment to determine authenticity. When both SPF and DKIM pass and are aligned (i.e., the domain in the From header matches the domain used in SPF/DKIM), DMARC considers the email authentic and applies the policy accordingly. In this case, the DMARC policy was set to 'quarantine', but because alignment checks passed, DMARC treated the email as legitimate and allowed delivery to the inbox, rather than quarantining it.

Answer

The email was sent from a subdomain not covered by DMARC

Answer

The DMARC record had a pct (percentage) of less than 100

Answer

The DMARC policy was set to 'none'

Question 15

In FortiManager, what is the purpose of header and footer policies in a policy package?

Accepted Answer

To ensure specific policies are always placed at the top (header) or bottom (footer) of the policy list. Header and footer policies in FortiManager are special policy types that enforce a fixed position within the policy list. Header policies are always placed at the top (before all other policies), and footer policies are always placed at the bottom (after all other policies). This ensures that critical security rules, such as default-deny or global allow rules, remain in their intended position regardless of policy package changes or reordering operations.

Answer

To create policy groups for better organization

Answer

To apply policies only during specific times of the day

Answer

To separate IPv4 and IPv6 policies

Question 16

Which command is used on a FortiGate to view the current routing table including VRF instances?

Accepted Answer

get router info routing-table all. Option B is correct because 'get router info routing-table all' is the FortiGate CLI command that displays the complete routing table, including all VRF instances. This command retrieves the kernel routing table entries for every VRF, showing routes from all routing protocols (static, OSPF, BGP, etc.) and is the standard way to view the full routing context on FortiGate.

Answer

show ip route

Answer

diagnose ip route list

Answer

execute router list

Question 17

An administrator wants to integrate a FortiSwitch with a FortiGate for LAN edge management. Which TWO steps are required for initial setup? (Choose two.)

Accepted Answer

Connect the FortiSwitch to the FortiGate's managed switch port. Option B is correct because a FortiSwitch must be physically connected to a FortiGate port that has been configured as a managed switch port (via config system interface and set type switch). This dedicated port enables the FortiGate to discover and manage the FortiSwitch using the FortiLink protocol, which encapsulates control and data traffic over a single link. Without this physical connection to a managed switch port, the FortiGate cannot establish the FortiLink adjacency required for LAN edge management.

Answer

Configure OSPF on the FortiSwitch

Answer

Set the FortiSwitch to 'transparent' mode

Answer

Create a firewall policy allowing traffic between FortiSwitch and FortiGate

Question 18

What is the purpose of a prefix list in FortiGate routing?

Accepted Answer

To match routes based on their network prefix and subnet mask.. A prefix list in FortiGate is used to match routes based on their network prefix and subnet mask (prefix length). It is commonly applied in route maps or BGP configurations to filter or manipulate routing information, such as in redistribution or neighbor policy statements. Unlike access lists, prefix lists match the exact prefix and length, providing more granular control over route advertisement and acceptance.

Answer

To configure NAT rules.

Answer

To define SD-WAN members.

Answer

To assign IP addresses to interfaces.

Question 19

A FortiGate with FortiExtender is using LTE as a backup WAN link. When the primary link fails, the LTE link does not take over. What could be the cause?

Accepted Answer

The LTE interface is not added as an SD-WAN member.. Option D is correct because for an LTE interface to be used as a backup WAN link in an SD-WAN setup, it must be explicitly added as an SD-WAN member. Without this, the FortiGate will not consider the LTE interface for traffic steering or failover, even if the primary link fails. The SD-WAN rules and performance SLA are only evaluated against interfaces that are members of the SD-WAN zone.

Answer

The primary link's performance SLA is still passing.

Answer

The FortiExtender is not configured in pass-through mode.

Answer

The FortiExtender firmware is out of date.

Question 20

What is the purpose of a route map when used with route redistribution on a FortiGate?

Accepted Answer

To filter or modify route attributes during redistribution. Route maps are used with route redistribution to filter which routes are redistributed and to modify route attributes (such as metric, tag, or next-hop) as they are injected from one routing protocol into another. Option D is correct because route maps provide granular control over the redistribution process, allowing administrators to match specific routes using prefix lists or ACLs and then set attributes like metric or tag before the routes are redistributed.

Answer

To create a prefix list for BGP

Answer

To define the administrative distance of redistributed routes

Answer

To enable the redistribution process

NSE7 Practice Exam 54 — 20 Questions

Exhibit

NSE7 Practice Exam 54 — 20 Questions

Exhibit