NSE7 Practice Exam 55 — 20 Questions

Question 1

A FortiGate administrator is configuring a multi-peer IPsec VPN (dial-up) for remote users. The administrator wants to assign different IP pools to different groups of users based on their authentication group. Which configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a separate phase1 interface for each user group with a different IP pool. FortiGate can assign IP pools based on user groups when using IKE with XAuth or IKEv2. The 'set ipv4-dns-server' and 'set ipv4-exclude-range' are not group-based. The 'set user-group' in phase1 associates a group with the tunnel, but IP pool per group requires separate phase1 configurations or using 'set ipv4-start-ip' with group mapping.

Answer

Use the 'set ipv4-start-ip' parameter in the phase1 interface

Answer

Configure a single phase1 interface with multiple IP pools and use group matching in the firewall policy

Answer

Use RADIUS to assign IP addresses per user

Question 2

An organization wants to implement Zero Trust Network Access (ZTNA) for remote users accessing an internal application. The application is hosted on a server that cannot have any client software installed. Which ZTNA deployment method is MOST appropriate?

Accepted Answer

ZTNA proxy (reverse proxy) with FortiClient for posture. ZTNA can be deployed in proxy-based or agent-based modes. For applications that cannot have a client software, the proxy-based method (where FortiGate acts as a reverse proxy) is ideal. The user's FortiClient can still provide posture data, but the application server does not need an agent.

Answer

FortiNAC with agent on the server

Answer

IPsec VPN with full tunnel

Answer

SSL VPN with web mode

Question 3

A company wants to provide external contractors with access to a specific internal web application without granting full network access. The solution must authenticate the user, verify device compliance, and log all access. Which three Fortinet features should be combined to meet these requirements? (Choose THREE)

Accepted Answer

SSL deep inspection. ZTNA provides application-specific access with authentication and logging. FortiClient EMS enforces device compliance (posture). SSL deep inspection is required for decryption to log content. This combination meets all requirements.

Answer

FortiNAC

Answer

IPsec VPN with XAuth

Question 4

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration uses certificates for authentication. The admin sees the following log message: 'Certificate validation failed: unable to get local issuer certificate.' What is the most likely cause?

Accepted Answer

The CA certificate that signed the peer's certificate is not imported on the FortiGate. The error indicates that the FortiGate cannot find the CA certificate that issued the peer's certificate. The CA certificate must be imported and trusted on the FortiGate.

Answer

The peer's certificate has expired

Answer

The certificate revocation list (CRL) is not configured

Answer

The local certificate does not match the peer's expected CN

Question 5

An administrator wants to enforce that only devices with antivirus software installed and running can access a sensitive application via ZTNA. Which ZTNA feature should be used to verify this requirement?

Accepted Answer

ZTNA tags with device posture checks. ZTNA uses tags to indicate device posture. The FortiGate or FortiClient EMS can check for antivirus status and include that information in the device's posture tag. The ZTNA access proxy rule can then require that tag for access.

Answer

ZTNA inline CASB

Answer

NAC with FortiNAC

Answer

IPsec VPN with DPD

Question 6

A FortiGate administrator configures SAML SSO with FortiGate as the Identity Provider (IdP). Users are redirected to the FortiGate login page, but after successful authentication, they are not redirected back to the service provider. What is a likely cause?

Accepted Answer

The assertion consumer service URL is misconfigured on the FortiGate. When FortiGate is the IdP, it must have the correct Assertion Consumer Service (ACS) URL to which the SAML response is sent after authentication. A mismatch prevents the redirect back to the SP.

Answer

SAML authentication timeout is too short

Answer

The ACS URL on the service provider does not match the FortiGate's SAML settings

Answer

The SP certificate is not imported on the FortiGate

Question 7

A FortiGate administrator wants to use SAML SSO to authenticate VPN users. The FortiGate will act as the service provider (SP) and an external identity provider (IdP) will be used. Which of the following must be configured on the FortiGate to enable SAML authentication for SSL VPN?

Accepted Answer

A user group with SAML authentication method and an SSL VPN portal referencing that group.. For SAML SSO on SSL VPN, you must configure a user group with SAML authentication, then assign an SSL VPN portal that uses that group. The FortiGate acts as SP. RADIUS/LDAP are not required.

Answer

A RADIUS server pointing to the IdP and an authentication rule.

Answer

An LDAP server with the IdP's certificate and a matching policy.

Answer

A local user with SAML attributes and a firewall policy referencing that user.

Question 8

An administrator has configured FortiGate as a SAML service provider (SP) for VPN authentication. Users are prompted for credentials but authentication fails even though they can authenticate directly at the IdP portal. What is the most likely misconfiguration?

Accepted Answer

The FortiGate's entity ID or ACS URL registered at the IdP is incorrect. If users can authenticate at the IdP but not via FortiGate SP, the problem is likely that the FortiGate entity ID or ACS URL does not match what is registered at the IdP.

Answer

The IdP is using HTTP-POST binding while FortiGate expects HTTP-Redirect

Answer

The IdP certificate is not imported on FortiGate

Answer

SAML authentication is not enabled in the VPN portal

Question 9

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is established but traffic is not passing. The administrator runs 'diagnose vpn ike log' and sees 'no matching policy for this IPsec SA'. What is the most likely cause?

Accepted Answer

There is no firewall policy allowing traffic from the local network to the remote network via the VPN tunnel interface. The error indicates that the IKE SA exists but no firewall policy matches the traffic to use the tunnel. The tunnel interface is likely configured but the policy to allow traffic through the tunnel is missing or incorrect.

Answer

The phase2 selectors do not match between peers

Answer

The pre-shared key is mismatched

Answer

The tunnel interface is administratively down

Question 10

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The Phase 1 status shows 'init' and the debug output indicates 'no suitable proposal found'. The remote peer is a third-party VPN device. Which of the following is the MOST likely cause?

Accepted Answer

The IKE version or encryption algorithm does not match between the peers. The 'no suitable proposal found' error in Phase 1 indicates that the IKE proposal parameters (such as encryption algorithm, hash algorithm, Diffie-Hellman group, or IKE version) do not match between the FortiGate and the third-party peer. Since the status is 'init', the peers have exchanged initial packets but cannot agree on a common proposal, which is a classic proposal mismatch issue. A pre-shared key mismatch would typically cause an authentication failure later in Phase 1, not a 'no suitable proposal' error.

Answer

The pre-shared key is incorrect on one side

Answer

The remote peer's IP address is not reachable

Answer

The firewall policy allowing the VPN traffic is missing

Question 11

An administrator is troubleshooting an SD-WAN scenario where traffic from a branch office to a critical SaaS application is experiencing high latency. The SD-WAN rule uses the best quality SLA strategy. The administrator runs 'diagnose sys sdwan neighbor' and sees that both WAN links have SLA compliance above 90%. However, traffic still uses the slower link. The administrator then runs 'diagnose sys sdwan health-check list' and notices that the health-check server IP is different from the SaaS application's server IP. What is the MOST likely reason the traffic is not using the best-performing link?

Accepted Answer

The health-check server's IP does not match the application's destination IP, so SLA measurements are not representative. The SD-WAN rule uses the best quality SLA strategy, which selects the link with the best SLA metrics (latency, jitter, packet loss) for the traffic. However, if the health-check server IP does not match the SaaS application's destination IP, the SLA measurements are not representative of the actual path to the application. The SD-WAN device measures performance to the health-check server, not the application server, so the link that appears best for the health-check may be worse for the actual application traffic, causing the slower link to be selected.

Answer

The SD-WAN rule is configured with 'set load-balance-mode' instead of 'best-quality'

Answer

The health-check server is not reachable from the faster link

Answer

The SD-WAN rule has a manual routing override configured

Question 12

A FortiGate administrator is setting up automation stitches in FortiManager to remediate threats. The stitch should run a CLI script on a managed FortiGate when a specific event is logged. Which THREE components must be configured in the automation stitch?

Accepted Answer

Trigger. An automation stitch in FortiManager requires a trigger to define the event that initiates the stitch. Without a trigger, the stitch has no starting condition and cannot execute. The trigger specifies the log event that, when matched, causes the stitch to run.

Answer

Schedule

Answer

Recovery action

Question 13

A FortiGate administrator is troubleshooting a BGP session that fails to establish with a neighbor at 10.0.1.1. Running 'diagnose ip router bgp all' shows the neighbor state as 'Idle'. Which TWO commands should the administrator run NEXT to diagnose the issue?

Accepted Answer

show full-configuration router bgp. 'show full-configuration router bgp' displays the complete BGP configuration, including all neighbor settings, network statements, and route-maps. This allows the administrator to verify that the neighbor at 10.0.1.1 is correctly configured with the proper remote-as, update-source, and any optional parameters that might prevent the session from leaving the Idle state. Option B is correct because a BGP session stuck in Idle often indicates a Layer 3 connectivity issue; pinging the neighbor confirms whether the destination is reachable, which is a fundamental prerequisite for TCP port 179 to establish.

Answer

diagnose ip router bgp all

Answer

diagnose sys session filter dport 179

Answer

get router info bgp summary

Question 14

An administrator is troubleshooting SD-WAN and wants to verify that performance SLA probes are being sent correctly. Which THREE CLI commands can provide information about the SLA probes and their results?

Accepted Answer

diagnose sys sdwan health-check. The 'diagnose sys sdwan health-check' command displays the current status and results of performance SLA probes for each SD-WAN health-check server, including metrics like latency, jitter, and packet loss. This allows the administrator to verify that probes are being sent and whether they meet the configured SLA thresholds.

Answer

diagnose sys sdwan route

Answer

diagnose sys sdwan config

Question 15

An administrator is investigating a security incident and needs to determine which firewall policy allowed a specific malicious traffic flow. The traffic is no longer active. Which FortiAnalyzer log type should the admin query?

Accepted Answer

Traffic logs. Traffic logs record every session that passes through the FortiGate, including the source/destination IPs, ports, policy ID, and action taken. Since the traffic is no longer active, the administrator must query historical traffic logs in FortiAnalyzer to identify which firewall policy permitted the malicious flow. Event logs, security logs, and audit logs do not contain the per-session policy mapping needed for this forensic analysis.

Answer

Event logs

Answer

Security logs

Answer

Audit logs

Question 16

A FortiGate is configured with an SD-WAN zone containing two WAN interfaces. The administrator wants to use the 'spillover' load balancing algorithm to ensure that the primary link carries traffic until its bandwidth reaches 80% utilization, after which new sessions are sent to the secondary link. Which THREE configuration steps are necessary?

Accepted Answer

Add both interfaces as members of the SD-WAN rule. Both WAN interfaces must be added as members of the SD-WAN rule to define which interfaces participate in the spillover load balancing. Without adding them as members, the SD-WAN rule cannot distribute traffic between the primary and secondary links based on the spillover algorithm.

Answer

Create a performance SLA to measure bandwidth utilization

Answer

Assign a weight of 80 to the primary interface and 20 to the secondary

Question 17

A FortiGate administrator is troubleshooting an issue where certain traffic is not being logged despite having a firewall policy with logging enabled. The administrator checks the policy and confirms logging is set to 'All Sessions'. Which THREE reasons could explain why the traffic is not being logged?

Accepted Answer

The log device (FortiAnalyzer or syslog) is not reachable and the FortiGate is configured to drop logs when the remote server is unavailable. When a FortiGate is configured to drop logs when the remote logging server (FortiAnalyzer or syslog) is unreachable, the logs are discarded locally rather than queued or buffered. This behavior is controlled by the 'log-drop-packet' setting or the 'reliable' vs 'unreliable' logging mode, and if the remote server is down, the logs never leave the FortiGate, resulting in no logging despite the policy being set to log all sessions.

Answer

The log disk is full

Answer

The traffic is denied by a local-in policy

Question 18

An administrator is configuring SD-WAN and wants to ensure that traffic matching a specific SLA rule uses the best-performing member. Which TWO commands can be used to verify the SLA performance and route selection? (Choose two.)

Accepted Answer

diagnose sys sdwan health-check. The 'diagnose sys sdwan health-check' command displays real-time SLA performance metrics for each SD-WAN member, including latency, jitter, and packet loss. Option D is correct because 'diagnose sys sdwan info' provides detailed information about SD-WAN zones, rules, and the current best-performing member selected for each SLA rule. Both commands are essential for verifying SLA compliance and route selection in FortiGate SD-WAN.

Answer

diagnose sys session list

Answer

get router info routing-table

Answer

show system sdwan

Question 19

An administrator wants to view the current number of active sessions on a FortiGate. Which CLI command should be used?

Accepted Answer

get system performance status. The command 'get system performance status' displays real-time system performance metrics, including the current number of active sessions (sessions in the session table). This is the correct CLI command for an administrator to view the active session count on a FortiGate.

Answer

exec system session count

Answer

show system session count

Answer

diagnose sys session list

Question 20

A network administrator is configuring SD-WAN on a FortiGate with two WAN links (port1 and port2). They want traffic to destination 10.0.0.0/8 to use port1 as long as its latency is below 50ms and jitter below 10ms; otherwise, fail over to port2. Which SD-WAN configuration components are required?

Accepted Answer

SD-WAN members, one performance SLA, one SD-WAN rule with the performance SLA as a strategy. SD-WAN failover based on latency and jitter thresholds requires a single performance SLA to measure both metrics on the active link (port1), and one SD-WAN rule that uses that SLA as the strategy to determine best path. The rule defines the destination (10.0.0.0/8) and the SLA's thresholds trigger failover to port2 when exceeded. Only one SLA is needed since the condition is applied to the primary link, not both.

Answer

SD-WAN members, one performance SLA, one SD-WAN member with a static route

Answer

SD-WAN members, two performance SLAs (one per interface), one SD-WAN rule

Answer

SD-WAN members, one performance SLA, two SD-WAN rules (one for each interface)